China’s top AI models carry fingerprints of banned Nvidia chips, an ex-OpenAI researcher says

Six of China’s newest open AI models, from DeepSeek, Moonshot AI, MiniMax and Ant Group, carry a numerical signature of Nvidia’s Blackwell chips, which can’t be exported to China without a US licence, former OpenAI researcher Will DePue says in a forensic report from his nonprofit, Unemployment Labs. He puts the hardware behind the training runs at more than half a billion dollars.

How a chip leaves a fingerprint

Before training, every weight in a model gets a random starting value. In PyTorch on Nvidia hardware these come from a generator fed by a seed number, with the work split across 2,048 threads for each of the chip’s processing units (streaming multiprocessors, or SMs). Because the number of SMs differs between chips, the same seed lays the numbers out in a different pattern on each one. Hopper chips such as the H100, H800 and H200 have 132; Blackwell’s B200 and B300 have 148; the Grace Blackwell GB200 and GB300 have 152.

Some starting values survive training untouched, and DePue searched about six trillion seed and layout combinations to reproduce them. He says DeepSeek reused the same seed, 953049583, for DeepSeek-V3 and DeepSeek-V4-Flash. On a real Hopper H100, unmodified PyTorch reproduced V3’s preserved values bit for bit but none of V4-Flash’s; on a Blackwell B300 it was the other way round. A rented GB200 reproduced all 13 of Kimi K3’s preserved rows with Moonshot’s seed, and changing either seed by one broke the match. His code is public.

The method also agreed with all 24 models whose makers have said what hardware they used, including Nvidia’s own Nemotron-3 Ultra, partly trained on GB200s.

Which models switched, and when

According to the report, DeepSeek-V4-Flash and V4-Pro (April 2026), Moonshot’s Kimi K3 (July) and K3.1-Pro, MiniMax-M3 (June) and Ant Group’s Ling-3.1-flash (October) all read as Blackwell. Earlier models from the same four labs read as Hopper. The newest open models from Alibaba’s Qwen, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper, and DePue found no fingerprint at all in DeepSeek’s latest, V4.1-Flash.

From each model’s size and training data he estimates Kimi K3 needed about 4,500 Blackwell GPUs and DeepSeek-V4-Pro about 3,000, for two to three months each, and about 12,000 across five runs. At roughly $70,000 a chip, the largest cluster would cost $200 million to $300 million. He raised those figures on Thursday and says he isn’t confident in them, as they rest on run lengths and efficiency no lab has disclosed.

DePue posted the findings on X on Thursday evening, where they passed 5.8 million views:

Again, this evidence isn’t based on any insider information or leaking. It’s based on a forensic analysis of the model weights released by the companies themselves.

Will DePue, on X

“I would not be 24 for 24”

The fingerprint identifies the hardware that created a model’s starting weights, not necessarily every chip that trained it. It says nothing about who owned the chips or where they were, and Blackwell systems can be rented from data centres outside China, so it doesn’t prove smuggling or an export-control breach. AMD’s MI300X, also restricted, can mimic the Blackwell layouts if configured to use 148 or 152 of its units; DePue ruled that out for DeepSeek-V4-Flash and calls it very unlikely for the other five.

When critics on X argued that a lab could create weights on one machine and train on another, DePue replied that the 24 known cases would then have failed:

If labs initialized on one machine and trained on another I would not be 24 for 24.

Will DePue, on X

He also says senior researchers at OpenAI and Anthropic independently verified the result. He hasn’t named them, and neither company has commented.

A bad week for Nvidia

The report lands a day after Jensen Huang resigned as Nvidia’s CEO, following reports that US intelligence believed an executive linked to the server firm Megaspeed had been recruited to spy on him. Washington is already scrutinising how it licenses Nvidia’s chips for China, after the US cleared Chinese firms with empty offices to handle the less powerful H200.

US officials have alleged before that DeepSeek and Moonshot used Blackwell chips, but without publishing technical evidence. DeepSeek has said publicly that it wants to train its biggest model on Huawei chips. Nvidia, DeepSeek, Moonshot AI, MiniMax, Ant Group and the US Commerce Department haven’t commented on the report.

Why it matters

If DePue’s method holds up, four of China’s leading labs, including the makers of Kimi K3.1 Pro, would have had access to thousands of chips the US says they shouldn’t. It gives Congress and Commerce technical evidence to chase, though not where the chips were or who supplied them.

Sources: Unemployment Labs, Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs; checkpoint-forensics code (GitHub); Will DePue on X; DePue’s reply on X.