Late on a Friday, a researcher at a small independent lab opened a checkpoint file and started counting. DeepSeek-V4-Pro, close to a terabyte of published weights, was sitting on his drive like a sealed envelope. Somewhere inside those numbers, he believed, was a record of the machine that made them.
He was right. Will DePue, an OpenAI researcher who worked on Sora and GPT-5 post-training, published findings this week through his nonprofit Unemployment Labs claiming that six open-weight models from China's leading labs carry the hardware fingerprint of Nvidia Blackwell GPUs, silicon that U.S. export controls are supposed to keep out of the country.
The models named are not fringe experiments. They include DeepSeek-V4-Pro, DeepSeek-V4-Flash, Kimi K3, MiniMax-M3 and Ling-3.1-Flash, a roster that covers most of the Chinese open-weight frontier released in 2026. DePue estimates the restricted hardware behind the largest runs cost more than $500 million.
The egg of Columbus, hidden in the seed
The method is almost embarrassingly plain once you hear it, which is why people who read the paper keep reaching for the Columbus story: a trick that looks obvious only after someone else has done it.
Every modern LLM starts life as random noise. Weight initialization runs through cuRAND, Nvidia's random number library, and randomness there is seeded. Same seed, same chips, same software stack, and you get the same numbers every single time. The work is spread across shader modules, the GPU's version of CPU cores, and each module handles exactly 2,048 threads on Blackwell and Hopper silicon.
Those counts differ by family. Hopper carries 132 shader modules, Blackwell B-series 148, and Blackwell GB parts 152. DePue's team rebuilt the initialization grid from scratch, replicated the distribution of the original weights, and watched the correlation collapse the moment they changed the module or thread count. Real matches landed between 49 and 1,385 sigma, against roughly 8 sigma for the best accidental hit inside a 6 trillion combination search.
The strongest check on the technique is retrospective. The team tested 24 models whose developers had publicly stated which hardware they used. Every single one matched the public record. For DeepSeek V4 they went further and analyzed the weight values directly, ruling out the possibility that AMD cards had been arranged to imitate Blackwell layouts.
- Hopper to Blackwell in one generation: DeepSeek's models read as Hopper-trained up to V3 in December 2024, then Blackwell from V4 in April 2026.
- Scale of the runs: DePue estimates 2,000 to 3,000 Blackwell GPUs each for Kimi K3 and DeepSeek-V4-Pro.
- Hardware pinned: B200 or B300 class parts, both built around 148 shader modules.
What the numbers cannot swear to
Here is where the story gets careful, and where the researcher himself slows down. The fingerprint identifies the hardware that initialized the weights. It does not identify where that hardware sat, who paid for it, or whether a law was broken.
Renting Blackwell capacity outside China is not currently illegal for Chinese firms, and U.S. providers are not strictly barred from selling it, a gap the recent Tencent-Oracle arrangement made plain. A lab could also, in principle, initialize weights on one cluster and run the actual training somewhere else. DePue's paper says the evidence supports, without proving, the inference that Blackwell also performed the training.
The work has not been peer-reviewed. It has, according to DePue, been independently checked by senior researchers at OpenAI and Anthropic, neither of which has commented publicly. Nvidia, which said in June that it follows Commerce Department guidance for Chinese-headquartered buyers, did not respond to requests for comment on the claims.
The surrounding picture is not quiet either. The White House accused Moonshot AI this summer of reaching Blackwell chips through a facility in Thailand, and sources told CNBC the Kimi maker has been hunting for European clusters of 8,000 or more GPUs. Reporting attributed to The Information described chips routed through permissive countries, pulled from data centers after inspection, and shipped onward. January 2026 guidance from the Bureau of Industry and Security keeps Blackwell and the coming Rubin generation under a presumption of denial for China for at least 18 to 24 months after domestic launch.
That is the part of this story with the longest tail. Export controls have always been enforced at ports, customs manifests and freight forwarders, all of which can be lied to. Checkpoint forensics moves the audit into the arithmetic itself, where a six trillion combination search can read a decision made years earlier by someone who assumed no one would ever look.
DePue says more of this work is coming. If he is right, the question for regulators stops being whether the chips reached China and becomes what anyone intends to do about an answer written into the weights, published openly, and downloadable by anybody with a fast enough connection.
Comments