Chinese frontier AI models carry the fingerprint of export-controlled GPUs

Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs Will DePue November 12, 2026 Print / save PDF Cite this report Executive Summary Our forensic analysis of publicly released AI models finds evidence that DeepSeek, Moonshot AI, MiniMax and Ant Group have gained access to NVIDIA’s Blackwell GPUs, despite restrictions on exporting these chips to China, and are using that hardware to create their AI models. Six models released by these companies since April 2026 contain numerical patterns matching Blackwell hardware, whereas earlier models from the same companies match NVIDIA’s older Hopper generation. The findings suggest that several leading Chinese AI developers have begun using Blackwell to train their newest models. U.S. officials and press reports had already alleged that DeepSeek and Moonshot AI were using Blackwell chips, without publishing technical evidence. The evidence comes entirely from the models’ own published weights, rather than from leaks or insider accounts. We recover traces of the models’ initial values, and then search for the hardware configurations and initial configurations that reproduce them; for DeepSeek-V4-Flash and Kimi K3, we also confirmed the match on physical Blackwell chips. The fingerprint identifies how the weights were created and supports, without proving, the inference that Blackwell also performed the training. Specially configured AMD hardware, which is also restricted from export to China, is the only alternative we have identified; we have excluded it for DeepSeek-V4-Flash, and consider it very unlikely for the other five models. Notably, our findings provide technical evidence of access to advanced computing hardware, but do not establish where the chips were located, how access was obtained, or whether export controls were violated. Table 1. Hardware fingerprints in successive models from DeepSeek, Moonshot AI, MiniMax and Ant Group Link ↗ Lab Model Released Chip the model was started on DeepSeek DeepSeek-V3 Dec 2024 NVIDIA Hopper (lab disclosed H800) DeepSeek-V4-Flash Apr 2026 • NVIDIA Blackwell B200/B300 DeepSeek-V4-Pro Apr 2026 • NVIDIA Blackwell GB200/GB300 Moonshot AI Kimi K2 Jul 2025 NVIDIA Hopper (lab disclosed H800) Kimi K2.5 Jan 2026 NVIDIA Hopper (lab disclosed H800) Kimi K3 Jul 2026 • NVIDIA Blackwell GB200/GB300 Kimi K3.1-Pro Nov 2026 • NVIDIA Blackwell GB200/GB300 MiniMax MiniMax-M2.7 Apr 2026 NVIDIA Hopper MiniMax-M3 Jun 2026 • NVIDIA Blackwell B200/B300 Ant Group Ling-3.0-flash Aug 2026 NVIDIA Hopper Ling-3.1-flash Oct 2026 • NVIDIA Blackwell GB200/GB300 • Requires a U.S. license for export to China; none have been reported. A Hopper fingerprint cannot distinguish an H800 from an H100 SXM or H200; the H800 identifications above are lab disclosures, not findings of this method. Full list of models in Appendix 2 ↓ Main Findings Six models from four Chinese labs read as Blackwell-trained. DeepSeek-V4-Flash and MiniMax-M3 match NVIDIA’s Blackwell-class B200 or B300 chips, which have 148 processor cores (called streaming multiprocessors , or SMs). DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash match the GB200 or GB300 chips, also Blackwell-class, which have 152 processor cores. Kimi K3.1-Pro starts from the same seed as K3, and may be a checkpoint of K3 with further post-training. Chinese labs started training on Blackwell relatively recently. DeepSeek’s models read as Hopper-trained through DeepSeek-V3 (released in December 2024), and as Blackwell from DeepSeek V4 (released in April 2026). Moonshot’s models read as Hopper through Kimi K2.5 (January 2026) and as Blackwell from K3 (July 2026). One Moonshot model sits in between: Kimi K2.7-Code, posted six weeks before K3, is built on the Hopper-era weights but contains a small part that matches the B200 or B300. MiniMax’s models read as Hopper through M2.7 (April 2026) and as Blackwell from M3 (June 2026). Ant Group’s Ling-3.0-flash (August 2026) reads as Hopper, while its Ling-3.1-flash (October 2026) reads as Blackwell. The Hopper readings do not identify a specific chip: H800s, H100 SXMs and H200s share the same fingerprint. Not every Chinese AI lab has switched to Blackwell. The newest models we could read from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi and StepFun all read as Hopper-trained. Meituan says its LongCat-2.0 was trained entirely on “AI ASIC superpods,” and we found no NVIDIA fingerprint in the model weights it’s released. The method gets known answers right. For 24 specific models, the developer has publicly said what hardware was used. In every case, our method agrees with the public announcement. NVIDIA’s own Nemotron-3 Ultra, whose technical report names the GB200 for one phase of its training, reads as 152 SMs, the same as Kimi K3. The matches are far stronger than chance would explain. Even unrelated numbers can appear to match when enough combinations are tried. Across the roughly 6 trillion seed-and-layout combinations in our search, the strongest chance match would be expected to reach about 8 sigma—a measure of how far a result stands above ordinary random variation. The strongest evidence for each of the six models ranges from 49 to 1,385 sigma. Even the weakest individual test we report reaches 20 sigma. The training runs were data-center scale. From each model’s size and the amount of data it was trained on, we estimate that each run needed roughly 500 to 3,000 Blackwell GPUs for two to three months (Table 2), assuming each model was trained on the hardware that initialized it. The same arithmetic applied to DeepSeek-V3 gives 2,000 to 2,500 chips; DeepSeek disclosed 2,048. At roughly $70,000 per GPU—the cost implied by a Wall Street Journal report that about 36,000 Blackwell chips being installed in Malaysia for ByteDance’s use would cost more than $2.5 billion—the largest of these clusters would cost $150 million to $200 million, and the five together more than half a billion dollars. These figures cover only the final training runs; the labs’ total spending on export-controlled GPUs is likely in the billions of dollars. Table 2. Rough scale of each training run Link ↗ Model Blackwell GPUs, best estimate Range DeepSeek-V4-Flash 1,000–1,500 250–4,500 DeepSeek-V4-Pro 2,000–2,500 750–6,000 Kimi K3 2,000–3,000 1,000–8,000 MiniMax-M3 500–600 200–2,000 Ling-3.1-flash 1,100–1,650 400–6,500 Training compute (about 6 × active parameters × training tokens) divided by chip throughput at 35% utilization, over a run of two to three months (six to eight weeks for DeepSeek-V4-Flash). DeepSeek disclosed its token counts; for the other models, we estimated them from the weights. Our investigation A model’s weights , also called parameters , are the billions of adjustable numbers that determine how it processes information and produces answers. Training repeatedly adjusts these numbers; but before training can begin, they need initial values. In the software examined here, those values come from a pseudorandom number generation (PRNG) algorithm called Philox: Philox produces seemingly random numbers in a deterministic way. The starting input for Philox is a number called the “seed.” Given the same seed and settings, Philox produces the same numbers every time. This lets engineers repeat an experiment from the same starting point. To fill billions of weights quickly, PyTorch, the software framework used in the development of most major AI models, divides the work that Philox does among many parallel workers on the GPU, called threads . (It does this through cuRAND, NVIDIA’s library for random number generation.) Each thread generates its own sequence of numbers from the seed and fills a particular set of positions. The number of threads then determines how those positions are shared out. On the NVIDIA chips examined here, a sufficiently large initialization uses the maximum o