Will DePue Forensics Tie Six Chinese AI Models to NVIDIA Blackwell

Six Models Match Blackwell Fingerprints

A forensic study published on November 12 claims that the six newest models from four leading Chinese AI labs were built on NVIDIA's Blackwell chips, which United States export rules bar from shipment to China. The author is Will DePue, a former OpenAI researcher, who announced the result in a post on X and released the full method and code alongside it. The report names DeepSeek-V4-Flash and DeepSeek-V4-Pro from DeepSeek, Kimi K3 and Kimi K3.1-Pro from Moonshot AI, MiniMax-M3 from MiniMax, and Ling-3.1-flash from Ant Group, all six released after April 2026. DeepSeek-V4-Flash and MiniMax-M3 match the B200 or B300; the remaining four match GB200 or GB300, NVIDIA's flagship rack-scale systems. The identification rests on initialization values, the random starting numbers assigned to model weights before training begins. According to the report, those values are laid down in an arrangement tied to the specific chip that generated them, so a released checkpoint carries a readable trace of its training hardware. The method cannot show where a chip sits or who owns it, a limit the report states itself. Run against the same companies' earlier releases, the test reads as the previous Hopper generation: DeepSeek up to V3 in December 2024, Moonshot up to Kimi K2.5 in January 2026, and MiniMax up to M2.7 in April 2026. DeepSeek and Moonshot had previously said they trained on H800 parts. On that reading, the switch to Blackwell came only this year.

@willdepue · X post

A post on X.

View on X

Seed Forensics and Its Limits

The mechanism is specific. Frameworks such as PyTorch generate a model's starting values from a single seed number, distributing the work across many GPU threads in parallel. Thread count tracks the chip's compute units: 132 on Hopper, 148 on the B200 and B300, and 152 on the GB200 and GB300. The same seed therefore yields the same numbers laid down in different positions, and weights that training never touched keep their starting values nearly intact. DePue reports searching about 6 trillion combinations of seed and chip arrangement against the public checkpoints. Pure chance, the report estimates, would produce matches of at most roughly 8 standard deviations, while the six models' strongest evidence runs between 49 and 1,385 standard deviations, and the weakest single test still reads 20. The result was also reproduced on physical hardware: seed 953049583 regenerates DeepSeek-V4-Flash's untouched initialization values bit-for-bit on a B300 but not on an H100, and a rented GB200 reproduced Kimi K3 at a correlation of 0.999995. Tests against 24 models whose developers disclosed their training hardware all agreed, which the report calls a consistency check rather than a measured accuracy rate. The report also sets its own boundaries. It identifies only the chip that produced the initial weights, not the full training run, and it states that weights cannot reveal a chip's owner or location; Blackwell systems can be rented in data centers outside China, so the evidence itself cannot prove smuggling or a breach of export controls. Scale estimates put Kimi K3 at roughly 4,500 Blackwell GPUs and DeepSeek-V4-Pro at about 3,000, with five runs totaling near 12,000, figures DePue revised on November 12 while writing that he has little confidence in them, since none of the labs has disclosed training efficiency or duration. Not every lab switched: Alibaba's Qwen, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper, and Meituan's LongCat-2.0, which Meituan says was trained entirely on its own AI chips, shows no NVIDIA fingerprint. DePue says senior researchers at OpenAI and Anthropic independently verified the result, without naming them, and no company involved, NVIDIA included, has responded publicly.

For export-control enforcement, the finding moves the audit from the port to the checkpoint. Released weights have long been treated as public artifacts; a reliable fingerprint turns each release into a de facto hardware disclosure, one no lab can easily retract. The method's limits are equally structural: it names a chip family, not a shipment, and rented capacity abroad sits entirely inside its blind spot, which is where the policy question now goes. If the four labs stay silent, the burden shifts to regulators to establish where the chips actually were; if the fingerprinting holds under replication, every future model release from China will be read twice, once for capability and once for hardware.