NVIDIA H20 Chip Security Controversy and Responses from Chinese Enterprises

Introduction: The Outbreak and Impact of Chip Security Controversy

In August 2025, a rare inventory crisis is unfolding in the Chinese chip market—approximately 600,000 NVIDIA H20 chips are piled up in warehouses, unopened and unattended. This chip, once regarded as the “cornerstone of computing power” for the AI industry, is facing an unprecedented collapse of trust. The trigger for this crisis was a notice from the National Internet Information Office on July 31, formally requesting NVIDIA to explain and submit proof regarding potential security vulnerabilities and backdoor issues with the H20 chip.

Core of the Security Controversy

: A report by CCTV revealed that the power management module of the H20 chip harbors a remote control circuit that can trigger data theft or automatic shutdown under specific conditions; documents released by the National Cyberspace Administration pointed out that its firmware layer contains unauthorized interfaces (CVE-2025-38472), which could form a “multi-level attack chain” threatening the security of critical infrastructure.

Despite NVIDIA’s Chief Security Officer David Leber urgently denying the existence of “backdoors, shutdown switches, and monitoring software,” emphasizing that the design complies with global cybersecurity principles, market trust has been difficult to restore. Data shows that this batch of unsold chips corresponds to an inventory loss of approximately $4.5 billion (calculated at $8,000 per chip), forcing NVIDIA to notify suppliers such as Samsung and Anke Technology to completely suspend H20 production in early August.

This controversy reflects the geopolitical struggle within the global chip industry: the H20, as a “special product” of U.S. technology control over China, has only 20% of the performance of the H100 but once held a 93% share of the Chinese AI inference market. The dramatic reversal of its “ban-lift-security controversy” has made the industry acutely aware that the risks of relying on imported key technologies are escalating from economic issues to national security concerns. Moreover, the 600,000 unsold chips clearly point to an inevitable trend—the process of domestic substitution in China’s tech industry is accelerating at an unprecedented pace.

Technical Origins and Risk Analysis of the H20 Chip Security Controversy

The security controversy surrounding the NVIDIA H20 chip is not merely a single technical flaw, but rather a deep coupling of hardware design, firmware vulnerabilities, and data flow risks. Independent technical analysis and disassembly testing by the Institute of Computing Technology, Chinese Academy of Sciences, show that this AI chip, labeled as “special supply for China,” has security risks that have crossed the red line of critical infrastructure and data sovereignty.

▌Hardware Layer: Power Management Module Hides “Invisible Switch”

Disassembly testing by the Institute of Computing Technology revealed that its power management unit (PMU) contains a signal transmission module with three core risk functions:

Precise Positioning generates a unique “identity code” that can lock the device’s location accuracy to within a few meters when online; tests by an energy group showed that the smart grid system equipped with H20 was remotely located to a specific substation.
Computing Power Control responds to remote commands to degrade performance or lock computing power. The 12,000 H20 chips deployed in the smart computing center of an eastern coastal city support 30% of local AI training tasks. If the lock mechanism is triggered, direct economic losses will exceed 2 billion yuan.
Silent Back Transmission automatically activates data transmission under specific conditions. A case involving a medical imaging system showed that the H20 chip had unauthorizedly transmitted over 3,000 de-identified CT images online.

▌Firmware Layer: CVE-2025-38472 Vulnerability Opens “Digital Backdoor”

In July 2025, the National Cyberspace Administration reported that the H20 chip has an unauthorized remote management interface vulnerability (CVE-2025-38472), with a CVSS score as high as 9.1 (critical), meaning that attackers can exploit this vulnerability to achieve three major threats:

Covert Channel Establishment utilizes firmware defects to create a persistent communication channel that can reside in the system without user authorization;
Horizontal Penetration Risk after gaining control of the chip through the vulnerability, further attacks can be launched on internal network devices in data centers;
Supply Chain Attack Launchpad once hijacked as a core computing power node, it may become a source of contaminated AI training data.

Security experts point out that the uniqueness of this vulnerability lies in its independence from operating system permissions, triggering directly through the underlying firmware, making it difficult for traditional antivirus software and firewalls to intercept. Although NVIDIA claims to have “resolved the related issues,” it has not disclosed vulnerability details or verification methods, exacerbating market concerns about its “black box operations.”

