Researchers Fingerprint Banned Nvidia Blackwell GPUs in Chinese AI Models

Independent researchers say they have statistical evidence that four open-weight Chinese AI models — DeepSeek V4, Kimi K3.1, MiniMax-M3, and Ling-3.1-Flash — were trained on Nvidia Blackwell GPUs, chips the United States bars from export to China. UnemploymentLabs, the research outfit behind the finding, used a new GPU "fingerprinting" technique that reads the imprint of the training hardware directly from published model weights.

The researchers hedge their conclusions. Their mathematics, they say, checks out. But it does not reveal where the chips physically were, how they were accessed, or whether export controls were violated in any legal sense. It is not currently illegal for Chinese companies to rent Blackwell hardware abroad, and U.S. companies are not strictly prohibited from providing such access. A recent deal between Tencent and Oracle demonstrates that this arrangement exists in practice.

How does the fingerprinting method work?

The technique exploits two base facts about accelerator hardware and training software. First, different AI accelerator families carry unique counts of shader modules (SMs), roughly analogous to CPU cores. Nvidia's Hopper chips have 132 SMs. Blackwell B-series chips have 148. Blackwell GB-series chips carry 152.

Second, virtually all large-scale model training on Nvidia hardware runs through PyTorch and its CUDA-aware software stack.

Training begins with weight initialization. In modern large language models, initial weight values are adjusted plus and minus in a pseudo-random fashion using cuRAND, Nvidia's random number library. A given seed value always produces the same adjustment figures.

That initialization work is spread across every SM on every card, subdivided into threads. For large weight sets, the thread count per SM is 2,048 on both Blackwell and Hopper silicon — a figure the researchers describe as carefully chosen and optimized.

UnemploymentLabs replicated the initialization process using the same chips, software stacks, and thread counts. Simple statistical analysis showed their resulting distribution of weight values matched the published weights of DeepSeek, Kimi, and the other models precisely. As a control, they changed the SM and thread counts. The correlation broke down completely.

What can the method prove — and what can it not?

The technique let the researchers identify the family of Blackwell or Hopper chip behind each model. It also yielded an approximate count of the cards used.

It cannot identify the exact card variant. The analysis tracks initialization layout counts alone — SM count and usage pattern. It is blind to VRAM capacity, memory bandwidth, and the other characteristics that distinguish individual SKUs.

The method also applies only to open-weight models, since it requires access to the weights themselves, and it depends on both the hardware and the software stack used in training.

Could AMD hardware explain the results?

In principle, yes. An AMD card such as the MI300X has a high SM count, and the researchers acknowledge it is not impossible that one could be configured to appear as two groups of 152 or 148 shaders, though they note there would be little reason to do so.

For DeepSeek V4, they ruled the AMD hypothesis out empirically. Analyzing the actual weight values, they found AMD cards did not produce the same weight value pattern as the published model.

What does this mean for export controls?

U.S. trade controls prohibit the export of high-end Nvidia and AMD AI accelerators to China. It is an open secret in the industry that Blackwell silicon reaches China regardless, whether through physical channels or remote access. This research offers the first public, methodical corroboration that the restricted chips are actively training China's flagship open models.

The legal picture remains ambiguous. Renting Blackwell capacity outside China appears lawful for Chinese firms today, and Nvidia's contractual grip on customers is tightening rather than resolving the question.

If the fingerprinting technique withstands scrutiny, every future open-weight release becomes a potential audit trail of the hardware behind it — and closed-weight models from any vendor will face the harder question of what their training clusters contain.