Pushback on lifting of H20 restrictions grows, from both sides of the US China AI 'race'
Examining the arguments and recent Chinese government actions targeting Nvidia for alleged "backdoors"
Following on my attempt to assess its meaning and impact, criticism is mounting of the decision to lift controls on some GPUs for export to China by the Trump administration. Remember, Nvidia’s H20 was designed to comply with - not ‘elude’ - US export controls that were changed in October 2023. The H20 was approved for 18 months, then restricted for three months, then approved again for export. It is not an “advanced” GPU, as former White House AI Czar Ben Buchanan termed it in a recent op-ed critical of the H20 decision. In addition, an interesting group of former government officials, think tankers, and investors under the name Americans for Responsible Innovation (ARI) penned a letter to Commerce Secretary Howard Lutnick decrying the decision to resume H20 exports. Let’s take a look at Buchanan’s line of argument and other criticisms in light of US China technology competition in general and AI in particular. We will also examine the recent notice from the Cyberspace Administration of China (CAC) calling for Nvidia to address the potential for the H20 and other GPUs to contain so-called “backdoors.”
The H20 has suddenly become the lightning rod for both sides of the debate on the ‘race’ with China
Buchanan’s argument that “America Will Come to Regret Selling A.I. Chips to China” was particularly interesting. He was in the White House when the October 2023 export controls forced Nvidia to do a second redesign of its H100 GPU to meet new performance thresholds based on “total processing power (TPP).” At the time, the Biden administration was fairly silent on the issue, with the exception of then-Commerce Secretary Gina Raimondo, who threatened to control the H20s but never got around to it, apparently believing it was part of the “fool’s errand” she later termed US efforts to control China’s technology rise. Buchanan did advocate for controls on the H20 and other restrictions on semiconductor manufacturing within the government, though he could not articulate this publicly before leaving the administration. The White House also does not have a vote on the committee that reviews licenses, so Buchanan had no ability to weigh in on controls around downgraded but still capable GPUs such as the H20. His comments reveal how contentious the issue of the H20 specifically and advanced GPUs in general was within the administration during the last months of the Biden era.
Let’s look more closely at what actually happened with the H20. In the rule that led to the creation of the H20—for which Nvidia significantly downsized the overall compute power, but not the memory bandwidth, to meet the requirements of the Notified Advanced Computing (NAC) framework—zones of performance were set up: companies could sell within the NAC green zone, and would require no license to do so. It turned out the H20 was in the fully green “go for it” zone. Presumably, for Biden administration officials at the Commerce Department and White House, there would have been no need to set up a licensing zone if they did not want companies to be able to sell some designed-down GPUs to China.
The Notified Advanced Computing (NAC) framework created three licensing tiers based on two key performance metrics:
Total Processing Performance (TPP): aggregate chip compute throughput
Performance Density: TPP per unit of external memory bandwidth
Based on these thresholds for data‑center / AI GPUs:
Green Zone: TPP < 1600 (and modest density). These GPUs do not need US Commerce Department notification or licensing — they can be exported freely.
Yellow Zone (moderate): TPP between 1600 and 4800, with performance density 1.6–6. These require advanced notice (~25 days) but are generally approvable.
Red Zone: TPP > 4800 or performance density > 6. These fall under standard export licensing, with a “presumption of denial.”
Hence, the 2023 rule that created the NAC zones established clear areas that required a license; but for the green zone, there was not presumption of denial. The H20 is firmly within the green zone and not in a grey area where a license could be required after notification. Then-Commerce Secretary Raimondo put the administration’s view clearly in December of 2023, when she said: “Nvidia can, will and should sell AI chips to China because most AI chips will be for commercial applications.” Raimondo added that “What we cannot allow them to ship is the most sophisticated, highest-processing power AI chips, which would enable China to train their frontier models.” The H20 does not fit those specifications, as it was not built for training or frontier-model development and is not classified among the most sophisticated chips. It fits the first description of chips with commercial applications, namely inference. In addition, before lifting the restrictions on the H20, the Trump administration did not publish a new rule defining revised performance thresholds or providing a justification.
