Texas A&M's 5G CATS Pins AI Chips to Their Location in Hardware

A November 2026 preprint from Texas A&M University reports that pairing a co-packaged 5G radio with a cryptographic engine can detect a 3,000 km fiber-relay attack from 1,410 km away — more than double the 619 km ceiling of the best published alternative.

The paper, "5G CATS: 5G-Based Cryptographic Authorization Against Trafficking of Semiconductor Devices" (arXiv:2611.13437), addresses a specific enforcement gap: verifying where an exported AI accelerator actually operates after deployment. Authors Sreevikram Rajaraman, Derek Ladd, Nicholas Heinrich-Barna, Srinivas Shakkottai and Jeyavijayan Rajendran argue that export controls on advanced GPUs have no reliable post-sale location check.

Why round-trip timing alone fails

The starting problem is jitter. Round-trip time (RTT) measurements can bound a chip's distance from a trusted landmark, but honest replies arrive with natural variance. The verifier must loosen its timeout to accommodate that jitter — and the slack is exactly what an attacker exploits by relaying traffic over fiber from a restricted region.

Prior systems fail in two ways, per the authors: they either cross the untrusted host stack — software, PCIe fabric, baseboard management controller — or rely on noisy power-line channels that inflate the timing slack an attacker can hide in.

What does the hardware design change?

5G CATS terminates the radio link inside the GPU package itself. The design combines:

• a 5G radio co-packaged on the GPU module;
• a cryptographic engine on the same package;
• a hardware interlock tying verification to operation;
• connectivity to 5G Ultra-Reliable Low-Latency Communication (URLLC) base stations.

Removing the host software, PCIe fabric and baseboard management controller from the verification path eliminates the intermediaries an attacker could manipulate for timing delay.

The protocol layer changes too. The authors map an authenticated challenge-response exchange onto 5G's slot structure, replace permanent key erasure with short-lived execution leases, and cross-check the chip's reported serving cell against the carrier's own attachment records.

How much tighter is the timing?

The numbers come from ns-3 and 5G-LENA simulations of an unloaded cell. The URLLC radio profile narrows the 99.9th-percentile round-trip spread to 2.60 ms — more than ten times narrower than default 5G.

Against relay attacks, the gap compounds:

• A tracer rejects every round of a fiber relay launched from 300 km, versus 2,000 km under default 5G.
• Facing a 3,000 km attacker, the tracer stays safe at distances up to 1,410 km from the chip. PowerCATS, the power-line-based predecessor, reaches at most 619 km in its published model. Default 5G is never safe at any distance.

The result reverses the defensive geometry: the closer the verification bound sits to the physical radio, the less room a remote attacker has to disguise distance as jitter.

What follows from a preprint?

The findings are simulation-based — ns-3 with 5G-LENA on an unloaded cell — and November 2026 marks a preprint, not a deployed system. The paper does not report silicon, carrier agreements or field trials. But it specifies a concrete engineering path: co-packaged radios, execution leases and carrier-side attachment cross-checks are each individually plausible components.

For policymakers weighing enforceable AI-chip export controls, the takeaway is plain: hardware-anchored location verification is measurable, and the numbers now favor the defender.