Report claims Nvidia Blackwell fingerprints in six Chinese AI models

By Sophie Lindqvist

A November 12 report identifies Nvidia Blackwell fingerprints in six Chinese AI models. Its test matched all 24 control models with disclosed hardware.

Will DePue, a former OpenAI researcher who worked on Sora, GPT-4o and GPT-5, published the analysis through his nonprofit, Unemployment Labs. He says six models released since April 2026 carry a Blackwell signature. Earlier models from the same laboratories match Nvidia's older Hopper generation.

The analysis links DeepSeek, Moonshot AI, MiniMax and Ant Group to Blackwell hardware. Such hardware requires a U.S. license for export to China.

Which models match which chips?

• DeepSeek-V4-Flash and MiniMax-M3: B200/B300, with 148 streaming multiprocessors each.
• DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ant Group's Ling-3.1-flash: GB200/GB300, with 152 streaming multiprocessors each.

These are statistical matches to starting-weight layouts. They do not show where the GPUs sat or who arranged access.

On X, DePue said a B300 reproduced DeepSeek-V4-Flash's untouched starting weights “bit for bit,” while a rented GB200 reproduced Kimi K3's weights with a correlation of 0.999995. An H100 reproduced none.

How does a seed reveal a chip?

Before training, PyTorch fills model weights with pseudorandom numbers from a seed. The process uses Nvidia's cuRAND library. It divides work across as many as 2,048 threads per streaming multiprocessor, or SM.

Because the thread count follows each chip's SM count, the same seed creates a different numerical layout on each processor architecture during the model-weight initialization phase. Hopper has 132 SMs. B200 and B300 have 148. GB200 and GB300 have 152.

Faint traces of that layout survive training. DePue searched about 6 trillion seed-and-layout combinations for matches. His six scores range from 49 to 1,385 sigma. The expected best chance match was about 8.

How strong is the control test?

The method agreed with disclosed hardware for all 24 control models. One was Nvidia's Nemotron-3 Ultra on GB200. That success supports the method. It is not vendor confirmation of the six disputed matches.

DePue wrote on X that “senior researchers at OpenAI and Anthropic had independently verified the result.” Neither company has said so publicly.

MLQ.ai found no public response from the four labs or Nvidia by Friday morning. The verification code is on GitHub.

U.S. officials and press reports had already alleged that DeepSeek and Moonshot used Blackwell, according to the report, but had offered no public technical evidence. The earlier allegations and the weight analysis remain separate evidentiary tracks.

How large could the clusters have been?

DePue estimates that five main training runs needed about 12,000 Blackwell GPUs, equivalent to roughly 30,000 H100s, although he says he is not confident in the figures.

He assigns about 4,500 GPUs to Kimi K3. DeepSeek-V4-Pro gets 3,000 in the same estimate. Each run lasts about 70 days. At about $70,000 per GPU, the largest cluster would cost $200 million to $300 million.

The five together would exceed half a billion dollars in hardware. On November 12, he revised the figures upward from 2,000 to 3,000 GPUs for the largest runs. He also says he is not confident in them. They rest on assumed chip efficiency, token counts and run lengths.

These are modeled capacity and procurement estimates. No lab or Nvidia had publicly disclosed procurement figures by Friday morning, according to MLQ.ai.

What does the evidence not prove?

The fingerprint identifies the hardware that produced the starting weights. It supports, without proving, that the same hardware performed the training.

The report identifies one alternative: specially configured AMD hardware. That hardware is also export-controlled, and DePue excluded it for DeepSeek-V4-Flash.

Because Chinese companies can rent compute in data centers outside China, the evidence does not establish where the chips were, how access was obtained, or whether export controls were violated. Blackwell GPUs require a U.S. license for export to China.

The match raises a compliance question, not a settled violation.

Which other models do not match?

Models from Alibaba's Qwen, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper. Meituan's LongCat-2.0 shows no Nvidia fingerprint.

That negative result limits the finding to the six named models. It does not establish a broader switch by Chinese laboratories to Blackwell.

Earlier coverage cited SemiAnalysis's estimate of more than 1.5 GW of banned Nvidia chips reaching China, and Bloomberg's reporting on banned chips in a Shanghai data center. Those claims remain separate from the weight-fingerprint evidence.

What would settle the capacity estimate?

Future disclosures of cluster capacity, chip ownership and procurement price would provide firmer evidence than the current model. Until cluster capacity and procurement prices are confirmed, the estimated half-billion-dollar hardware footprint will remain an inference.