Our Blog

Blog Index 

Blackwell Fingerprints: Six Chinese AI Models Traced to Export-Banned Nvidia Chips

Posted on 14th Nov 2026 11:03:51 in Artificial Intelligence, Machine Learning

Tagged as: Nvidia Blackwell, AI export controls, DeepSeek, Kimi K3, AI chips

Six of the most closely watched AI models released by Chinese labs since April 2026 carry a measurable trace of Nvidia's Blackwell chips — hardware the United States does not license for export to China. That is the central claim of a forensic report published on November 12 by Will DePue, a former OpenAI researcher who now runs the research consultancy Unemployment Labs, and it has landed in Washington at the most awkward possible moment for Nvidia.

The finding is unusual because it does not rely on leaks, satellite imagery or inside sources. It comes from the models themselves: the published weight files that any developer can download from a model hub. DePue argues that the starting values of a model's weights depend on the exact GPU that generated them, and that this pattern survives training. If he is right, then the origins of a model can be audited after the fact — which changes what export controls can realistically enforce.

What the Report Actually Found

Unemployment Labs examined open-weight models from DeepSeek, Moonshot AI, MiniMax and Ant Group. Six of them matched Blackwell hardware configurations rather than the older Hopper generation the same labs had used in earlier releases.

  • DeepSeek-V4-Flash (April 2026) matched Blackwell-class B200 or B300 parts, identified by a layout of 148 streaming multiprocessors.
  • DeepSeek-V4-Pro (April 2026) matched the GB200 or GB300, the Blackwell parts inside Nvidia's liquid-cooled rack-scale systems, at 152 multiprocessors.
  • Kimi K3 (July 2026) and Kimi K3.1-Pro (November 2026) from Moonshot AI both read as GB200 or GB300.
  • MiniMax-M3 (June 2026) matched B200 or B300.
  • Ling-3.1-flash (October 2026) from Ant Group matched GB200 or GB300.

The generational shift is visible inside each lab's own release history. DeepSeek read as Hopper-trained through DeepSeek-V3 in December 2024 and only switches at V4 in April 2026. Moonshot reads as Hopper through Kimi K2.5 in January 2026 and flips at K3 in July. MiniMax flips between M2.7 in April and M3 in June. Ant Group's Ling-3.0-flash in August 2026 still reads as Hopper, while Ling-3.1-flash two months later does not.

Two details in the report matter for anyone tempted to read it as a blanket accusation. First, the switch is not universal: the newest models the team could read from Alibaba's Qwen, Zhipu's GLM, Tencent, Xiaomi and StepFun all still read as Hopper-trained, and Meituan's LongCat-2.0 showed no Nvidia fingerprint at all, consistent with its claim of training on custom ASIC superpods. Second, the report says this is the first time MiniMax and Ant Group have been publicly linked to Blackwell use — the earlier public allegations from US officials had centred on DeepSeek and Moonshot.

How a Model Carries Its Hardware's Fingerprint

The technique is easier to follow than the headline suggests. Before training starts, a neural network's weights have to be set to some initial value. One common way to do that in PyTorch is to spawn many GPU threads in parallel and let Nvidia's cuRAND library fill in the numbers using a pseudorandom generator called Philox, seeded with a fixed value.

Because the generator is deterministic, a given chip layout combined with a given seed always produces the same starting pattern. Different layouts — a B200 with 148 multiprocessors versus a GB200 with 152 — produce different patterns. Those initial values are then repeatedly overwritten during training, but traces of the original structure persist in the final weights, the way a watermark survives compression.

So the test is essentially a search problem: take a published model, hypothesise a hardware layout and a seed, regenerate the starting weights, and see whether the residual pattern lines up. DePue says he searched more than six trillion seed-and-layout combinations to find matches. For DeepSeek-V4-Flash and Kimi K3, the match was also confirmed on physical Blackwell chips. The code and the specific seed values are published, so the work can be reproduced rather than taken on trust.

The Statistics Are the Strongest Part of the Case

Any search across trillions of combinations will produce coincidental matches, which is why the report leans on statistical distance rather than a simple yes-or-no hit. Across roughly six trillion combinations, the strongest match explainable by pure chance would be expected to reach about 8 sigma. The matches reported for the six models range from 49 to 1,385 sigma, and the weakest individual test in the report still reaches 20 sigma.

There is also a control group. For 24 models where the developer had publicly disclosed which hardware was used, the method agreed with the public disclosure every time. Nvidia's own Nemotron-3 Ultra, whose technical report names the GB200 for one phase of training, reads as 152 multiprocessors — the same signature as Kimi K3, an outside model the method was not calibrated on.

What It Would Have Taken in Silicon and Dollars

The report also converts the fingerprints into a rough bill of materials. Working back from model size, training tokens and release timelines, it estimates that Kimi K3 needed about 4,500 Blackwell GPUs for roughly 70 days, and DeepSeek-V4-Pro about 3,000 for the same period — equivalent to about 11,500 and 7,500 H100s respectively. Across the five training runs analysed, the estimate is around 12,000 Blackwell GPUs.