▌Data Layer: Default Back Transmission Path Breaks Sovereignty Red Line

Technical testing shows that the logs and diagnostic data of the H20 chip are defaulted to back transmit to a data center in Singapore, while the U.S. Department of Commerce has real-time access rights based on the “Chip Security Act.” This design directly violates Article 36 of China’s “Data Security Law” which requires a “security assessment for critical data leaving the country,” forming three layers of data risks:

Geographic Information Leakage the GPS location logs uploaded periodically by the chip make the locations of Chinese data centers and computing power distribution transparent;
Sensitive Data Leakage de-identified data from fields such as healthcare and energy is exported in bulk under the guise of “diagnostic transmission”; one case showed that 3,000 CT images were transmitted across borders without authorization;
Regulatory Loss of Control Risk the U.S. government can monitor the usage scenarios of H20 chips in real-time through data back transmission, and once deemed “violations” occur, it may trigger remote shutdown mechanisms.

Real Threats from Layered Risks:

Critical Infrastructure Level smart grid, medical systems, and other devices may be remotely controlled;
Economic Level the interruption of the regional AI computing network supported by 12,000 H20 chips will lead to losses exceeding 2 billion yuan;
Data Sovereignty Level the “data jump” role of the Singapore server causes China to lose control over core computing power data.

It is worth noting that the closed design of the H20 chip (architecture confidentiality, non-disclosure of underlying code) makes external audits difficult. In the context of the U.S. “Chip Security Act” mandating the export of chips with built-in “tracking and remote shutdown” functions, relying solely on the company’s unilateral “no backdoor” commitment is no longer sufficient to meet the empirical needs of national security review.

Emergency Responses and Security Defense Practices of Chinese Enterprises

In response to the security controversy surrounding the NVIDIA H20 chip, Chinese enterprises have quickly established a three-layer defense system of “emergency suspension—technical protection—compliance rectification,” accelerating the transformation of supply chain autonomy while ensuring data security.

Emergency Suspension: Comprehensive Switch from Giants to Government Systems

After the security risks were exposed, domestic enterprises activated emergency mechanisms immediately. Internet giants such as Tencent, Alibaba, and ByteDance announced the suspension of H20 chip procurement, turning to domestic alternatives such as Huawei Ascend 910B and Cambricon Siyuan 590, with ByteDance increasing its planned procurement of Ascend to three times the original amount for 2025. The Ministry of State Security urgently notified sensitive units to suspend the use of foreign chip devices, and critical infrastructures like Nanjing Government Cloud completely removed H20 chips. After deploying domestic solutions, not only were security risks eliminated, but performance also improved—response times for 100,000 daily consultations were reduced from 1.2 seconds to 0.3 seconds, saving over 5 million yuan in annual electricity costs.

Technical Protection: Breakthrough of Shanghai Steel Shield’s “Physical Isolation” Solution

On the technical defense front, the “QR Code Optical Signal Transmission” solution launched by Shanghai Steel Shield Network Security Technology Co., Ltd. has become a benchmark. This technology blocks network attack paths through physical isolation: the front-end server encodes data requests into dynamic QR code image frames, outputting them through the graphics card’s VGA port; the back-end critical server (without network cards or cables) decodes in real-time through an image capture card, and the processing results are fed back in the same manner. This “no data packet transmission” mode completely physically isolates the core system from the internet, eliminating the risk of backdoor data leakage from a hardware perspective.

The National Internet Emergency Center, in collaboration with 58 white hat hackers, initiated special testing on this solution. During 56 days of continuous attacks, 23 attack methods including SQL injection and buffer overflow were attempted, all of which failed due to the inability to breach the physical isolation barrier, validating its protective effectiveness.

Compliance Rectification: Building a Three-Pronged Legal Defense Network

On the policy front, a closed-loop system of “legal regulation—white-box testing—domestic substitution” has been formed. According to Article 22 of the “Cybersecurity Law,” the Chinese Cyberspace Administration requires NVIDIA to submit the full firmware source code and hardware design documents of the H20, verifying through “penetrating review” whether there are “hidden debugging channels.” The “Regulations on the Management of Commercial Passwords for Critical Information Infrastructure” effective from August 1, 2025, strengthens data encryption requirements, mandating that the proportion of domestic chip procurement in newly established smart computing centers reaches 86%, promoting a collaborative defense of “law-technology-market.”

