# Forensic Analysis of Public Weights Ties Six Chinese Frontier Models to Export-Controlled Nvidia Blackwell GPUs

Will DePue says a rented Blackwell B300 reproduced the starting weights of DeepSeek-V4-Flash bit for bit, while a rented H100 did not, as the Commerce Department reportedly prepares to require licenses for Blackwell-class capacity in seven countries where Chinese firms rent compute.

- Published: 2026-11-14T06:20:14.641Z
- Canonical: https://polylog.news/ai/2026-11-14/forensic-analysis-of-public-weights-ties-six-chinese-frontie
- Publisher: Polylog (AI desk)
- Section: tech
- Sources: [Polylog editors](https://polylog.news), [The Register](https://www.theregister.com/ai-and-ml/2026/11/13/chinese-ai-labs-are-training-models-on-nvidias-blackwell-despite-export-controls-says-ex-openai-engineer/5309891), [RuntimeWire](https://runtimewire.com/article/chinese-ai-models-blackwell-fingerprint-depue-report), [AICoder](https://www.aicoder.com/news/news-20261113-x-discussion-will-depue-checkpoint-forensics-chinese-models-blackwell-fingerprint-deepseek-kimi-minimax-ling), [CASRAI](https://casrai.org/news/commerce-ai-chip-rule-third-country-data-centers-2026), [Tech Times](https://www.techtimes.com/articles/330620/20261113/chinese-firms-rush-reserve-nvidia-chip-capacity-reported-us-rule-requires-local-host-licenses.htm)

Will DePue, a former OpenAI researcher who now runs the nonprofit Unemployment Labs, published a checkpoint-forensics report on November 12. He [says the published weights of six open-weight models](https://runtimewire.com/article/chinese-ai-models-blackwell-fingerprint-depue-report) from DeepSeek, Moonshot AI, MiniMax and Ant Group carry an initialization signature that matches Nvidia Blackwell GPUs. Blackwell parts are barred from export to China. The models named in coverage include DeepSeek-V4-Pro, DeepSeek-V4-Flash, Kimi K3 and MiniMax-M3.

The method relies on a detail of how frameworks generate initial weights. PyTorch spreads random-number generation across the GPU's parallel units, and the resulting layout of values depends on the chip's configuration as well as the seed. DePue [searched about six trillion combinations of chip layout and seed](https://www.theregister.com/ai-and-ml/2026/11/13/chinese-ai-labs-are-training-models-on-nvidias-blackwell-despite-export-controls-says-ex-openai-engineer/5309891) against tensors that training appears to have left untouched. On rented hardware, a Blackwell B300 regenerated DeepSeek-V4-Flash's starting values bit for bit with the recovered seed. An H100 did not. The Russian-language channel AI ML Big Data, summarizing the report, [says 445 rows matched exactly](https://t.me/ai_machinelearning_big_data/11353). Cluster-size estimates derived from the layout differ between outlets, from about 2,000 to 3,000 GPUs to 3,000 to 4,500.

DePue limits his own claim. His paper says the fingerprint "identifies how the weights were created and supports, without proving, the inference that Blackwell also performed the training," and that it [does not show where the chips were located](https://www.aicoder.com/news/news-20261113-x-discussion-will-depue-checkpoint-forensics-chinese-models-blackwell-fingerprint-deepseek-kimi-minimax-ling). The labs could have rented Blackwell capacity from clouds outside China. Until now, that route has sat largely outside the chip-export rules. No independent group has yet reproduced or rebutted the result beyond DePue's published scripts. The named labs and Nvidia had not commented in the coverage reviewed. DeepSeek denied earlier reporting that it used Blackwell, including a February account in which a US official said its training ran on Blackwell chips.

The report comes as the Commerce Department's Bureau of Industry and Security (BIS) moves to close the rental route. According to The Information, as relayed by [CASRAI](https://casrai.org/news/commerce-ai-chip-rule-third-country-data-centers-2026), BIS is finalizing a rule that would require licenses for Blackwell-class or newer chips shipped to Singapore, Malaysia, Thailand, Indonesia, Brazil, Norway and South Africa. Buyers would have to disclose end users and accept monitoring. US-operated data centers in those countries could avoid the license requirement if they block remote access from China, Russia and other arms-embargoed states. Chinese firms, including Tencent, Alibaba and ByteDance, [have reportedly moved quickly to reserve offshore Nvidia capacity](https://www.techtimes.com/articles/330620/20261113/chinese-firms-rush-reserve-nvidia-chip-capacity-reported-us-rule-requires-local-host-licenses.htm) before the rule takes effect. Commentators question whether BIS has the statutory authority to regulate remote access. The Remote Access Security Act passed the House 369 to 22 in January, but the Senate has not acted on it. China's Ministry of Commerce has accused Washington of abusing export controls.

## What this means

Public open-weight checkpoints have become evidence that an enforcement agency can use, and this changes what Chinese labs give up when they release weights. The exposed parties are offshore hosts in Southeast Asia and elsewhere that rent Blackwell capacity to Chinese tenants, and those revenues now carry license risk. The Chinese labs whose pace of releases depends on that capacity are exposed for the same reason. The market already prices in tighter chip exports. The new element is a cheap, repeatable test that anyone can run on public files, which gives US hawks a factual basis that leaked intelligence did not provide. The consensus treats the fingerprint as a lasting surveillance channel. That view is probably wrong. A lab can initialize on CPU or re-randomize the tensors training leaves untouched, and that removes the signal from future checkpoints. The likelier outcome is that BIS publishes the remote-access rule within weeks and cites this class of evidence. Chinese labs would then strip initialization traces from releases in the following months, and offshore hosts would face more scrutiny, which would weigh on Malaysian and Singaporean data-center operators that serve Chinese tenants. The read depends on BIS judging its current authority sufficient without the Senate bill. It would be proven wrong if an independent replication shows that non-Blackwell hardware or emulation produces the same bit patterns.

## What to watch

- Whether independent researchers reproduce the B300 match on DeepSeek-V4-Flash, or show that another chip produces the same pattern, because the evidence is only as strong as its replication.
- The published text of the BIS remote-access rule, especially the exemption for US-operated data centers, which decides whether Malaysian and Singaporean hosts lose Chinese tenants or simply change owners.
- Whether the next DeepSeek, Kimi or MiniMax checkpoint still contains untouched initialization tensors, since removing them would show the labs treating weight releases as an export-control exposure.