Will DePue finds Nvidia Blackwell fingerprints in six Chinese AI models, despite US export limits

The evidence sits in weights the labs published themselves, but it can't say where the chips were.

By Think Facility · November 14, 2026 · DeepSeek China

On November 12, 2026, Will DePue published a report saying six AI models from four Chinese companies were set up on Nvidia's Blackwell chips, which need a US license to be exported to China. The companies are DeepSeek, Moonshot AI, MiniMax and Ant Group. He announced it on X at 4:29 pm Eastern, with the full report on the Unemployment Labs site.

He didn't use leaks or insiders. All of it comes from the models' own published weights, the numbers the labs released themselves.

Models: DeepSeek-V4-Flash, DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro, MiniMax-M3, Ling-3.1-flash
Labs: DeepSeek, Moonshot AI, MiniMax and Ant Group
Strongest evidence per model: 49 to 1,385 sigma
Best accidental match expected: about 8 sigma
Largest runs: about 4,500 and 3,000 Blackwell GPUs

How a model gives away its chip

Before training starts, every weight in a model needs a starting value. In PyTorch those values come from a random number generator that splits the work across the GPU's streaming multiprocessors, or SMs. A chip with more SMs hands the same job to more workers, so one seed puts its numbers in different places on different chips.

That makes the layout a clue. Nvidia's Hopper chips have 132 SMs. The Blackwell B200 and B300 have 148, and the GB200 and GB300 have 152. Some weights, like the ones for words a model never sees in training, keep their starting values almost exactly, so the layout survives into the released model.

DePue then checked it on real hardware. With DeepSeek's seed, which he gives as 953049583, a Blackwell B300 running unmodified PyTorch reproduced 445 entire rows of DeepSeek-V4-Flash bit for bit. An H100 reproduced none of them. On a rented GB200, Moonshot's seed reproduced all 13 of Kimi K3's preserved rows.

The fingerprint identifies how the weights were created and supports, without proving, the inference that Blackwell also performed the training.

From Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs · Unemployment Labs

What the report doesn't show

DePue is careful about the limits. The method finds the hardware that created the starting weights, not every chip that trained the model afterward. It can't say who owned the chips or where they sat, and Blackwell systems can be rented from data centers outside China. He writes that the evidence by itself doesn't establish smuggling or a broken export rule.

One other chip could fake the pattern. An AMD MI300X, set to use only 152 or 148 of its units, reproduces the Blackwell layouts (and it's export-controlled too). DePue ruled it out for DeepSeek-V4-Flash: in the 377 values where AMD and Nvidia calculate differently, the published weights match Nvidia in 363 and AMD in none. For the other five he calls AMD very unlikely, but the test couldn't settle them.

The method does get known cases right. For 24 models whose developers named their hardware, it agreed every time, Nvidia's own Nemotron-3 Ultra included. And not every Chinese lab switched. The newest models he could read from Alibaba, Zhipu, Tencent, Xiaomi and StepFun all read as Hopper.

Who answered

DePue's post says senior researchers at OpenAI and Anthropic independently verified the result. That's his account; I haven't found a post from either company saying so. The first replies came within the hour, and Nathan Calvin read it as a question of enforcement.

Nathan Calvin@_NathanCalvinNov 12, 4:45 pm ET

Brilliant work from Will, and strong evidence that its not that advanced chip export controls aren't effective, its that we don't robustly enforce them

View the post on X

Dean Ball's reply was about how strong the evidence is.

Dean W. Ball@deanwballNov 12, 5:09 pm ET

When I first saw this I thought, “wow, this is dna evidence,” and then it quickly dawned me that this is in fact orders of magnitude stronger than literal dna evidence submitted in court.

View the post on X

Eric Neyman called it an indictment of Nvidia and of the Trump administration. Nathan Lambert asked whether people hadn't already assumed this. They had, in a way. The report notes that US officials and press reports had already alleged DeepSeek and Moonshot were using Blackwell, without publishing technical evidence.

What it means for chip export rules

The size of the runs is what matters for enforcement. DePue estimates about 12,000 Blackwell GPUs across five of the final training runs, which at roughly $70,000 a GPU is more than half a billion dollars. Those numbers went up on the day he published. The first version put the largest runs at 2,000 to 3,000 GPUs, and the revision lifted them to about 4,500 and 3,000, because training runs disclosed on Blackwell have been less efficient than Nvidia's benchmarks. He says he isn't confident in them.

Congress already has a bill aimed at this. The Chip Security Act, which the House Foreign Affairs Committee passed on March 26, 2026, would require location verification for advanced AI chips and make chipmakers report credible information about diversion. A weights check can't do that job. It only works on models whose weights are public, and it can't tell where a chip was.

DePue has posted his code and the preserved weights on GitHub, and says the check runs on a laptop in a few seconds. His post says he has more to share about these models soon.