The weights remember the chip
The method examines traces of random weight initialization that survive training. Before training adjusts a model's weights, software has to generate them, and on an Nvidia GPU that job is split across the chip's streaming multiprocessors. Change the chip and you change the count: 132 multiprocessors on Hopper, 148 on a Blackwell B200 or B300, 152 on a GB200 or GB300. The same seed produces the same numbers on any of them, but deals them into different positions.
Most of that arrangement is destroyed by training. Not all of it. Weights tied to tokens a model never saw can survive untouched, and even trained weights keep a faint statistical lean toward where they started. Will DePue's report, published November 12 by Unemployment Labs, works backward from those traces in the weights the labs themselves released, searching seed and layout combinations until one reproduces what survived, then testing that combination on weights held out of the search.
The result is a hardware-initialization timeline reconstructed from the released weights. DeepSeek reads as Hopper through V3 in December 2024 and as Blackwell from V4 in April 2026. Moonshot reads as Hopper through Kimi K2.5 in January 2026 and as Blackwell from K3 that July. MiniMax switches between M2.7 in April and M3 in June. Ant Group's Ling-3.0-flash, in August, still reads as Hopper; Ling-3.1-flash, in October, reads as Blackwell. The newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper.
How strong the matches are
The numbers are not close calls. Searching roughly six trillion combinations buys a lot of chances to get lucky, and the report sets the luck ceiling at about 8 sigma. The weakest of the six headline results is 49 sigma, for DeepSeek-V4-Pro, where fewer starting values survived. The strongest, DeepSeek-V4-Flash, is 1,385 sigma, and its preserved rows could be regenerated: on a physical B300, unmodified PyTorch reproduced 461 of 469 selected rows with correlations above 0.99, including 445 entire rows that matched bit for bit. A rented GB200 reproduced all 13 preserved rows of Kimi K3. Changing either seed by one reproduced nothing.
Two alternative explanations get a fair hearing. The first is AMD: a partitioned MI300X can imitate either Blackwell layout, so DePue tested the values themselves on physical AMD hardware. Where the two vendors' arithmetic differs, DeepSeek-V4-Flash's preserved weights match Nvidia in 363 of 377 cases and AMD in none. For the other five, the distinguishing-value test was inconclusive; the report considers a partitioned-MI300X explanation very unlikely. The second check is calibration. Across 24 models whose hardware their developers have disclosed, the method agreed every time. Because related models are not independent tests, that agreement is a consistency check, not a measured accuracy rate.
What the report does not claim
Read the limits section before the headlines about it. The fingerprint identifies the hardware that generated the starting weights. A lab normally initializes on the cluster that will train the model, which is why the report says the finding "supports, without proving" that Blackwell also did the training. But weights can be generated on one system and trained on another, and a mixed cluster would leave only the initializing chip's trace.
The weights also carry no address. Blackwell systems can be rented in data centers outside China, and the report states plainly that its findings "do not establish where the chips were located, how access was obtained, or whether export controls were violated." There is one more asymmetry worth keeping: the method only works on published weights initialized on a GPU in PyTorch. Several Qwen models were initialized on a CPU and leave no trace at all, and DeepSeek's own V4.1-Flash returned no fingerprint after an exhaustive search. Failure to recover a fingerprint does not establish which hardware was used, or rule out Blackwell.
The estimates were revised within a day
The softest numbers in the report are the ones most likely to be quoted. From model sizes and training-token counts, the authors estimate the five distinct runs used about 12,000 Blackwell GPUs in total, with Kimi K3 the largest at about 4,500, and put the largest cluster at roughly $200 to $300 million, priced at about $70,000 per GPU implied by a Wall Street Journal report about chips installed in Malaysia. Those are the revised figures. The version published earlier on November 12 said 2,000 to 3,000 GPUs for the largest runs and $150 to $200 million for the largest cluster, and write-ups quoting those numbers are quoting a draft the authors already replaced. The revision note explains why: the first version assumed the GPUs ran at Nvidia-benchmark efficiency, and disclosed Blackwell training runs have run slower. The range around the new total is 7,000 to 22,000 GPUs, and the authors' own summary of the section is a sentence readers should retain: "We are not confident in these estimates."
CryptoBriefing reported on November 13 (00:23 UTC) that Nvidia, DeepSeek, Moonshot, MiniMax and Ant Group had not commented at its publication time. The evidence, meanwhile, is checkable by anyone: the code and the preserved weight rows are on GitHub, and the core comparison runs on a laptop in seconds.
Sources
- [1] Will DePue, "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs," Unemployment Labs, November 12, 2026 (primary source; revised the same day)Read source
- [2] Reproduction code and preserved weights, checkpoint-forensics repositoryRead source
- [3] CryptoBriefing, "Former OpenAI researcher says six Chinese AI models were built on banned Nvidia chips," November 13, 2026 (source of the no-comment status as of 00:23 UTC, Nov 13)Read source
- [4] U.S. export licensing rule cited by the report: 15 CFR 742.6Read source