In the Ezra Klein podcast with Buchanan that I assessed in March, he first made the argument that inference should be controlled in addition to training. This argument is now being belatedly picked up by critics of the H20 decision. But the letter from the ARI group shows little understanding of the technology or China’s AI industry in asserting that, “On the heels of DeepSeek’s breakthrough model release earlier this year, Chinese AI labs began bulk-ordering H20 chips to develop even more advanced AI models.” They are not even close. The reason Chinese AI developers put in large orders for the H20 was in anticipation of a change in US policy on the H20. And the demand for them was decidedly not tied to developing more advanced models, but to the need to have a better ability to run inference services given the uptake of AI applications across the private sector and state-owned enterprises that I termed the #DeepSeekEffect earlier this year.
One well-connected Silicon Valley technologist and investor, whom I spoke with during an exclusive tour of Chinese AI companies around the World AI Conference, read the letter and immediately concluded that neither the authors nor the signatories really appeared to understand the rather critical difference between training and inference. Yes, post-training is important, but pre-training remains more important, and the H20s are almost uniquely unsuited to the task of training, given the compute degradation Nvidia had to undertake to meet the Commerce requirements, which were specifically aimed at training performance.
The ARI group also raises the dubious specter of the H20s being used for unspecified “military purposes,” using the typical open source analysis-based (almost always unsubstantiated) claim that China’s “Military-Civilian Fusion” initiative means that the tech in question will be “adapted for military purposes.” This allegation was also raised in a congressional letter from Senator Elissa Slotkin to Commerce Secretary Lutnick on the H20 issue. Even conservative pundit Steve Bannon, apparently now weighing in on AI policy, shared his views to the FT and in an interview with ARI letter signer Oren Cass. It is more than a little interesting that some commentator are citing Bannon, Bass, and Cass on these complex technology and technology policy issues that require a modicum of understanding of China and the AI ecosystem.
The claims put forward in the various letters to Commerce and comments from conservative pundits sound scary but are ultimately unprovable. Also raised in the ARI letter is the unfounded assertion that DeepSeek is aiding the Chinese military. (The letter cites the US State Department as the source of this claim!) Based on my on-the-ground discussions with multiple industry sources and companies in China over the past three months, this type of assertion appears highly unlikely and based on questionable analysis of the type I have previously addressed. Given the size and design of the company, which has not developed close collaboration yet with other commercial actors in the AI space in China, and based on conversations with people close to the company, the likelihood of any direct support to military end users seems highly negligible. (Because it is an open source/weight model, of course, any government organization in China can use it. This does not represent any kind of direct assistance of the kind being alleged.) In terms of the H20 specifically, I have seen no indication that DeepSeek itself has purchased this particular GPU. Eliding all this together, in a letter to the Commerce Department replete with self-referencing footnotes and caveated assertions, does not add up to something particularly convincing to seasoned observers of China’s technology development with deep knowledge of the AI and semiconductor industry and of individual companies.
The real reason for all the H20 pushback clearly hinges on this sentence in the letter: “Loosening restrictions weakens export controls generally.” The fear of the architects and supporters of the Biden-era export controls is that the H20 decision portends further rollbacks of elements of the carefully constructed export control edifice built around AI and supercomputing starting with the October 2022 controls. This edifice now appears to be unravelling. Trump himself is not a fan of export controls or regulations in general, and when confronted with data about how export controls are damaging US technology companies, his instinctive reaction appears to be to ask, “Why are we doing that?” The fact that key individuals brought in by Trump to craft technology policy, such as AI and Crypto Czar David Sacks and OSTP Director Michael Kratsios, have nuanced views on technology controls and can influence the President’s views on these issues is contributing to heightened concern within the “choke point technology” and “compute governance” factions behind the Biden-era controls.
