Former OpenAI researcher Will DePue has published the results of a forensic analysis of the weights of six new Chinese neural network models, which he reports retain numerical fingerprints matching Nvidia's Blackwell-generation graphics accelerators. The models in question are DeepSeek-V4-Flash and DeepSeek-V4-Pro, Moonshot AI's Kimi K3 and Kimi K3.1-Pro, as well as Ant Group's MiniMax-M3 and Ling-3.1-flash. According to the researcher, earlier models from these same companies corresponded to the previous Nvidia Hopper generation, whereas the identified fingerprints point to Blackwell B200/B300 configurations with 148 streaming multiprocessors (SMs) or GB200/GB300 setups with 152 such blocks. Thus, the technical analysis provides evidence that Chinese developers had access to accelerators subject to US export controls.
How the "Digital Fingerprinting" Method Works
The method is based on the characteristics of initial neural network weight initialization—assigning starting numerical values to billions of parameters prior to training. The Philox pseudo-random number generator used in PyTorch creates a sequence of values based on a given seed. The GPU distributes computations among threads, and their count depends on the number of SM compute blocks. As a result, the exact same sequence of numbers is placed in different tensor positions across different accelerators. Some of the initial values persist in the published weights even after training—for instance, in neurons responsible for words and symbols the model never encountered in training data. According to the authors, these surviving values make it possible to reconstruct both the initial seed and the specific GPU configuration.
Verification on Real Hardware
To verify DeepSeek-V4-Flash, the researchers used a physical Nvidia B300 accelerator and reproduced 445 out of 469 selected weight rows down to the exact bit; another 16 rows showed high correlation, while 8 were partially altered during training. No such matches were found for this model on an Nvidia H100 accelerator. For the earlier DeepSeek-V3, the picture was reversed: the H100 reproduced all 57,344 surviving initial values, whereas the B300 could not. A similar verification of Kimi K3 was performed on a rented GB200—all 13 surviving rows matched the initial values. The method was further tested on 24 models where developers publicly disclosed the hardware used, and in all cases, the results matched known data.
Estimating Compute Cluster Scale
The authors also estimated the potential scale of computing resources. Assuming the models were trained on the same accelerators used to generate their initial weights, the five largest training runs may have required around 12,000 Blackwell accelerators: the estimate for Kimi K3 is roughly 4,500 GPUs, and for DeepSeek-V4-Pro around 3,000. Two such compute clusters could have cost $200–300 million each, with the total equipment cost for the five runs estimated to exceed $500 million. At the same time, the researchers emphasize that these are estimated calculations rather than verified data, as they depend on training duration, accelerator utilization efficiency, and training dataset volume.
Method Limitations and Alternative Explanations
The method has significant limitations. It shows what hardware was used to create the initial weights, but it does not prove that these exact GPUs were used throughout the entire training process. Nor can it establish the location of the accelerators, their owners, or how access to them was obtained. The researchers also tested an alternative explanation involving the AMD MI300X, which can be configured to 148 or 152 compute blocks, mimicking the characteristic Blackwell pattern. This hypothesis was ruled out for DeepSeek-V4-Flash based on additional numerical features, and the authors consider it highly unlikely for the remaining five models. Ultimately, the analysis provides technical evidence of Chinese developers accessing export-restricted Nvidia accelerators, but does not in itself prove violations of US export controls.
