Forensic study finds export-restricted Blackwell GPU fingerprints in six Chinese AI models

A forensic analysis of publicly released AI model weights finds that six recent models from four leading Chinese AI labs — DeepSeek, Moonshot AI, MiniMax and Ant Group — were initialized on NVIDIA's Blackwell GPUs, hardware that U.S. export rules bar from shipment to China without a license. The evidence, published by Unemployment Labs and surfaced on Hacker News, comes entirely from the models' own published weights rather than leaks or insider accounts.

Which models read as Blackwell

According to the report, DeepSeek-V4-Flash and MiniMax-M3 match the B200 or B300 chips, which have 148 streaming multiprocessors (SMs), while DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ant Group's Ling-3.1-flash match the GB200 or GB300 variants, which have 152 SMs. All of these chips require a U.S. export license for China, and none has been reported.

The switch is recent. DeepSeek's models read as Hopper-trained through DeepSeek-V3 (December 2024) and Blackwell from the V4 generation (April 2026). Moonshot reads Hopper through Kimi K2.5 (January 2026) and Blackwell from Kimi K3 (July 2026). MiniMax moved between M2.7 (April 2026) and M3 (June 2026), and Ant Group between Ling-3.0-flash (August 2026) and Ling-3.1-flash (October 2026). One Moonshot release, Kimi K2.7-Code, sits in between: it is built on Hopper-era weights but contains a small component matching the B200 or B300.

Not every major Chinese lab shows the pattern. The newest readable models from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi and StepFun all read as Hopper-trained, and Meituan says its LongCat-2.0 was trained entirely on AI ASIC superpods, with no NVIDIA fingerprint in its released weights.

How the fingerprint works

Before training begins, a model's billions of parameters need initial values. In PyTorch, the framework behind most major models, those values come from a deterministic pseudorandom generator called Philox, invoked through NVIDIA's cuRAND library. The work is divided among up to 2,048 threads per SM, so a chip with more SMs assigns the same numbers to different positions in the weight matrices. That makes an SM count — 148 for B200/B300, 152 for GB200/GB300 — legible in the finished weights.

The researchers recovered traces of each model's initial values, then searched roughly six trillion seed-and-layout combinations for configurations that reproduce them; for DeepSeek-V4-Flash and Kimi K3 they confirmed the match on physical Blackwell hardware. The method passes a validation test: for 24 models whose developers disclosed their training hardware, it agreed with the disclosure every time, and NVIDIA's Nemotron-3 Ultra, whose technical report names the GB200 for one training phase, reads as 152 SMs. Statistically, the strongest chance match across the search space would reach about 8 sigma, while the six flagged models range from 49 to 1,385 sigma.

The scale of the hardware

Combining each model's size and training data with Blackwell throughput at 35 percent utilization, the report estimates that each final training run needed roughly 500 to 3,000 Blackwell GPUs running for two to three months. The same arithmetic applied to DeepSeek-V3 yields 2,000 to 2,500 chips, against the 2,048 DeepSeek disclosed for that run.

At about $70,000 per GPU — a figure the report derives from a Wall Street Journal account of roughly 36,000 Blackwells being installed in Malaysia for ByteDance at a cost above $2.5 billion — the largest clusters would represent $150 million to $200 million each, with the five identified runs together exceeding half a billion dollars. The labs' total spending on export-controlled GPUs is likely in the billions, the report argues.

What the evidence does and does not prove

The fingerprint identifies the hardware that initialized the weights, and the report is explicit about the limits of the inference: it supports, without proving, the conclusion that Blackwell also performed the training. Specially configured AMD hardware, itself restricted from export to China, is the only alternative the researchers identified; they excluded it for DeepSeek-V4-Flash and consider it very unlikely for the other five models.

The analysis establishes access to advanced computing hardware but not where the chips were located, how access was obtained, or whether export controls were actually violated. Kimi K3.1-Pro, which shares its seed with K3, may simply be a checkpoint of K3 with further post-training.

Why it matters

U.S. officials and press reports had already alleged Blackwell use by DeepSeek and Moonshot, but without technical evidence; this analysis supplies it, and widens the list to four labs. If leading Chinese developers are running datacenter-scale training on restricted silicon, export controls are leaking in practice, not just in allegation, and the pressure shifts toward enforcement and supply-chain tracing. The method also matters on its own: because it reads hardware signatures straight from published weights, open-weight releases now carry a forensic trail that outside analysts can audit — something labs can no longer treat as invisible.