Chinese frontier AI models carry the fingerprint of export-controlled Nvidia Blackwell GPUs, forensic report finds

For years, US officials and press reports have alleged that Chinese AI labs were training their newest models on Nvidia’s Blackwell GPUs — chips Washington bars from export to China — without ever publishing technical evidence. On November 12, a forensic report from Unemployment Labs changed that: researcher Will DePue says the published weights of six recent Chinese models carry numerical fingerprints matching Blackwell hardware, and that the match was confirmed on physical Blackwell chips for two of them.

The six models come from four labs — DeepSeek, Moonshot AI, MiniMax and Ant Group — and all were released since April 2026. The report is careful about what that proves: a fingerprint identifies the hardware that created a model’s initial weights. It supports, without proving, that Blackwell also did the training. It says nothing about where the chips were, how access was obtained, or whether any export control was violated.

Six models, four labs, one pattern#

The before-and-after is what makes the pattern hard to dismiss. DeepSeek-V3, released in December 2024, reads as Hopper — the lab itself disclosed H800 hardware. Kimi K2.5, from January 2026, also reads as Hopper. The Blackwell readings start with the April 2026 releases and continue through the autumn. And the pattern is not universal: the newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper, which cuts against a flaw in the method. The B200/B300 are single GPUs with 148 streaming multiprocessors; the GB200/GB300 are Grace Blackwell superchips with 152.

How a weight file betrays its hardware#

Training a model starts with initialization: random starting weights, drawn from a pseudorandom number generator. DePue’s method recovers traces of those initial values from the published weights, then searches for the hardware configuration and seed that reproduces them. The tell is in the fine details of how the numbers were generated — the Philox pseudorandom-number seed and the thread-count layout, which vary by chip. The search space is enormous: roughly six trillion seed-and-layout combinations. The matches came back at 49 to 1,385 sigma per model, against a chance benchmark of about 8 sigma.

For two models, the match was confirmed on real hardware. DePue reports that a single Blackwell B300 reproduced DeepSeek-V4-Flash’s initial weights, and a rented GB200 reproduced Kimi K3’s to a correlation of 0.999995. Across 24 cases where a developer had publicly named a model’s hardware, the method agreed every time — though 11 of those involve step-zero checkpoints and are not fully independent. Crucially, the evidence comes entirely from the models’ own published weights, not from leaks or insider accounts, which means anyone with the weights and the method can in principle check the work.

What the fingerprint does not prove#

The most important passage in the report is the one that limits it. A lab could initialize weights on one system and train on another, and a Hopper reading does not rule out later Blackwell training. The weights cannot say where the chips sat — Blackwell systems can be rented outside China, a point the report itself makes — or how access was obtained. The only alternative hardware the report identifies is specially configured AMD MI300X chips, which are also export-restricted; it rules that out for DeepSeek-V4-Flash and calls it very unlikely for the other five.

The report also ventures a scale estimate — roughly 1,500 to 3,500 Blackwell GPUs per run for one and a half to three months, about 12,000 across five runs — and immediately undercuts it: the author writes that he is “not confident in these estimates.” Finally, the report is the work of a single researcher, not a peer-reviewed paper, and no independent reproduction has yet been published. That is the next test, and it is one the method invites: the weights are public, and the fingerprint is either there or it is not.

Why it matters#

Export controls on advanced chips are the centerpiece of US policy toward Chinese AI, and until now the debate has run on allegations and logistics — seized shipments, smuggling arrests, shell companies. A forensic method that reads hardware out of the models themselves gives regulators something new: technical evidence that does not depend on catching a shipment. It also raises the question the report does not answer: if the chips are being used, how did they get there?

The finding also lands while Washington is reportedly weighing tighter rules on remote access to advanced chips: The Information has reported that the Commerce Department is finalizing a rule aimed at stopping Chinese AI companies from remotely using advanced chips in data centers abroad — a rule this finding would tend to support. For the labs named, the report is an accusation they have not yet answered publicly. For everyone else building on open weights, it shows a model’s training history is harder to hide than its builders may have assumed.

What to watch#

Three things. First, independent reproduction: the weights are public, the method is described, and a second lab confirming the fingerprints would turn a single-author finding into a settled fact. Second, responses — from DeepSeek, Moonshot, MiniMax and Ant Group, from Nvidia, and from US officials — and whether any of them disputes the method or the readings. Third, enforcement: whether the finding shows up in export-control actions, licence decisions, or the remote-access rule reportedly in the works. Until then, the honest summary is the report’s own: strong evidence of access to Blackwell hardware, and no proof yet of how it was obtained or whether a law was broken.

Sources: Unemployment Labs — Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs (Nov. 12, 2026); Unite.AI — Unemployment Labs Reports Blackwell Patterns in Chinese AI Models (Nov. 12, 2026). Prior coverage: China moves to fence in AI: 23 AI technologies proposed for export controls, registration starts today; Moonshot curbs Kimi K3.1 Pro’s hacking skills — 81% on its cyber test after cyber data was filtered from training.