Report claims six Chinese AI models carry a fingerprint of export-controlled Nvidia Blackwell chips

A report published on Thursday 12 November by Will DePue of Unemployment Labs claims that six recent open-weight models from four Chinese AI developers carry a numerical "fingerprint" of Nvidia's Blackwell GPUs, which need a US licence for export to China. The report is a single source and we found no sign it has been peer reviewed; we found no response from the companies named, Nvidia or the US Commerce Department.

What the report claims

The report names six models: DeepSeek-V4-Flash and DeepSeek-V4-Pro (DeepSeek), Kimi K3 and Kimi K3.1-Pro (Moonshot AI), MiniMax-M3 (MiniMax) and Ling-3.1-flash (Ant Group). It says earlier models from the same four companies match Nvidia's older Hopper generation instead.

Its conclusion, in its own words: "we believe that we have strong evidence that six Chinese AI models were initialized on export-controlled NVIDIA hardware, and that for DeepSeek-V4-Flash the evidence is conclusive". It adds that this "also strongly suggests that they trained on the same export-controlled hardware".

The report also sets limits on its own finding. The fingerprint "supports, without proving, the inference that Blackwell also performed the training", and the findings "do not establish where the chips were located, how access was obtained, or whether export controls were violated". It notes that "Blackwell systems can be rented from data centers outside China."

How the method works, according to the report

• Before training, a model's weights are filled with starting values from a random-number generator that is seeded with a number. PyTorch splits that job across GPU threads, and the number of threads depends on how many processing units (streaming multiprocessors, or SMs) the chip has.
• The same seed on a chip with a different number of SMs puts the same numbers in different places. The report gives Hopper chips 132 SMs, B200/B300 148 and GB200/GB300 152.
• Some weights, such as those for tokens never seen in training, keep their starting values. The author says he searched "roughly 6 trillion seed-and-layout combinations" for the pattern that reproduces them, then tested each match on weights held out of the search.
• It says DeepSeek-V4-Flash and Kimi K3 were also checked on physical Blackwell hardware (a B300 and a rented GB200) using unmodified PyTorch. Changing the seed by one reproduced nothing.

The report gives its strongest results as 49 to 1,385 sigma, against about 8 sigma expected from chance across the search. It says its readings agree with all 24 cases where a developer has publicly named its hardware, but calls that "a consistency check rather than a measured accuracy rate".

It names its own limits. The method reads the chip that created the starting weights, not necessarily every chip that trained the model. Specially configured AMD MI300X hardware, also export-controlled, can reproduce the same layouts: the report says it excluded AMD for DeepSeek-V4-Flash and considers it "very unlikely" for the other five. It found no fingerprint in DeepSeek's newer V4.1-Flash. It says the newest models it could read from Alibaba, Zhipu, Tencent, Xiaomi and StepFun all read as Hopper.

It also estimates the size of the training runs, about 4,500 Blackwell GPUs for Kimi K3 and 3,000 for DeepSeek-V4-Pro, while saying "We are not confident in these estimates." A same-day revision raised these from an earlier 2,000 to 3,000.

What is public

The code is on GitHub under the MIT licence, at macrogrants/checkpoint-forensics. It covers four of the six models plus one more: DeepSeek-V3 (which the report reads as Hopper), DeepSeek-V4-Flash, Kimi K3, MiniMax-M3 and Ling-3.1-flash. DeepSeek-V4-Pro and Kimi K3.1-Pro are not in it. The README says the check "runs on a laptop in a few seconds", and its GPU table also lists MiniMax-M3 matching on a B300.

Who is behind it

The report has a single author, Will DePue. Unemployment Labs' site describes itself as "a small, independent research group started by Will DePue" and part of macrogrants, "a California nonprofit" whose 501(c)(3) status is pending. Macrogrants' site lists DePue as director and says he helped create Sora at OpenAI. Neither the report nor the repository says how this project was funded; the macrogrants site describes Unemployment Labs as "Generally self-funded; but we back some of the projects with money, compute, and introductions."

Reaction

The Hacker News thread had 294 points and 102 comments when we checked. One commenter said "The method seems sound and the findings correct", and added that renting GPUs outside China is legal. Others questioned whether starting hardware means training hardware, and others pointed to the author's OpenAI background. Another commenter noted that DeepSeek's own DeepInfer inference software lists "NVIDIA SM100 GPUs" (Blackwell) as supported hardware, alongside "Huawei Ascend 950 NPUs". We checked, and its README does say this, but it covers inference, not training.

We found no statement on the report from DeepSeek, Moonshot AI, MiniMax, Ant Group, Nvidia or the US Commerce Department's Bureau of Industry and Security as of Friday morning UK time.

Why it matters

On our reading, the report's main contribution is a method anyone can rerun on published weights, since the code for four of the six models, plus DeepSeek-V3, is public. Its claim about where training happened rests on more steps than its claim about initialisation, and the report says so itself. It makes no claim about how the chips were obtained or whether any law was broken.