The Trump administration likely does not now intend to issue a new AI diffusion plan, after rescinding the Biden era AI Diffusion Rule, which was not well supported among either US allies or industry. The entire concept behind the AI Diffusion Rule is being rethought by officials like Sacks and Kratsios. While I have documented Sacks’ criticism of the Biden approach to AI diffusion, in a recent interview, Kratsios suggested more of a focus on large-scale runs for training sophisticated models over “small-scale inference runs for some Chinese app.” Elaborating further, Kratsios noted that:
“Between being able to have stringent and strong [Know Your Customer] requirements imposed on people who are operating the data centers, married with monitoring for the scale and scope of the actual training runs, I think you’re able to kind of piece together and identify actors.”
Translation: The new US team that will coordinate US AI policy, including export controls, understands the difference between training and inference, and believes that the goal of US controls should be on the most advanced GPUs; not the H20s, and not inference.
Finally, the issue of what comes after the H20 remains unclear. While removing the H20 controls changes the broader approach from that taken by the Biden administration on GPU exports, the Trump administration has yet to clarify what the new policy is on this issue other than trying to “addict” China to inferior US-origin GPUs. Nvidia’s CEO has held out the possibility of shipping GPUs based on the Blackwell architecture, B30s, to China as a follow-on to the H20. But it remains uncertain whether the B30 has been approved by the Commerce Department, what the performance parameters are, and when production of such a China-specific GPU would commence. As of early August, Nvidia had still not received licenses for the H20, despite assurances the company indicated it had received from the Trump administration. This could be a result of the massive backlog of license applications at the Bureau of Industry and Security, including $10-15 billion just for US semiconductor toolmakers.
Nvidia caught in difficult place on GPU tracking issue
Then there is the Jensen Effect. Lobbying from Nvidia CEO Jensen Huang, including with Sacks (together with the rare earths issue, as I explained here), helped carry the day on lifting the H20 restrictions. Yet a broader issue remains around GPU exports and several efforts to mandate some type of locational tracking and monitoring systems—one which last week put Nvidia in hot water again due to the CAC’s announcement and summons. What is going on here?
First, this is about the much-discussed (and hyped) issue of diversion, which I have addressed in some detail in previous posts. A recent FT report appears to document at least some of the scope of potential diversions of controlled GPUs. But it remains unclear how to interpret the data in the FT report, which appears to deal with tenders and invoices, but with no evidence or documentation of actual installations of restricted GPUs in specific Chinese date centers, making it difficult to determine the scope and impact of the diversions. Depending on the configuration in question—in the FT report, typically larger systems were claimed to have been diverted—there would be no technical support available. For advanced Nvidia systems, this would be a significant issue in putting together a sizeable, stable, workable array of advanced GPUs. So, while there are continued reports of diversion, assessing the actual numbers, actual installations, who is using them and for what, and actual impact remains problematic.
The diversion issue has led to calls for action, which now revolve around growing discussion within certain circles in the White House and on the Hill regarding the necessity for some type of system to track and monitoring movements of GPUs around the world, to prevent diversion, smuggling, or other attempts by Chinese companies or researchers to access the most advanced GPUs. The debate has come with several recent initiatives:
Bills circulating in Congress: Senator Tom Cotton (R‑AR) introduced the Chip Security Act in the Senate on May 9, 2025, which requires that export‑controlled advanced chips and systems be equipped with a location verification mechanism within six months of enactment. Exporters would also be mandated to report if devices are diverted or tampered with.
A House version of the bill, put forward by the Select Committee on China, is also circulating. Language in this bill such as the following is clearly directed at China: “The Department of Commerce must work to ensure America’s most advanced AI chips are not diverted to unauthorized regions and end up in the hands of our adversaries—especially those fueling military aggression or targeting the U.S. economy and service members.”
