Six Chinese AI models carry the fingerprint of Nvidia Blackwell chips, according to a report published on November 12, 2026. The United States bars these Nvidia AI chips from export to China without a license. Will DePue, a former OpenAI researcher according to his X profile, published the report under the name Unemployment Labs. The six models come from four Chinese companies: DeepSeek-V4-Flash and DeepSeek-V4-Pro from DeepSeek, Kimi K3 and Kimi K3.1-Pro from Moonshot AI, MiniMax-M3 from MiniMax and Ling-3.1-flash from Ant Group.
All six are open-weight models: their makers publish the weights, the billions of numbers that make up a model. The report’s evidence comes only from those files, which companies also download to run the models on their own servers. DeepSeek-V4-Flash, free for commercial use under the MIT license, was downloaded more than a million times over the past month, according to Hugging Face, the main site for sharing AI models.
The report says the fingerprint points to the chip that generated each model’s starting weights, before training began. That supports the idea of training on Blackwell without proving it. The report does not establish where the chips were, how the labs got access to them, or whether export rules were broken.
A fingerprint left before training
Before training starts, every weight in a model gets a starting value, which training then adjusts. In the software studied, these values come from a number generator called Philox. Its output looks random, but the same starting number, called the “seed,” always produces the same sequence.
PyTorch, the software used to build most large models, splits this work into hundreds of thousands of threads, small tasks the graphics card runs in parallel. On the Nvidia chips studied, each processing unit, called a streaming multiprocessor or SM, runs 2,048 threads. With the same seed, a chip with more units therefore puts the same numbers in different places.
Hopper chips (H100 SXM, H200 and H800), the Nvidia generation before Blackwell, have 132 units. Blackwell chips have 148 units in the B200 and B300 and 152 in the GB200 and GB300.
Training leaves some weights untouched, such as those reserved for words or symbols the model never sees. These preserved weights keep their starting values, and with them the chip’s pattern. DePue says he tested about 6 trillion combinations of seeds and chip layouts to find the one that reproduces those values.
DeepSeek and Kimi starting weights reproduced on Blackwell chips
DePue ran unmodified PyTorch on two machines. Using DeepSeek’s seed, 953049583, a Blackwell B300 chip reproduced 461 of the 469 selected rows of weights in DeepSeek-V4-Flash, 445 of them exactly, bit for bit. A Hopper H100 reproduced none.
The test also worked in reverse: for DeepSeek-V3, the company’s earlier model, the H100 reproduced all 57,344 preserved values and the B300 reproduced none. With a seed off by one, no row matched at all.
On a rented GB200 chip, Moonshot’s seed reproduced all 13 preserved rows of Kimi K3.
The method also matches all 24 cases where a developer has disclosed a model’s hardware, which the report calls a consistency check. Nvidia’s own Nemotron-3 Ultra, which Nvidia says was trained on GB200 chips for one phase, reads as a 152-unit chip, like Kimi K3.
To measure the odds of a coincidence, the report uses sigma, a statistical gauge of how far a result stands above random noise. In a search this large, chance alone would produce a best match of about 8 sigma. The six models’ strongest results range from 49 to 1,385 sigma, and the weakest single test reported reaches 20 sigma.
Four labs moved from Hopper to Blackwell
DeepSeek’s models carry a Hopper fingerprint up to DeepSeek-V3, released in December 2024, and a Blackwell fingerprint from V4, released in April 2026.
Moonshot moved from Hopper with Kimi K2.5, in January 2026, to Blackwell with Kimi K3, in July. MiniMax made the same switch between M2.7, in April, and M3, in June. Ant Group made it between Ling-3.0-flash, in August, and Ling-3.1-flash, in October.
According to the report’s appendix, MiniMax M3.1 Flash, which MiniMax launched in October at half the price of M3, carries the same Blackwell fingerprint. It starts from the same initial weights as M3, though the report did not test it separately.
Not every Chinese lab has changed hardware. Among models the method can read, the newest from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi and StepFun all carry a Hopper fingerprint. That includes Zhipu’s GLM-5.3, the model the digital bank Revolut says it runs on its own servers instead of Claude Code, Anthropic’s coding tool.
Meituan, the Chinese food-delivery group, says it trained its LongCat-2.0 model on specialized chips, and the report finds no Nvidia fingerprint in it. In Europe, French company Mistral AI’s Mixtral-8x7B model also carries a Hopper fingerprint.
DePue estimates that each training run would have needed 500 to 3,000 Blackwell chips for two to three months. That assumes each model was trained on the hardware that set its starting weights. At about $70,000 per chip, a price based on a Wall Street Journal report, the largest chip clusters would cost $150 million to $200 million.
