A Researcher Says Six Chinese Open Models Were Started on Export-Controlled Blackwell GPUs. The Weights Cannot Say Where the Chips Were, and His GPU Count Changed the Same Day.
Will DePue of Unemployment Labs published a report on November 12 arguing that six Chinese open-weight models, DeepSeek-V4-Flash, MiniMax-M3, DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro, and Ling-3.1-flash, were initialized on NVIDIA Blackwell GPUs that need a US export license for China. The method reads untouched rows of the published weights against PyTorch's seeded random initializer, whose value layout depends on a chip's streaming multiprocessor count. An independent CPU-only reproduction matches the six layouts. The report itself says the evidence establishes neither smuggling nor an export violation, since Blackwell can be rented outside China; the fingerprint shows the chip class that created the starting weights, not where training ran. The GPU-count and dollar estimates are the author's and were revised upward the same day, and no lab, NVIDIA, or US government response had appeared when we checked. We read the report, the thread, and the reproduction repo.
By T.W. Ghost
Will DePue, a former OpenAI researcher now at Unemployment Labs, published a report today, November 12, 2026, titled "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs." The method is the interesting part. PyTorch fills a model's starting weights from a seeded Philox random generator, and the work is spread across 2,048 threads per streaming multiprocessor, so the same seed lands values in a layout set by the chip's SM count: 132 on Hopper, 148 on B200 and B300, 152 on GB200 and GB300. Rows that training never touches, such as unused vocabulary embeddings, keep those starting values. Test seed and layout against the published weights and you can read the chip class that created them.
By that reading, DeepSeek-V4-Flash and MiniMax-M3 were initialized on B200 or B300, and DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro, and Ling-3.1-flash on GB200 or GB300. Each lab's earlier model reads as Hopper. All four Blackwell parts need a US export license for China, and none has been reported. The catch is in the report's own text: the fingerprint shows the hardware that produced the starting weights, not where that hardware was or who owned it, and Blackwell can be rented outside China. The GPU counts and dollar figures attached to the finding are the author's estimates, and they changed the same day. We read the report, the X thread, the independent reproduction, and Unite.AI's summary. Here is what held up.
What the Report Reads
| Model | Reading | Earlier model from the same lab |
|---|---|---|
| DeepSeek-V4-Flash | B200 or B300 (148 SMs) | DeepSeek-V3 (Dec 2024): Hopper |
| DeepSeek-V4-Pro | GB200 or GB300 (152 SMs) | same |
| Kimi K3; Kimi K3.1-Pro | GB200 or GB300 | Kimi K2.5 (Jan 2026): Hopper |
| MiniMax-M3 | B200 or B300 | MiniMax-M2.7 (Apr 2026): Hopper |
| Ling-3.1-flash | GB200 or GB300 | Ling-3.0-flash (Aug 2026): Hopper |
| Newest readable models from Alibaba, Zhipu, Tencent, Xiaomi, StepFun | Hopper, not Blackwell |
How Strong, and How Checked
| Claim | Detail | Who |
|---|---|---|
| Statistical strength | 49 to 1,385 sigma per model; weakest single test 20 sigma; expected best chance match across about 6 trillion seed and layout combinations about 8 sigma | Report's statistical model |
| Physical check | A B300 reproduced 461 of 469 selected V4-Flash rows (r above 0.99), 445 bit for bit; an H100 reproduced V3 but not V4-Flash; a rented GB200 reproduced all 13 preserved Kimi K3 rows; a seed off by one gives no matches | Report claim |
| Consistency | Agreed with all 24 cases where a developer named the hardware; 11 are step-zero checkpoints and related models are not independent | Report claim; a consistency check, not an accuracy rate |
| Independent reproduction | CPU-only repo by Peter J. Liu matches the six layouts; a blind seed search recovers DeepSeek's seed at 148 SMs and finds single hits for MiniMax-M3 and Ling-3.1 | Verified (repo) |
| What the reproduction does not verify | Which chip has which SM count ("public spec pages disagree"); the GPU-count and cost estimates; the AMD test | Verified (repo's own caveat) |
| Validators | "Independently verified by senior researchers at OpenAI and Anthropic" | Author claim; names not given |
The Estimates, Both Versions
| Version | Figures | Who |
|---|---|---|
| First (Nov 12) | 2,000 to 3,000 GPUs for the largest runs; $150M to $200M for the largest cluster | Replaced the same day |
| Revised (Nov 12) | Kimi K3 about 4,500 and DeepSeek-V4-Pro about 3,000 Blackwell GPUs; about 12,000 across five runs; largest cluster about $200M to $300M at about $70,000 per GPU; five together above $0.5B; revision assumed lower efficiency, about 20% MFU | Author estimate, "not confident" |
| At Mistral Large 4 or MAI-Base-2 pace | The two largest runs would need about 8,000 to 9,000 Blackwell GPUs | Author estimate |
Initialization is not training. The fingerprint is set at step zero. Training could have moved to other hardware afterward; the GPU counts assume it did not.
