Analysis Finds Blackwell GPU Fingerprints in Six Chinese AI Models

Six open-weight Chinese AI models carry initialization patterns consistent with NVIDIA's export-controlled Blackwell GPUs, according to an Unemployment Labs analysis by Will DePue published November 12, 2026. The study links models from DeepSeek, Moonshot AI, MiniMax and Ant Group to B200, B300, GB200 or GB300 chips — hardware whose export to China requires a U.S. license — with statistical confidence ranging from 49 to 1,385 sigma.

The stakes are considerable. U.S. export controls treat B200, B300, GB200 and GB300 shipments to China as license-requiring, and the report states that no such licenses have been reported. The analysis gives policymakers technical evidence of hardware access while stopping short of any enforcement conclusion.

What did the analysis find?

DePue's report associates DeepSeek-V4-Flash and MiniMax-M3 with initialization on B200 or B300 chips, and DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash with GB200 or GB300 chips. The matches identify the hardware layout behind each model's starting weights. Whether those same chips also performed training is a separate inference the report treats cautiously.

The release timeline places the apparent hardware shift in sequence. DeepSeek-V3 produced a Hopper reading in December 2024, followed by the two Blackwell-reading V4 models in April 2026. Moonshot AI's Kimi K2.5 read as Hopper in January 2026 before K3 arrived in July 2026. MiniMax-M2.7 and M3 followed the same pattern in April 2026 and June 2026, respectively. Ant Group's Ling-3.0-flash and Ling-3.1-flash did so in August 2026 and October 2026.

The pattern was not universal. The newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun produced Hopper rather than Blackwell readings.

How does initialization reveal a hardware layout?

The technique starts with weights — the numerical parameters that training adjusts. Before training begins, the PyTorch/cuRAND setup examined in the report uses the Philox generator to produce repeatable values from a seed. GPU threads distribute those values among weight positions, and a sufficiently large initialization uses 2,048 threads per streaming multiprocessor (SM), the core compute unit of an NVIDIA GPU. Changing the SM count changes where the same generated numbers land.

The thread counts differ sharply across chip generations. In the configurations tested, Hopper H100 SXM, H200 and H800 chips have 132 SMs and 270,336 threads; B200 and B300 chips have 148 SMs and 303,104 threads; GB200 and GB300 chips have 152 SMs and 311,296 threads. A reading identifies one of these groups, not a specific chip within it.

The method exploits a preservation effect. Weights reserved for words or symbols absent from training can keep their initial values almost exactly, while trained weights may retain only a weaker statistical relationship to those values. The investigators select a seed and layout on one set of weights, then test that unchanged combination on a separate set excluded from the search — a holdout design that guards against overfitting.

The statistical margin is large. Under the report's statistical model, roughly 6 trillion seed-and-layout combinations would produce an expected strongest chance match of about 8 sigma — a measure of distance from random variation. The strongest results for the identified models range from 49 to 1,385 sigma. Every individual test included reaches at least 20 sigma.

What did the physical chip tests show?

DePue ran reproductions on physical hardware as a second check. Using DeepSeek's recovered seed, an H100 reproduced DeepSeek-V3's preserved values but not V4-Flash's, while a B300 did the reverse. On the B300, unmodified PyTorch reproduced 461 of 469 selected V4-Flash rows with correlations above 0.99, including 445 complete bit-for-bit row matches.

A rented GB200 reproduced all 13 preserved Kimi K3 rows with Moonshot's seed. Changing either recovered seed by one produced no matching rows.

The method also agreed with all 24 cases where a developer publicly named a specific model's hardware, though the report cautions that 11 of those involve step-zero checkpoints and that related models are not independent. That makes the comparison a consistency check rather than a measured accuracy rate.

How large was the training?

Kimi K3.1-Pro uses K3's seed and may be a K3 checkpoint with further post-training, according to the report. Assuming the initializing hardware also performed training, DePue estimates five distinct final runs at roughly 500 to 3,000 Blackwell GPUs each, generally over two to three months.

The calculation divides training compute by chip throughput at 35% utilization, using DeepSeek's disclosed token counts and weight-based token estimates for the other models. Applying the same arithmetic to DeepSeek-V3 produced an estimate of 2,000 to 2,500 chips, against DeepSeek's disclosed figure of 2,048 — a close fit that lends the method credibility.

Could the chips be AMD instead?

AMD's MI300X is the identified hardware alternative. It normally uses 304 processing units but can be divided into two groups of 152 or configured to use 148, reproducing the examined layouts in physical tests. For DeepSeek-V4-Flash, 363 of 377 preserved values that differ between vendors matched NVIDIA and none matched AMD. That numerical test did not settle the other five models, although the report considers a specially configured AMD cluster very unlikely.

What are the limits for export-control enforcement?

A match concerns initialization alone. It cannot inventory every processor used during later training. A lab could create initial values on one system and transfer them elsewhere, mixed clusters could leave only some hardware traces, and a Hopper result does not exclude subsequent Blackwell training. Nor can weights establish chip ownership, location or acquisition.

The report is explicit about the boundary. It notes that Blackwell systems can be rented outside China and says this evidence alone establishes neither smuggling nor an export-control violation. Determining whether export controls were breached would still require evidence about where the hardware was used, who owned it and how access was obtained.

The method has structural blind spots. It requires public weights and a recognizable hardware-dependent initialization pattern. CPU initialization leaves no GPU layout, and Baidu's PaddlePaddle generator does not carry the examined chip layout.

The forward implication cuts both ways. Open-weight releases expose an auditable hardware fingerprint that closed models would never reveal, giving regulators a new evidentiary tool — but the same analysis shows how far a statistical signal is from a proven violation.

By Marcus Bennett