Together, the five runs would cost more than half a billion dollars. Kimi K3.1-Pro, which starts from the same seed as K3, gets no separate estimate.
Earlier accusations came without technical evidence
On February 23, 2026, a senior Trump administration official told Reuters that DeepSeek’s next model had been trained on Blackwell chips. The official said the chips were probably clustered at DeepSeek’s data center in Inner Mongolia, a region of northern China. The official also said Washington expected DeepSeek to remove technical signs that it had used American chips.
Nvidia declined to comment. DeepSeek did not respond to Reuters, but it has denied the accusations, according to the technology news site Startup Fortune.
In July 2026, the White House accused Moonshot of using Blackwell chips through a facility in Thailand. On November 5, CNBC reported, citing four sources, that Moonshot had also tried to rent capacity in Europe from GPU cloud providers. These companies rent out AI chips in their data centers. One of the sources mentioned talks about clusters of 8,000 or more Blackwell chips.
Current export controls largely do not cover remote access to chips outside China, CNBC notes. A bill to close that gap, the Remote Access Security Act, passed the House of Representatives in January but not the Senate.
DeepSeek itself has published measurements taken on Blackwell chips, without saying where the chips were. Its DeepInfer inference engine, the software that runs its finished models, supports those chips and Huawei’s Ascend 950 AI chip. Released on GitHub, the main code-sharing site, on October 16, 2026, it powers DeepSeek’s production services, the company says. The measurements cover running the models; DePue’s report covers how the models were created.
The limits the report acknowledges
The report says the fingerprint “supports, without proving” the idea that training ran on the chip that generated the starting weights. A lab can generate weights on one system and train them on another. Blackwell systems can be rented in data centers outside China, the report notes.
A Hopper reading also cannot tell an H800, a chip that could be sold legally in China until October 2023, from an H100 or an H200.
The report found only one other chip that can mimic the Blackwell pattern: AMD’s MI300X, set up to use only 148 or 152 of its processing units. The MI300X also requires a US export license for China.
For DeepSeek-V4-Flash, the report rules out the AMD chip through a small difference in how Nvidia and AMD chips calculate. Of 377 values where the two differ, 363 match Nvidia and none match AMD. For the other five models, the report calls an AMD origin very unlikely but cannot exclude it.
The report’s conclusions are more cautious than DePue’s post announcing it on X. The report calls the evidence “conclusive” only for the starting weights of DeepSeek-V4-Flash. The post extends that verdict to all six models and says senior researchers at OpenAI and Anthropic verified the results.
Startup Fortune points out that the report names no reviewer and offers its scripts to reviewers on request. The site said it found no response from DeepSeek, Moonshot, MiniMax, Ant Group or Nvidia.
What it means
Washington and the press had accused DeepSeek and Moonshot without publishing technical evidence that they used American chips. DePue’s report publishes some. The method needs public weights and can say nothing about closed models, whose weights stay private.
In February, the official quoted by Reuters said Washington expected DeepSeek to remove such signs. In DeepSeek-V4-Flash, the report found them in weights that training never changed, inside files DeepSeek published.
For companies that run DeepSeek, Kimi or MiniMax models on their own machines, the report flags no defect in the models themselves. It concerns the hardware used to create them. The issue is mainly one of policy: US export rules and chip rental in data centers, including in Europe.
Independent teams have yet to reproduce the method, and the report’s scripts, available on request, make that possible. The four labs and Nvidia have not yet responded publicly to the report.
The US Senate has yet to act on the remote-access bill. DePue says he has more results drawn from these models’ weights.
Sources
- Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs, Will DePue, Unemployment Labs, November 12, 2026
- Will DePue’s post announcing the report, X, November 12, 2026
- Breaking News as Researcher Says Six Chinese AI Models Carry the Fingerprint of Banned Nvidia Chips, Startup Fortune, November 13, 2026
- China’s DeepSeek trained AI model on Nvidia’s best chip despite US ban, official says, Reuters (via Zawya), February 23, 2026
- Chinese AI lab Moonshot turned to Europe for Nvidia Blackwell access amid U.S. China curbs, sources tell CNBC, CNBC, November 5, 2026
- DeepInfer: High-performance, large-scale inference framework for DeepSeek models, DeepSeek, GitHub, October 16, 2026
- deepseek-ai/DeepSeek-V4-Flash, Hugging Face, accessed November 13, 2026
Header image: MACCUS chart, data from Will DePue, Unemployment Labs, November 12, 2026