Location and ownership are invisible. Rented Blackwell capacity outside China fits every row above. The report says the evidence alone establishes neither smuggling nor an export-control violation.
The chip map is the report's. 148 means B200 or B300 and 152 means GB200 or GB300 by the report's table. The reproduction did not check that against hardware, and notes that public spec pages disagree.
Nobody has answered. No statement from DeepSeek, Moonshot, MiniMax, Ant, NVIDIA, or the Commerce Department as of this writing. X summaries mention congressional calls for NVIDIA testimony; we found no primary source and do not print that as fact.
Verified vs Unconfirmed: The Scorecard
| Claim | Verdict |
|---|---|
| Report published Nov 12, 2026 by Will DePue, Unemployment Labs | Verified (primary) |
| Six models read as Blackwell; each lab's earlier model reads Hopper | Report finding |
| Other labs' newest readable models read Hopper | Report finding (via Unite.AI) |
| Sigma figures | Report's statistical model |
| B300, H100, and GB200 reproductions | Report claim |
| 24 of 24 agreement where hardware was named | Report claim; not an accuracy rate |
| Independent CPU reproduction of the six layouts | Verified (repo) |
| SM count to chip mapping | Unverified by the reproduction |
| GPU counts and dollar figures | Author estimates, revised the same day, "not confident" |
| OpenAI and Anthropic validators | Author claim, unnamed |
| B200, B300, GB200, GB300 need a US license for China; none reported; MI300X also controlled | Report claim |
| Congressional calls for NVIDIA testimony | Unverified (X summaries only) |
| Response from any lab, NVIDIA, or Commerce | None found |
What To Do
Read it as strong evidence of hardware access at initialization, and not as an enforcement finding; the report draws the same line, and the independent reproduction supports the layout reading and nothing past it.
Skip changing anything about the weights you run; they behave today as they did yesterday. The exposure is policy and procurement, in the report's framing possible future restrictions on models whose provenance is in dispute.
The frontier is elsewhere: the two labs named most here are the ones whose open models we have covered most: Kimi K3.1 Pro, which the report names and which leads AA's open-weights board under a custom license, and DeepSeek V4.1 Flash 1017, a later DeepSeek release the report does not list. Neither post changes on this report. Our model comparison has the current standings side by side.
Sources
- Unemployment Labs: checkpoint forensics report
- Will DePue on X: thread on the report (Thread Reader copy)
- GitHub: peterjliu/checkpoint-forensics-repro, independent CPU reproduction
- Unite.AI: Unemployment Labs reports Blackwell patterns in Chinese AI models
- Techmeme: coverage roundup, November 12
*Not sure whether a model's provenance should change which one you deploy? Take the free 2-minute quiz and get matched. Then read about the model at the top of both the fingerprint list and the open-weights board: Kimi K3.1 Pro.*