Forensic analysis finds Blackwell GPU fingerprints in Chinese AI models

Evidence in the weights

A forensic analysis published by Will DePue has identified specific hardware fingerprints in several new Chinese AI models. The study examined six models released since April 2026 from companies including DeepSeek, Moonshot AI, MiniMax, and Ant Group. These models contain numerical patterns that match the architecture of Nvidia’s Blackwell chips.

The findings are significant because Washington has placed restrictions on exporting Blackwell hardware to China. The report notes a distinct shift in the data: older models from these same companies match Nvidia’s previous Hopper generation, while the newest versions match the Blackwell architecture. This timeline suggests a recent transition to more advanced hardware.

The analysis was published on November 12 by DePue, who previously worked on Sora and GPT-5 at OpenAI. While the report provides technical evidence of hardware access, it does not explicitly state how the chips were obtained or if any laws were violated. It serves as a forensic snapshot of the computing power being used by Chinese labs.

How the fingerprint works

The method used to identify the hardware relies on how AI models are initialized before training begins. Every model needs starting values for its billions of weights, which are generated by a pseudorandom number generator called Philox. This generator uses a specific "seed" to produce the same numbers every time the settings are held constant.

Nvidia chips distribute this work across many parallel threads on what the company calls streaming multiprocessors, or SMs. When a chip contains a higher number of SMs, it distributes the workload among more workers, which causes the starting values to be scattered differently across the model. By searching for the hardware configuration that reproduces a model's initial values, researchers can identify the specific chip type.

The study found that DeepSeek-V4-Flash and MiniMax-M3 match the 148-SM count of the B200 or B300 Blackwell chips. Other models, such as Kimi K3 and Ant Group’s Ling-3.1-flash, match the 152-SM count of the GB200 or GB300. DePue confirmed these matches on physical Blackwell chips, rather than just relying on mathematical probability.

Verifying the methodology

To ensure the accuracy of the forensic method, DePue tested it against 24 other models whose developers have publicly disclosed their training hardware. In every single case, the method correctly identified the hardware used. This includes Nvidia’s own Nemotron-3 Ultra, which was confirmed to match the 152-SM count of the GB200.

The statistical significance of these matches is very high. The report notes that the strongest random false match would be expected to reach about 8 sigma, while the six Chinese models ranged from 49 to 1,385 sigma. Even the weakest individual test reached 20 sigma, making the likelihood of a false match extremely low.

The report also considered whether specialized AMD hardware could be responsible for these patterns. However, DePue excluded AMD as a candidate for DeepSeek-V4-Flash and deemed it very unlikely for the rest of the models. This leaves Nvidia's Blackwell architecture as the primary candidate for the hardware used in these frontier models.

The scale of the hardware

The sheer volume of hardware required for these models suggests a massive infrastructure investment. DePue estimates that the five Blackwell runs analyzed together would have required approximately 12,000 Blackwell GPUs. Based on reported costs, this would represent a significant financial commitment for the labs involved.

The report suggests that the largest single cluster among these runs could cost between $200 million and $300 million. When combined, the five runs would total more than half a billion dollars in hardware costs. These figures highlight the high barrier to entry for training frontier models on the most advanced silicon available.

Not all Chinese labs have made the switch to Blackwell hardware yet. Models from Alibaba’s Qwen, Zhipu’s GLM, and Tencent still show the fingerprints of the older Hopper chips. Additionally, Meituan reported training its LongCat-2.0 model on "AI ASIC superpods," which showed no Nvidia fingerprints at all.

Implications for export controls

The timing of these findings is particularly noteworthy for those monitoring international trade and technology policy. US officials and various press reports had already alleged that companies like DeepSeek and Moonshot were using Blackwell chips. This study provides the first technical evidence to support those claims by identifying the fingerprints directly in the model weights.

The presence of these fingerprints makes it much harder to dismiss reports of restricted hardware reaching China. While the study does not establish where the chips were located or how they were moved, it confirms that the hardware is being utilized. This creates a new challenge for regulators trying to maintain the integrity of export controls.

Moving forward, the focus will likely shift toward how this silicon is bypassing existing restrictions. The data shows that while some labs are still using older hardware or custom ASICs, the most advanced frontier models are increasingly showing signs of Blackwell integration. This suggests a complex and ongoing struggle to limit the flow of high-end computing power.