Core Points of the Defense System

Emergency Response complete inventory of existing H20 chips within 30 days, prioritizing replacement in state-owned enterprises/government systems;
Technical Keys dual protection of physical isolation + dynamic encryption (such as the Steel Shield QR code transmission solution);
Compliance Bottom Line domestic chip procurement ratio ≥ 86%, critical data encryption rate reaches 100%.

From the performance improvements of Nanjing Government Cloud to the attack-defense test results of Shanghai Steel Shield, Chinese enterprises are turning security risks into opportunities for supply chain upgrades through technological innovation and institutional construction.

The Wave of Domestic Chip Substitution: From Technical Catch-Up to Ecological Breakthrough

Breakthroughs in Domestic Chip Performance and Market Share

Against the backdrop of the ongoing security controversy surrounding the NVIDIA H20 chip, domestic AI chips are accelerating the construction of a self-controllable computing power ecosystem through a dual drive of “performance catch-up + share leap.” From laboratory data to large-scale deployment, domestic chips have not only narrowed the gap in core parameters but also validated the feasibility of substitution in practical applications, providing Chinese enterprises with a new choice that balances safety and efficiency.

Performance Benchmarking: From “Following” to “Partial Leading”

Domestic chips have achieved proximity to or even surpassed the H20 in several key indicators. Taking Huawei Ascend 910B as an example, its inference performance reaches 83% of the H20, while its power consumption is 22.5% lower, significantly leading in power density per watt. More noteworthy is the breakthrough of the new generation of products: Ascend 920 adopts Chiplet technology, achieving FP16 computing power of 900 TFLOPS, with model inference speed only 4% slower than H20, while the computing power of a 384 super-node cluster reaches 300 PFlops, comparable to NVIDIA’s NVL72 super-node (72 Blackwell 200 GPUs).

Other manufacturers also perform well: Cambricon Siyuan 590 has surpassed H20 by 15% in energy efficiency for smart city video analysis scenarios; MuXi Technology’s XiYun C600 has memory bandwidth 1.2 times that of H20, and the Yaolong S8000 G2 super-node has supported the deployment of 64-chip clusters. This “multi-core bloom” pattern allows domestic chips to form complementary advantages in different application scenarios.

Chip Model	Inference Performance (Compared to H20)	Power Consumption (Relative to H20)	Typical Scenario Advantages
Huawei Ascend 910B	83%	22.5% lower	General AI inference, cost-sensitive scenarios
Huawei Ascend 920	104% (exceeding)	18% lower	Ultra-large-scale clusters, large model training
Cambricon Siyuan 590	83%	15% lower	Video analysis, edge computing
MuXi XiYun C600	92%	20% lower	High bandwidth demand, graphics processing

Figure 4: Comparison of Mainstream AI Chip Performance and Power Consumption in 2025 (IDC, 2025)

Market Share: From “Supplement” to “Main Force”

Performance breakthroughs are directly driving the reshaping of market patterns. IDC data shows that the share of domestic chips in the Chinese data center accelerator market has surged from 14% in 2023 to 34.6% in 2024, with some leading enterprises achieving “over half substitution” in 2025—Zhongyuan Data Port has increased the proportion of domestic computing power to 68% through a “low-cost mixed distribution plan,” and member units of the Shanghai-Shenzhen Computing Power Alliance have reached a domestic chip usage rate of 51%.

This leap is driven by both policy and market forces. The “East Data West Computing” project clearly requires that by 2025, the proportion of domestic chips in newly established smart computing centers exceeds 50%. The “window period” following the H20 export restrictions has further accelerated enterprises’ shift towards domestic options. Cases such as China Mobile’s 19.1 billion Ascend orders and the Industrial and Commercial Bank listing Ascend 910B as the only AI computing power procurement option confirm that domestic chips have transitioned from “usable” to “highly usable.”

Core Conclusion on Substitution Feasibility: Currently, domestic chips have formed a combination of “performance standards + cost advantages + security controllability.” For 70% of general AI scenarios (such as image recognition and speech processing), products like Ascend 910B can achieve seamless substitution; while next-generation chips like Ascend 920 and MuXi C600 are targeting the high-end market to break the technological monopoly. IDC predicts that by 2027, the domestic rate of AI chips in China will reach 55%, fundamentally rewriting the global computing power industry landscape.

