Report finds Blackwell signatures in six Chinese open models — and urges caution

A November 12 analysis by Will DePue of Unemployment Labs, reported by Unite.AI, finds weight-initialization patterns consistent with Nvidia's export-controlled Blackwell GPUs in six open-weight models from DeepSeek, Moonshot AI, MiniMax and Ant Group.

The mapping is specific. DeepSeek-V4-Flash and MiniMax-M3 read as initialized on B200 or B300 systems, while DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash read as GB200 or GB300. The match identifies the hardware layout behind the starting weights; whether those same chips performed training is a separate inference.

The method exploits reproducibility. Before training, the PyTorch and cuRAND setup uses the Philox generator to derive repeatable values from a seed, and GPU threads distribute them across weight positions; a large enough initialization uses 2,048 threads per streaming multiprocessor. Change the SM count, and the same numbers land in different places.

Hopper H100 SXM, H200 and H800 chips have 132 SMs and 270,336 threads; B200 and B300 have 148 SMs and 303,104 threads; GB200 and GB300 have 152 SMs and 311,296 threads. The report says its strongest matches range from 49 to 1,385 sigma, with every individual test at 20 sigma or above.

Physical checks back the statistical ones. Using DeepSeek's recovered seed, an H100 reproduced DeepSeek-V3's preserved values but not V4-Flash's, while a B300 did the reverse; on the B300, unmodified PyTorch reproduced 461 of 469 selected V4-Flash rows, including 445 bit-for-bit matches. A rented GB200 reproduced all 13 preserved Kimi K3 rows with Moonshot's seed.

The caveats are substantial. Initialization alone cannot inventory every processor used later, a lab could generate initial values on one system and move them, mixed clusters may leave only partial traces, and a Hopper reading does not rule out subsequent Blackwell training. Weights cannot establish chip ownership, location or acquisition, and the report says the evidence alone establishes neither smuggling nor an export-control violation.

The signal is not universal, either. The newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun produced Hopper readings, and AMD's MI300X is a viable alternative that can be configured to reproduce the 148 and 152 layouts. On DeepSeek-V4-Flash, however, 363 of 377 preserved values that distinguish vendors matched Nvidia and none matched AMD.

What makes the report notable is the shift it implies in enforcement. Export controls have been policed through licenses, shipping records and investigations; a weights-based fingerprint turns a model release into a testable claim about the hardware behind it. The report notes that B200, B300, GB200 and GB300 exports to China require a U.S. license and that no such licenses have been reported.

Watch whether developers respond with cluster details, whether outside researchers can reproduce the readings on more models, and whether regulators treat the technique as evidence. The method also has limits: it needs public weights and a hardware-dependent initialization signature, and CPU initialization or non-CUDA frameworks leave nothing to read.