Blackwell fingerprints remain in the weights of six Chinese large models

A forensic report published on November 12, 2026, claims that the initialization weights of six Chinese large models carry NVIDIA Blackwell fingerprints. Blackwell is NVIDIA's current flagship AI chip; exports of B200, B300, GB200, and GB300 to China require U.S. licenses. The report says no approved records were found. The report's author, Will DePue, is from Unemployment Labs, and the tweet says the results have been independently reviewed by senior researchers at OpenAI and Anthropic. The evidence comes from model weights published by the companies themselves and does not rely on insider information or leaks.

How the fingerprints are left behind

Model weights are the billions of numbers that determine how a model processes information. Before training begins, these numbers must first be initialized. The report says PyTorch uses the Philox pseudorandom number generator on NVIDIA GPUs to produce the initial values. The seed determines which numbers are generated, and the number of SMs on the GPU determines how threads are allocated—and therefore where those numbers are placed in the weights.

Hopper H100 SXM, H200, and H800 have 132 SMs and use 270,336 threads. Blackwell B200/B300 have 148 SMs and use 303,104 threads. GB200/GB300 have 152 SMs and use 311,296 threads. After training, weights that were not updated retain their initial values, and weights that were changed by training may also leave weak traces.

Figure 1 uses a simplified example to show how a GPU fills weights. Real chips have more threads, but the placement rules are the same.

Figure 2 shows that when the same seed is moved to a different GPU, the number sequence stays the same but the positions change.

Figure 3 shows that both the seed and the thread layout must be correct to reproduce the original arrangement.

Figure 4 compares retained initial values. DeepSeek-V3 matches the Hopper layout, while DeepSeek-V4-Flash matches the Blackwell layout.

Figure 5 shows that trained weights still retain weak traces. Under the Blackwell layout, DeepSeek-V4-Flash weights with higher initial values also end up slightly higher.

Figure 6 compares candidate layouts. DeepSeek-V3 peaks at 132 SMs, V4-Flash at 148, and Kimi K3 at 152.

The six models and verification

The report lists the following six models:

The report says Kimi K3.1-Pro uses the same seed as K3 and may be continued post-training from a K3 checkpoint.

The verification section is more robust. The report's author reproduced DeepSeek-V4-Flash's retained initial values on a real B300 using unmodified PyTorch, with 445 of 461 rows matching bit for bit. H100 reproduced DeepSeek-V3, and GB200 reproduced Kimi K3. DeepSeek's seed is 953049583, and Moonshot's seed is 20256586. Changing the seed by 1 makes the match disappear.

Statistically, the report searched about 6 trillion seed and layout combinations. Under random conditions, the strongest false match was about 8 sigma. The evidence for the six models ranges from 49 to 1385 sigma, and even the weakest individual test is 20 sigma.

Cost and limits

The report estimates that the largest training runs, Kimi K3 and DeepSeek-V4-Pro, each used 2,000 to 3,000 Blackwell chips. A single cluster costs about $150 million to $200 million to procure. The five training runs total more than $500 million, and the labs' total spending on export-controlled GPUs could reach billions of dollars.

The limits are also stated clearly. A fingerprint can only show what type of hardware generated the initialization weights; it cannot prove that the entire training run used the same set of chips. Weights can be initialized on one system and then moved to another system for training. Mixed clusters weaken the inference. Fingerprints cannot determine where the chips are or who owns them, nor can they alone prove that export controls were violated.

AMD MI300X is the alternative explanation that the report seriously rules out. Under special configurations, it can produce a layout of 148 or 152. But at 377 numerically differing points in DeepSeek-V4-Flash, the public weights match NVIDIA 363 times and AMD 0 times. The other five models were not ruled out with this test, but the report still considers the AMD explanation extremely unlikely.

There are also blind spots. Closed-source models cannot be checked. Models initialized on CPU have no GPU fingerprint. Baidu ERNIE-5.5 uses PaddlePaddle; the report recovered seed 2760 but could not identify the hardware. Hopper fingerprints also cannot distinguish between H800, H100 SXM, and H200.

The report also shows that not all Chinese labs switched to Blackwell. New models from Alibaba Qwen, Zhipu GLM, Tencent, Xiaomi, and StepFun still read as Hopper. Meituan LongCat-2.0 says it was trained on an AI ASIC supercluster, and the report found no NVIDIA fingerprints in its weights.

Why it matters

Debates over export controls usually focus on logistics, customs declarations, and procurement records. Public weights provide another inspection point. Model companies publishing weights was originally an ecosystem strategy; now it has also become hardware forensic material. Closed-source models leave blind spots.

This report does not answer where the chips came from. It pushes the question to a more specific place: if these fingerprints hold, where did these Blackwell systems come from, who has access to them, and how should export controls be verified?

Source: Will DePue, Unemployment Labs, full report, original post.