Will DePue at Unemployment Labs published a report on 12 November with a blunt title: Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs. It says six models released since April 2026 “contain numerical patterns matching Blackwell hardware”: DeepSeek-V4-Flash and V4-Pro, Kimi K3 and K3.1-Pro from Moonshot AI, MiniMax-M3, and Ant Group’s Ling-3.1-flash. Earlier models from the same four labs match Nvidia’s older Hopper generation.
US officials have made this accusation before, without showing their evidence. This report gets its evidence from the published weights alone and gives you the code to check it. I read the report, the PyTorch source it points to and the reproduction repository. My conclusion is that the fingerprint is about as solid as outside evidence gets, the report is careful about what the fingerprint can’t show, and the cluster-size estimates resting on it are much weaker than the headline makes them look.
A chip count written into the weights
Before training, every weight in a model needs a starting value. PyTorch fills those values with a pseudorandom generator called Philox, which always produces the same numbers from the same seed. On an Nvidia GPU the work is split across threads, and each thread produces its own stream of numbers. How many threads PyTorch launches depends on the chip.
The rule is in DistributionTemplates.h, in a function called calc_execution_policy. It caps the grid at the device’s multiProcessorCount times the number of blocks that fit on one streaming multiprocessor. That is a performance setting, meant to keep every core busy. One side effect is that, for a large tensor, the total thread count equals 2,048 times the number of SMs on the chip. The reproduction repository puts the consequence in one line: “Element i is written by thread i mod G where G = 2048 × SMs.”
Hopper parts (H100, H800, H200) have 132 SMs, which gives 270,336 threads. The B200 and B300 have 148, giving 303,104. The GB200 and GB300 have 152, giving 311,296. A given seed produces the same numbers on all three, but they land in different positions.
None of this would matter if training overwrote every starting value. It doesn’t. A token that never appears in the training data never gets a gradient, so its row in the embedding table keeps its starting values. The repository says that with the right seed and SM count, those rows come back “at r > 0.9999. Anything else gives about 0.” Trained weights keep a much weaker trace. On DeepSeek-V4-Flash’s trained layers the report finds a correlation of 0.066 under the Blackwell layout, which it scores at 57 sigma, and nothing under Hopper.
The part anyone can rerun
Unlike the earlier accusations from unnamed officials, this one comes with a rerun on real hardware. It used stock PyTorch, so none of the author’s own code generated the numbers.
DeepSeek reuses one seed, 953049583, across model generations. On an H100, unmodified PyTorch with that seed “reproduced all 57,344 preserved values in DeepSeek-V3 bit for bit.” On a B300 it reproduced 461 of 469 selected rows in V4-Flash with correlations above 0.99, 445 of them bit for bit. The other eight were partly changed by training. Swap the chips and neither reproduces the other model. On a rented GB200, Moonshot’s seed, 20256586, reproduced all 13 of Kimi K3’s preserved rows. Change either seed by one and nothing matches on any machine.
The repository’s own table adds MiniMax-M3: 17 of 17 rows on the B300 at seed 2760. Ling-3.1-flash only reaches a median correlation of 0.983, because Ant uses a truncated normal and the author’s model of that code path is approximate. That makes Ling the weakest of the five rerunnable cases, and the report says so.
The report is careful with the statistics. The search covered about six trillion seed-and-layout combinations, so a lucky match somewhere was expected. The report puts the best chance result at about 8 sigma, then picks the seed and layout on one set of weights and tests them on a held-out set. The strongest evidence per model runs from 49 to 1,385 sigma, and the weakest individual test still reaches 20. The method also matches all 24 cases where a developer has publicly named its hardware. Llama 3.1 reads as 132 SMs, eight Pythia models as 108 (A100), and Nvidia’s Nemotron-3 Ultra, whose report names the GB200 for one phase of training, reads as 152. The author is careful to call this “a consistency check rather than a measured accuracy rate,” since related models aren’t independent tests.
Most published work on model fingerprints asks a different question: is this network a copy of mine? A 2025 IEEE paper, for example, detects cloned networks from their output predictions, probability vectors and the power traces of the device running them (Aknesil et al., 2025). That is fingerprinting for intellectual property. This report uses the same idea for supply chains, where the identifying mark is the machine that made the weights rather than the weights’ owner.
A timeline the labs didn’t publish
Because DeepSeek reuses its seed and Moonshot derives its seeds by one rule, the report can follow each lab’s hardware from release to release. All four switch at a visible point.
The Hopper readings don’t clear anyone. A 132-SM fingerprint fits an H800, which was legal to export until October 2023, just as well as an H100 or H200. The report leaves those rows as “unresolved” and doesn’t treat them as findings. It also says not every lab has switched: the newest models it could read from Alibaba, Zhipu, Tencent, Xiaomi and StepFun all read as Hopper. One case it handles well is Kimi K2.7-Code, which mixes about 80% Hopper-layout values with 20% of a 148-SM draw. The author reads this as a merged checkpoint, not mixed hardware, and leaves it off the Blackwell list. I wrote in September about Kimi K3 turning up inside a San Francisco product. If this reading holds, the same model was started on chips that need a US license for China, and no such license has been reported.
