The hardware hidden inside an AI model
One of the biggest questions surrounding China's artificial intelligence industry is how its leading companies continue to develop increasingly capable models despite restrictions on access to America's most advanced AI chips.
Washington has spent years trying to limit China's access to advanced semiconductor technology, particularly NVIDIA's high-performance processors. Yet Chinese laboratories continue to release competitive models, creating a persistent debate about whether export controls are slowing China's AI ambitions or simply forcing its companies to find alternative routes.
A new investigation by Will DePue, published through Unemployment Labs on November 12, introduces an unusual piece of evidence into that debate.
Rather than examining shipping records, corporate disclosures or leaked information, DePue looked inside the numerical structures of publicly released AI models. His central finding is that six recent models from four major Chinese AI developers carry initialization patterns consistent with NVIDIA's Blackwell generation of processors.
The companies identified are DeepSeek, Moonshot AI, MiniMax and Ant Group. The models include DeepSeek-V4-Flash, DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro, MiniMax-M3 and Ant Group's Ling-3.1-flash.
The significance is not simply that these companies may have accessed powerful processors. It is that the evidence, if independently reproduced, suggests researchers can sometimes determine the computing hardware behind an AI model by examining the model itself.
How can a model reveal which GPU created it?
The discovery rests on an aspect of AI development that normally receives little public attention: weight initialization.
An AI model consists of billions of numerical parameters, commonly called weights. During training, these values are repeatedly adjusted as the model learns patterns from its training data.
But before training begins, the weights need initial values. These are commonly generated using pseudorandom number generators, which produce deterministic sequences based on a starting number known as a seed.
The important detail is how those numbers are distributed across the GPU.
Modern processors perform these operations in parallel. NVIDIA GPUs divide computational work among thousands of threads distributed across processing units called streaming multiprocessors, or SMs.
Different GPU configurations distribute the generated numbers across memory differently. Even when two GPUs use the same random seed, differences in their processing-unit counts can change where the numbers are placed in the model's initial weight structure.
This creates a potential hardware fingerprint.
Training changes the weights, but it does not necessarily erase every trace of their original arrangement. Some parameters may remain untouched, while others retain weaker statistical relationships with their starting values.
DePue developed a method to recover these patterns by testing different combinations of random seeds and GPU configurations against published model weights.
He searched approximately six trillion combinations.
The results were striking. The newest models from the four Chinese companies showed patterns consistent with Blackwell processors, while several earlier models from the same developers matched NVIDIA's previous Hopper generation.
This is particularly interesting because it creates a historical comparison. Rather than identifying an isolated model, the analysis suggests a transition in the hardware fingerprints associated with several Chinese AI laboratories.
Six models point toward Blackwell
The investigation identifies two distinct groups of Blackwell hardware.
DeepSeek-V4-Flash and MiniMax-M3 match the 148-streaming-multiprocessor configuration associated with NVIDIA's B200 and B300 processors.
DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash match the 152-SM configuration associated with the GB200 and GB300 Grace Blackwell systems.
The distinction matters because the latter processors belong to NVIDIA's more advanced rack-scale computing architecture, combining Grace CPUs with Blackwell GPUs.
The researcher also tested the method against 24 models for which developers had publicly disclosed their training hardware. According to the report, the results matched the disclosed hardware in all 24 cases.
More importantly, DePue attempted to reproduce the recovered initialization patterns on actual hardware.
Using an NVIDIA B300 and the recovered seed, he reproduced DeepSeek-V4-Flash's untouched starting weights, with hundreds of selected rows matching bit for bit. On a rented GB200, he also reproduced the preserved initialization values associated with Kimi K3.
Changing the seed by just one destroyed the matches. An H100 from NVIDIA's older Hopper generation also failed to reproduce DeepSeek-V4-Flash's Blackwell-associated pattern.
These experiments make the findings considerably more interesting than a statistical comparison performed entirely in software.
Why the statistical evidence matters
Searching trillions of combinations introduces an important statistical problem.
When researchers test enough possibilities, some results will appear significant simply through coincidence. A convincing forensic method must account for the enormous number of combinations examined.
DePue estimates that the strongest accidental match across his search should reach approximately eight sigma. Sigma measures how far an observation lies from what would normally be expected under a statistical model.
The strongest reported evidence for the six models ranges from 49 to 1,385 sigma, with the weakest individual test reaching 20 sigma.
These numbers are far beyond the report's estimated threshold for accidental matches.
The researcher also separated the process of finding a fingerprint from testing it. After identifying a promising seed and hardware configuration using one group of weights, he tested the same combination against previously unused weights.
That distinction is important. It reduces the possibility that the method simply found a coincidental pattern in the data it was designed to examine.
DePue says the results have also been independently verified by senior researchers at OpenAI and Anthropic. However, the public report does not identify those researchers or provide enough detail to independently assess the scope of their verification.