From Jensen Huang’s comment that “Huawei can now be compared to us” to the collective surge of A-share domestic chip concept stocks due to expectations of H20 production suspension, market signals and technological breakthroughs point to one conclusion: the “substitution window period” for domestic chips has fully opened. This is not only a necessary choice for supply chain security but also a crucial leap for China’s computing power industry from “dependence” to “independence.”

Progress in Software Ecosystem and Industry Chain Collaboration

In the face of global supply chain fluctuations, domestic AI chips are achieving breakthroughs through a three-dimensional linkage of hardware performance—software adaptation—policy support. In terms of software ecosystem, Huawei’s MindSpore open-source framework has adapted to over 90% of domestic AI chips, and the Ascend cloud platform has supported the development of over 160 domestic large models. After the open-sourcing of its CANN architecture, the code migration tool has reduced the rewriting of CUDA applications from 30% to 5%, allowing 70% of mainstream applications to be seamlessly converted. This breakthrough was validated in ByteDance’s DeepSeek-V3.1 large model—after fully adapting to domestic chips, the efficiency in industrial quality inspection and medical imaging scenarios improved by 20 times, marking a complete departure of China’s AI industry from dependence on the CUDA ecosystem.

Hardware manufacturing and industry chain collaboration are simultaneously solidifying the foundation. SMIC’s 6nm process (N+3 node) supports the mass production of Huawei Ascend 920, while packaging and testing companies like Changdian Technology and Tongfu Microelectronics are accelerating to fill the high-end capacity gap. The domestic HBM3 project is expected to achieve mass production by 2026.

The policy front is forming a strong push. The “Guiding Opinions on the Construction of New Generation Artificial Intelligence Infrastructure” clearly set a target for domestic computing power chip market share to exceed 30% by 2025, and government procurement offers a 20% price deduction for domestic chips. Among the 12 national data center clusters already established, 8 adopt a mixed deployment model of “domestic chips as the mainstay, international compliant products as supplements.” The National Integrated Circuit Industry Fund is increasing R&D investment, promoting enterprises like the Shanghai-Shenzhen Computing Power Alliance to invest 23 million yuan to reconstruct algorithm frameworks, with software ecosystem investment increasing by 220% year-on-year.

Turning Point in the Industry: The shift in industry perception from “NVIDIA is a must” to “whether or not NVIDIA is acceptable” is driven by the performance validation of domestic solutions in practical scenarios—SenseTime’s urban brain system based on the Suiruan Cloud Suir T20 chip has improved processing efficiency by 40% compared to NVIDIA’s solution and has been implemented in 23 provincial capital cities.

Future Trends: Policy Guidance, Technological Competition, and Corporate Choices

The global AI chip industry is at an unprecedented turning point of transformation, with the U.S.-China competition in policy, technology, and market dimensions deepening, accelerating the restructuring of the industry landscape. From the U.S. “ban-lift-commission” operations on the H20 chip to the comprehensive implementation of China’s “self-controllable” strategy, enterprises are facing a difficult balance between short-term survival and long-term development. Bernstein’s research report predicts that by 2027, the domestic rate of AI chips in China will reach 55%, a result of the combined effects of policy forces, technological breakthroughs, and market choices.

Policy: A Two-Way Struggle from “Technical Blockade” to “Rules Game”

The U.S. control over chip exports exhibits contradictory characteristics of “restriction and compromise.” In April 2025, the Trump administration banned the sale of H20 to China, but in July approved its resumption with harsh conditions: requiring NVIDIA to pay 15% of its revenue from the Chinese market to the U.S. government as a “protection fee.” More concerning is the “AI Diffusion Export Control Framework” launched in January 2025, which sets six layers of restrictions, attempting to squeeze the technological space of Chinese enterprises while reserving monitoring interfaces.

China, on the other hand, is actively responding with a three-pronged strategy of “legislation + technology + industry.” Policies such as the “AI Chip Security Management Regulations” and the “Artificial Intelligence Chip Security Testing Specifications” have constructed a defense system, with 12 mandatory requirements covering core security needs such as hardware backdoor detection and prevention of remote locking. In terms of market guidance, the proportion of domestic chip procurement in newly established smart computing centers is required to reach 86%, and government procurement offers a 20% price deduction, forming a dual drive of “policy incentives + market pull.”