A mention in the White House AI Action Plan calling for an effort “led by Department of Commerce, OSTP, and the NSC in collaboration with industry, explore leveraging new and existing location verification features on advanced AI compute to ensure that the chips are not in countries of concern.”
The CAC notice acknowledges these congressional efforts but adds a wrinkle: “Previously, US lawmakers called for advanced chips exported from the US to be equipped with tracking and location capabilities. US artificial intelligence experts revealed that Nvidia’s computing chips have mature tracking and location and remote shutdown technologies.” This refers to comments from Chip Security Act co-sponsor Representative Bill Foster (D‑IL) that on‑chip location verification is technically feasible today and that much of the required architecture is already built into Nvidia GPUs, as verified by independent experts. This almost certainly refers to studies such as this from the Institute for AI Policy and Strategy (IAPS), which attempt to estimate the cost to Nvidia of using a firmware update and a network of servers to track GPU locations.1 Among the backers of IAPS is Open Philanthropy, a proponent of Effective Altruism (EA) and compute governance—topics I addressed in some depth here, in the context of the debate around getting to AGI and slowing down Chinese companies.
Nvidia pushed back hard this week on the “backdoor” and “kill switch” issue. Nvidia stressed that its 30 years of experience building advanced semiconductors made the firm acutely aware of introducing vulnerabilities, and “embedding backdoors and kill switches into chips would be a gift to hackers and hostile actors. It would undermine global digital infrastructure and fracture trust in US technology. Established law wisely requires companies to fix vulnerabilities — not create them.” The Nvidia post nicely shoots down a lot of arguments and technology comparisons made by pundits who have commented on the issue over the past few months or written papers suggesting installing tracking capabilities was a good idea. For Nvidia, the bottom line is that “for decades, policymakers have championed industry’s efforts to create secure, trustworthy hardware. Governments have many tools to protect nations, consumers and the economy. Deliberately weakening critical infrastructure should never be one of them.”
To mitigate the risk of misuse, some pundits and policymakers propose requiring hardware “kill switches” or built-in controls that can remotely disable GPUs without user knowledge and consent. Some suspect they might already exist. NVIDIA GPUs do not and should not have kill switches and backdoors.—Nvidia
If in fact the preferred replacement for the AI Diffusion rule appears to be a combination of different approaches—including tracking the most advanced GPUs, bilateral agreements with countries such as Saudi Arabia and the UAE, and allowing fourth-tier GPUs to be sold to China—it remains unclear yet how this policy comes together in a coherent manner. The CAC is obviously reading the literature on locational tracking and becoming concerned about the issue, but it is interesting that the CAC focus is on the H20, which is now approved for export and would presumably not require tracking under a notional system of the type called for by the Chip Security Act. However, now that this issue has gotten a lot of attention, including for “AI experts” cited by the CAC, it seems likely that Beijing will be taking a hard look at all GPU exports from the US, and is likely to step up internal guidance on using domestic GPUs. Similar guidance appears to have been largely ignored and not enforced in any way, given the needs of Chinese AI developers for inference capacity—but this looks set to change in the wake of the CAC notice.
There were also unconfirmed indications in early August that the CAC was advising some Chinese model developers to steer clear of the H20. The details of this remain unclear, and may just constitute general guidance until the CAC can clear up concerns around the potential for tracking mandates to force companies such as Nvidia to implement new monitoring capabilities, which are not likely to happen soon and which will be challenged by Nvidia and other industry players.
The discussion within the Chinese AI sector around this is complex, given the issues I have previously raised around the ability of the domestic AI stack to attract developers. Much (though not all) of this effort is being driven by Huawei, its Ascend series of processors, and, by next year, almost certainly the redesigned 910D version that will be a true General Purpose GPU (GPGPU)2, coupled with HBM from unclear sources and CANN, Huawei’s CUDA alternative, which significantly Huawei announced it would open source in early August. Chinese developers have been reluctant to make the switch, according to numerous firsthand discussions around the World AI Conference (WAIC) in late July.
