Chinese frontier AI models carry the fingerprint of export-controlled GPUs

Will DePueNovember 12, 2026

Executive Summary

Our forensic inspection of publically released AI models finds evidence that DeepSeek, Moonshot AI, MiniMax and Ant Group have gained admission to NVIDIA’s Blackwell GPUs, notwithstanding restrictions on exporting these chips to China, and are using that hardware to create their AI models. Six models released by these companies since April 2026 merge numerical patterns matching Blackwell hardware, whereas before models from the identical companies equivalent NVIDIA’s older Hopper generation. The findings propose that multiple foremost Chinese AI developers have begun using Blackwell to train their newest models. U.S. officials and media reports had already alleged that DeepSeek and Moonshot AI were using Blackwell chips, without publishing specialized evidence.

The evidence comes entirely from the models’ own published weights, fairly than from leaks or insider accounts. We regain traces of the models’ first values, and afterward hunt for the hardware configurations and first configurations that reproduce them; for DeepSeek-V4-Flash and Kimi K3, we additionally confirmed the equivalent on bodily Blackwell chips. The fingerprint identifies how the weights were created and supports, without proving, the conclusion that Blackwell additionally performed the training. Specially configured AMD hardware, which is additionally restricted from export to China, is the lone substitute we have identified; we have excluded it for DeepSeek-V4-Flash, and regard it extremely improbable for the another five models. Notably, our findings provision specialized evidence of admission to advanced computing hardware, but do not established anywhere the chips were located, how admission was obtained, or whether export controls were violated.

Table 1. Hardware fingerprints in successive models from DeepSeek, Moonshot AI, MiniMax and Ant Group Link ↗

• Requires a U.S. licence for export to China; none have been reported.

A Hopper fingerprint cannot differentiate an H800 from an H100 SXM or H200; the H800 identifications complete are lab disclosures, not findings of this method.

Full catalog of models in Appendix 2 ↓

Main Findings

1. Six models from four Chinese labs peruse as Blackwell-trained. DeepSeek-V4-Flash and MiniMax-M3 equivalent NVIDIA’s Blackwell-class B200 or B300 chips, which have 148 processor cores (called streaming multiprocessors, or SMs). DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash equivalent the GB200 or GB300 chips, additionally Blackwell-class, which have 152 processor cores. Kimi K3.1-Pro starts from the identical kernel as K3, and may be a checkpoint of K3 alongside additional post-training.
2. Chinese labs started training on Blackwell comparatively recently. DeepSeek’s models peruse as Hopper-trained through DeepSeek-V3 (released in December 2024), and as Blackwell from DeepSeek V4 (released in April 2026). Moonshot’s models peruse as Hopper through Kimi K2.5 (January 2026) and as Blackwell from K3 (July 2026). One Moonshot example sits in between: Kimi K2.7-Code, posted six weeks before K3, is built on the Hopper-era weights but contains a small part that matches the B200 or B300. MiniMax’s models peruse as Hopper through M2.7 (April 2026) and as Blackwell from M3 (June 2026). Ant Group’s Ling-3.0-flash (August 2026) says as Hopper, during its Ling-3.1-flash (October 2026) says as Blackwell. The Hopper readings do not acknowledge a particular chip: H800s, H100 SXMs and H200s portion the identical fingerprint.
3. Not all Chinese AI lab has switched to Blackwell. The newest models we could peruse from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi and StepFun all peruse as Hopper-trained. Meituan says its LongCat-2.0 was trained entirely on “AI ASIC superpods,” and we established no NVIDIA fingerprint in the example weights it’s released.
4. The method gets known answers right. For 24 particular models, the developer has publically stated what hardware was used. In all case, our method agrees alongside the community announcement. NVIDIA’s own Nemotron-3 Ultra, whose specialized study names the GB200 for one phase of its training, says as 152 SMs, the identical as Kimi K3.
5. The matches are far stronger than chance would explain. Even unrelated numbers can appear to equivalent whenever adequate combinations are tried. Across the approximately 6 trillion seed-and-layout combinations in our search, the strongest chance equivalent would be expected to attain concerning 8 sigma—a measure of how far a outcome stands complete average random variation. The strongest evidence for all of the six models ranges from 49 to 1,385 sigma. Even the weakest idiosyncratic test we study reaches 20 sigma.
6. The training runs were data-center scale. From all model’s size and the amount of data it was trained on, we evaluation that all run needed approximately 500 to 3,000 Blackwell GPUs for two to three months (Table 2), assuming all example was trained on the hardware that initialized it. The identical arithmetic applied to DeepSeek-V3 gives 2,000 to 2,500 chips; DeepSeek disclosed 2,048. At approximately $70,000 per GPU—the disbursal implied by a Wall Street Journal study that concerning 36,000 Blackwell chips being installed in Malaysia for ByteDance’s use would disbursal additional than $2.5 billion—the largest of these clusters would disbursal $150 myriad to $200 million, and the five together additional than fractional a milliard dollars. These figures shield lone the final training runs; the labs’ total spending on export-controlled GPUs is apt in the billions of dollars.

