Forensic Report Says Six Chinese Models Carry Blackwell Chip Fingerprints

What happened

Will DePue published the report, titled 'Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs,' on Nov 12 under his nonprofit Unemployment Labs. DePue worked on Sora and GPT-5 at OpenAI before leaving this year to found the lab. The report says six Chinese models released since April 2026 carry a Blackwell fingerprint: DeepSeek-V4-Flash and V4-Pro, Moonshot's Kimi K3 and K3.1-Pro, MiniMax-M3 and Ant Group's Ling-3.1-flash; the appendix says MiniMax's M3.1 Flash, launched in October, carries the same fingerprint.

The method is weight forensics: before training begins, starting weights are drawn by the Philox pseudorandom algorithm through Nvidia's cuRAND library across parallel GPU threads, and each combination of chip layout and seed leaves a unique pattern. DePue said he compared more than six trillion chip-layout and seed combinations, reproduced all 13 preserved rows of Kimi K3's weights on a rented GB200, and that changing either seed by one broke the match; the code is public. The method agreed with all 24 models whose makers have disclosed their training hardware, including Nvidia's own Nemotron-3 Ultra.

The report also states its limits: the fingerprint only identifies the hardware that generated the starting weights, and does not establish where the chips were, how the labs obtained access, or whether export rules were broken; Blackwell systems can be rented from data centers outside China. The report calls the evidence 'conclusive' only for DeepSeek-V4-Flash's starting weights, with more cautious wording for the other models. DePue estimated the five Blackwell runs together needed about 12,000 chips, while saying he is not confident in that figure because it rests on undisclosed run lengths and efficiency.

Key facts

1. Report: Will DePue published the forensic report on Nov 12 under Unemployment Labs; he previously worked on Sora and GPT-5 at OpenAI
2. Six models: DeepSeek-V4-Flash and V4-Pro, Kimi K3 and K3.1-Pro, MiniMax-M3 and Ant Group's Ling-3.1-flash; the appendix says M3.1 Flash carries the same fingerprint
3. Method: Philox pseudorandom initialization through cuRAND on GPU threads leaves a unique pattern per chip layout and seed; more than six trillion combinations compared; code is public
4. Validation: A rented GB200 reproduced all 13 preserved rows of Kimi K3's weights; the method agreed with all 24 models with disclosed training hardware
5. Numbers: For DeepSeek-V4-Flash, 461 of 469 selected weight rows matched, 445 bit-for-bit; four models match GB200/GB300, two match B200/B300
6. Limits: The fingerprint only identifies the hardware that generated the starting weights; it does not prove chip location, how access was obtained, or any export-control breach; Blackwell can be rented outside China
7. Context: US officials previously accused DeepSeek and Moonshot of using Blackwell without publishing technical evidence; the report came the day after Jensen Huang resigned