Blackwell fingerprints emerge in six Chinese AI models

By Elena Vasquez

A forensic analysis by Will DePue found distinct Nvidia Blackwell signatures in six Chinese AI models and estimated that five related training runs used about 12,000 GPUs worth more than $500 million.

US officials and news outlets had suspected DeepSeek and Moonshot AI were using Blackwell, but they never published proof, DePue’s report says. His findings sharpen a central export-control dispute over how Chinese labs obtained restricted hardware.

DePue previously helped build Sora, Sora 2, GPT-4o, o3, and GPT-5 at OpenAI. He later founded the nonprofit research group Unemployment Labs. DePue describes his work as the first technical evidence that leading Chinese AI labs have accessed Nvidia’s latest Blackwell chips despite US export controls.

DePue wrote on X: “senior researchers at OpenAI and Anthropic have already independently checked and confirmed his findings.” His claim addresses the fingerprint method, not the location or ownership of the suspected chips.

What did DePue find?

DePue’s report identifies Blackwell traces in six Chinese models released since April 2026. The six are DeepSeek-V4-Flash, DeepSeek-V4-Pro, MiniMax-M3, Ant Group’s Ling-3.1-flash, and Moonshot AI’s Kimi K3 and Kimi K3.1-Pro. Earlier models, including DeepSeek-V3 and Kimi K2.5, show traces of Nvidia’s older Hopper generation, according to DePue.

His analysis maps each of the six models to one of two Blackwell configurations:

• DeepSeek-V4-Flash: The 148-core pattern associated with Nvidia’s B200 or B300 chips.
• MiniMax-M3: The same 148-core B200 or B300 pattern.
• DeepSeek-V4-Pro: The 152-core pattern associated with liquid-cooled GB200 or GB300 rack systems.
• Kimi K3: The 152-core GB200 or GB300 pattern.
• Kimi K3.1-Pro: The same 152-core GB200 or GB300 pattern.
• Ling-3.1-flash: The 152-core pattern tied to GB200 or GB300 hardware.

In DePue’s report, the split is more precise than a company-level accusation. He ties individual published models to particular core counts and chip families, rather than treating every Chinese lab as one suspect.

His analysis says models from Alibaba’s Qwen3.8 and from Zhipu, Tencent, Xiaomi, and StepFun still show only Hopper signatures. Meituan’s LongCat-2.0 instead points to Huawei hardware.

How does a GPU leave a fingerprint?

DePue’s method starts with the language models themselves. Each model contains billions of numerical values called weights, according to his report. Those values preserve a statistical trace of the hardware that initialized them.

Before training starts, PyTorch, the standard software framework, fills empty slots with random numbers generated from a starting value called a seed. The GPU splits that work across its individual compute cores. Because different chip models have different core counts, the filling process produces a characteristic pattern, DePue explains.

Nvidia’s older Hopper chips, including the H100 and H800, use 132 compute cores. Blackwell processors use exactly 148 or 152 cores, depending on the model. B200 and B300 chips carry the 148-core pattern; liquid-cooled GB200 and GB300 rack systems use 152.

Training then adjusts those values millions of times. Still, some slots tied to unused words or symbols keep their initial random values. Even in heavily trained parts of a model, a faint statistical echo of the original distribution survives, according to DePue.

DePue says he worked the pattern backward and reproduced the results for DeepSeek-V4-Flash and Kimi K3 exactly on real Blackwell chips. He has published the verification code on GitHub.

His report says statistical chance can be ruled out. The method also correctly identified all 24 control models with known hardware, including Meta’s Llama 3.1 on an H100.

That control set gives the fingerprint method a direct test against known chips. The entire claim depends on whether a small statistical trace can distinguish hardware generations reliably.

What could five training runs have cost?

DePue estimates the five training runs he examined required about 12,000 Blackwell GPUs combined. He puts that at roughly the computing power of 30,000 older H100 chips.

Kimi K3 alone required an estimated 4,500 Blackwell processors over about 70 days. DeepSeek-V4-Pro required about 3,000, according to the report.

At a unit price of about $70,000, each of those two clusters would cost between $200 million and $300 million. All five systems together would cost more than half a billion dollars, DePue’s report estimates.

The figures turn a model-file fingerprint into a hardware-spending estimate. They also show why chip access matters to export policy: the report treats five training efforts as half-billion-dollar infrastructure commitments.

The findings also align with separate analysis from Dylan Patel, chief analyst at SemiAnalysis. In an interview with Sequoia Capital, Patel said: “DeepSeek-V3's model architecture was still specifically tailored for Nvidia's Hopper chips.” He also described DeepSeek-V4’s architecture as built for both Blackwell GPUs and Huawei’s Ascend chips.

Those observations align with the fingerprint split between Hopper-era V3 and Blackwell-era V4, DePue’s report says. The architecture analysis and the weight-level evidence point in the same direction.

Does the fingerprint prove an export-control violation?

Strictly speaking, DePue’s method shows only which hardware initialized the weights. He says the training itself very likely ran on the same systems.

The only other technical explanation would be an AMD MI300X, according to DePue. He says that chip is also restricted and could produce the same pattern only if artificially throttled. DePue says he ruled out AMD for DeepSeek-V4-Flash by using tiny rounding differences between the chips.

The data does not reveal where the GPUs are or who owns them, according to the investigation. The evidence cannot connect a specific model, laboratory, or training run to a particular hardware supplier.

Because Chinese companies can rent computing capacity at data centers outside China, the report says its technical evidence shows access to Nvidia’s top hardware. It does not by itself prove physical smuggling or a violation of US export law.

For regulators, access and legal responsibility remain separate findings. The fingerprint supports the first, while the model’s public weights leave the second unresolved.

What can researchers test next?

DePue’s GitHub release gives other researchers a way to rerun the test against the published models. His claim that OpenAI and Anthropic researchers have checked the method adds another route to scrutiny, though the report does not describe those checks in detail.

Broader replication is the next substantive test because the evidence rests on a statistical trace left in trained weights. If that trace survives independent review, researchers can compare future Chinese models against known Blackwell hardware.

For Nvidia and US policymakers, a repeatable Blackwell fingerprint can expose access to top hardware without showing who moved chips across borders. If replication holds, the six model files will have exposed restricted-chip access that investigators can test, while leaving ownership, location, and legal responsibility unresolved.