Six Chinese AI models carry Nvidia Blackwell fingerprints

Export controls just got a forensic test. Six Chinese open models failed it, according to one researcher.

Will DePue of Unemployment Labs published an analysis on Nov. 12 that reads hardware traces out of published model weights. He writes that "we have strong evidence that six Chinese AI models were initialized on export-controlled NVIDIA hardware," meaning Blackwell GPUs.

How a GPU leaves a fingerprint

The method rests on how a training run begins. PyTorch fills a new model's weights with random numbers, and how those numbers are laid out depends on how many streaming multiprocessors the GPU has, DePue explains. Hopper chips have 132. Blackwell B200 and B300 chips have 148, and GB200 and GB300 have 152, per The Decoder's report.

Some weights barely change during training. DePue recovered the starting seed and layout from those, then tested his settings on weights he had held out of the search.

He puts DeepSeek-V4-Flash and MiniMax-M3 on 148-core Blackwell parts. DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ant Group's Ling-3.1-flash match the 152-core layout. Older models, including DeepSeek-V3 and Kimi K2.5, show Hopper layouts.

He also ran unmodified PyTorch on real chips. A B300 reproduced 461 of 469 selected DeepSeek-V4-Flash rows, he says, and the method agreed with all 24 cases where a developer had publicly stated its hardware. He calls the evidence for DeepSeek-V4-Flash "conclusive." He published the verification code too.

The fingerprint is strong, the chip count is a guess

DePue's best estimate is about 12,000 Blackwell GPUs across five of the training runs, within a range of 7,000 to 22,000.

At roughly $70,000 a chip, a figure he takes from a Wall Street Journal report, that's more than half a billion dollars of hardware. He says plainly that he is not confident in the GPU counts.

He's just as plain about what the weights can't show. They show which hardware generated a model's starting weights, not that Blackwell ran the whole job. "The weights also cannot reveal who owned the chips or where they were located," he writes. The analysis doesn't establish how anyone got access, or whether export controls were broken.

Why you should care if you run these models

Yes, this sounds like Washington's problem. It's yours too if open-weight models from DeepSeek, Kimi or MiniMax sit in your stack.

The forensics don't change what those models can do. They change the pressure around them, and they land in the same week Jensen Huang quit Nvidia and agreed to testify to Congress.

Nothing breaks today. Keep a second model you've already tested ready, in case procurement rules or a customer's compliance team starts asking where your weights came from.

The bigger change is the method. Anyone with the published weights and DePue's code can now check a model for hardware traces. Closed models can't be checked this way, he notes.

Watch for replication and a response

The Decoder's report carried no comment from Nvidia. Watch for independent researchers rerunning the code on other models, and for whether US officials cite it.

Open weights say more than their makers meant. Expect more people to read them.