Blackwell fingerprints in DeepSeek, Kimi and MiniMax weights: how checkpoint forensics reads the GPU behind a model

On November 12, Will DePue, a former OpenAI researcher who now runs the nonprofit Unemployment Labs, published a checkpoint forensics report claiming that six open-weight models from four Chinese labs carry the numerical fingerprint of Nvidia Blackwell GPUs. The models are DeepSeek-V4-Flash and V4-Pro, Moonshot AI’s Kimi K3 and K3.1-Pro, MiniMax-M3 and Ant Group’s Ling-3.1-flash. Blackwell chips have required a US export license for China since before they shipped, and none has been reported.

The timing is pointed. The report landed the same day Jensen Huang resigned as Nvidia’s CEO amid questions about Megaspeed and chip diversion, which we covered in our report on Huang’s exit. TechCrunch and The Decoder picked it up on November 13. What makes it worth reading closely is not the geopolitics but the technique: it turns a published checkpoint into evidence about the hardware that created it, and the code is public.

How a random seed leaks the chip

Before training, every weight in a model is filled with random numbers. In PyTorch on an Nvidia GPU, those numbers come from the Philox generator in cuRAND, and the work is split across GPU threads. Each thread produces its own stream, and which positions in a tensor each thread fills depends on how many threads there are. The report counts 2,048 threads per streaming multiprocessor (SM), which gives distinct totals per chip class:

• Hopper (H100, H200, H800): 132 SMs, 270,336 threads
• Blackwell B200/B300: 148 SMs, 303,104 threads
• Blackwell GB200/GB300: 152 SMs, 311,296 threads

So the same seed produces a different arrangement of values on each class of chip. If you can recover the seed and find the thread count that reproduces the published starting values, you have identified the chip family that ran the initialization.

Two kinds of evidence survive training. Some rows are never updated at all, such as embeddings for tokens that never appear in the training data; these keep their exact initial values. Trained weights keep a faint trace too: larger starting values still predict slightly larger final values. In DeepSeek-V4-Flash the report measures a correlation of just r = 0.066 under the Blackwell layout, which is small but, across billions of parameters, 57 standard deviations above chance, and absent under the Hopper layout.

DePue searched roughly 6 trillion seed and layout combinations, selected candidates on one set of weights and validated them on held-out weights. Because the search is so large, he treats about 8 sigma as the level a lucky chance match could reach. The Blackwell readings run from 49 sigma (V4-Pro) to 1,385 sigma (V4-Flash).

The six models and the controls

Lab	Model	Released	Reading	Evidence
DeepSeek	V4-Flash	Apr 2026	148 SMs (B200/B300)	exact copy, 1,385 sigma
DeepSeek	V4-Pro	Apr 2026	152 SMs (GB200/GB300)	partial survival, 49 sigma
Moonshot	Kimi K3	Jul 2026	152 SMs	exact copy, 305 sigma
Moonshot	Kimi K3.1-Pro	Nov 2026	152 SMs	same seed as K3, 305 sigma
MiniMax	M3	Jun 2026	148 SMs	exact copy, 323 sigma
Ant Group	Ling-3.1-flash	Oct 2026	152 SMs	untrained rows, r = 0.98, 244 sigma

The controls are the strongest part of the report. On real hardware, an unmodified PyTorch install on an H100 with DeepSeek’s recovered seed (953049583) reproduced all 57,344 preserved values in DeepSeek-V3 bit for bit, and none of V4-Flash’s. A B300 with the same seed reproduced 461 of 469 selected V4-Flash rows, 445 of them bit-exact, and none of V3’s. A rented GB200 reproduced all 13 preserved rows in Kimi K3. Shifting the seed by one matched nothing on any machine.

Earlier releases from the same labs read as Hopper: DeepSeek through V3.2, Moonshot through K2.5, and the 2026 releases from Zhipu, Alibaba, Tencent, Xiaomi and StepFun. The method also returns nothing where it should. Qwen3 models initialized on CPU show no GPU layout; Baidu’s ERNIE-5.5, built on PaddlePaddle, yielded its seed (2760) but no hardware; Meituan’s LongCat-2.0, which its model card says was trained on “AI ASIC superpods,” shows no Nvidia signature. Across 24 models whose developers publicly disclosed their hardware, including Llama 3.1 (H100), eight Pythia models (A100, read as 108 SMs) and Nvidia’s own Nemotron-3 Ultra (GB200 for one phase), the reading matched every time. DePue calls that a consistency check rather than a measured accuracy rate, since 11 of those are step-zero checkpoints.

