Numerical patterns matching NVIDIA's Blackwell-generation GPUs, which are subject to US export controls on China, have been detected in six AI models released by four major Chinese AI developers. Following an investigative report published by researcher Will DePue on November 12, 2026, another researcher independently reimplemented the verification method and obtained the same results. US officials and media outlets have previously pointed to Chinese companies' use of Blackwell chips, and the weights of the publicly released models now offer new technical evidence. However, what this method can directly confirm is the GPU configuration used to initialize the models. It cannot identify the hardware used for the whole training run, where that hardware was located, or whether export controls were violated.
Blackwell traces found in six models from four Chinese firms, confirmed by independent verification
According to the Unemployment Labs report that Will DePue published on November 12, 2026, initialization patterns matching NVIDIA Blackwell-generation GPUs were found in six models released since April 2026 by four companies: DeepSeek, Moonshot AI, MiniMax and Ant Group. DeepSeek-V4-Flash and MiniMax-M3 matched a B200 or B300 configuration with 148 streaming multiprocessors (SMs). DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash matched a GB200 or GB300 with 152 SMs. However, Kimi K3.1-Pro uses the same random seed as Kimi K3 and is likely a version of K3 with additional post-training. Detecting fingerprints in six models therefore does not necessarily mean six independent training runs.
A key piece of corroboration came from an independent verification by Bojie Li. Without using DePue's program code, Li implemented from scratch a method for inferring the GPU configuration from the weights of publicly released models. The inferred GPU type matched in all 65 models examined by both researchers, and the results also agreed for the nine models in which no fingerprint was detected. No contradictions have been found between the two sets of results. For DeepSeek-V4-Flash in particular, DePue reproduced 461 of 469 rows of weight data, with a statistical significance of 1,385 sigma. Li reproduced 461 of 468 rows and obtained almost the same result, at 1,384 sigma.
The fact that an independent check using different code reached the same conclusion considerably strengthens confidence in the method. With the published weights and verification procedure, researchers can recheck the inferences without needing a particular developer's code or physical GPUs. One caveat is that the two independent implementations rely on the same theoretical premises. Evaluating the method's scope and accuracy will require further testing on models that use different initialization schemes and hardware configurations.
How the Philox random number generator and GPU thread layout leave a fingerprint
GPU traces remain in model weights because of the parallel processing PyTorch uses when it generates initial weight values on a GPU. In PyTorch on NVIDIA GPUs (CUDA), a pseudorandom number generator called Philox is used, and many threads compute initial values in parallel. Each thread is assigned a stream of random numbers and writes values to designated positions in the weight matrix. Even with the same random seed, if the total number of threads the GPU launches differs, the positions where the generated numbers are stored also change. In other words, the arrangement as well as the random numbers themselves reflects differences in hardware configuration.
In the initialization of the large tensors examined here, PyTorch uses up to 2,048 threads per SM. That means 270,336 threads on a 132-SM Hopper GPU, 303,104 threads on a 148-SM B200 or B300, and 311,296 threads on a 152-SM GB200 or GB300. The spacing between the elements each thread handles is determined by this total thread count. As a result, even when random numbers are generated from the same seed, a different number of SMs changes their arrangement within the weight matrix, producing a numerical pattern that reflects the hardware configuration at initialization.
Model weights are normally updated during training by gradient descent. However, initial values can remain almost intact in places such as rows of the embedding layer corresponding to rare words or symbols that never appear in the training data. Once such unupdated data is found, the initial values can be regenerated from the inferred random seed and thread layout and compared directly with the published weights. Unlike methods that infer the hardware used from a model's outputs, this approach can test for a complete bit-for-bit match when conditions allow.
DePue released the verification code in a public GitHub repository and also ran reproduction experiments on actual GPUs. On an H100, he reproduced 57,344 unupdated values of DeepSeek-V3 exactly, bit for bit. On a B300, he reproduced 461 of the 469 rows of DeepSeek-V4-Flash with a correlation coefficient of 0.99 or higher, 445 of which matched bit for bit. On a rented GB200, he reproduced all 13 unupdated rows of Kimi K3 using the random seed "20256586." In control experiments where the seed was changed by one, no matching rows were found.
The public repository also includes roughly 7 MB of extracted weight data and verification hash values. For five models, including DeepSeek-V3, matching can be done in a few seconds on an ordinary PC's CPU, without a GPU. DePue searched about 6 trillion combinations of random seeds and thread layouts and estimated the maximum statistical significance that could arise from chance matches at about 8 sigma. By contrast, the strongest detections for the six reported models reach 49 to 1,385 sigma. The likelihood that chance explains them is extremely low, which shows that the numerical patterns examined are strongly tied to specific initialization conditions.
