Forensic analysis links Chinese AI models to restricted Nvidia chips

Tracing hardware through weights

A forensic analysis published on November 12 suggests that several prominent Chinese AI models were initialized using Nvidia Blackwell chips. These specific chips are currently subject to U.S. export controls designed to limit their availability to certain regions. The study focused on models from major companies including DeepSeek, Moonshot AI, MiniMax, and Ant Group.

The researcher, Will DePue, examined the publicly released weights of these models to find evidence of their origins. He identified traces in the starting values assigned to the model weights before the training process began. These initial values are not random in a practical sense because they depend on specific hardware configurations and random seeds.

By analyzing these patterns, DePue was able to link the models to specific hardware types. The analysis matched four models to Nvidia GB200 or GB300 Grace Blackwell systems and two others to B200 or B300 chips. This suggests that the foundational architecture of these models was built on high-end hardware that is restricted for export.

The mechanics of the forensic method

The method used in this study relies on the fact that hardware configurations leave unique signatures in the initial weights of an AI model. Because the arrangement of these values depends on the GPU layout, the researcher could test different combinations to find a match. DePue reported that he searched more than 6 trillion different combinations of chip layouts and random seeds to find these specific traces.

The results of the search were statistically significant, with observed matches ranging from 49 to 1,385 standard deviations. To put this in perspective, the report noted that the strongest result expected by pure chance would be about 8 standard deviations. This high level of certainty indicates that the matches are likely not coincidental but are tied to the physical hardware used.

For example, a Blackwell B300 reproduced the untouched starting weights of DeepSeek-V4-Flash bit for bit using a recovered seed. Similarly, a rented GB200 reproduced all 13 preserved rows of Kimi K3. In contrast, the analysis showed that Nvidia’s H100 and AMD’s MI300X chips reproduced none of the tested rows for the DeepSeek-V4-Flash model.

Economic scale of the training runs

The analysis provides a glimpse into the massive financial investment required to train these large-scale models. DePue estimated that the Kimi K3 and DeepSeek-V4-Pro models each utilized between 2,000 and 3,000 Blackwell GPUs during their largest training runs. These figures suggest a significant level of infrastructure and capital were deployed to create these specific AI systems.

The estimated cost for each of these training clusters is between $150 million and $200 million. When looking at the combined cost of five final training runs, the total expenditure is estimated to be above $500 million. These figures highlight the high barrier to entry for developing state-of-the-art models that require massive amounts of compute power.

While the report identifies the hardware used to generate the initial weights, it does not account for every chip used throughout the entire training process. It also does not establish the physical location of the chips, who owned them, or the specific methods used to acquire them. However, the report notes that Blackwell systems can be rented at data centers located outside of China.

Policy and geopolitical implications

The findings come at a time of increased scrutiny regarding how high-end semiconductors reach restricted markets. In July, White House science adviser Michael Kratsios mentioned that Moonshot had accessed GB300 systems in Thailand, which was likely used for training AI models. This suggests that companies may be using third-party locations to bypass direct export restrictions.

The forensic report has already prompted calls for increased oversight from U.S. lawmakers. Senators Elizabeth Warren and Chris Coons recently urged the Trump administration to preserve Nvidia export records to better track the movement of these chips. These actions reflect a growing effort to ensure that restricted technology does not reach entities on the restricted list.

Despite the findings, the report clarifies that the results do not necessarily mean any specific laws were broken. The analysis identifies the hardware used for initialization rather than providing a complete audit of the entire training lifecycle. Nevertheless, the ability to