Six Chinese AI models carry the fingerprint of banned Nvidia Blackwell chips

A team of researchers opened the weights of the newest Chinese AI models and found them. The chips Washington banned from China are in the fingerprint of six models from four leading Chinese labs. The method is a counting trick on numbers that fill the weights before training begins.

Will DePue published the report at Unemployment Labs this week. The study is called "Checkpoint Forensics". It rose to the top of Hacker News with 143 points. Four Chinese labs released six models since April 2026 that match the Blackwell layout. The labs are DeepSeek, Moonshot AI, MiniMax and Ant Group. The chips are the B200, B300, GB200 and GB300. The US requires an export license for each of them. None has been reported for China.

What the method does

Before training, a model's billions of weights get starting values. PyTorch fills them with Nvidia's cuRAND library. The library splits the work across one thread per core, up to 2,048 per streaming multiprocessor. A chip with more cores assigns the same job to more threads. The threads then write the numbers in different places on different chips.

The fingerprint catches this. If two chips have different core counts, the numbers end up in different positions. So the weight layout is a clue to the chip that created it. The Hopper H100 and H800 use 132 cores. The Blackwell B200 and B300 use 148 cores. The GB200 and GB300 use 152. The study searched around six trillion seed and layout combinations per model.

The results, by lab

DeepSeek's models read as Hopper through DeepSeek-V3 in December 2024. DeepSeek-V4-Flash, released in April 2026, reads as Blackwell B200 or B300. DeepSeek-V4-Pro, also April 2026, reads as GB200 or GB300. Moonshot's models read as Hopper through Kimi K2.5 in January 2026. Kimi K3, released in July 2026, reads as GB200 or GB300. Kimi K3.1-Pro in November matches too. MiniMax-M3, released in June 2026, reads as B200 or B300. Ant Group's Ling-3.1-flash, released October 2026, reads as GB200 or GB300.

The study estimates each training run needed 1,500 to 3,500 Blackwell GPUs for one and a half to three months. The five runs together used about 12,000 chips. The matches on real chips are stated at 49 to 1,385 sigma. The study tested the method against 24 models whose hardware was publicly disclosed. The method got every one right.

What the study does not claim

The report says it cannot prove where the chips sit or how the labs got access. It says it cannot rule out training on specially configured AMD hardware, also restricted from export to China. It calls AMD unlikely for the five less certain models. It calls AMD excluded for DeepSeek-V4-Flash. The scale figures are rough. The study does not know each lab's actual chip efficiency or the exact run length.

What this means for your work

Suppose your team runs DeepSeek, Kimi, MiniMax or Ling in production. Your supply chain now has a political variable it did not have last week. A US enforcement action against the source of these chips could affect the labs' ability to release the next model. Model availability depends on hardware a government controls. That is a different kind of risk than the one a model card describes. It belongs on the same line as model license and API uptime in your evaluation.

Source

Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs, Unemployment Labs, by Will DePue. Hacker News discussion.