The fingerprint alone cannot identify GPU model, location or export-control violations
An important point in interpreting these results is that what the method directly identifies is the thread layout at initialization, not the GPU's product model itself. For example, AMD's MI300X normally has 304 compute units, but restricting the units used to 152 or 148 can reproduce the same thread layout as a Blackwell-generation GPU. To examine this possibility, DePue compared 377 values remaining in DeepSeek-V4-Flash's weights where AMD's and NVIDIA's random number generation would differ. Of those, 363 matched NVIDIA's computed results, and none matched AMD's. This strongly supports the conclusion that NVIDIA GPUs were used to initialize DeepSeek-V4-Flash, but this kind of discrimination has not been completed for the other five models. Li also states explicitly that his independent verification did not reproduce this vendor-discrimination step.
In addition, the GPUs used to initialize a model are not necessarily the same as those used for the subsequent full-scale pretraining. For Kimi K3, a 152-SM layout was detected in every process with at least 64 distinct seeds, strongly suggesting initialization in an environment compatible with GB200 or GB300. Even so, it cannot be ruled out that the weights were moved to different GPUs after initialization to continue training, or that a cluster mixing several GPU generations was used. Conversely, for models initialized on CPUs, or models using random number generation that does not depend on GPU thread layout, such as PaddlePaddle, this method cannot detect a GPU fingerprint. The absence of a fingerprint therefore cannot be taken to mean that domestic chips were used or that Blackwell was not.
The legal assessment faces similar limits. The published weights do not reveal who owns the GPUs, where they are physically installed, or how they were procured. The numerical patterns left in the weights are no different between Blackwell GPUs in a data center outside China accessed remotely and GPUs brought into China in violation of export controls. US export administration regulations (15 CFR 742.6) set license requirements for the export, re-export and in-country transfer of controlled items, but weight data contains no information about transaction records, destinations or end users. The technical evidence alone therefore cannot establish an export-control violation.
Still, being able to infer from public models that an initialization environment compatible with advanced GPUs was used is an important step forward for verifying how companies use hardware. Combining procurement records, cloud contracts, data center operating records and customs data could make it possible to investigate the facilities used and the access routes in more detail. The next question is whether technical evidence from weights can be linked to records showing actual transactions and where the hardware is located.
Are Chinese AI firms' GPUs shifting from Hopper to Blackwell?
Comparing the new detections with previously available public information shows when Chinese AI developers appear to have begun moving from the Hopper generation to Blackwell. In its V3 technical report, DeepSeek stated that it trained on 14.8 trillion tokens using 2,048 H800s, spending a total of 2.788 million GPU hours. Moonshot AI also disclosed in its Kimi K2 paper that it pretrained on 15.5 trillion tokens using an H800 cluster. For both companies' major models through 2025, developer documents confirm that the H800, the export-compliant version of the Hopper generation, was used.
In this investigation, Blackwell-compatible fingerprints were confirmed in DeepSeek V4 (released April 2026), MiniMax-M3 (June), Kimi K3 (July) and Ling-3.1-flash (October). Kimi K2.7-Code, released in June 2026, illustrates the transition period well. Examining 254 unupdated rows in this model showed that about 80% corresponded to the conventional Hopper layout and about 20% to the new 148-SM layout. Because the two were mixed at a roughly constant ratio across rows, the finding suggests the checkpoint may be a merge of the weights of different models. This model is not among the six in this report. Separately, DeepSeek engineer LyricZhao commented on GitHub on June 12, 2025 that the company did not have SM100 (Blackwell) GPUs, but that statement came about 10 months before V4's release and is no evidence against usage as of 2026.
Other public materials also contain information suggesting access to Blackwell. Ant Group's cuLA repository records benchmark results generated on March 31, 2026 on an NVIDIA GB300 using CUDA 12.9 and PyTorch 2.9.1. This alone does not show that a GB300 was used to train Ling-3.1-flash, but it supports the view that the company was conducting technical validation in a GB300 environment. Meanwhile, models from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi and StepFun, which were also examined by DePue, showed Hopper-generation layouts.