Table 2. Rough measure of all training run Link ↗

Training compute (about 6 × energetic parameters × training tokens) divided by part throughput at 35% utilization, complete a run of two to three months (six to eight weeks for DeepSeek-V4-Flash). DeepSeek disclosed its token counts; for the another models, we estimated them from the weights.

Our investigation

A model’s weights, additionally called parameters, are the billions of adjustable numbers that decide how it processes data and produces answers. Training often adjusts these numbers; but before training can begin, they need first values. In the application examined here, those values arrive from a pseudorandom figure generation (PRNG) algorithm called Philox: Philox produces apparently random numbers in a deterministic way. The starting input for Philox is a figure called the “seed.” Given the identical kernel and settings, Philox produces the identical numbers all time. This lets engineers reiterate an test from the identical starting point.

To inhabit billions of weights quickly, PyTorch, the application example used in the betterment of most important AI models, divides the activity that Philox does among many parallel workers on the GPU, called threads. (It does this through cuRAND, NVIDIA’s archive for random figure generation.) Each thread generates its own sequence of numbers from the kernel and fills a particular set of positions. The figure of threads afterward determines how those positions are shared out. On the NVIDIA chips examined here, a sufficiently ample initialization uses the maximum of 2,048 threads for all handling unit, called a streaming multiprocessor (SM). A part alongside additional SMs hence assigns the identical job to additional workers, changing anywhere their numbers go.

Figure 1 illustrates how this plant on a simplified GPU alongside six SMs and eight threads per SM, giving 48 threads in total. Imagine the weights as a lengthy row of bare boxes, wrapped into a grid to fit on the page. The archetypal thread fills the archetypal box, the second fills the second box, and so on through all 48 threads. The archetypal thread’s next figure afterward goes into box 49, its next into box 97, and so forth. The dreary outlines prosecute this one thread through the grid: the archetypal thread fills all 48th position. The colors acknowledge which handling component supplies all set of values, during the brightness in the right-hand panel represents the value itself.

Now keep the kernel fixed, but use a GPU alongside five SMs alternatively of six. In our simplified example, that method 40 threads fairly than 48. The archetypal thread generates exactly the identical sequence, but now puts its numbers in boxes 1, 41, 81, and so on, fairly than boxes 1, 49, 97. Figure 2 follows these numbers as their positions change. Across the grid, lone 6 percent of the values equivalent the first arrangement. The kernel is right, but the employee figure is wrong. That is what makes the institution of example weights a clue to the part used to create it.

Reproducing the weights hence requires two things to be correct at once. The kernel must create the correct numbers, and the thread figure must put them in the correct places. A accurate kernel alongside the incorrect thread figure mostly gives the correct numbers in the incorrect positions; a accurate thread figure alongside the incorrect kernel gives distinct numbers. Figure 3 shows why only the accurate combination recreates the first arrangement.

On genuine chips, the thread counts are much larger, but the regulation is the same. In the NVIDIA configurations examined here, the Hopper H100 SXM, H200 and H800 have 132 SMs and use 270,336 threads; the Blackwell B200/B300 have 148 SMs and use 303,104 threads; and the Blackwell GB200/GB300 have 152 SMs and use 311,296 threads. Recovering the thread figure hence tells us which of these hardware groups matches the starting arrangement, although it cannot differentiate chips inside a group. A Hopper match, for example, cannot inform an H800 from an H100 or H200.

