Forensic Analysis of Public Weights Ties Six Chinese Frontier Models to Export-Controlled Nvidia Blackwell GPUs

Will DePue, a former OpenAI researcher who now runs the nonprofit Unemployment Labs, published a checkpoint-forensics report on November 12. He says the published weights of six open-weight models from DeepSeek, Moonshot AI, MiniMax and Ant Group carry an initialization signature that matches Nvidia Blackwell GPUs. Blackwell parts are barred from export to China. The models named in coverage include DeepSeek-V4-Pro, DeepSeek-V4-Flash, Kimi K3 and MiniMax-M3.

The method relies on a detail of how frameworks generate initial weights. PyTorch spreads random-number generation across the GPU's parallel units, and the resulting layout of values depends on the chip's configuration as well as the seed. DePue searched about six trillion combinations of chip layout and seed against tensors that training appears to have left untouched. On rented hardware, a Blackwell B300 regenerated DeepSeek-V4-Flash's starting values bit for bit with the recovered seed. An H100 did not. The Russian-language channel AI ML Big Data, summarizing the report, says 445 rows matched exactly. Cluster-size estimates derived from the layout differ between outlets, from about 2,000 to 3,000 GPUs to 3,000 to 4,500.

DePue limits his own claim. His paper says the fingerprint "identifies how the weights were created and supports, without proving, the inference that Blackwell also performed the training," and that it does not show where the chips were located. The labs could have rented Blackwell capacity from clouds outside China. Until now, that route has sat largely outside the chip-export rules. No independent group has yet reproduced or rebutted the result beyond DePue's published scripts. The named labs and Nvidia had not commented in the coverage reviewed. DeepSeek denied earlier reporting that it used Blackwell, including a February account in which a US official said its training ran on Blackwell chips.

The report comes as the Commerce Department's Bureau of Industry and Security (BIS) moves to close the rental route. According to The Information, as relayed by CASRAI, BIS is finalizing a rule that would require licenses for Blackwell-class or newer chips shipped to Singapore, Malaysia, Thailand, Indonesia, Brazil, Norway and South Africa. Buyers would have to disclose end users and accept monitoring. US-operated data centers in those countries could avoid the license requirement if they block remote access from China, Russia and other arms-embargoed states. Chinese firms, including Tencent, Alibaba and ByteDance, have reportedly moved quickly to reserve offshore Nvidia capacity before the rule takes effect. Commentators question whether BIS has the statutory authority to regulate remote access. The Remote Access Security Act passed the House 369 to 22 in January, but the Senate has not acted on it. China's Ministry of Commerce has accused Washington of abusing export controls.