All walkthroughs · Paper briefs

Diversion and resale: estimating compute smuggling to China

Isabel Juniewicz
Epoch AI report, 29 April 2026

Paper · Brief and rating · Dashboard entry

About 21 minutes · Download MP3

AI-generated walkthrough with synthesised voices: a host explains the paper and a discussant questions it. It covers claims, methods, key assumptions, citations and use so far, decision relevance, and what an evaluator should check. Every direct quotation was checked word for word against its source. Public sources only. Not an Unjournal evaluation or decision.

Transcript

Host
This is a walkthrough of Diversion and resale: estimating compute smuggling to China, a report by Isabel Juniewicz of Epoch AI, published online on April twenty-ninth, twenty twenty-six. It is an AI-generated walkthrough with two voices, a host and a discussant, and it is not an Unjournal evaluation or decision. The report asks a single quantitative question: how much advanced AI computing hardware reached China in violation of United States export controls through the end of twenty twenty-five? Its headline answer is a median of about six hundred and sixty thousand H100-equivalents, with a ninety percent interval running from about two hundred and ninety thousand to one point six million.
Discussant
Before the numbers, define the unit. What is an H100-equivalent, and why use it instead of a chip count?
Host
The H100 is Nvidia's flagship data-center graphics processor from the Hopper generation. Smuggled hardware is a mix of older A100s, Hoppers, and the newer Blackwell chips, the B200 and B300, which are much faster. So the report converts everything into the number of H100s that would deliver the same computing throughput. The conversion uses dense eight-bit operations per second, meaning raw arithmetic throughput at the low numerical precision used in AI work. Judging from the report's case table, a B200 counts as about two and a half H100s on that measure. The summary says the median would be roughly a third of China's total compute. Globally, the report puts the median at roughly three percent of the world's AI compute stockpile.
Discussant
So the main claims are a level, a share of China's compute, and a wide interval. What evidence goes in?
Host
Indictments from the Department of Justice and investigative journalism from the New York Times, the Wall Street Journal, The Information, the Financial Times and Bloomberg. The report sorts this evidence into two kinds. Diversion evidence covers how chips leave legitimate supply chains, for example a server maker's employees routing servers to a front company. Resale evidence covers the gray market inside China: how many vendors sell banned chips and how much each moves. The organizing idea is in this passage. Because every smuggled chip must pass through both stages, the author writes, "we can build two parallel estimates of the same underlying quantity that should, in theory, approximately agree."
Discussant
Start with the raw diversion tally, before any modeling.
Host
The report compiles a table of cases from twenty twenty-four and twenty twenty-five. Two cases dominate. The first is the Supermicro indictment, where employees of the server maker Super Micro Computer are accused of diverting two and a half billion dollars of Nvidia-based servers to a pass-through company that sent them on to China. The report counts that as roughly eighty thousand chips, about half of them B200s, or around one hundred and forty thousand H100-equivalents. The second is Megaspeed, a Singapore cloud provider that Bloomberg reporting suggests holds tens of thousands fewer chips in its Malaysian data centers than it imported. The report treats that as about fifty thousand chips, mostly Blackwells, or about one hundred and eleven thousand H100-equivalents. Then there is a tail of smaller cases. Summed, the allegations come to almost three hundred thousand H100-equivalents. The author is careful about what that sum means: "This figure is neither a ceiling nor a floor on actual smuggling."
Discussant
Why not a floor? If these are documented cases, the truth should be at least that.
Host
Two reasons are given. Most allegations are unproven in court, and some diverted chips may never have reached China. Against that, the report says "some, probably most, smuggling goes undetected by journalists and authorities." So the author concludes it is almost certain the true total exceeds three hundred thousand, even though the tally itself could overstate the documented portion.
Discussant
Megaspeed has not been charged with anything, as far as the report says. Its inclusion rests on a Bloomberg feature that, in the report's own words, insinuates a shortfall. That case alone is more than a third of the tally.
Host