The inquiry is whether adequate of that institution survives training for us to regain it. Some weights, specified as those reserved for words or symbols never encountered during training, can remain untouched and keep their starting values nearly exactly. We can difference these preserved values immediately alongside the starting values generated by a applicant kernel and thread count. Figure 4 shows specified a comparison: DeepSeek-V3’s preserved weights equivalent the Hopper arrangement, during DeepSeek-V4-Flash’s equivalent the Blackwell arrangement.

Even weights that training has changed can keep a faint trace of their starting values. Each final importance is its starting value affirmative all the adjustments made during training. If those adjustments do not entirely cancel or overwhelm the starting differences, several of those differences survive. For example, two weights that commencement at 0.2 and 0.8 and all addition by concerning 0.1 volition motionless be ordered the identical way afterward. Real adjustments change much more, so one importance tells us little. But throughout hundreds of thousands of weights, we can test whether higher starting values motionless lean to equivalent to higher final values. Figure 5 shows this feeble but measurable relationship. It is a finding in these weights, not a asset guaranteed to last all training run.

These living traces let us activity backward. Suppose, in an invented example using Figure 1’s layout, kernel 7 makes the archetypal thread create 0.2, −0.5 and 0.8. With 48 threads, those values go into positions 1, 49 and 97; alongside 40 threads, they go into positions 1, 41 and 81. If the published weights maintain the archetypal pattern, we can try applicant seeds and thread counts until we recreate it. In the genuine investigation, we difference thousands of values in their corresponding positions. Untouched weights can equivalent exactly; trained weights may display lone the weaker similarity described above. In either case, we appearance for the blend that finest reproduces the living pattern.

We afterward test that blend on weights we kept out of the search. Having chosen a kernel and thread figure using one set of weights, we use them to foretell the starting values of a distinct set, without changing either environment to enhance the fit. A equivalent on these earlier unused weights is stronger evidence than a equivalent confined to the weights that helped us choose the combination. Figure 6 shows the comparisons: DeepSeek-V3 matches the initialization layout of Hopper H100 SXM, H200 or H800 chips; DeepSeek-V4-Flash matches Blackwell B200/B300; and Kimi K3 matches Blackwell GB200/GB300.

In our investigations, we established patterns powerfully indicative of initialization on Blackwell chips in six models from four Chinese companies: DeepSeek-V4-Flash and DeepSeek-V4-Pro from DeepSeek, Kimi K3 and Kimi K3.1-Pro from Moonshot AI, MiniMax-M3 from MiniMax, and Ling-3.1-flash from Ant Group. V4-Flash and MiniMax-M3 equivalent the 148-SM layout; the another four equivalent the 152-SM layout. These are fingerprints of the starting weights, which support, but do not by themselves prove, the use of Blackwell chips for training AI models.

Limits of our investigation

Notably, the forensic method we used to acknowledge the hardware on which these models were initialized lone plant for certain models. It needs published weights, so closed models cannot be checked. It additionally needs a recognizable, hardware-dependent form from the application that generated the starting weights. PyTorch on the GPUs examined current leaves specified a pattern; Baidu’s PaddlePaddle framework, which was used to train Baidu’s ERNIE-5.5 model, does not. We were capable to regain the kernel for ERNIE-5.5 (2760), but could not acknowledge which hardware was used to initialize it. Likewise, weights initialized on an average processor fairly than a GPU depart no GPU fingerprint; multiple of Alibaba’s Qwen3 models were initialized this way, and thus depart no trace of which GPUs were used to train them. We additionally established no fingerprint in Meituan’s LongCat-2.0, which the business says was trained on “AI ASIC superpods,” or in DeepSeek-V4.1-Flash, notwithstanding an exhaustive search.