What the fingerprint can’t say
The report sets its own limits, and I think they’re the right ones.
It identifies the hardware that created the starting weights, not the hardware that trained them. A lab could initialize on one machine and train on another. For Kimi K3, though, “at least 64 separately seeded processes each left the same 152-SM layout,” which makes a single stray Blackwell box an awkward explanation.
It says nothing about where the chips were. “Blackwell systems can be rented from data centers outside China,” the report notes, and it doesn’t claim smuggling or a legal violation.
One other chip can fake the pattern. An AMD MI300X normally runs 304 compute units, but it can be split into two groups of 152 or limited to 148, and its random-number library can produce the same sequences. The author tested this on a physical MI300X. For V4-Flash, the two vendors compute one step slightly differently, and in the 377 values where the results diverge, the published weights match Nvidia in 363 and AMD in none. That rules AMD out for V4-Flash only. For the other five, “the same test could not settle” it, and the report argues AMD is very unlikely rather than excluded. The MI300X is export-controlled too, so this alternative doesn’t help the labs much.
Hard fingerprint, soft cluster
The weak part of the report is Table 2, and I think it’s the part most likely to get quoted. From parameter counts and estimated token counts, the report estimates about 4,500 Blackwell GPUs for Kimi K3 and 3,000 for DeepSeek-V4-Pro. That comes to about 12,000 across five runs, and at roughly $70,000 per GPU, “more than half a billion dollars.”
Those estimates depend on four things the weights can’t show: how efficiently each lab used its GPUs, how many tokens it trained on, how long each run lasted, and whether training stayed on the chips that created the weights. The report admits this directly: “We are not confident in these estimates.” It also revised them on publication day. The first version said 2,000 to 3,000 GPUs for the largest runs and $150 million to $200 million for the largest cluster. A comparison with Microsoft’s disclosed run would push the two largest to about 8,000 to 9,000.
Estimating training compute from the outside is normal practice. Sevilla and colleagues curated the training compute of 123 milestone systems for their study of compute trends (Sevilla et al., 2022). I did a smaller version of it for Xiaomi’s $3M training claim. But an estimate made from published parameter counts is a different kind of number from a bit-for-bit reproduction, and the report puts both in the same executive summary. If you’re citing it, cite the fingerprint and hedge the cluster.
A detector that works once
On 23 February, Reuters reported a senior administration official saying DeepSeek’s next model had been trained on Blackwell, and that “the U.S. believes DeepSeek will remove the technical indicators that might reveal its use of American AI chips.” Two months later V4-Flash shipped with its fingerprint intact, in embedding rows that, according to the repository, nobody had touched since initialization.
The trace is also easy to avoid, and the report’s own null results show how. Several Qwen3 models were initialized on a CPU and carry no GPU layout. Baidu’s PaddlePaddle framework leaves no chip pattern. And DeepSeek-V4.1-Flash, the successor to the model with the 1,385-sigma reading, gave no signature “despite an exhaustive search.” The report doesn’t say why, and I won’t guess. Either way, now that the method is public, a model with no fingerprint tells you nothing. It works well on the back catalog and probably won’t work on the next release.
What I’d take from it
For the six models it names, this is the first public, checkable technical evidence of Blackwell access that I’ve seen, and the checking is cheap: the repository says its replay runs on a laptop in a few seconds. The claims I’d repeat are the narrow ones the report itself defends: these weights were created on 148- or 152-SM hardware, and for V4-Flash that hardware was Nvidia. I’d keep the GPU counts and dollar figures in quotation marks. And I’d treat this as a record of the past two years, not a tool for monitoring what comes next.
References
- DePue, W. (2026). Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs. Unemployment Labs, 12 November 2026 (revised the same day).
- DePue, W. (2026). checkpoint-forensics. GitHub repository, MIT licence, read 13 November 2026.
- PyTorch contributors. aten/src/ATen/native/cuda/DistributionTemplates.h,
calc_execution_policy. PyTorch main branch, read 13 November 2026. - Holland, S. and Alper, A. (2026). China’s DeepSeek trained AI model on Nvidia’s best chip despite US ban, official says. Reuters, 23 February 2026 (syndicated copy).
- Aknesil, C., Dubrova, E., Lindskog, N., Sternby, J. et al. (2025). Hybrid Fingerprinting for Effective Detection of Cloned Neural Networks. 2025 IEEE 55th International Symposium on Multiple-Valued Logic (ISMVL), June 2025.
- Sevilla, J., Heim, L., Ho, A., Besiroglu, T. et al. (2022). Compute Trends Across Three Eras of Machine Learning. 2022 International Joint Conference on Neural Networks (IJCNN), July 2022.