---
title: "Six Chinese AI Models Found to Contain Numerical Fingerprints of Banned Nvidia Blackwell Accelerators"
description: "A former OpenAI researcher has discovered numerical fingerprints of Nvidia Blackwell accelerators in six Chinese AI models, pointing to developer access to export-restricted hardware."
date: 2026-11-13T15:49:20.230Z
lang: en
url: https://xab.info/en/posts/chinese-ai-models-nvidia-blackwell-fingerprints
tags: [nvidia-blackwell, chinese-ai, deepseek, gpu-fingerprinting, export-controls, moonshot-ai, neural-networks]
author: "Alexander Buran"
publisher: "XAB.info"
---

# Six Chinese AI Models Found to Contain Numerical Fingerprints of Banned Nvidia Blackwell Accelerators

![Nvidia Blackwell graphics processor and a digital grid with numerical AI model fingerprints](https://xab.info/media/2026/11/13/kitajskie-ii-modeli-otpechatki-nvidia-blackwell/kitajskie-ii-modeli-otpechatki-nvidia-blackwell-1.webp)

## Key Points

- Six Chinese AI models (DeepSeek-V4, Kimi K3, MiniMax-M3, Ling-3.1-flash) contain numerical fingerprints matching Nvidia Blackwell B200/B300 and GB200/GB300 accelerators.
- The method relies on analyzing surviving initial weight initialization values tied to the Philox generator and the specific GPU's SM compute block count.
- Verification on physical B300 hardware reproduced 445 out of 469 DeepSeek-V4-Flash weight rows bit-for-bit; the method is validated on 24 models with publicly known hardware.
- Calculations suggest roughly 12,000 Blackwell accelerators were used for the five largest runs, with total equipment costs exceeding $500 million.
- The authors stress that the analysis does not prove GPU use throughout the entire training process or confirm actual violations of export controls.

Former OpenAI researcher Will DePue has published the results of a forensic analysis of the weights of six new Chinese neural network models, which he reports retain numerical fingerprints matching Nvidia's Blackwell-generation graphics accelerators. The models in question are DeepSeek-V4-Flash and DeepSeek-V4-Pro, Moonshot AI's Kimi K3 and Kimi K3.1-Pro, as well as Ant Group's MiniMax-M3 and Ling-3.1-flash. According to the researcher, earlier models from these same companies corresponded to the previous Nvidia Hopper generation, whereas the identified fingerprints point to Blackwell B200/B300 configurations with 148 streaming multiprocessors (SMs) or GB200/GB300 setups with 152 such blocks. Thus, the technical analysis provides evidence that Chinese developers had access to accelerators subject to US export controls.

### How the "Digital Fingerprinting" Method Works

The method is based on the characteristics of initial neural network weight initialization—assigning starting numerical values to billions of parameters prior to training. The Philox pseudo-random number generator used in PyTorch creates a sequence of values based on a given seed. The GPU distributes computations among threads, and their count depends on the number of SM compute blocks. As a result, the exact same sequence of numbers is placed in different tensor positions across different accelerators. Some of the initial values persist in the published weights even after training—for instance, in neurons responsible for words and symbols the model never encountered in training data. According to the authors, these surviving values make it possible to reconstruct both the initial seed and the specific GPU configuration.

### Verification on Real Hardware

To verify DeepSeek-V4-Flash, the researchers used a physical Nvidia B300 accelerator and reproduced 445 out of 469 selected weight rows down to the exact bit; another 16 rows showed high correlation, while 8 were partially altered during training. No such matches were found for this model on an Nvidia H100 accelerator. For the earlier DeepSeek-V3, the picture was reversed: the H100 reproduced all 57,344 surviving initial values, whereas the B300 could not. A similar verification of Kimi K3 was performed on a rented GB200—all 13 surviving rows matched the initial values. The method was further tested on 24 models where developers publicly disclosed the hardware used, and in all cases, the results matched known data.

### Estimating Compute Cluster Scale

The authors also estimated the potential scale of computing resources. Assuming the models were trained on the same accelerators used to generate their initial weights, the five largest training runs may have required around 12,000 Blackwell accelerators: the estimate for Kimi K3 is roughly 4,500 GPUs, and for DeepSeek-V4-Pro around 3,000. Two such compute clusters could have cost $200–300 million each, with the total equipment cost for the five runs estimated to exceed $500 million. At the same time, the researchers emphasize that these are estimated calculations rather than verified data, as they depend on training duration, accelerator utilization efficiency, and training dataset volume.

### Method Limitations and Alternative Explanations

The method has significant limitations. It shows what hardware was used to create the initial weights, but it does not prove that these exact GPUs were used throughout the entire training process. Nor can it establish the location of the accelerators, their owners, or how access to them was obtained. The researchers also tested an alternative explanation involving the AMD MI300X, which can be configured to 148 or 152 compute blocks, mimicking the characteristic Blackwell pattern. This hypothesis was ruled out for DeepSeek-V4-Flash based on additional numerical features, and the authors consider it highly unlikely for the remaining five models. Ultimately, the analysis provides technical evidence of Chinese developers accessing export-restricted Nvidia accelerators, but does not in itself prove violations of US export controls.

## Fact-Check & Sources

- [В китайских ИИ-моделях нашли отпечатки запрещённых Nvidia Blackwell: DeepSeek воспроизвела 445 строк весов бит в бит](https://www.ixbt.com/news/2026/11/13/v-6-kitaiskix-ii-modeliax-nasli-otpecatki-zapreshhennyx-nvidia-blackwell-deepseek-vosproizvela-445-strok-vesov-bit-v-bit.html) - Source material: Full text of W. DePue's forensic analysis. All figures (445/469, 57,344, 13 rows, 24 models, ~12,000 GPUs, $200–300M, >$500M) carried over unchanged. Caveats: method does not prove GPU use throughout full training and does not confirm export control violations; AMD MI300X alternative ruled out for one model and deemed unlikely for the rest.

## FAQ

### Which specific models were analyzed?

Six models: DeepSeek-V4-Flash and DeepSeek-V4-Pro, Moonshot AI's Kimi K3 and Kimi K3.1-Pro, and Ant Group's MiniMax-M3 and Ling-3.1-flash.

### What is the fingerprint detection method based on?

It is based on analyzing surviving initial weight initialization values that depend on PyTorch's Philox pseudo-random number generator and the specific accelerator's SM compute block count.

### How accurate is the verification on real hardware?

For DeepSeek-V4-Flash on a physical B300, 445 out of 469 weight rows were reproduced bit-for-bit, another 16 showed high correlation, and 8 were partially altered by training. The method is also validated on 24 models with publicly disclosed hardware.

### Does the analysis prove a violation of US export controls?

No. The authors explicitly state that the analysis provides technical evidence of access to export-restricted Nvidia accelerators, but does not in itself prove violations of export controls, nor does it establish the location or owners of the equipment.