A researcher read the numbers inside six Chinese AI models. They point at banned Nvidia chips.

I’ll start with the number that made me stop and reread it: 1,385. That’s the sigma score, how far a result sits from pure chance, that researcher Will DePue found on November 12 when he checked Moonshot’s Kimi K3 weights against Nvidia’s Blackwell GPU fingerprint. Six models, four Chinese labs, 20 to 1,385 sigma apiece.

The researcher runs a nonprofit called Unemployment Labs, and before this he worked at OpenAI. A chance match this strong is expected to show up around 8 sigma at most, so 1,385 is not noise. His report doesn’t claim anyone smuggled anything. It claims something narrower and, to me, more interesting: the weights of DeepSeek’s, Moonshot’s, MiniMax’s and Ant Group’s newest open models carry numerical fingerprints that match Nvidia’s Blackwell architecture, chips the US has banned from export to China since late 2025.

How you read a GPU out of a model’s weights

Before training starts, a model’s weights get filled with random numbers from a seed, using PyTorch’s cuRAND generator. The generator’s Philox algorithm hands out work to GPU threads in a pattern that depends on how many streaming multiprocessors (SMs) the chip has. An Nvidia H100 has a different SM count than a B200, which has a different count than a GB200. DePue’s method recovers the seed from leftover, barely-trained values in a public checkpoint, then checks which chip’s SM count reproduces those exact values.

He didn’t stop at statistics. He rented a B300 and a GB200 and ran the recovered seeds on the real hardware. On the B300, unmodified PyTorch reproduced 461 of 469 selected rows from DeepSeek’s V4-Flash checkpoint, 445 of them bit-for-bit. The rented GB200 reproduced all 13 preserved rows from Kimi K3. Change the seed by one digit, DePue says, and none of it reproduces. He also tested whether an AMD MI300X, the only other chip anyone has suggested, could fake the same signature. For V4-Flash, 363 of 377 values that differ by vendor matched Nvidia. None matched AMD.

Which models, and when the pattern shifted

DeepSeek’s own V3, released in December 2024, reads as Hopper, which matches what DeepSeek has publicly said (it has disclosed H800 use before). Then the picture changes:

Model	Released	Fingerprint
DeepSeek-V3	Dec 2024	Hopper (H800 disclosed)
DeepSeek-V4-Flash / V4-Pro	Apr 2026	Blackwell B200/B300 and GB200/GB300
Kimi K2 / K2.5	2025 / Jan 2026	Hopper
Kimi K3 / K3.1-Pro	Jul 2026	Blackwell GB200/GB300
MiniMax-M2.7 / M3	Apr 2026 / Jun 2026	Hopper then Blackwell B200/B300
Ant Group Ling-3.0-flash / 3.1-flash	Aug 2026 / Oct 2026	Hopper then Blackwell GB200/GB300

DePue also checked Alibaba, Zhipu, Tencent, Xiaomi and StepFun’s recent readable models. All of them still read as Hopper. The shift isn’t industry-wide; it’s specific to these four labs, and it lines up with when the White House’s technology adviser, Michael Kratsios, said earlier this year that US intelligence had flagged Moonshot for using export-banned Nvidia chips.

What the fingerprint doesn’t prove

Here’s the part the report is careful about, and the part I think matters most for anyone reading the headlines. The fingerprint shows which chip initialized the weights. It doesn’t show which chip did all the training that followed, and training can run across a mixed cluster that leaves only a partial trace. DePue’s own estimate, built by dividing each model’s training compute by a Blackwell chip’s throughput at 35% utilization, puts each final run at roughly 500 to 3,000 GPUs over two to three months. That’s a scale estimate, not a chip count DePue observed directly. (As a sanity check, the same math applied to DeepSeek-V3 lands on 2,000 to 2,500 chips, close to the 2,048 DeepSeek has publicly disclosed, which is why he trusts the method on the newer models too.)

The report also doesn’t say where the chips physically sat, who owns them, or how the labs got access, which is the open part of this story. Blackwell systems can legally be rented from data centers outside China. Epoch AI, a separate research group cited in TechCrunch’s writeup, estimates 275,000 Nvidia AI accelerators were imported into Malaysia in 2024 and 2025, which has become a popular route for Chinese firms buying compute without buying hardware. DePue’s own words: this evidence alone “does not establish where chips were located, how access was obtained, or whether export controls were violated.”

That caveat matters because the same week this report landed, Nvidia’s own story got messier. Jensen Huang resigned as CEO after admitting an affair with Alice Huang, an executive at Megaspeed, a company the US has accused of smuggling Nvidia chips into China and alleged ties to Chinese intelligence, detailed in our earlier post on the spy memo. Those are separate, serious claims from separate reporting, not something the Unemployment Labs analysis itself verifies. My read: those two stories shouldn’t be collapsed into one. The weights forensics stands on its own evidence, and it’s narrower than the smuggling allegations around Huang.

Currently, Blackwell GPUs are banned outright from export to China. The Trump administration does allow Nvidia to sell the older, weaker H200 to Chinese buyers, but only via a longer shipping route that lets the US collect a 25% tariff, a policy we covered when the approval for one buyer turned out to list an empty shell office.

My read

I think the most useful part of this report isn’t the headline number, it’s the method. If a model’s own weights can be read for the hardware that trained them, export enforcement stops depending entirely on shipping manifests and customs seizures, and starts depending on researchers who can download open weights and run the math. That’s a slower, quieter kind of accountability than a Commerce Department raid, but it’s one that doesn’t need China’s cooperation to work.

I’m also not going to pretend the gap between “the weights look like Blackwell” and “someone broke the law” is small. DePue doesn’t pretend that either. Four labs showing a hardware shift that happens to line up with a US intelligence tip about one of them is suggestive, not conclusive, and the honest version of this story holds both things at once.

A note on sources: I read Unemployment Labs’ full report at unemploymentlabs.com/checkpoint-forensics, including its methodology, tables and appendices, plus TechCrunch’s full article. The Epoch AI and Michael Kratsios references come from TechCrunch’s own reporting, which I’m citing through TechCrunch rather than claiming I read those statements first-hand.

Sources

1. Export-banned Nvidia chips are behind China’s most powerful AI models, uh oh, Jensen, TechCrunch
2. Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs, Unemployment Labs (Will DePue), November 12, 2026