One mixed case is telling: about 80% of Kimi K2.7-Code’s preserved rows carry the Hopper layout and about 20% a 148-SM layout. The report reads it as a merged checkpoint and leaves it out of the six.

AMD is the obvious alternative, since an MI300X can be configured to 148 or 152 compute units and reproduce the same layouts. For V4-Flash, DePue used a calculation where Nvidia and AMD round differently: of 377 values that differ between the two, the published weights match Nvidia in 363 and AMD in none. That test could not settle the other five models, which the report only calls “very unlikely” to be AMD.

What the evidence does not show

The report is careful about its limits, more careful than some of the coverage around it. The fingerprint identifies the hardware that generated the starting weights, not every chip used in training. It says nothing about where the GPUs sat, who owned them or how access was obtained, and Chinese labs can legally rent Blackwell capacity in data centers outside China, for example in Malaysia. The report explicitly does not claim smuggling or an export-control violation. It says the fingerprint supports, without proving, the inference that Blackwell also did the training.

Critics raised the most direct escape hatch: initialize on rented Blackwell GPUs, then train somewhere else. DePue’s reply, per HuggingNews, is that the method matched disclosed training hardware in all 24 known cases, and that shipping a Kimi K3 starting checkpoint of more than 5 TB between clusters would be an odd choice. That argument is about plausibility, not proof.

Coverage is also partial by design. Closed models cannot be tested, frameworks that do not use a hardware-dependent generator leave no trace, and labs can simply change their initialization. DeepSeek’s September V4.1-Flash produced zero matches across 4.3 billion seeds; DePue says DeepSeek changed its initialization between V4 and V4.1 and that he has not yet tested Huawei Ascend random number generators against it, so that model’s hardware is unknown.

The compute estimates are the softest numbers in the report. A first version suggested 2,000 to 3,000 Blackwell GPUs per model; the revision puts the total best estimate at about 12,000 across all five distinct training runs, with wide ranges (Kimi K3 at 4,500, range 1,000 to 9,500), assuming about 20% model FLOPs utilization and 50 to 100 day runs. DePue labels these low-confidence.

Finally, the thread around the report says senior researchers at OpenAI and Anthropic verified the result, but none is named and neither company has commented. As of November 13 there was no response from Nvidia, the four labs or the Commerce Department in any of the coverage we reviewed.

Why it matters beyond this week’s scandal

Until now, claims that Chinese frontier models were trained on banned chips rested on intelligence sources and supply-chain reporting. White House technology adviser Michael Kratsios had said Moonshot used export-banned Nvidia chips, citing US intelligence, without publishing evidence. SemiAnalysis’s Dylan Patel had argued from architecture alone that DeepSeek-V4 was designed for Blackwell and Huawei Ascend while V3 was tuned for Hopper. DePue’s report is the first public, reproducible test: the verification code and preserved rows for DeepSeek-V3, V4-Flash, Kimi K3, MiniMax-M3 and Ling-3.1-flash are on GitHub, and the CPU check runs in seconds on a laptop.

That changes the policy argument in two directions. For enforcement, it gives regulators a cheap, independent signal that does not depend on tracing shipments. Epoch AI estimates about 2 million advanced chips entered China in 2024 and 2025 through schemes designed to hide their destination, and Reuters has reported about 600,000 H200s stockpiled in Hong Kong. For open-weight developers everywhere, it is a reminder that a checkpoint leaks more than its architecture. Seeds, chip classes and even merges between checkpoints from different clusters can be recovered from published tensors.

It is also easy to defeat once known. Initializing on CPU, reshuffling or re-randomizing untouched rows, or using a framework without a hardware-dependent generator would erase the signal, and DeepSeek’s V4.1-Flash already shows none. Expect this to be a one-time window into releases made before the method was public, not a permanent audit tool.

What to watch next

• Independent replication. The code is public; outside researchers rerunning it on the five released cases, and anyone extending the AMD test to the other models, will matter more than unnamed endorsements.
• Responses from the labs and Commerce. DeepSeek, Moonshot, MiniMax and Ant Group have not addressed the findings, and Commerce is under separate pressure over its Megaspeed investigation.
• The Ascend test on V4.1-Flash. If Huawei’s generator reproduces DeepSeek’s newest weights, it would be the first forensic evidence of a Chinese frontier model initialized on domestic chips.
• Changes to release practices. Watch whether the next open-weight releases from these labs scrub untrained rows or switch to CPU initialization, which would itself be informative.
• Nvidia’s Asian revenue. Michael Burry and others have revived questions about Nvidia’s shipments to Singapore and Southeast Asia; Nvidia’s next earnings report, under interim CEO Colette Kress, is the first place that question can be asked directly.