1. A forensic report challenges the Nvidia Blackwell China ban
Six AI models from four leading Chinese labs, DeepSeek, Moonshot AI, MiniMax and Ant Group, show signs of having been initialized on Nvidia Blackwell chips, according to a forensic analysis published on November 12 by former OpenAI researcher Will DePue. The findings put fresh pressure on the Nvidia Blackwell China ban, since US export rules bar those chips from China.
DePue released the work through Unemployment Labs. He says the analysis relies solely on model weights that the companies themselves made public, and not on leaked material or accounts from people inside the labs.
The report stops short of alleging wrongdoing. It states plainly that its results are not a finding that any law was broken, and it lists several things its method cannot establish, including where the chips were located and who owned them.
2. Which Chinese AI models were flagged?
The six models named in the report are DeepSeek-V4-Flash and DeepSeek-V4-Pro from DeepSeek, Kimi K3 and Kimi K3.1-Pro from Moonshot AI, MiniMax-M3 from MiniMax, and Ling-3.1-flash from Ant Group.
According to the analysis, four of them match Nvidia's GB200 or GB300 Grace Blackwell systems, which pair Blackwell graphics processors with Nvidia's Grace central processors in large rack-scale configurations. Those four are DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash. The remaining two, DeepSeek-V4-Flash and MiniMax-M3, match standalone B200 or B300 chips.
Blackwell is Nvidia's most advanced generation of data center processors for training and running large AI models. Washington has restricted shipments of its top AI chips to China for several years on national security grounds, and Blackwell-class hardware falls under those controls.
3. Why the US restricts advanced AI chips
US export controls on AI processors rest on the view that computing power is a strategic resource. The most capable AI systems are trained on vast clusters of specialized chips, and the countries and companies with access to the best hardware can build more powerful models faster. Restricting that hardware is meant to slow rivals' progress in areas with potential military and intelligence uses.
Over successive rounds of rules, Washington has barred sales of Nvidia's leading data center chips to China and tightened the definitions of what counts as an advanced processor. Nvidia has, at times, designed reduced-capability versions of its products for the Chinese market to stay within those limits. Blackwell, as the company's flagship generation, sits on the restricted side of the line.
Enforcement has always been the hard part. Chips are small, valuable and sold through global supply chains, and computing capacity can be rented remotely. Determining after the fact which hardware trained a particular model has, until now, depended largely on disclosures, investigations or intelligence rather than on the models themselves.
4. How does the chip fingerprinting work?
The method looks at a model's starting point. Before training begins, the billions of numerical values that make up a neural network, known as weights, are filled in with random numbers. DePue's analysis rests on the observation that the exact layout of those initial values depends on the specific GPU hardware and the random seed used to generate them.
Training then adjusts most of those numbers, but DePue says traces of the original values survive into the finished, published model. By comparing what remains with what different hardware and seed combinations would have produced, the analysis tries to work backward to the machine that created the starting weights.
The underlying idea is that random number generation on a computer is not truly random. It follows deterministic procedures, and the way those procedures are spread across a processor's internal computing units can differ from one chip design to another. The same seed run on two different GPU architectures can therefore produce slightly different arrangements of numbers, leaving a signature tied to the hardware that generated them.
The search was extensive. DePue reports testing roughly six trillion combinations of seed and chip layout to find the configurations that best matched each model.
5. Why open weights made the analysis possible
The study depends on a choice the Chinese labs made themselves: releasing their models with open weights. Unlike closed systems that are accessed only through an online service, open-weight models are published in full, allowing anyone to download the numerical parameters and run or modify them.
That openness has been a defining strategy for several Chinese AI developers, helping their models spread quickly among researchers and businesses worldwide. It also means the internal makeup of those models is available for inspection. DePue's technique treats the published weights as a kind of physical evidence, examining them for patterns that reveal how they were first created.
The same approach cannot be applied to models whose weights are kept private, since there is nothing to examine. That limitation means the method speaks only to the subset of models that developers choose to release openly.
6. Testing the results on real hardware
To check the statistical matches, DePue ran the recovered settings on physical chips. Using the seed he had identified, a B300 regenerated the untouched starting values found in DeepSeek-V4-Flash. A rented GB200 reproduced all 13 preserved rows of values in Kimi K3.
He also tested whether the matches could be accidental. Shifting the seed by a single digit caused every match to disappear, which the report presents as evidence that the alignment is specific rather than coincidental.
The report quantifies the gap between chance and signal in standard deviations, a common statistical measure of how unusual a result is. The strongest match that could be produced by chance alone came in at about 8 standard deviations. The matches for the six flagged models ranged from 49 to 1,385 standard deviations, far beyond that baseline.
7. The cost of the training runs
DePue also estimated what the hardware behind these models would have cost. By his calculation, the five final training runs together involved more than $500 million worth of computing equipment.
That figure underlines why access to advanced chips is so central to the competition in artificial intelligence. Frontier models require thousands of high-end processors working together for extended periods, and the most capable hardware delivers more computing power per chip and per dollar of electricity. Export controls on Blackwell-class systems are intended to keep that advantage out of reach for Chinese developers.
The estimate also hints at the scale of the operations involved. Spending of that size points to organized, well-funded efforts rather than small experiments, which is part of why the findings have drawn attention beyond the research community. If the hardware link is borne out, the question of how such large volumes of restricted equipment were accessed becomes a matter for policymakers as much as for engineers.
8. What the report does not prove, and who has checked it
DePue is careful to define the limits of the technique. It identifies the hardware that generated a model's initial weights, not every chip that later took part in training. A lab could, in principle, create starting weights on one type of machine and carry out most of the training on another.
The analysis also cannot show where the chips were physically located, who owned them or how they were obtained. Blackwell systems can be rented through data centers outside China, and the report notes that possibility directly. Access to computing capacity abroad occupies a contested space in export control policy, since rules written around physical shipments do not always map neatly onto remote cloud access.
For those reasons, the report says its results do not amount to a finding that any law was broken. The evidence speaks to what kind of hardware was used, not to whether its use breached US rules.
On X, DePue said senior researchers at OpenAI and Anthropic had independently verified the result. The report itself, however, does not name any outside reviewers, so that verification rests on his public statement.
The work also arrives from a single author using a novel technique. Independent replication by other researchers, using the same public weights, would be the most direct way to test whether the conclusions hold. Because the method relies only on openly released models, others are in a position to attempt exactly that.
9. Washington's scrutiny of Chinese access to Nvidia chips
The report lands amid growing official attention on how Chinese AI developers obtain advanced American hardware. In July, White House science adviser Michael Kratsios said Moonshot had accessed GB300 systems in Thailand, in remarks tied to its Kimi K3 model.
On November 11, a day before the report appeared, Senators Elizabeth Warren and Chris Coons urged the Trump administration to preserve its records on Nvidia's export activity. Their request reflected congressional interest in how decisions on chip sales to China have been made and documented.
For Nvidia, questions about where its most advanced products end up have become a persistent political issue. The company sits at the center of the global AI buildout, and its chips have become a focal point of the technology rivalry between the United States and China.
10. What's next after the Blackwell findings
At the time the report was published, Nvidia, DeepSeek, Moonshot, MiniMax and Ant Group had not commented on its findings. Responses from any of those companies would be the most immediate development to watch.
DePue has said more results using the same method are on the way, which could extend the analysis to other models. Further scrutiny from lawmakers and regulators overseeing export controls is also likely, given the political attention already focused on Chinese access to Nvidia's most powerful hardware.