DeepSeek, Kimi models carry Blackwell GPU fingerprint

A forensic report from Unemployment Labs, revised on November 12, finds NVIDIA Blackwell fingerprints in six open-weight models that DeepSeek, Moonshot AI, MiniMax and Ant Group released since April 2026. That makes it the first technical evidence that these labs’ newest models were created on chips that need a U.S. license for export to China, though the report says it can’t show where the chips were, how the labs got access or whether export controls were broken. Earlier models from the same four labs match NVIDIA’s older Hopper generation. The fingerprint identifies the hardware that created the starting weights, and the report calls Blackwell training an inference it supports without proving.

The author, former OpenAI researcher DePue, worked only from weights the labs published themselves, with no leaks or insiders. U.S. officials and press reports had already said DeepSeek and Moonshot AI were using Blackwell, but they published no technical evidence. DePue says senior researchers at OpenAI and Anthropic have independently verified his result.

How a chip ends up in the weights

Before training, every weight needs a starting value. In PyTorch those values come from Philox, a pseudorandom generator that always produces the same numbers from the same seed. To fill billions of weights quickly, PyTorch splits the job across GPU threads through NVIDIA’s cuRAND library. A large initialization uses 2,048 threads per streaming multiprocessor (SM), one of the GPU’s processor cores. Hopper chips (H100, H800, H200) have 132 SMs, B200 and B300 have 148, and GB200 and GB300 have 152. So the same seed on a different chip produces the same numbers but puts them in different positions.

Training overwrites most of those starting values. In every large model, though, some rows of the weight matrices survive essentially untouched. With enough of them recovered, you can search backward for the seed and chip layout that produced them. The search covered more than six trillion combinations. The report says the best match chance alone could produce across that many tries is about 8 sigma, a measure of how far a result sits above ordinary random variation. The six models’ strongest matches range from 49 to 1,385 sigma, and the weakest single test reported reaches 20.

DePue then ran the recovered seeds on real hardware. With unmodified PyTorch, a Blackwell B300 reproduced DeepSeek-V4-Flash’s untouched starting weights bit for bit, and a rented GB200 matched Kimi K3’s to a correlation of 0.999995. A Hopper H100 reproduced none of V4-Flash’s weights, and shifting the seed by one broke the match. DeepSeek’s seed, he notes, is 953049583.

The method was checked against 24 models whose developers have said what hardware they used, and it agreed in every case. NVIDIA’s own Nemotron-3 Ultra, whose technical report names the GB200 for one phase of training, reads as 152 SMs, the same as Kimi K3.

Which models switched, and when

DeepSeek reads as Hopper through DeepSeek-V3 (December 2024). V4-Flash matches the B200 or B300, and V4-Pro matches the GB200 or GB300, both released in April 2026. Moonshot reads as Hopper through Kimi K2.5 (January 2026), then as GB200 or GB300 for K3 (July 2026) and K3.1-Pro (November 2026). K3.1-Pro starts from K3’s seed and may be a K3 checkpoint with more post-training. In between, Kimi K2.7-Code was posted six weeks before K3 and built on the Hopper-era weights, but a small part of it matches the B200 or B300. MiniMax went from Hopper in M2.7 (April 2026) to B200 or B300 in M3 (June 2026). Ant Group went from Hopper in Ling-3.0-flash (August 2026) to GB200 or GB300 in Ling-3.1-flash (October 2026).

Not every Chinese lab has moved. The newest models the report could read from Alibaba’s Qwen, Zhipu’s GLM, Tencent, Xiaomi and StepFun all read as Hopper. Meituan says LongCat-2.0 was trained entirely on “AI ASIC superpods,” and the report found no NVIDIA fingerprint in its weights. A Hopper reading also can’t tell an H800 from an H100 SXM or H200, so where the table says H800, that is the lab’s own disclosure.

DeepSeek’s serving side points the same way. In October it open-sourced DeepInfer, its production inference engine, with support for Blackwell-class SM100 and Huawei’s Ascend 950 but not Hopper. That concerns serving, not training.

Limits of the evidence

The report names one alternative to Blackwell. AMD’s MI300X, which is also restricted from export to China, can mimic the Blackwell layouts if it is configured to use 148 or 152 of its units. DePue rules it out for DeepSeek-V4-Flash, where neither an H100 nor an MI300X reproduced any of the preserved rows, and calls it very unlikely for the other five models.

The cluster sizes are much softer. In the revised report, the two largest runs are estimated at about 4,500 Blackwell GPUs for Kimi K3 and about 3,000 for DeepSeek-V4-Pro, each running for two to three months. That equals roughly 11,500 and 7,500 H100s, and about 12,000 Blackwell GPUs across five runs. The report takes about $70,000 per GPU from a Wall Street Journal report that roughly 36,000 Blackwell chips being installed in Malaysia for ByteDance would cost more than $2.5 billion. On that basis, the largest cluster would cost $200 million to $300 million, and the five together more than half a billion dollars. DePue’s announcement post still gives the first version’s figures of 2,000 to 3,000 GPUs and $150 million to $200 million. The report replaced them because they assumed NVIDIA’s benchmark efficiency, and the new figures assume the GPUs ran at about 20% of peak. So the dollar figure has already moved once.

The ranges are wide: Kimi K3 alone spans 1,000 to 9,500 GPUs. The report says it is not confident in these estimates. They rest on utilization, token counts and run lengths that no lab has published for these runs, and halving the run length doubles the GPU count. At the pace Microsoft reported for MAI-Base-2, 16,000 GPUs in 38 days, the two largest runs would have needed about 8,000 to 9,000 Blackwell GPUs. All of these figures cover only the final training runs. The report puts the labs’ total spending on export-controlled GPUs likely in the billions of dollars.

Other claims had come before the report. Israel-based security company Lava said it had found “32 Nvidia B300 GPUs, part of Nvidia’s Blackwell Ultra generation, through publicly exposed monitoring endpoints with IP addresses geolocated to China,” The Register reported. On November 11, Senators Elizabeth Warren and Chris Coons urged the Trump administration to preserve Nvidia’s export records. A day later, The Information reported that companies tied to Alice Huang had invested in DeepSeek and promised it Nvidia chips.