The method identifies the hardware that generated the starting weights, not all part that afterward helped train the model. When a training run creates its weights on the identical GPUs that volition train it, the fingerprint points to both. But a lab could create the weights on one scheme and move them to another, or continue training an existing example on new hardware. The weights solitary cannot regulation out those possibilities. A blended collection introduces the identical limitation. If NVIDIA chips generated several weights and Huawei chips afterward helped train them, the NVIDIA form could last without revealing Huawei’s participation. Different NVIDIA generations could depart distinct patterns in the parts they initialized, if those traces survived. In Kimi K3, at smallest 64 separately seeded processes all remaining the identical 152-SM layout. A Blackwell-compatible form hence supports its use at initialization, topic to the AMD substitute below; it does not established that the complete training run used Blackwell. A Hopper form likewise does not regulation out afterward training on Blackwell.

The weights additionally cannot disclose who owned the chips or anywhere they were located. Blackwell systems can be rented from data centers exterior China. The evidence concerns admission to the hardware; by itself, it does not established that chips were smuggled into China or that an export-control infringement occurred.

Could a distinct part create one of these Blackwell-compatible patterns? Among the NVIDIA configurations tested here, the older chips cannot: application can use small of a chip’s handling units, but cannot provision it additional than it physically has. Under the norm PyTorch behavior examined here, they cannot create the 148- or 152-SM layouts. The China-market Blackwell graphics cards use a distinct figure of threads per SM and do not create either total.

AMD presents a distinct possibility. An MI300X normally uses 304 handling units, but it can be divided into two groups of 152 or configured to use lone 148. Its random-number application can additionally create the identical underlying sequences as NVIDIA’s. Such configurations would be extremely unusual, but we confirmed on a bodily MI300X that, constricted to 152 or 148 of its units, it reproduces the layouts we affiliate alongside Blackwell, so the layout solitary does not resolve the question.

To differentiate them, we looked for small numerical differences in the values themselves. AMD and NVIDIA execute one calculation in the number-generating procedure slightly differently. On a bodily MI300X, DeepSeek-V4-Flash’s preserved weights item to NVIDIA: in the 377 values anywhere the two vendors’ results differ, the published importance matches NVIDIA’s in 363 and AMD’s in none. The identical test could not resolve the another five models, but we regard the AMD clarification extremely improbable for them. In its normal configuration, an MI300X produces neither layout; a lab would have had to configure an complete collection to use the identical figure of handling units as a Blackwell chip. Other community evidence additionally points to Blackwell: U.S. officials and media reports have alleged that DeepSeek and Moonshot AI were using Blackwell chips, and Ant Group’s community code includes benchmark results generated on a GB300.

Verifying our findings

To reproduce the outcome that connected DeepSeek-V3 to Hopper and DeepSeek-V4-Flash to Blackwell, we ran unmodified PyTorch on a Hopper-class NVIDIA H100 and a Blackwell-class NVIDIA B300. We had identified DeepSeek’s kernel figure as 953049583, and established that it was used in the initialization of the two DeepSeek-V3 and DeepSeek-V4-Flash. Using that seed, the H100 reproduced the preserved starting values in DeepSeek-V3, but not V4-Flash; the B300 reproduced the preserved values in V4-Flash, but not V3. On the B300, unmodified PyTorch reproduced 461 of the 469 selected rows in DeepSeek-V4-Flash alongside correlations complete 0.99, including 445 complete rows that matched bit for bit. Eight selected rows were partially changed by training. On the H100, it reproduced all 57,344 preserved values in DeepSeek-V3 bit for bit. Neither part reproduced the another model’s preserved rows. Changing the kernel by one reproduced no matching rows on either machine. On a rented GB200, unmodified PyTorch likewise reproduced all 13 of Kimi K3’s preserved rows using Moonshot’s seed, 20256586; changing the kernel by one reproduced none.

Our forensic method additionally gets the correct answer whenever the answer is already known. There are 24 cases anywhere a developer has publically named the hardware rearward a particular model; our forensic method agrees alongside all one. Meta’s Llama 3.1 models, trained on H100s, peruse as 132; eight of EleutherAI’s Pythia models, trained on A100s, peruse as 108. NVIDIA’s own Nemotron-3 Ultra, whose specialized study names the GB200 for one phase of training, says as 152, the identical as Kimi K3. DeepSeek and Moonshot have reported H800 use for before models. Our Hopper readings are accordant alongside those disclosures, but would additionally be accordant alongside H100 SXM or H200 hardware; they do not independently verify H800 use.

