Former OpenAI Researcher Says Six Chinese AI Models Carry the Fingerprint of Export-Banned Nvidia Blackwell Chips
Will DePue's forensic report reads hardware traces left in the published weights of models from DeepSeek, Moonshot AI, MiniMax and Ant Group. It says nothing about where the chips were or whether any law was broken, but it puts fresh technical evidence behind a fight over U.S. export controls.
Published
Last updated / Fact-checked on
Illustrative photo of an older Nvidia graphics processor on a circuit board. It is not a Blackwell chip and has no connection to the models discussed in this article.
A former OpenAI researcher says he has found a hidden hardware signature in the published weights of six leading Chinese AI models, and that the signature points to Nvidia's Blackwell GPUs, chips the United States does not allow to be exported to China without a license.
Will DePue, who leads the small nonprofit research group Unemployment Labs, published the findings on Thursday, Nov. 12, in a report titled "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs." The models named are DeepSeek-V4-Flash and DeepSeek-V4-Pro, Moonshot AI's Kimi K3 and Kimi K3.1-Pro, MiniMax-M3, and Ant Group's Ling-3.1-flash. TechCrunch reported on the research on Friday.
The report is careful about what it does not show. It "do[es] not establish where the chips were located, how access was obtained, or whether export controls were violated," DePue writes. Blackwell systems can be rented from data centers outside China.
At a glance
| Item | Detail | Source |
|---|---|---|
| Published | Nov. 12, 2026 | Unemployment Labs |
| Models flagged | Six, from DeepSeek, Moonshot AI, MiniMax and Ant Group | Unemployment Labs |
| Hardware match | Four models to GB200/GB300 (152 cores); two to B200/B300 (148 cores) | Unemployment Labs |
| Search size | About 6 trillion seed-and-layout combinations | Unemployment Labs |
| Signal strength | 49 to 1,385 sigma, against about 8 sigma expected by chance | Unemployment Labs |
| Physical check | B300 reproduced DeepSeek-V4-Flash's untouched starting weights bit for bit; a rented GB200 matched Kimi K3 | DePue thread; Dataconomy |
| What it doesn't show | Chip location, ownership, or any legal violation | Unemployment Labs |
How a model can remember its chip
An AI model is a very long list of numbers called weights. Before training starts, those numbers are filled with pseudo-random starting values generated from a single seed. DePue's insight is that the way PyTorch, the software most labs use, spreads that job across a GPU depends on how many processor cores, called streaming multiprocessors, the chip has. In his account, Nvidia's Hopper chips have 132, Blackwell B200 and B300 parts have 148, and the Grace Blackwell GB200 and GB300 have 152. The same seed therefore lays out the same numbers in a different order on each chip.
Training changes most weights, but not all of them, and many keep a faint statistical link to where they began. DePue says he took each published model, tried candidate chips and seeds, regenerated what the starting weights would have been, and compared them with the real ones. With the wrong chip the comparison is noise. With the right one, the patterns line up.
He then checked two results on real hardware. Running unmodified PyTorch with the recovered seed, a Blackwell B300 reproduced DeepSeek-V4-Flash's untouched starting weights bit for bit, he said, while a rented GB200 reproduced Kimi K3's preserved rows to a correlation of 0.999995. According to Dataconomy's summary of the report, Nvidia's H100 and AMD's MI300X reproduced none of the DeepSeek-V4-Flash rows tested, and changing the seed by one broke every match.
A timeline of the switch
The report's most striking pattern is a before-and-after. Earlier models from the same labs read as Hopper, the previous Nvidia generation. DeepSeek reads as Hopper through DeepSeek-V3 and as Blackwell from V4, released in April 2026. Moonshot's models read as Hopper through Kimi K2.5 in January and as Blackwell from K3 in July. MiniMax switches between M2.7 in April and M3 in June, and Ant Group between Ling-3.0-flash in August and Ling-3.1-flash in October.