The report handles that through case-specific uncertainty. In a footnote, the Supermicro case is modeled as somewhere between one point two five and two point five billion dollars of servers reaching China, because an indictment is stronger evidence, while Megaspeed is modeled as anywhere from zero to fifty thousand chips. So Megaspeed contributes a range that includes zero. An evaluator would still want to see how much of the final median comes from Megaspeed and how the median moves if it is dropped.
Discussant
Now the methods. How does the tally turn into a distribution?
Host
By Monte Carlo simulation, which here just means drawing every uncertain input many times from a chosen distribution and collecting the outputs. On the diversion side there are two main adjustments. One is a reporting-accuracy haircut: a footnote says reporting is assumed accurate with a median of eighty percent. The other is the detection rate, the share of all diversion that has surfaced in indictments or reporting. Observed diversion, after the haircut, is divided by the detection rate. The author is direct that this is the weak point: "The biggest driver of uncertainty on the diversion side is that we don't know what fraction of diversion has been observed."
Discussant
What prior do they put on detection, and where does it come from?
Host
The main text gives a ninety percent interval of ten to eighty percent with a median of twenty-five percent. The footnote grounding it cites estimated detection rates for tax evasion, about twenty-five percent, and corporate fraud, about thirty-three percent, and argues these are better analogies than drug smuggling because large chip diversion looks like financial fraud. The author also argues: "Detection is easier than interception — if a repeat offender is ever caught, this reveals previous transactions."
Discussant
I see a discrepancy there. You said the main text gives ten to eighty percent. Another footnote says the detection rate is between ten and sixty percent, with a median of twenty-four and a half percent. Which one is in the model?
Host
The report does not reconcile them, so an evaluator should ask. The difference matters for the tails more than the median, since the upper end of detection controls the low end of the smuggling estimate. More generally, because the estimate scales with one over the detection rate, this single prior does most of the work on the diversion side. The conclusion says so: a ten percent detection rate and an eighty percent detection rate imply very different totals, and "the available evidence does not allow us to choose between them with confidence."
Discussant
And the analogy to tax evasion is a loose one. Tax-evasion detection rates come from random audit programs with known sampling. There is nothing like that here. A prosecutor's caseload is selected on the cases that are easiest to prove, and enforcement attention to chips has risen sharply since twenty twenty-four, so detection is probably not stable over the period.
Host
The report does not model detection changing over time. Turn to the resale side. Here the author follows a twenty twenty-four estimate by Erich Grunewald and Tim Fist at the Center for a New American Security, abbreviated CNAS. The basic structure is the number of vendors in China's gray market times the volume per vendor. The vendor count for twenty twenty-four is lognormal with a ninety percent interval of thirty-eight to one hundred and fifty, following CNAS, widened to twenty to two hundred for twenty twenty-five because there was less reporting on vendor numbers. Volume per vendor follows CNAS, roughly two hundred to twelve thousand chips a year, with a higher ceiling from April to July twenty twenty-five, when the United States required licenses for the H20, a downgraded chip Nvidia designed for China.
Discussant
What does the report add beyond CNAS?
Host
A hierarchical structure. Instead of drawing one average vendor volume, or drawing every vendor independently, vendors share a market-wide shock plus individual variation. A footnote explains that a single average draw gives unrealistically wide bounds and independent draws give unrealistically narrow ones. There is also a shared year-level shock across the three sub-periods of twenty twenty-five, calibrated so that twenty twenty-five has the same spread on the log scale as twenty twenty-four. Then a final adjustment: the gray market only captures chips sold through intermediaries. The report argues most chips pass through them, partly because known diversion cases all used middlemen and partly because, in its words, "selling export-controlled chips is not illegal within China." It puts the intermediary share at a median of eighty-two percent and scales the resale estimate up accordingly.
Discussant
That hierarchical choice sets the interval width, and the shock variance is calibrated to match a spread rather than estimated from anything. The interval on the resale side is close to an assumption.
Host