When we difference the published weights alongside the numbers generated by a applicant kernel and part layout, several similarity is inevitable equal if the applicant is wrong. How much similarity counts as evidence depends on how many weights we compare: accord throughout a fistful of numbers could effortlessly be accidental, during accord throughout thousands is much harder to explain by chance. Our statistical example accounts for the figure of weights compared and measures how far the observed equivalent exceeds the similarity expected by chance. We province that extend in norm deviations, or sigma. A higher mark method stronger evidence against an unintended match, provided the statistical example correctly describes the random assortment in the data.

We must additionally document for how many candidates we tried. Searching approximately six trillion combinations of kernel and layout gives us trillions of opportunities to discover a fortunate match. Under a normal-distribution model, a affirmative equivalent of five sigma or additional occurs by chance concerning formerly in 3.5 myriad comparisons. That would be striking in a sole test, but unsurprising location in a hunt as ample as ours. We hence use about eight sigma as our benchmark for assessing unintended matches throughout the complete search.

Our findings exceed that benchmark by a broad margin. We archetypal choose a kernel and layout using one set of weights, and afterward test that identical blend on a distinct set that played no part in choosing it. This checks whether the apparent fingerprint extends beyond the numbers that led us to it. The strongest evidence for all of the six models ranges from 49 to 1,385 sigma; equal the weakest idiosyncratic test reported reaches 20 sigma. Under our statistical model, these results are far too powerful to trait to unintended resemblance. They established evidence of a shared initialization pattern; identifying exactly which computing hardware produced that pattern, and whether it additionally performed the training, requires the distinct arguments discussed above.

Conclusion

Based on our forensic investigation, we accept that we have powerful evidence that six Chinese AI models were initialized on export-controlled NVIDIA hardware, and that for DeepSeek-V4-Flash the evidence is conclusive; we accept that this initialization additionally powerfully suggests that they trained on the identical export-controlled hardware. While this leaves unanswered another questions—such as the circumstances through which the companies that developed these models acquired export-controlled NVIDIA systems—we accept that this fact deserves urgent notice from the public.

Appendix 1: Each Chinese lab’s hardware complete timeHardware fingerprints throughout successive models from all lab. Appendix 2: Every example identifiedComplete example catalogue, disclosed hardware, and evidence notes.

Sources

• The Information, Dec. 10, 2025, on DeepSeek and Blackwell (via Bloomberg).
• Reuters, Feb. 23, 2026, “China’s DeepSeek trained AI example on Nvidia’s finest part notwithstanding US ban, authoritative says” (syndicated copy).
• Michael Kratsios, White House OSTP director, July 22, 2026, on Moonshot AI (via Bloomberg).
• The Wall Street Journal, March 2026, on Blackwell chips in Malaysia for ByteDance’s use (via Reuters).
• DeepSeek engineer’s GitHub comment, June 12, 2025: DeepGEMM drag petition 112.
• Ant Group’s GB300 benchmark results, March 31, 2026: cuLA, BENCHMARK_GB300.md.
• U.S. export licensing rule: 15 CFR 742.6.
• Disclosed hardware: DeepSeek-V3 Technical Report; Kimi K2 paper; Nemotron-3 Ultra Technical Report.
• PyTorch code that sets the thread layout: DistributionTemplates.h.
• Model weights: DeepSeek-V3, V4-Flash, V4-Pro, Kimi K3, K3.1-Pro, MiniMax-M3, Ling-3.1-flash.

How to citation this report

Suggested citation:

Will DePue, “Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs,” Unemployment Labs, November 12, 2026, https://unemploymentlabs.com/checkpoint-forensics.

BibTeX:

@techreport{depue2026blackwell, author = {DePue, Will}, heading = {{Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs}}, institution = {Unemployment Labs}, twelvemonth = {2026}, duration = nov, url = {https://unemploymentlabs.com/checkpoint-forensics} }

In news coverage, delight trait the findings to Will DePue and nexus to this page.