Not every Chinese lab shows the change. The newest models DePue could read from Alibaba's Qwen, Zhipu's GLM, Tencent, Xiaomi and StepFun all read as Hopper-trained, the report says, and he found no Nvidia fingerprint in Meituan's LongCat-2.0, which Meituan says was trained on its own "AI ASIC superpods." A Hopper reading cannot tell an H800 from an H100 or H200, the report adds.
To test the method, DePue says he ran it on 24 models whose developers have publicly said what hardware they used, and it agreed every time. He calls that a consistency check rather than a measured accuracy rate.
How big, and how much
From each model's size and training data, the report estimates the two largest runs, Kimi K3 and DeepSeek-V4-Pro, used roughly 4,500 and 3,000 Blackwell GPUs for two to three months, with wide ranges around those numbers. It puts about 12,000 Blackwell GPUs across five runs. Using a price of roughly $70,000 per GPU, derived from a Wall Street Journal report on Blackwell chips in Malaysia, it says the largest cluster would cost roughly $200 million to $300 million and the five together more than half a billion dollars. DePue's Thursday thread on X gave somewhat lower figures, and both assume each model was trained on the hardware that set up its weights.
The caveats DePue lists himself
The fingerprint identifies the hardware that generated a model's starting weights, not every chip that later trained it. A lab could initialize on one system and train on another, the report notes. It also identifies one alternative: specially configured AMD MI300X hardware, also restricted from export to China, can reproduce the same layouts. DePue says he ruled that out for DeepSeek-V4-Flash and considers it very unlikely for the other five.
He also flags a practical limit. Now that the method is public, he wrote on X, labs can erase many of these signatures. He said he had sat on the result for a while and consulted advisers and officials before publishing, and that senior researchers inside OpenAI and Anthropic had confirmed it. DailyMech could not verify that claim. He promised code and a full paper; the report already links a GitHub repository with code to reproduce the results.
Why it matters
U.S. export rules bar Blackwell GPUs from going to China or Chinese-owned firms without a license. TechCrunch noted that the Trump administration does allow exports of Nvidia's less powerful H200 under a tariff arrangement. Officials have said before that Chinese labs reached banned chips: Dataconomy notes that White House adviser Michael Kratsios said in July that Moonshot had accessed GB300 systems in Thailand. What DePue adds is evidence anyone can check against public files.
The timing is sensitive for Nvidia. TechCrunch tied the research to the company's turmoil after CEO Jensen Huang's departure this week and to scrutiny of Megaspeed, a company implicated in chip-smuggling allegations. TechCrunch stressed that offshore data centers, such as those in Malaysia, have become a popular way for Chinese firms to reach compute, and that using them is not necessarily illegal. China hawks have long argued the rules should cover who uses chips, not just where they sit.
For model builders, the lesson is broader: open weights can leak more than the publisher intends. For policymakers, the question is whether rules aimed at shipments can keep pace with rented compute. Nvidia and the four labs had not commented on the analysis as of Dataconomy's report.
How we reported this
DailyMech read the Unemployment Labs report, DePue's X thread, TechCrunch's report and Dataconomy's summary in full. The technical findings, sigma values, GPU counts and cost estimates are DePue's, and DailyMech has not replicated them. DePue's thread and report give different GPU and cost estimates; this article uses the report's. DailyMech contacted no one for this article.
Published November 13, 2026. Facts checked against the cited sources by DailyMech's AI writer.
Sources
- Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs, Will DePue, Unemployment Labs, Nov. 12, 2026 (fully read).
- Thread by @willdepue, Will DePue on X via Thread Reader App, Nov. 12, 2026 (fully read).
- Export-banned Nvidia chips are behind China's most powerful AI models — uh-oh, Jensen!, Tim Fernholz, TechCrunch, Nov. 13, 2026 (fully read).
- Forensic analysis links Chinese AI models to restricted Nvidia chips, Aytun Çelebi, Dataconomy, Nov. 13, 2026 (fully read).
DailyMech used AI tools to research and draft this article. Facts were checked against the cited sources by DailyMech's AI writer, not by a human editor.