The next important milestone will be the publication of the implementation code and a fuller technical paper, allowing other researchers to reproduce the findings independently.
The scale of the computing infrastructure
The implications extend beyond identifying which processors may have been used.
Training frontier AI models requires enormous computing resources, and Blackwell processors are among the most expensive and strategically important components in the global AI infrastructure race.
DePue estimates that the five major training runs examined required approximately 12,000 Blackwell GPUs in total, although the uncertainty is substantial.
His revised estimates put Kimi K3 at approximately 4,500 GPUs and DeepSeek-V4-Pro at approximately 3,000 GPUs. The report's estimated ranges are much wider, reflecting uncertainty about training duration, computing efficiency and the amount of data processed.
The estimated hardware bill for the five runs exceeds half a billion dollars.
These are not confirmed purchase records. They are estimates derived from assumptions about model size, training compute, hardware performance and the duration of training.
Nevertheless, the numbers illustrate the scale of the infrastructure potentially involved. Access to thousands of advanced processors is not equivalent to obtaining a few restricted graphics cards. It represents the kind of computing infrastructure associated with major data-centre operations.
If the estimates are broadly correct, the implications for semiconductor export policy could be significant.
Does this prove China violated US export controls?
This is where the findings require more careful interpretation.
The investigation provides evidence consistent with the models being initialized on Blackwell hardware. It does not establish that the processors were physically located in China.
There are several possible explanations.
Chinese AI companies could have obtained access to restricted processors through unauthorized shipments. Alternatively, they could have used computing infrastructure located outside China, including rented data-centre capacity.
The distinction matters because US export controls regulate the transfer and provision of restricted technology under specific legal conditions. Establishing a violation requires more than identifying a processor's computational fingerprint.
There is also a technical limitation: identifying the hardware that initialized a model does not necessarily identify every processor involved in its subsequent training.
A company could initialize a model on Blackwell GPUs and move the weights to another computing environment for further training. It could also use a mixture of different processors.
The report acknowledges another alternative. Certain configurations of AMD's MI300X processors can reproduce the same broad processing-unit layouts associated with Blackwell. DePue was able to distinguish NVIDIA from AMD for DeepSeek-V4-Flash using additional numerical evidence, but says the AMD possibility could not be conclusively excluded for the other five models.
The findings are therefore strongest when describing the initialization fingerprints, rather than making definitive claims about the entire training infrastructure or the legality of hardware access.
What about the rest of China's AI industry?
Another interesting finding is that the investigation does not suggest every major Chinese AI developer has moved to Blackwell.
The latest examined models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun still showed patterns associated with Hopper hardware.
Meituan's LongCat-2.0 did not show an NVIDIA fingerprint, consistent with its reported use of dedicated AI accelerator infrastructure.
This matters because the Chinese AI industry is not a single technological ecosystem operating with identical resources.
Different companies have different computing strategies, infrastructure arrangements and access to hardware. Some may rely on older NVIDIA processors, while others develop alternative accelerator architectures or use computing resources outside mainland China.
The investigation provides a potential new tool for examining these differences without depending entirely on what companies choose to disclose.
The bigger implication: AI models may become forensic evidence
Perhaps the most consequential aspect of DePue's work is not the immediate allegation about restricted NVIDIA processors.
It is the possibility that publicly released AI models contain more information about their development than their creators intend to reveal.
For years, researchers have examined model weights to understand capabilities, biases, training methods and architectural choices. Checkpoint forensics introduces another dimension: reconstructing aspects of the computing environment that produced them.
If this approach survives independent scrutiny, it could become a useful instrument for researchers, policymakers and regulators investigating the origins of AI systems.
It could also change how AI developers think about releasing their models. DePue has suggested that some initialization fingerprints could be removed or obscured, making future forensic analysis more difficult.
That creates an interesting tension. Open-weight models make independent research and technological scrutiny possible, but they may also expose information about the infrastructure and development processes behind them.
For the United States, the findings raise an uncomfortable question about the effectiveness of semiconductor export restrictions. If Chinese developers can access restricted processors through overseas computing arrangements or other channels, controlling the physical shipment of chips may not be enough.
For China, the report offers a different insight. Its leading AI companies may have found ways to access some of the world's most advanced computing infrastructure, but the findings do not diminish the importance of domestic semiconductor development or prove that the industry has overcome its dependence on foreign hardware.
The investigation is compelling because it moves the debate beyond speculation and introduces a testable technical claim based on publicly available evidence.
But the distinction between a hardware fingerprint, access to a processor, and a proven export-control violation must remain clear.
The next test is whether independent researchers can reproduce the results, whether the companies involved respond, and whether investigators can connect the technical evidence to actual hardware procurement and deployment.
For now, the most important discovery may be that an AI model's weights can reveal clues about the machines that helped bring it into existence.