What the Analysis Found
A forensic analysis of publicly released AI models finds evidence that DeepSeek, Moonshot AI, MiniMax and Ant Group have gained access to Nvidia’s Blackwell GPUs, despite restrictions on exporting these chips to China, and are using that hardware to create their AI models. The analysis, published on Thursday by researcher Will DePue of Unemployment Labs, examined the published weights of open-weight models to recover traces of the hardware that created them.
Six models released by the four companies since April 2026 contain numerical patterns matching Blackwell hardware, while earlier models from the same companies match Nvidia’s older Hopper generation. DeepSeek-V4-Flash and MiniMax-M3 match Blackwell B200 or B300 chips, which have 148 processor cores. DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash match the GB200 or GB300 chips, which have 152 processor cores.
“Our forensic analysis of publicly released AI models finds evidence that DeepSeek, Moonshot AI, MiniMax and Ant Group have gained access to NVIDIA’s Blackwell GPUs, despite restrictions on exporting these chips to China,” the report says. U.S. officials and press reports had already alleged that DeepSeek and Moonshot AI were using Blackwell chips, but without publishing technical evidence.
How a Weight Reveals a Chip
The evidence comes entirely from the models’ own published weights, rather than from leaks or insider accounts. Before training begins, a model’s weights need starting values, generated by a pseudorandom algorithm called Philox. The software framework PyTorch divides that work among parallel workers on the GPU, and the number of workers depends on how many processor cores, called streaming multiprocessors, the chip has.
Hopper chips have 132 cores and use 270,336 threads. Blackwell B200 and B300 chips have 148 cores and use 303,104 threads. Blackwell GB200 and GB300 chips have 152 cores and use 311,296 threads. Because the starting values land in different positions depending on the thread count, the arrangement of a model’s weights carries a fingerprint of the chip that created it. Some weights are never touched by training, so they preserve their starting values almost exactly.
For DeepSeek-V4-Flash and Kimi K3, the researchers also confirmed the match on physical Blackwell chips. Using DeepSeek’s recovered seed, an H100 reproduced DeepSeek-V3’s preserved values but not V4-Flash’s, while a B300 did the reverse. On the B300, unmodified PyTorch reproduced 461 of 469 selected V4-Flash rows with correlations above 0.99.
The Switch Happened in 2026
The pattern is consistent across the four labs, and it is recent. DeepSeek’s models read as Hopper-trained through DeepSeek-V3, released in December 2024, and as Blackwell from the V4 models in April 2026. Moonshot’s models read as Hopper through Kimi K2.5 in January 2026 and as Blackwell from K3 in July 2026. MiniMax’s models read as Hopper through M2.7 in April 2026 and as Blackwell from M3 in June 2026. Ant Group’s Ling-3.0-flash from August 2026 reads as Hopper, while Ling-3.1-flash from October 2026 reads as Blackwell.
The matches are far stronger than chance would explain. Across roughly 6 trillion seed-and-layout combinations in the search, the strongest chance match would be expected to reach about 8 sigma, a measure of distance from random variation. The strongest evidence for each of the six models ranges from 49 to 1,385 sigma, and even the weakest individual test reaches 20 sigma.
The method also gets known answers right. For 24 specific models, the developer has publicly said what hardware was used, and in every case the method agrees. The report cautions that the comparison is a consistency check rather than a measured accuracy rate, because 11 of those cases involve step-zero checkpoints and related models are not independent.
Data-Center Scale, and the Limits of the Evidence
The training runs were data-center scale. From each model’s size and the amount of data it was trained on, the report estimates that each run needed roughly 500 to 3,000 Blackwell GPUs for two to three months. At roughly $70,000 per GPU, the largest cluster would cost $150 million to $200 million, and the five together more than half a billion dollars. The report’s arithmetic checks out against a known case: applied to DeepSeek-V3, it gives 2,000 to 2,500 chips, and DeepSeek disclosed 2,048.
Not every Chinese lab has switched. The newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun all read as Hopper-trained. Meituan says its LongCat-2.0 was trained entirely on “AI ASIC superpods,” and the researchers found no Nvidia fingerprint in the weights it has released.
The limits matter as much as the finding. The fingerprint identifies how the weights were created and supports, without proving, the inference that Blackwell also performed the training. The report states that its findings “do not establish where the chips were located, how access was obtained, or whether export controls were violated.” Blackwell systems can be rented outside China, and B200, B300, GB200 and GB300 exports to China require a U.S. license, of which none have been reported.
Why It Matters
The analysis is the first technical evidence, rather than allegation, that leading Chinese AI developers are training frontier models on export-controlled Blackwell hardware. It lands in the middle of the Nvidia scandal, days after documents showed Moonshot AI renting B300 chips inside China, and as Congress weighs bills that would freeze the rules on chip sales to China and require tracking of exported chips.
For policymakers, the finding sharpens the question at the center of the export-control debate: whether the current rules are actually keeping advanced computing out of China, or whether the hardware is getting through by rental, diversion, or other routes the rules do not cover. The report does not answer that question, and its author is careful to say so. But it gives the debate something it did not have before: numbers, recovered from the models themselves, that can be checked.
