Imagine opening a file anyone on Earth can download, and finding a fingerprint inside it. Not a smudge on the cover, but a pattern buried in the numbers themselves — a pattern that names the exact machine the file was born on. In this case, the machine it names is an Nvidia Blackwell chip.
That is what Will DePue says he has done. DePue, a former OpenAI researcher who now runs a small independent group called Unemployment Labs, published a report on November 12, 2026, claiming that six of China’s leading AI models were started on Nvidia Blackwell chips.
Blackwell is Nvidia’s most advanced data-centre chip family. Under US export rules, the B200, B300, GB200 and GB300 all need a licence before they can be sold to China. According to the report, no such licence has been reported for any of them.
The claim lands in the middle of a storm. Nvidia’s export-control troubles have already cost its chief executive his job and triggered a congressional investigation. Now the evidence, if it holds up, is hiding in plain sight — inside the models themselves.
Six Models, Four Labs, One Pattern
The six models named in the report are DeepSeek-V4-Flash and DeepSeek-V4-Pro from DeepSeek, Kimi K3 and Kimi K3.1-Pro from Moonshot AI, MiniMax-M3 from MiniMax, and Ling-3.1-flash from Ant Group.
All of them are open-weight models, which means their files are published for anyone to download and inspect — and that openness is exactly what made the detective work possible.
The older models from the same labs tell a different story. DeepSeek-V3, Kimi K2 and K2.5, MiniMax-M2.7 and Ant’s Ling-3.0-flash all match Nvidia’s previous chip generation, Hopper. The switch to Blackwell appears to have happened between April and November 2026, when the newer weights were posted.
Not every Chinese lab made the jump. The report found the latest models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun still reading as Hopper. The Blackwell pattern belongs to four labs only.
How a Chip Leaves a Fingerprint in a Model
Every AI model is a vast list of numbers called weights. Before training begins, each weight is filled with a random-looking starting value. In PyTorch, the software most labs use, those values come from a generator called Philox, started from a single number known as the seed.
The same seed always produces the same numbers. That is what lets engineers repeat an experiment. But the chip changes where those numbers land.
To fill billions of weights quickly, an Nvidia chip splits the work across 2,048 workers for each of its processing cores, which Nvidia calls streaming multiprocessors. A Hopper H100 has 132 cores and runs 270,336 workers; a Blackwell B200 has 148 and runs 303,104; a GB200 has 152 and runs 311,296.
Each worker draws its own stream of numbers from the seed and writes them into positions spaced apart by the total number of workers. A chip with more cores has more workers, so the same numbers land in different places.
A seed alone cannot reproduce a model’s starting weights. The seed and the chip’s core count have to be right together.
Training changes almost every weight. But each word or symbol a model knows — a token — has its own row of weights, and some tokens never appear in the training data. Their rows are never adjusted, so they still hold their starting values when the model is published.
DePue searched about six trillion combinations of seed and chip layout to find which one recreates those untouched rows. He says only one combination fits each model, and it points to a chip family.
The Numbers Behind the Nvidia Blackwell Match
The matches are not close calls. DePue’s report puts them at between 49 and 1,385 standard deviations above chance. A chance match, the report calculates, should reach only about eight.
Then came the counter-test on real hardware. Running unmodified PyTorch with the recovered seed, a Blackwell B300 regenerated 461 of the 469 tested rows of DeepSeek-V4-Flash — 445 of them bit for bit. An H100 reproduced none of them.
Changing the seed by one broke the match entirely. A rented GB200 did the same for Kimi K3, reproducing its starting values to a correlation of 0.999995. DeepSeek-V4-Pro and Kimi K3.1-Pro are not in the public code, so their results rest on the report alone.
The method was checked against models whose hardware is already known. DePue says it matched the stated hardware for all 24 open-weight models whose developers have disclosed their chips, including Meta’s Llama 3.1.
And the check is public. DePue published the code, and the research outlet Transclew re-ran it on November 14 with weights downloaded fresh from Hugging Face. For the four Blackwell models the code covers, it gave the same answer, in a few seconds on an ordinary computer.
What the Fingerprint Does Not Prove
The report is careful about its own limits, and they matter. First, there is a gap in the chain from core count to chip name. AMD’s MI300X AI chip, which is also export-controlled, can be configured to use 148 or 152 of its 304 cores, producing the same layouts.
DePue says tiny rounding differences between the two manufacturers rule AMD out for DeepSeek-V4-Flash, and he considers AMD very unlikely for the other five. But the step from “152 cores” to “Blackwell” remains the report’s own reasoning, not a direct observation.
Second, the method sees only the hardware that created the starting weights. A lab could create those weights on one machine and train on another — DePue writes that the pattern “strongly suggests” the same chips did the training, but the weights “support, but do not by themselves prove” it.
Most important, the weights carry no address. The report states plainly that its findings “do not establish where the chips were located, how access was obtained, or whether export controls were violated”.
Blackwell systems can be rented in data centres outside China, so access to the chips is not proof that any were smuggled into the country.
Chinese companies can, under current law, rent Blackwell hardware at data centres outside China. That rental route is the loophole the rules leave open, and it is the first explanation any of the labs would reach for.
Why It Matters for the Export-Control Fight
Even with those limits, the report is the first forensic, weight-based evidence that the chip regime is being sidestepped at the frontier. US officials and press reports had already alleged that DeepSeek and Moonshot used Blackwell chips, but without publishing technical evidence.
The timing could hardly be worse for Nvidia. The company is already at the centre of a sprawling scandal over chips reaching China through other routes.
Reuters reported that a blacklisted Chinese university bought Nvidia H200 chips through an intermediary, and Malaysia is probing whether billions of dollars of Nvidia hardware was re-exported through a company called Megaspeed.
The fallout has been personal. Jensen Huang resigned as Nvidia’s chief executive on November 12 after 33 years, and he has agreed to testify before Congress on December 1. More than $1 trillion has been wiped from Nvidia’s value since early November.
The rules are not new. A US Commerce Department note dated May 31, 2026, reminds readers that since November 17, 2023, supplying this class of chip to a company whose parent is Chinese requires a licence, even when it operates outside China.
No licence has been reported for these models, the report notes. DePue also puts a scale on the effort: Kimi K3 and DeepSeek-V4-Pro each drew on roughly 2,000 to 3,000 Blackwell GPUs at their peak, and the five final training runs cost more than $500 million combined.
Those are researcher estimates, with no procurement records behind them. His separate estimate of about 12,000 Blackwell chips in total comes with his own warning that he is “not confident” in it.
What Happens Next
Neither DeepSeek, Moonshot, MiniMax, Ant Group nor Nvidia had responded publicly to the report by November 14. DePue wrote on X that senior researchers, including some at OpenAI and Anthropic, had confirmed his results, but neither company has spoken publicly and the report does not name them.
The method has one more quirk: it found no trace at all in a later DeepSeek model, V4.1-Flash, even after a full search, and the report does not say why. Several of Alibaba’s Qwen3 models were started on ordinary processors, which leave no chip trace.
And now that the method is public, any lab can start its next model’s weights on an ordinary processor and leave nothing to find. The fingerprint that exposed six models may never catch a seventh.
Whether Washington acts on the findings is another question. The report proves a pattern in the numbers, not a crime. But it hands regulators something they did not have before: evidence they can run on a laptop, in seconds, from files the labs themselves published.
According to Transclew, which independently re-ran the code, the answer comes back the same every time.