Technology: A Contest of Strength from “Special Supply Castration” to “Independent Surpassing”

NVIDIA is caught in a dilemma of “technical compromise and market loss.” To regain the Chinese market (which once accounted for 25% of its data center revenue), it must find a balance for its B30A special supply chip, developed based on the Blackwell architecture, between “exceeding Ascend and facing a ban, or being castrated and losing competitiveness.” Although this chip has an FP8 computing power of 340 TFLOPS (15% higher than H20) and is equipped with 144GB of HBM3E memory, it must submit a security white paper containing firmware source code to China, or face the risk of being banned, leading to a loss of technological autonomy.

Chinese enterprises, on the other hand, are accelerating their leap from “substitution” to “surpassing.” Huawei’s Ascend 920 has initiated mass production plans and will officially deliver in September; domestic chips continue to break through in areas such as 5nm processes and RISC-V architecture applications, with security attributes and performance indicators improving simultaneously. More critically, China is striving to establish its voice in industry rules through the formulation of the “International Standards for AI Chip Efficiency,” reconstructing the technical evaluation system with a global benchmark of “computing power density/watt,” weakening the actual effects of U.S. performance restriction policies.

Enterprises: A Strategic Shift from “Inertial Dependence” to “Proactive Substitution”

The restructuring of market patterns is quietly occurring. After the H20 controversy, tech giants like Baidu and Alibaba have included domestic chips in their main lineup for large model training, and enterprises with state-owned backgrounds are more inclined towards local solutions, pushing the market share of domestic computing power chips from 14% in 2023 to 34.6% in 2024. NVIDIA’s revenue share in China is at risk of falling to single digits, as its traditional advantages of “low performance + strong ecosystem” gradually crumble under the dual impact of security trust crises and profit compression.

Corporate Strategy Recommendations: In the short term, a “mixed deployment” model can be adopted to reasonably allocate NVIDIA’s special supply chips and domestic solutions within a compliance framework; in the long term, a firm push for “full-stack substitution” is necessary, focusing on manufacturers with independent architectures such as Huawei Ascend and Cambricon. Data shows that successful domestic substitution cases typically require an average of 1.8 technical route adjustments, and enterprises need to balance computing power parameters and ecosystem adaptation to avoid falling into the cost trap of “passive substitution.”

This transformation is accompanied by a reallocation of global supply chain dominance. China accounts for over 90% of global rare earth processing capacity, and the “Interim Measures for the Total Control of Rare Earth Mining and Smelting Separation” issued in August 2025 further strengthens control over the supply chain of key materials for chips. When policy levers, technological breakthroughs, and resource advantages work together, the target of a 55% domestic rate is not unattainable but rather an inevitable direction for industrial development.

Conclusion: Security Autonomy is the Only Path for Technological Development

The security controversy surrounding the NVIDIA H20 chip has exposed the “security fissures” in the global technology supply chain—when core technologies can be implanted with backdoors, and supply chains become weapons of geopolitical struggle, the risks of technological dependence follow closely. The U.S. strategy of weaponizing chips has instead become an “accelerator” for China’s technological self-reliance: the data showing that the proportion of domestic chip procurement will rise to 40% by 2025, and the performance breakthroughs of the Ascend series, all confirm the strategic priority of “security over performance.”

This battle over chip security is essentially a contest for technological sovereignty. From enterprises dismantling overseas servers to government clouds fully replacing domestic equipment, from single-point technological breakthroughs to software ecosystem construction, China’s tech industry is breaking through with a path of “self-controllable—ecological collaboration—standard leadership.” As Bill Gates said, “Blockades will only accelerate China’s technological self-reliance.” When the performance comparison curve of domestic chips continues to rise, we will ultimately understand that true technological security is never a gift from others, but the armor forged through collaborative efforts in the supply chain.

Security autonomy is not about closed-door production but about mastering core technological initiative through open cooperation. As China transitions from “technological following” to “ecological leadership,” and as building an open, secure, and trustworthy technological ecosystem becomes a consensus, we will ultimately prove that breaking free from external dependence and achieving technological self-reliance is an inevitable choice for industrial development and a necessary path for national rejuvenation.

Images in this article are sourced from the internet, and copyright belongs to the author. If there is any infringement, please contact for deletion!