The report says the resale side runs higher because of what it calls "the marketplace model's fat right tail", and explains that "the product of uncertain vendor counts and uncertain per-vendor volumes compounds into a wide distribution." The resale median is about seven hundred thousand H100-equivalents, with an interval from two hundred and thirty thousand to two point three million. The diversion median is about five hundred and thirty thousand, from one hundred and eighty thousand to one point six million.
Discussant
And the combination step?
Host
The two sides are blended, the report says, "with more weight on the diversion estimate (which has more case-level anchors grounded in indictments with specific quantities)." The text does not give the weight. The mechanics are described in one sentence: since both distributions are right-skewed, "averaging the draws pushes the combined median up (and narrows the confidence intervals)." That produces the headline: six hundred and sixty thousand, from two hundred and ninety thousand to one point six million.
Discussant
This is the step I would press hardest. If you have two noisy measurements of one quantity, the textbook approach is to combine likelihoods, so the posterior concentrates where both agree. Averaging draws is something else: it gives the distribution of a weighted mean of two random variables. Its narrowing depends on treating the two sides as independent. But they share evidence. Five cases appear in both tables, including the Leslie Zhou case and the brokers called William and Mike, and the report itself says the same chips are likely observed on both sides. The Financial Times reporting on the H20 ban period may overlap with the Supermicro indictment, which a footnote concedes it cannot sort out. So the narrowed interval may overstate precision, and the agreement between the two sides is weaker validation than it looks.
Host
The report's claim on agreement is modest. It says the two distributions are not identical but substantially overlap. An evaluator could ask for the combined result under different weights, under a likelihood-style combination, and with overlapping cases assigned to one side only.
Discussant
What about the chip mix? You mentioned a Blackwell counts for about two and a half H100s.
Host
That drives the comparison with earlier estimates. CNAS estimated about one hundred and forty thousand chips smuggled in twenty twenty-four, with a ninety percent interval from twenty thousand to eight hundred thousand. Aqib Zakaria at ChinaTalk, a newsletter on Chinese technology and policy, extended that to a cumulative four hundred and fifty-two thousand H100-equivalents through twenty twenty-five. Epoch is close to both on chip counts, about four hundred and sixty-six thousand chips cumulatively, and the medians sit inside each other's intervals. The gap in H100-equivalents comes from the mix. Epoch assumes more Hoppers than A100s in twenty twenty-four, about eighty-three percent versus sixty-seven percent for CNAS, and roughly an even split between Hoppers and Blackwells in twenty twenty-five. The support is Financial Times reporting on B200 demand, the Supermicro indictment, and Megaspeed.
Discussant
So a good part of the difference from prior work is a composition assumption, and it leans on Megaspeed again. One more internal point: the text says the Supermicro scheme switched to shipping Blackwells once they became available, and puts that in twenty twenty-six, yet elsewhere it says B200 diversions started in April twenty twenty-five. That looks like a typo, but it sits in the paragraph that justifies the Blackwell share.
Host
Agreed, worth flagging. On scope: the estimates cover hardware physically moved into China. They exclude Chinese firms renting compute in data centers abroad, which is generally legal under current controls. And the conclusion frames the policy reading in terms of the interval. At the low end, smuggling is a meaningful but secondary channel and most of it has already led to an indictment or investigation. At the high end, smuggling exceeds legal channels as a source of China's AI compute.
Discussant
The one-third figure needs a denominator. Where does China's total compute come from?
Host
From Epoch's own estimates of chips China imported legally and produced domestically, presented in its AI chip ownership data. The report says the three hundred thousand allegation tally equals about a quarter of that legal and domestic stock. The report itself does not lay out the denominator's uncertainty, including estimates of Huawei Ascend production, which are contested. So the one-third share carries uncertainty in both numerator and denominator.
Discussant
How has the report been used and cited?
Host