These results suggest not that Chinese AI companies all moved to Blackwell at once, but that access to advanced GPUs and the timing of adoption may differ from company to company. However, a model's release date does not necessarily match when GPUs were acquired, and the same method cannot examine unreleased models or models initialized on CPUs. Even where a Hopper fingerprint remains, it cannot be ruled out that Blackwell was used in later training. What public weights reveal is only part of each model's initialization environment, not a full picture of a company's computing infrastructure.
Estimated 12,000 Blackwell GPUs compared with actual training scale
DePue also estimated how many GPUs would be needed if the models had been trained on the same hardware used for initialization, based on parameter counts and training data volume. In the revised report of November 12, he estimated that DeepSeek-V4-Pro needed 3,000 GPUs for 70 days (estimated range 750 to 6,500) and Kimi K3 needed 4,500 GPUs for 70 days (range 1,000 to 9,500). Summing the five final training runs, excluding duplicates, gives a best estimate of 12,000 GPUs, with a range of 7,000 to 22,000. These figures do not include preliminary experiments, early-stage trial runs or GPUs for inference serving.
The estimate rests on several assumptions made without being able to check the actual training environments. DePue assumes model FLOPs utilization (MFU) of roughly 20% and estimates training periods from factors such as model release dates. For models other than DeepSeek's, he used an unpublished method of his own that works backward from the weights to estimate the number of training tokens. The November 12 revision raised the original estimate of "2,000 to 3,000 GPUs for the largest training run" because it incorporated Blackwell training efficiency actually disclosed by other companies instead of NVIDIA's nominal performance.
| Model / disclosure | Type of evidence | Configuration / GPU detected | GPU count / training period | Status of figures |
|---|---|---|---|---|
| DeepSeek-V4-Flash | Unupdated-row match (461/469 rows, 1,385σ) and NVIDIA discrimination | 148 SMs (B200/B300-compatible) | 1,500 GPUs, 50 days (range 250–5,000) | Layout match is a verified result; GPU count and period are estimates |
| DeepSeek-V4-Pro | Traces of initial values remaining in trained weights (49σ) | 152 SMs (GB200/GB300-compatible) | 3,000 GPUs, 70 days (range 750–6,500) | Layout match is a verified result; GPU count and period are estimates |
| Kimi K3 | Unupdated-row match (13/13 rows, 305σ) | 152 SMs (GB200/GB300-compatible) | 4,500 GPUs, 70 days (range 1,000–9,500) | Layout match is a verified result; GPU count and period are estimates |
| MiniMax-M3 | Unupdated-row match (17/17 rows, 323σ) | 148 SMs (B200/B300-compatible) | 1,500 GPUs, 60 days (range 200–7,000) | Layout match is a verified result; GPU count and period are estimates |
| Ling-3.1-flash | Unupdated-row match (384/384 rows, 244σ) | 152 SMs (GB200/GB300-compatible) | 1,500 GPUs, 100 days (range 400–6,500) | Layout match is a verified result; GPU count and period are estimates |
| Mistral Large 4 (reference) | Primary disclosure by developer | Grace Blackwell | 3,800 GPUs (period not disclosed) | Developer-published figure (52B active) |
| Microsoft MAI-Base-2 (reference) | Primary disclosure by developer | GB200 | 16,000 GPUs, 38 days (MFU 21%) | Developer-published figure |
Comparison with other companies' cases using the same Blackwell generation shows that the required GPU count varies greatly with training efficiency and duration. Mistral has stated that it trained Mistral Large 4, with 52 billion active parameters, on 3,800 Grace Blackwell GPUs. That is close in scale to DeepSeek-V4-Pro, which has 49 billion active parameters. Microsoft, meanwhile, has said it used 16,000 GB200s for 38 days to train MAI-Base-2, recording an average MFU of 21% and goodput of 89%. According to DePue's revised report, applying such actual training paces to the two largest Chinese models would require 8,000 to 9,000 Blackwell GPUs each.
The figures of 3,000 GPUs for DeepSeek-V4-Pro and 4,500 for Kimi K3 therefore cannot be regarded as confirmed numbers of GPUs each company actually owned or used. The most solid finding of this analysis is that initialization patterns matching the Blackwell generation remained in the published weights. The estimates of required GPU counts, by contrast, depend heavily on uncertain conditions such as training duration, computational efficiency and the number of training tokens. If the companies disclose their actual training scale and GPU procurement and usage routes, these estimates could be examined in more detail. Public model weights have been shown to offer a clue to hardware use, but assessing the effectiveness of export controls will require verification from both technical analysis and transaction and operating records.