News · 2026-11-13

A forensic report says six Chinese frontier models started life on export-controlled Blackwell GPUs

A report published November 12, 2026 by Will DePue of Unemployment Labs says the initial random weights of six Chinese frontier models carry the layout of Nvidia Blackwell GPUs, which are export-controlled for China. The six are DeepSeek-V4-Flash, DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro, MiniMax-M3 and Ant Group's Ling-3.1-flash. The report is one author's work with published code and no independent replication, and by its own wording the fingerprint "supports, without proving, the inference that Blackwell also performed the training."

Key facts

• Who and when: Will DePue, Unemployment Labs, November 12, 2026; the full report was revised the same day, raising its GPU-count estimates.
• Strength: the six Blackwell matches run from 49 to 1,385 standard deviations in the report's strongest tests; the chance of a false match across its search is about 8 sigma.
• Code: a GitHub repo was created November 13 with 7 stars.
• Status: no response from DeepSeek, Moonshot, MiniMax, Ant Group or the Commerce Department had been found.

The trick: random numbers remember the chip

Every neural network starts as random numbers. PyTorch generates them with a counter-based generator called Philox, via Nvidia's cuRAND library, and splits the job across thousands of GPU threads, 2,048 per streaming multiprocessor (SM) on large jobs. The number of SMs therefore decides how many threads there are, and the thread count decides which position in the weight matrix each random number lands in. A Hopper H100, H200 or H800 has 132 SMs and 270,336 threads. A B200 or B300 has 148 SMs and 303,104 threads. A GB200 or GB300 has 152 SMs and 311,296 threads.

The same seed on a different chip yields the same numbers in different places. In the report's toy example only 6% of positions line up. So a match needs both the right seed and the right layout, and finding that pair in a published checkpoint is a fingerprint, much like matching a typewriter to a page. (Our lesson on counter-based random numbers explains the mechanism.)

Where the trace survives

Training overwrites weights, but not all of them. Rows that were never updated, such as embeddings for tokens never seen in training, keep their starting values, often bit for bit. Trained weights keep a faint trace: in DeepSeek-V4-Flash the correlation between starting and final values is 0.066, about 57 sigma, under the Blackwell layout and gone under the Hopper layout. The authors pick the seed and layout on one set of weights and test on held-out weights.

What it found

DeepSeek-V4-Flash reads as 148 SMs (B200 or B300) with an exact copy of the untouched values. DeepSeek-V4-Pro, Kimi K3 and Kimi K3.1-Pro, and Ling-3.1-flash read as 152 SMs; MiniMax-M3 reads as 148. Earlier models from the same labs read as Hopper, and the newest readable models from Alibaba's Qwen, Zhipu's GLM, Tencent, Xiaomi and StepFun all read Hopper too, so this is not a universal switch. Some models show no fingerprint at all: DeepSeek-V4.1-Flash, Baidu's ERNIE-5.5 and Meituan's LongCat-2.0, which the company says was trained entirely on AI ASIC superpods.

The report confirmed the method on real chips. DeepSeek's seed, 953049583, reproduced 57,344 preserved DeepSeek-V3 values bit for bit on an H100, but not V4-Flash. A B300 reproduced 461 of 469 selected V4-Flash rows with correlations above 0.99. A rented GB200 reproduced all 13 preserved Kimi K3 rows with Moonshot's seed, 20256586, while changing the seed by one reproduced none. In a known-answer check, the method agreed with 24 of 24 cases where developers had disclosed their hardware, though the report calls that a consistency check rather than an accuracy rate.

The report's own caveats

The fingerprint shows where weights were initialized, not where training ran, and it says nothing about ownership or location. Blackwell chips can be rented outside China. The report says "U.S. officials and press reports had already alleged that DeepSeek and Moonshot AI were using Blackwell chips, without publishing technical evidence," and positions itself as technical evidence, not a legal finding. Its scale estimates, about 12,000 Blackwell GPUs across five runs and roughly $500 million, rest on assumed utilization of about 20% and assumed run lengths, and were revised upward the day of publication. AMD hardware is the only alternative the report identified; on a physical MI300X, V4-Flash matched Nvidia in 363 of 377 differing values and AMD in none, but the test could not settle the other five models.

Reception

The Hacker News thread drew about 300 points. Skeptics noted that "initialized on Blackwell" is not "trained on Blackwell," that one rented card would suffice, and that the author's affiliation and stance, described by commenters as a former OpenAI staffer and China hawk, are unverified. Supporters noted the method is cheap to check without a GPU. A strong counter-take: a lab could initialize on a few rented cards and train elsewhere, and a lab that changes its seed could defeat the method going forward.

What it means

If the method holds up, checkpoint forensics gives export-control debates a new kind of evidence: public files that anyone can test. The next steps are independent replication and any response from the labs or Commerce. Related background: model fingerprinting and weight initialization.

Primary source, verified: read the paper →

Ground Truth. (2026, November 13). A forensic report says six Chinese frontier models started life on export-controlled Blackwell GPUs. Ground Truth. https://groundtruth.day/news/report-says-six-chinese-frontier-models-were-initialized-on-blackwell-gpus.html

@misc{groundtruth:report-says-six-chinese-frontier-models-were-initialized-on-blackwell-gpus,
  title  = {A forensic report says six Chinese frontier models started life on export-controlled Blackwell GPUs},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {nov},
  url    = {https://groundtruth.day/news/report-says-six-chinese-frontier-models-were-initialized-on-blackwell-gpus.html}
}

Topics: export-controls · forensics · nvidia · deepseek · moonshot · model-provenance · cybersecurity · ai-security