Weight forensics: ex-OpenAI researcher Will DePue finds six Chinese open models were started on export-controlled Nvidia Blackwell GPUs
Partly confirmed
Importance: major (4 of 5)Status
- Claim
Partly confirmed
- Our reporting
- Medium confidence
- Importance
- Major (4 of 5)
- Last verified
- 13 November 2026
Your AI and this story
- GPT-6 Astra196 days after its cutoff
- Claude Opus 5.5135 days after its cutoff
- Gemini 4 Hydrogen226 days after its cutoff
- Grok 4.7165 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 135 days before it.
Key facts
- Method (report): a model’s initial random weights depend on the exact GPU (number of streaming multiprocessors) and the seed; traces survive training. DePue searched about 6 trillion GPU-layout and seed combinations against published weights
- Blackwell matches: DeepSeek-V4-Flash and MiniMax-M3 (B200/B300, 148 SMs); DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash (GB200/GB300, 152 SMs). Earlier models (DeepSeek-V3, Kimi K2/K2.5, MiniMax-M2.7, Ling-3.0-flash) read as Hopper
- Hardware check: an unmodified PyTorch run with the recovered seed on a B300 reproduced DeepSeek-V4-Flash’s untouched initial weights bit for bit; a rented GB200 reproduced Kimi K3’s to a correlation of 0.999995; an H100 reproduced none, and changing the seed by one broke the match
- Statistics: best chance match expected around 8 sigma across the search; real matches 49 to 1,385 sigma, weakest single test 20 sigma. Validated on 24 open models whose developers disclosed their hardware (all agreed), including Nvidia’s Nemotron-3 Ultra (GB200)
- Not switched: newest readable models from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi and StepFun read as Hopper; Meituan’s LongCat-2.0 shows no Nvidia fingerprint (Meituan says it used ‘AI ASIC superpods’)
- Scale estimate (revised Nov 12, low confidence): about 4,500 Blackwell GPUs for Kimi K3 and 3,000 for DeepSeek-V4-Pro, about 12,000 across five runs; the first version said 2,000-3,000 per large run and $150-200M per cluster
- Limits stated in the report: the fingerprint shows where the weights were initialised and ‘supports, without proving’ that training ran there; specially configured AMD hardware is the only alternative found; it does not establish chip location, how access was obtained or whether export controls were violated
- DePue (X, 5.09M views by Nov 13): ‘I’ve found conclusive forensic evidence…’; he says senior researchers at OpenAI and Anthropic verified it independently (not confirmed by those companies)
Show 2 more
- Reactions: roon (OpenAI) ‘really bad’ (274k views); Dylan Patel (SemiAnalysis) said it was already obvious from the labs’ Blackwell-only open-source kernels (119k); Dean Ball called it ‘orders of magnitude stronger than literal dna evidence’ (47k); Teortaxes called the alarm ‘pretty silly’, estimating DeepSeek served V4.1-Flash on ~2.7-3K GB200s
- Same day, Reuters: a review of Chinese contracts and disclosures finds $3.2B+ in compute projects built or planned around US-restricted Nvidia GPUs; Techmeme ran the report as a lead story and it reached #6 on Hacker News (307 points)
What happened
DePue, who worked on Sora and post-training at OpenAI, published the report under the name Unemployment Labs on the evening of Nov 12, the day Jensen Huang resigned from Nvidia over the Megaspeed affair. It uses only the weights the labs themselves released. For two models it goes further and regenerates the starting weights on physical Blackwell machines rented for the purpose.
The report draws its own limits: a model can be initialised on one machine and trained on another, and the fingerprint says nothing about whether the chips sat in China, in a Southeast Asian data centre or were rented remotely. US officials and press had earlier alleged Blackwell use by DeepSeek and Moonshot without publishing technical evidence. None of the four labs had commented by Nov 13. Several engineers replied that Blackwell-specific kernels in the labs’ open-source code had already pointed the same way.
Why it matters
It turns a policy dispute (are export controls working?) into a checkable claim based on public artefacts, at the moment Congress is questioning Nvidia and the Commerce Department. Commentators such as Nathan Calvin read it as evidence that controls are poorly enforced rather than ineffective. The technique could also be used to audit other open models’ hardware provenance.
Sources
7 sources from 4 sites. Numbers match the chips in the text.
7 sources: 1 primary, 1 press, 5 reactions
Primary
- Unemployment Labs (Will DePue): Top Chinese frontier AI models carry the fingerprint of export-controlled NVIDIA Blackwell GPUsunemploymentlabs.com, paper
Press
- Reuters: Huang exit and US scrutiny imperil $3 billion in Chinese AI projects reliant on Nvidia (Nov 13)reuters.com, press
Reactions
- Will DePue on X: announcement thread (5.09M views)x.com, discussion
- Hacker News discussion (307 points)news.ycombinator.com, discussion
- Dylan Patel on X: kernels were already Blackwell-onlyx.com, discussion
- Dean Ball on X: ‘stronger than literal dna evidence’x.com, discussion
- roon on X: ‘really bad’x.com, discussion
Changes
- Filed (news agent)