The record is modest and recent. The clearest use is a guest post by Erich Grunewald on Peter Wildeford's Substack in May twenty twenty-six, on how banned chips end up in China. It quotes Epoch's headline range and gives its own reading: "Smuggling is a pretty big problem, though not serious enough to make the AI chip controls ineffective." Note that Grunewald co-wrote the CNAS estimate the resale model builds on and is thanked in Epoch's acknowledgements, so this is engagement from close to the source and does not count as independent verification. In September twenty twenty-six, Tom's Hardware, covering a separate investigation by the research group C4ADS, wrote: "Another earlier report by Epoch AI estimates that around a third (and possibly most of) China's AI compute power is comprised of smuggled GPUs." So the one-third figure is circulating in trade press.
Discussant
Any independent checks on the number?
Host
The nearest is Epoch's own follow-up, also by Juniewicz, published in September twenty twenty-six. It uses mirror trade statistics, comparing what Malaysia says it exported to China against what China says it imported. Between April twenty twenty-four and June twenty twenty-five, China recorded about three point eight billion dollars of server imports from Malaysia, while Malaysia recorded about point six billion of exports to China. The flow collapsed after Malaysia required export permits in July twenty twenty-five. Dividing by an H100 price gives roughly one hundred and fifty thousand H100-equivalents, which the follow-up says is about a quarter of the main report's median. The follow-up is cautious: "This is a rough estimate intended to give a sense of scale." It also says the pattern does not prove diversion. So it supports the order of magnitude for one corridor without validating the total. I searched OpenAlex, the open scholarly citation index, and the report does not appear to be indexed there, so formal citation counts are unavailable. I found no government document citing it. That is a search result, and it could reflect lag or indexing gaps.
Discussant
Why would funders, regulators or labs care?
Host
The size of smuggling bears on several live decisions. For the Commerce Department's Bureau of Industry and Security, which administers export controls, it bears on how much to spend on end-use checks and enforcement relative to tightening controls on chipmaking equipment. For Congress, it bears on chip location-verification proposals such as the Chip Security Act, which would require chips to report or verify where they are. For Nvidia and server makers, it bears on compliance obligations and on authorized-buyer schemes. If smuggling is near the low end, controls are largely holding and enforcement is catching most of it. If it is near the high end, the controls leak badly.
Discussant
And for an Unjournal evaluation specifically?
Host
The report is a transparent structural model on public evidence, with explicit priors, which makes it straightforward to evaluate. Its numbers are already being repeated in press and advocacy. It has not had formal peer review. The obvious reviewers would be a trade or export-control economist, who could judge the case data and the trade-data cross-check, and a Bayesian modeler, who could judge the detection prior and the combination step. Unlike CNAS and ChinaTalk, which linked notebooks, the report does not link its model code, so a first request would be the code and input tables.
Discussant
Let me collect what an evaluator should check. First, the detection-rate prior: reconcile the two stated intervals, justify the analogy to tax evasion and fraud, consider detection rising over time, and show the posterior's sensitivity to it. Second, the combination step: state the weights, compare averaging draws with a likelihood-style combination, and handle the shared cases so the two sides are closer to independent. Third, case leverage: rerun without Megaspeed and with Supermicro at the bottom of its range. Fourth, the chip mix and the H100-equivalent conversion, since Blackwell shares drive most of the gap with earlier estimates. Fifth, the resale parameters inherited from CNAS, especially volume per vendor, and how the shared shock was calibrated. Sixth, the denominator behind the one-third share. Seventh, internal consistency, including the Blackwell timing.
Host
I would add a structural question. Smuggling volumes respond to policy, and the report notes that twenty twenty-five smuggling rose partly because the H20 ban raised incentives, while controls have since loosened on paper and several large networks have been disrupted. The estimate is a backward-looking stock through twenty twenty-five.
Discussant
Final question. Does the report claim more than it shows?
Host
Mostly no. The interval is wide and the report names its main uncertainty plainly. The places where it is stronger than its evidence are the narrowed combined interval and the headline share of China's compute, which reads as firmer than the underlying denominator. Those are the points where an outside evaluation could add the most. That concludes this walkthrough.

Sources