Six leading open-weight AI models from Chinese companies — including Moonshot AI’s Kimi K3 and DeepSeek’s V4 models — were initialized on Nvidia Blackwell chips that the US bans from export to China, according to a forensic analysis of the models’ publicly released weights published on November 12. The researcher behind it is explicit about the limit of the finding: it is evidence of access to the restricted hardware, not proof that export controls were violated.
November 13, 2026
How the fingerprint works
The analysis comes from Will DePue, a former OpenAI researcher who now publishes forensic hardware analyses through the nonprofit Unemployment Labs. Before training begins, a model’s weights are set to starting values whose arrangement depends on the layout of the GPU’s processors and a random seed. DePue’s claim is that traces of that starting arrangement can survive training and remain detectable in the released weights — a fingerprinting technique, not a direct log of hardware use. The work was built entirely from publicly released model weights, with no leaks or insider accounts.
According to the report’s own account, DePue tested more than 6 trillion pairings of chip layout and seed. Its controls argue against coincidence: Nvidia’s H100 and AMD’s MI300X matched none of the rows tested, changing the recovered seed by a single digit eliminated every match, and the observed matches ran from 49 to 1,385 standard deviations against roughly 8 expected by chance — all figures from the report itself, not independently verified.
What was found
Six models from four companies — DeepSeek, Moonshot AI, MiniMax and Ant Group — carried Blackwell fingerprints. Four matched GB200 or GB300 systems from Nvidia’s Grace Blackwell line, and two matched B200 or B300 chips. DePue further estimates that the largest training runs, for Kimi K3 and DeepSeek-V4-Pro, each used roughly 2,000 to 3,000 Blackwell GPUs in clusters costing an estimated $150 million to $200 million, with five final runs together costing more than $500 million. Those are his estimates, not procurement records, and they move a lot with assumptions about timing and efficiency.
What the finding does not show
The report states its own boundary plainly: the findings provide technical evidence of access to advanced computing hardware, but do not establish where the chips were located, how access was obtained, or whether export controls were violated. Blackwell systems rented at data centers outside China — in Malaysia or Thailand, for example — are one possible route, and the models need not have been trained entirely on Nvidia chips. The method also has blind spots: several Alibaba Qwen3 models were initialized on ordinary processors and leave no GPU fingerprint, and at least one DeepSeek variant’s architecture hid its footprint despite an exhaustive search. Nvidia, DeepSeek, Moonshot, MiniMax and Ant Group had not responded publicly as of the report’s publication.
Why it matters
If the fingerprints hold up, they are the first public technical evidence tying specific Chinese frontier models to the exact hardware US controls are meant to keep from them — arriving the same week Reuters documented $3.2 billion of Chinese AI projects designed around restricted Nvidia chips, and in a period when Nvidia’s own export compliance is under intense scrutiny. The policy fight it feeds is a real one: whether controls should govern only who buys chips and where they are installed, or also who gets to use them, wherever they sit. For readers, the disciplined take is the researcher’s own: access looks demonstrated, violation does not — and anyone claiming more than that is ahead of the evidence. Everything AI, tested.
Frequently asked questions
Does this prove Chinese companies broke US export law?
No. The report itself says the fingerprints show access to Blackwell hardware, not where the chips were, how access was obtained, or whether any control was violated. Renting Blackwell systems at data centers outside China is one possible explanation.
Which models were named?
Six open-weight models from DeepSeek, Moonshot AI, MiniMax and Ant Group. TechCrunch’s coverage highlights Moonshot’s Kimi K3 releases and DeepSeek’s V4 models among the most closely watched matches.
How reliable is the fingerprint method?
It is a single research group’s new technique, reported here with its own controls: over 6 trillion layout-and-seed pairings tested, no matches for H100 or AMD MI300X hardware, and matches that disappear when the recovered seed is altered by one digit. It has not, at publication, been independently replicated, and some models leave no fingerprint at all.
Sources: TechCrunch, The Outpost (via Dataconomy and Wccftech), Unemployment Labs analysis published November 12, 2026