Analysis Ties Six Chinese AI Models to NVIDIA Blackwell Chips

Six open-weight Chinese AI models carry initialization fingerprints consistent with NVIDIA's export-controlled Blackwell GPUs, according to an Unemployment Labs analysis by Will DePue published November 12, 2026. The findings cover models from DeepSeek, Moonshot AI, MiniMax and Ant Group — chips whose export to China requires a U.S. license, and no such licenses have been reported. The evidence establishes hardware traces, not violations.

Which models matched which chips?

The analysis associates DeepSeek-V4-Flash and MiniMax-M3 with B200 or B300 chips. It links DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash to GB200 or GB300 chips. The matches identify only the hardware layout behind the starting weights; whether those chips performed training is a separate inference.

Successive releases place the changes in time. DeepSeek-V3 produced a Hopper reading in December 2024, before two Blackwell-reading V4 models appeared in April 2026. Moonshot AI's Kimi K2.5 read as Hopper in January 2026, then K3 in July 2026. MiniMax-M2.7 and M3 followed the same arc in April and June 2026. Ant Group's Ling-3.0-flash and Ling-3.1-flash did so in August and October 2026.

The pattern was not universal. The newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun produced Hopper, not Blackwell, readings.

How do weights reveal a chip?

The technique starts with the numerical parameters that training adjusts. In the PyTorch/cuRAND setup examined, the Philox generator produces repeatable values from a seed before training begins. GPU threads distribute those values across weight positions, and a large initialization uses 2,048 threads per streaming multiprocessor (SM). Change the SM count and the same numbers land in different places.

The tested chip groups split cleanly:

• Hopper H100 SXM, H200 and H800: 132 SMs, 270,336 threads
• B200 and B300: 148 SMs, 303,104 threads
• GB200 and GB300: 152 SMs, 311,296 threads

A reading identifies one group, not a specific chip. Weights reserved for words absent from training can preserve their initial values almost exactly. The investigators select a seed and layout on one weight set, then test that unchanged combination on a separate set excluded from the search.

Under the report's statistical model, roughly 6 trillion seed-and-layout combinations would produce a strongest chance match of about 8 sigma. The identified models range from 49 to 1,385 sigma, and every individual test reaches at least 20 sigma.

What did the physical checks show?

DePue reproduced the readings on real chips. An H100 running DeepSeek's recovered seed reproduced DeepSeek-V3's preserved values but not V4-Flash's; a B300 did the reverse. On the B300, unmodified PyTorch reproduced 461 of 469 selected V4-Flash rows with correlations above 0.99, including 445 bit-for-bit matches. A rented GB200 reproduced all 13 preserved Kimi K3 rows with Moonshot's seed; shifting either seed by one produced no matching rows.

The method agreed with all 24 cases where a developer publicly named a model's hardware. The report cautions that 11 involve step-zero checkpoints and related models are not independent, making this a consistency check rather than a measured accuracy rate.

Kimi K3.1-Pro uses K3's seed and may be a K3 checkpoint with further post-training. Assuming the initializing hardware also trained the models, DePue estimates five distinct final runs at roughly 500 to 3,000 Blackwell GPUs each, over two to three months. The calculation divides training compute by chip throughput at 35% utilization, using DeepSeek's disclosed token counts and weight-based estimates elsewhere. The same arithmetic on DeepSeek-V3 yields 2,000 to 2,500 chips, versus DeepSeek's disclosed 2,048.

What can this not prove?

Plenty. A match concerns initialization alone and cannot inventory every processor used during training. A lab could initialize on one system and transfer the values; mixed clusters could leave partial traces; a Hopper result does not exclude later Blackwell training. Weights cannot establish chip ownership, location or acquisition. The report notes Blackwell systems can be rented outside China and says this evidence alone establishes neither smuggling nor an export-control violation.

AMD's MI300X is the identified alternative: it normally uses 304 processing units but can be split into two groups of 152 or configured to use 148, reproducing the layouts in physical tests. For DeepSeek-V4-Flash, 363 of 377 preserved values that differ between vendors matched NVIDIA and none matched AMD. That test did not settle the other five models, though the report deems a specially configured AMD cluster very unlikely. The MI300X is itself controlled, and the method requires public weights; CPU initialization leaves no GPU layout, and Baidu's PaddlePaddle generator carries no examined chip layout.

The takeaway for policymakers: public weights can now expose hardware access, but any enforcement conclusion would still require evidence on where the hardware ran, who owned it and how access was obtained.