At roughly US$70,000 per GPU — the price implied by a Wall Street Journal report that about 36,000 Blackwell chips being installed in Malaysia for ByteDance would cost more than US$2.5 billion — the largest single cluster works out to somewhere between US$200 million and US$300 million. The five runs together would exceed half a billion dollars in hardware, before counting the failed experiments, the retries and the chips bought for inference. That is not a rounding error, and it is not the kind of purchase that fits in a single shipping container.

What the Evidence Does Not Prove

The report is careful about its own limits, and those limits are the crux of the policy argument. A fingerprint identifies how a model's weights were created, and supports — without proving — the inference that Blackwell hardware also performed the training. It cannot establish where those chips were.

That distinction matters because a Chinese lab could lawfully rent Blackwell capacity in an offshore data centre. Malaysia has become a popular route: Epoch AI estimates that 275,000 Nvidia AI accelerators were imported there in 2024 and 2025, and that around two million advanced chips entered China over the same period through schemes designed to disguise their final destination.

Sam Bresnick, a researcher at Georgetown's Center for Security and Emerging Technology, put the loophole bluntly to TechCrunch: "If we care about the U.S. tech edge, it doesn't make any sense to me that you would not allow Chinese companies to access chips in mainland China or Hong Kong and Macau, but then say, actually, if you just go over to Malaysia, you can do whatever you want."

The only alternative hardware the report considers is specially configured AMD accelerators, which are also export-restricted to China. The team says it excluded that possibility for DeepSeek-V4-Flash and considers it very unlikely for the other five models.

Why the Timing Is Brutal for Nvidia

The report dropped in the middle of the worst week in Nvidia's history. Jensen Huang resigned as chief executive after acknowledging an affair with Alice Huang, an executive at Singapore-based Megaspeed, a company that CNBC reports has bought more than US$4.8 billion of advanced Nvidia AI chips over the past two years. US officials have alleged she was recruited by Chinese intelligence; Beijing denies it, and the Justice Department has not concluded she was a spy.

On the same day the forensic report circulated, Bloomberg published documents tying banned Nvidia hardware to a Shanghai AI facility. According to Engadget's account of that reporting, filings from Shanghai Longteng Intelligent Computing describe 22 Dell servers containing H800 chips bought through Aperia Cloud Services, an Nvidia Cloud Partner in Singapore, plus 52 Supermicro units carrying H100 or H200 chips. Dell reportedly cut ties with Aperia in February 2025 over the deal.

Independent sightings point the same way. Israeli security firm Lava said it found 32 Nvidia B300 GPUs — Blackwell Ultra parts — through publicly exposed monitoring endpoints with IP addresses geolocated to China. White House technology adviser Michael Kratsios said in July that Moonshot had used export-banned Nvidia chips, citing US intelligence.

Congress is now moving. At least four bills are queued: the AI Overwatch Act, the Chip Security Act, the Match Act and the Cloud Security Act, the last aimed squarely at closing the offshore-compute route. Senators Jim Banks and Elizabeth Warren cited Huang's relationship with a suspected Chinese spy as grounds for passing the AI Overwatch Act, which would write the administration's existing chip controls into law. The Senate Banking Committee has asked Huang to testify on December 3, and Commerce Secretary Howard Lutnick has agreed to appear voluntarily on December 10 to answer questions about how his department oversaw chip exports.

What This Means for Builders and Businesses

For most companies outside the chip supply chain, the practical lesson is not about geopolitics — it is that model provenance has become auditable. Three things follow from that.

  • Hardware claims can now be checked. A lab's assertion about its training infrastructure is no longer purely a marketing statement. If the fingerprint method holds up under replication, procurement teams and regulators gain a tool that works on artefacts rather than testimony.
  • "Open weights" is not the same as "open process". The models in this report are downloadable, but almost nothing about how they were built is disclosed. Businesses building on open-weight models should assume the training stack is unknown, and plan their security and licensing reviews accordingly.
  • Compute geography is becoming a compliance question. If the Cloud Security Act or its siblings pass, renting GPU capacity through an offshore intermediary may carry disclosure obligations for the provider and, indirectly, for the customer. Anyone signing multi-year compute contracts should read the jurisdiction and end-use clauses now rather than at renewal.

For Indian firms, the nearer-term signal is about cost and supply rather than legality. Stricter enforcement in the US-China channel tends to tighten global allocation of high-end accelerators, which pushes up rental prices everywhere else and lengthens queues for the mid-tier parts that Indian AI startups actually buy. The 600,000 H200 chips reportedly stockpiled in Hong Kong awaiting import approval are a reminder that a very large amount of capacity is currently parked and priced on politics rather than demand.

The deeper point is simpler. Export controls were designed around the movement of physical objects — who owns a chip, where it is installed, who receives the shipping crate. A model weight file travels as a download and leaves a statistical residue of the machine that made it. DePue's report is the first serious attempt to read that residue at scale, and whether or not every number survives replication, it has already changed the terms of the argument: the evidence now lives inside the product.

Sources

Recent Posts

Catgories

Archives

`
whatsapp me