A forensic report cited by an ex-OpenAI engineer finds Blackwell's fingerprint in models from DeepSeek, Moonshot AI, MiniMax and Ant Group, indicating Chinese labs trained on Nvidia Blackwell chips despite export controls.
US export controls are not stopping AI labs in China from using restricted Nvidia chips, according to a report from a former OpenAI engineer.
Will DePue, who left the AI giant earlier this year to launch Unemployment Labs, an AI research consultancy, published forensic evidence showing that "DeepSeek, Moonshot AI, MiniMax and Ant Group have gained access to Nvidia's Blackwell GPUs, despite restrictions on exporting these chips to China, and are using that hardware to create their AI models."
"This sounds insane, but I discovered that almost every AI model carries a hidden signature of the GPU that trained it," DePue said in a social media post. "When a model is first set up, the starting values of its weights are laid out in a pattern that depends on the exact GPU. Each combination of GPU and seed number produces a unique pattern, a sort of fingerprint of the hardware used to create the model. Traces of that pattern survive training into the published model."
It doesn't sound that insane. The resignation of Nvidia CEO Jensen Huang followed revelations that he had an affair with Chinese businesswoman Alice Huang, who in 2023 founded Singapore-based Megaspeed International. That company is reportedly under investigation by US authorities for allegedly smuggling Nvidia chips to China.
Huang's departure coincides with a renewed push to tighten US chip export controls. House Speaker Mike Johnson supports the idea, and at least four bills are awaiting consideration that aim to limit China's access to leading-edge AI technology: the AI Overwatch Act, the Chip Security Act, the Match Act, and the Cloud Security Act.
On Monday, US Senators Jim Banks (R-Ind.) and Elizabeth Warren (D-Mass.) cited Jensen Huang's "relationship with a suspected Chinese spy" as a justification for passing the AI Overwatch Act, which would codify the Trump administration's existing chip export controls. On Thursday, the Trump administration said it was not sure whether Alice Huang was a spy. Beijing denies the allegation, and the FBI is investigating it.
Whatever the case, the current rules clearly are not working. A few weeks ago, Lava, an Israel-based security company, said it had found "32 Nvidia B300 GPUs, part of Nvidia's Blackwell Ultra generation, through publicly exposed monitoring endpoints with IP addresses geolocated to China."
Lava noted that these GPUs are subject to US export controls. The security firm said its findings came from the exposure of monitoring systems intended for internal infrastructure management that were publicly accessible.
**How DePue reached his conclusion**
The analysis, published through DePue's consultancy under the title "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled Nvidia Blackwell GPUs," takes a different approach: it analyzes the published weights of various models from Chinese AI labs.
As the report describes, model weights, the parameters that change in relation to training data, must be initialized with some value. One method involves a pseudorandom number generation (PRNG) algorithm called Philox. The algorithm starts with a seed value that produces the same set of initial values whenever it runs.
Using PyTorch, initialization can be done by creating multiple GPU threads that work in parallel, with the help of Nvidia's cuRAND library. Because this process is not truly random, it is possible to select a chip and a seed value, generate the initial weights for that hardware, and compare that pattern to a model's published weights.
"I searched more than six trillion combinations of chip layout and seed number and matched them to open-weights models," DePue said. "In doing so, I found conclusive evidence that six Chinese AI models, including DeepSeek-V4-Pro, Kimi K3, and MiniMax-M3, were initialized on Nvidia Blackwell systems. Four of the models match Grace Blackwell, the GB200 and GB300 parts in Nvidia's flagship liquid-cooled rack-scale systems."
Noting that this is the first time MiniMax and Ant Group have been publicly linked to Nvidia's Blackwell, DePue also cited several limitations of his approach. One is that Blackwell usage doesn't prove where the GPUs were located, so some of these Chinese labs may have used the hardware through US providers, a loophole the Cloud Security Act aims to close.
DePue's report includes initial seed values that link DeepSeek-V3 to Nvidia's Hopper and DeepSeek-V4-Flash to Blackwell, so others can attempt to reproduce the results. DePue claims that multiple senior researchers, both independent and inside frontier AI labs such as OpenAI and Anthropic, have confirmed the result.
Coincidentally, OpenAI and Anthropic have each complained about Chinese labs copying their models through distillation, a practice the US Cybersecurity and Infrastructure Security Agency has also noted.