Unverified: Will DePue Claims Conclusive Evidence That DeepSeek, Moonshot, MiniMax and Ant Group Trained on Banned Nvidia Blackwell Chips
I have a major result to share. I’ve found conclusive forensic evidence that the top 4 Chinese AI labs—DeepSeek, Moonshot, MiniMax and Ant Group—have built their newest models on NVIDIA’s most advanced Blackwell chips, which are barred from export to China. This sounds insane, but I discovered that almost every AI model carries a hidden signature of the GPU that trained it. When a model is first set up, the starting values of its weights are laid out in a pattern that depends on the exact GPU. Each combination of GPU and seed number produces a unique pattern—a sort of fingerprint of the hardware used to create the model. Traces of that pattern survive training into the published model. Again, this evidence isn’t based on any insider information or leaking. It’s based on a forensic analysis of the model weights released by the companies themselves. I searched more than six trillion combinations of chip layout and seed number and matched them to open-weights models. In doing so, I found conclusive evidence that six Chinese AI models—including DeepSeek-V4-Pro, Kimi K3, and MiniMax-M3—were initialized on NVIDIA Blackwell systems. Four of the models match Grace Blackwell, the GB200 and GB300 parts in NVIDIA’s flagship liquid-cooled rack-scale systems. I then verified these results on real hardware. Running unmodified PyTorch with the seeds I’d recovered, a Blackwell B300 reproduced DeepSeek-V4-Flash’s untouched starting weights bit for bit, and a rented GB200 reproduced Kimi K3’s to a correlation of 0.999995. A Hopper H100 reproduced none of DeepSeek-V4-Flash’s, and changing the seed by one broke the match. (DeepSeek’s seed is 953049583 by the way.) The method also was verified to match 24 known open-weights models to the hardware that developers said they used. It is exceedingly unlikely that these results are a coincidence. Across six trillion combinations, the best accidental match should reach only about 8 sigma (i.e., eight standard deviations above what random chance would produce). The real matches range from 49 to 1,385 sigma, and even the weakest single test hits 20. These were data-center-scale training runs. With some analysis of release schedules and model details, I estimate that the largest, Kimi K3 and DeepSeek-V4-Pro, used 2,000 to 3,000 Blackwell GPUs each. Clusters of this size cost on the order of $150 to $200 million each to buy, and across these labs alone would add up to more than half a billion dollars of export-controlled GPUs, not counting experimental compute or otherwise. It’s quite likely that we see multi-billion dollar expenditure on export-controlled GPUs. I am highly confident in this result, and it has been independently verified by senior researchers at OpenAI and Anthropic. You can read the full report at t.co/YOtzND0Jqk. There is much more I’ve identified about these models through other forms of checkpoint forensics like this, and will have more to share soon.
Context
If this unverified claim holds, four major Chinese labs trained their newest models on Nvidia Blackwell chips that cannot legally be shipped to China.
Will DePue posted on November 12 that he has conclusive forensic evidence that DeepSeek, Moonshot, MiniMax and Ant Group built their newest models on Nvidia's most advanced Blackwell chips, which he says are barred from export to China. He says the finding comes from a forensic analysis of published model weights, not from insider information, and he links to a full report. This is an unverified claim. In a quote post, roon wrote that all major Chinese models are being trained on Blackwell class chips.
Deep dive
Will DePue posted on November 12 that he has found conclusive forensic evidence that DeepSeek, Moonshot, MiniMax and Ant Group built their newest models on Nvidia's most advanced Blackwell chips, which he says are barred from export to China. He says the finding comes from a hidden GPU signature in published starting weights, not from insider information.
DePue says he searched more than six trillion chip and seed combinations and found conclusive evidence that six Chinese AI models, including DeepSeek V4 Pro, Kimi K3, and MiniMax M3, were initialized on Nvidia Blackwell systems, four of them matching Grace Blackwell GB200 and GB300 parts. A table on the post, titled Table 1, lists those labs' models and the GPU he says each was created on, with six newer models marked in red as Nvidia Blackwell. The table notes that red requires a U.S. license for export to China and that none has been reported.
He says a Blackwell B300 reproduced DeepSeek V4 Flash's starting weights bit for bit, and a rented GB200 reproduced Kimi K3's to a correlation of 0.999995, while a Hopper H100 reproduced none of them and changing the seed by one broke the match. He also says the method matched 24 known open weights models to the hardware developers said they used, with real matches from 49 to 1,385 sigma.
DePue estimates Kimi K3 and DeepSeek V4 Pro used 2,000 to 3,000 Blackwell GPUs each, costing on the order of $150 to $200 million per cluster, or more than half a billion dollars of export controlled GPUs across these labs. He says he is highly confident and that senior researchers at OpenAI and Anthropic have independently verified the result. He points readers to a full report. In a quote post, roon wrote, "really bad. all major Chinese models are being trained on Blackwell class chips."
No first hand confirmation from Nvidia, DeepSeek, Moonshot, MiniMax, Ant Group, OpenAI, or Anthropic was found for this post. The findings are DePue's own claim and should be treated as unverified.
What to expect next
Watch for first hand confirmation or rebuttal from Nvidia, DeepSeek, Moonshot, MiniMax, or Ant Group, and for OpenAI or Anthropic to say whether their researchers verified the result on the record. Independent researchers can also try to reproduce the weight signature tests DePue describes. Policymakers may ask how export controlled Blackwell systems could have been used at this scale if the claim holds. Until a lab, a chipmaker, or a government confirms the finding, treat it as an unverified claim.