China's Top AI Models Carry the Fingerprint of Banned Nvidia Blackwell Chips, Forensic Study Finds

Six of China's newest open-weight artificial intelligence models carry the numerical fingerprint of Nvidia Blackwell chips, hardware that United States export controls bar from shipment to China without a licence, according to a forensic analysis published on November 12, 2026. The finding, from former OpenAI researcher Will DePue and his nonprofit group Unemployment Labs, is the first technical evidence of its kind — and it stops well short of proving that any law was broken.

The models named in the report are DeepSeek-V4-Flash and DeepSeek-V4-Pro from DeepSeek, Kimi K3 and Kimi K3.1-Pro from Moonshot AI, MiniMax-M3 from MiniMax, and Ling-3.1-flash from Ant Group. All six are open-weight models, meaning their makers publish the billions of numbers that make up each model, and it is those public files — not leaks or insider accounts — that the analysis is built on.

How a chip leaves a fingerprint in a model

Before training begins, every weight in a model is given a random starting value. Those starting values are generated on the hardware that initialises the model, and some of them survive training untouched. Because different Nvidia chip generations organise that work differently, the untouched values carry a trace of the hardware that created them.

Nvidia's Hopper chips, such as the H100, H800 and H200, have 132 streaming multiprocessors. Blackwell's B200 and B300 have 148, while the Grace Blackwell GB200 and GB300 systems have 152. DePue searched about six trillion combinations of random seeds and chip layouts to reproduce the surviving starting values in the published weights — and then tested the recovered settings on real hardware.

The clearest result concerns DeepSeek-V4-Flash. Using the seed DeepSeek itself reused from its earlier V3 model, 953049583, a Blackwell B300 chip reproduced 461 of the 469 selected weight rows, 445 of them exactly, bit for bit. For Moonshot's Kimi K3, a rented GB200 server reproduced all 13 preserved rows tested with the company's seed, and changing either seed by a single step broke every match. DePue says the method also agreed with all 24 models whose makers have disclosed the hardware they used, including Nvidia's own Nemotron-3 Ultra, which was partly trained on GB200 systems.

Four of the six models match Grace Blackwell GB200 or GB300 systems, and two match standalone B200 or B300 chips. The exact chip within each pair cannot be pinned down from the weights alone.

The switch from Hopper to Blackwell

The report traces a clear change in hardware over time. DeepSeek's models read as Hopper-trained through V3, released in December 2024, and as Blackwell from V4, released in April 2026. Moonshot moved from Hopper with Kimi K2.5 in January 2026 to Blackwell with Kimi K3 in July. MiniMax-M3, from June, and Ant Group's Ling-3.1-flash, from October, also read as Blackwell.

Not every Chinese lab shows the same pattern. The newest open models from Alibaba's Qwen, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper, and DePue found no fingerprint at all in DeepSeek's latest model, V4.1-Flash, despite an exhaustive search.

DePue estimates the scale of the training runs from each model's size and training data, putting the largest runs at a few thousand Blackwell GPUs each and the combined hardware behind the five runs he analysed at more than half a billion dollars. He has since raised those figures himself and says he is not confident in them, because they rest on run lengths and efficiency figures no lab has disclosed. Readers should treat the cost estimates as rough, not settled.

What the evidence does not prove

The report is explicit about its limits, and they matter. The fingerprint identifies the hardware that generated a model's starting weights, not every chip that later helped train it. It says nothing about where the chips were, who owned them, or how the labs obtained access to them. Blackwell systems can be rented from data centres outside China, so the findings are not proof of smuggling or of an export-control breach. In the report's own words, the results are not a finding that any law was broken.

One alternative was examined and largely set aside. AMD's MI300X accelerator, which is also restricted, could mimic the Blackwell layouts if configured to use 148 or 152 of its units. DePue says he ruled that out for DeepSeek-V4-Flash and calls it very unlikely for the other five models. The research has not been peer-reviewed, and senior researchers at OpenAI and Anthropic have independently verified the result, according to DePue.

At the time of publication, Nvidia, DeepSeek, Moonshot AI, MiniMax, Ant Group and the US Commerce Department had not commented on the report.

Why Washington is paying attention

Blackwell GPUs are banned from export to China or to Chinese-owned firms, while the Trump administration allows Nvidia to export the less powerful H200, provided shipments take a circuitous route that lets the United States claim a 25 percent tariff. The apparent access to Blackwell hardware among China's leading labs therefore cuts directly against the stated purpose of the controls: to stop Chinese labs training on the most powerful chips.

US officials have alleged before that Chinese labs used Blackwell chips, but without publishing technical evidence. White House technology adviser Michael Kratsios said earlier this year that Moonshot had used export-banned Nvidia chips, citing US intelligence sources. Epoch AI, a nonprofit research organisation, estimates that about two million advanced chips entered China in 2024 and 2025 through schemes designed to hide their final destination, and that 275,000 Nvidia AI accelerators were imported to Malaysia in the same period. Separately, the Israeli security company Lava said it had found 32 Nvidia B300 GPUs through publicly exposed monitoring endpoints with internet addresses geolocated to China.

The report lands a day after Jensen Huang resigned as Nvidia's chief executive, following reports that US intelligence believed an executive linked to the server firm Megaspeed had been recruited to spy on him. Megaspeed, led by Alice Huang, has been at the centre of the chip trade for several years through its subsidiary Speedmatrix and is under investigation by the United States and Singapore. Nvidia and Huang have both vouched for Megaspeed's data centres, saying Nvidia officials visited them to confirm they were legitimate. The wider fallout from Huang's departure has already put a spotlight on Southeast Asia's AI boom and on a separate US Justice Department probe into whether Alice Huang helped smuggle Super Micro products into China.

For now, US companies have limited obligations to track what their customers do with controlled goods such as AI chips. The forensic evidence does not change that legal position, but it does make the enforcement question harder to ignore: if the starting weights of China's best open models were generated on Blackwell hardware, somebody, somewhere, gave four of the country's top labs access to chips Washington intended them never to touch.

Photo note: the featured image shows NVIDIA AI server hardware in a data centre. It is a closely relevant illustration of the computing infrastructure at the centre of this story, not a photograph of the specific Blackwell chips named in the report.

Sources

• TechCrunch — Export-banned Nvidia chips are behind China's most powerful AI models, November 13, 2026 — https://techcrunch.com/2026/11/13/export-banned-nvidia-chips-are-behind-chinas-most-powerful-ai-models-uh-oh-jensen/
• The Register — Chinese AI labs are training models on Nvidia's Blackwell despite export controls, says ex-OpenAI engineer, November 13, 2026 — https://www.theregister.com/ai-and-ml/2026/11/13/chinese-ai-labs-are-training-models-on-nvidias-blackwell-despite-export-controls-says-ex-openai-engineer/5309891
• Unemployment Labs (Will DePue) — Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs, November 12, 2026, as reported by TechCrunch and The Register
• madrobot.blog — Chinese AI models carry banned Nvidia Blackwell fingerprints, November 13, 2026 — https://madrobot.blog/2026/11/13/chinese-ai-models-nvidia-blackwell-fingerprints/
• europesays.com — Former OpenAI researcher says six Chinese AI models were built on banned Nvidia chips, November 13, 2026 — https://www.europesays.com/ai/239100/

Internal links: China's $3.2 billion Nvidia-powered AI projects at risk after Huang exit | Banned Nvidia AI chips found at Shanghai data centre | Nvidia fallout throws spotlight on Southeast Asia's AI boom | DOJ probes Alice Huang over Super Micro AI servers