Chinese AI models show fingerprints of restricted Nvidia Blackwell chips

Image- Collected

A forensic report has found that six open-weight AI models developed by four major Chinese technology companies carry numerical patterns matching Nvidia's Blackwell GPUs, which are prohibited from export to China under US regulations.

Published on November 12 by Unemployment Labs, the analysis was conducted by former OpenAI researcher Will DePue. It identified the fingerprints in DeepSeek-V4-Flash and DeepSeek-V4-Pro, Moonshot AI's Kimi K3 and Kimi K3.1-Pro, MiniMax-M3, and Ant Group's Ling-3.1-flash. Earlier models from the same developers were found to match Nvidia's previous-generation Hopper chips.

The researchers stressed that the findings do not conclusively establish that Blackwell GPUs were used to train the models. Instead, they indicate how the models' initial weights were generated and support the possibility that the same hardware was used during training.

DePue said on X that senior researchers from OpenAI and Anthropic had independently examined the findings. However, the report does not identify those reviewers, and the analysis has not undergone peer review.

How the detection method works

The technique examines patterns embedded in a model's initial weights. According to DePue, these patterns depend on the GPU configuration and random seed used to generate them, and can remain detectable in the final published model.

The researchers examined approximately six trillion possible combinations of random seeds and chip configurations. They said the strongest accidental match would produce a statistical score of around 8 sigma, whereas the six models recorded scores ranging from 49 to 1,385 sigma.

The team also tested the results using physical hardware. A B300 GPU running standard PyTorch with DeepSeek's recovered seed reproduced 445 rows of V4-Flash exactly. Meanwhile, a rented GB200 system reproduced all 13 preserved rows of Kimi K3. Changing either random seed by just one eliminated the matches.

Although the researchers acknowledged that a specially configured AMD MI300X could theoretically produce similar patterns, they considered that possibility highly unlikely. They also said their method correctly matched all 24 cases in which developers had publicly disclosed the hardware used.

Findings and limitations

The report found that the latest readable models from Alibaba, Zhipu AI, Tencent, Xiaomi and StepFun still carried Hopper-generation fingerprints.

It estimated that the final training runs for each of the six models involved thousands of Blackwell GPUs, with the combined clusters costing more than $500 million. However, the researchers described these figures as rough estimates.

The analysis does not establish where the GPUs were located, who owned them or how the Chinese AI developers obtained access. Since Blackwell systems can be rented outside China, the report explicitly states that its findings do not establish that any laws were violated.

The findings come amid growing scrutiny over Chinese AI companies' access to advanced Nvidia hardware. In July, White House science adviser Michael Kratsios said Moonshot AI had “accessed GB300s in Thailand.”

Nvidia and the four Chinese AI companies had not commented on the report by the time it was published.