“This move will help to speed up innovation from developers and make Ascend easier to use.” – Huawei’s Eric Xu on open sourcing of CANN
In its announcement on the open sourcing of CANN, a media site that covers Huawei developments closely tied the move directly to the reintroduction of the H20 into China: “Huawei was planning a better Ascend AI chip ecosystem for Chinese customers amid Nvidia H20 chaos. It finally found a way in the form of open-source CANN (Compute Architecture for Neural Networks).” The site also pointed to Nvidia’s tighening of its EULA for CUDA to limit CUDA deployments on non-Nvidia hardware as a factor in the open sourcing of CANN: “Last year, Nvidia applied some strict regulations on CUDA under which one can’t run CUDA on third-party GPUs or non-Nvidia hardware systems. In such a time, Huawei’s open-sourced CANN move will help developers build more innovative products.” As noted above, it is the combination of Huawei’s hardware design of the Ascend and the maturity of CANN that has been a major stumbling block to developers moving to the alternative stack. The open sourcing of CANN is significant, but in the short term will not likely make a significant difference in this calculus.
The Chinese AI development community remains of course highly split on the issue of migration away from the Nvidia/CUDA ecosystem. Earlier this year, the MIIT subordinate China Academy of Information and Communications Technology (CAICT) warned about the high costs involved in shifting to domestic solutions, noting that:
“[I]t involves complex engineering to transfer models trained on Nvidia GPUs to domestic solutions due to differences in hardware and software.”
The H20 issue, coupled with the GPU traction voice becoming louder from the Washington, means that the Chinese government and the AI sector could be at odds about the potential timeline for moving to an all-domestic solution. In this regard, Huawei’s open sourcing of CANN and Mindspore are major developments, along with the H20 issue now muddying the domestic AI development waters.
Finally, the H20 issue may open another can of worms. Some within the industry note that the H20 is produced using TSMC’s N4 node, a 5 nm class process. Toolmakers are wondering why it is now legal to ship GPUs at the 5 nm class to China, but not tools capable of supporting manufacturing at that node. Most industry players have been uncomfortable with the Commerce end use controls being set at 16/14 nm for “advanced” nodes, because as the technology advances, what is considered “advanced” changes and no one in the industry considers 16/14 nm to be “advanced.” At this point advanced is really at the 3 and 2 nm process class level, so an argument can be made that companies should be able to ship tools to Chinese foundries that are designed for 5 nm production, particularly if Commerce is approving shipments of the 5 nm node class H20. I will cover this in greater depth in future posts.
In the paper, the authors estimate costs as follows:
In order to implement location verification at scale, chip companies such as Nvidia would need to implement two steps, which could likely be completed within six months:
Firmware update: A firmware and software update that allows their AI chips to perform easy, rapid location verification. We estimate that this would cost less than $1 million[1].
Landmark network: A network of trusted landmark servers would need to be set up in or near all major data centers in all countries where smuggling is likely to occur. This would likely be somewhere between 100 to 500 landmarks depending on which countries are included, and which types of actors are required to provide location verification. At an estimated cost of $25,000 per landmark per year[2], this would imply a cost between $2.5 million to $12.5 million per year.
General-purpose GPUs (GPGPUs), such as those from Nvidia, are the preferred choice for AI model training due to their flexibility, mature software ecosystems (e.g., CUDA, PyTorch, TensorFlow), and broad support for diverse workloads. In contrast, Neural Processing Units (NPUs), like those in Huawei’s Ascend 910C, are specialized accelerators optimized for specific AI operations, particularly matrix computations in inference and some training scenarios. While NPUs can offer higher efficiency and performance-per-watt for targeted tasks, they typically lack the programmability, developer tooling, and framework compatibility that make GPGPUs the dominant platform for large-scale model training.