Six of China’s highest-profile open AI models appear to carry digital fingerprints from Nvidia’s Blackwell processors, hardware Washington bars from export to China. The finding, based on an analysis of publicly released model weights, could intensify scrutiny of how Chinese laboratories access advanced computing power—and whether export controls are working as intended. The analysis identifies Blackwell signatures in leading Chinese models, but it does not establish where the chips were located or whether any law was broken.
Will DePue, a former OpenAI researcher who leads the nonprofit Unemployment Labs, examined the numerical structure left behind in models from DeepSeek, Moonshot AI, MiniMax, and Ant Group. His research links DeepSeek-V4-Flash and MiniMax-M3 to configurations associated with Nvidia’s B200 or B300, while DeepSeek-V4-Pro, Moonshot’s Kimi K3 and Kimi K3.1-Pro, and Ant Group’s Ling-3.1-flash appear consistent with the 152-compute-core layouts used by GB200 or GB300 systems.
The approach is notable because model weights can preserve clues about the hardware and software environment used during initialization and training. DePue reportedly reproduced the matching patterns for DeepSeek-V4-Flash and Kimi K3 on physical Blackwell systems. Earlier releases from several of the same companies instead showed signatures associated with Nvidia’s Hopper generation, including chips such as the H100 and H800.
That evidence points to access, not necessarily to a secret shipment of GPUs into China. Chinese companies can rent computing capacity from data centers in other countries, creating a possible route around geographic restrictions without proving that a prohibited accelerator ever crossed into Chinese territory. The analysis also does not show whether Blackwell hardware performed an entire training run, a preliminary initialization stage, or only part of a broader process.
The timing makes the discovery especially awkward for Nvidia and U.S. policymakers. Blackwell and the newer Rubin generation remain subject to China export restrictions, while the Trump administration has permitted some sales of Nvidia’s less powerful H200 on a case-by-case basis and under additional conditions. At the same time, a separate review identified more than $3 billion in Chinese computing projects designed around restricted Nvidia processors, suggesting that demand and infrastructure have continued to develop despite the rules.
For the AI industry, the episode highlights the limits of treating export controls as a simple matter of preventing hardware deliveries. Remote access, cloud rentals, intermediaries, and the ability to share or publish trained models can make it difficult to determine who actually used a restricted system. The Blackwell fingerprints will likely prompt closer examination of training records and cloud providers, but the immediate conclusion is narrower: leading Chinese labs appear to have obtained access to Blackwell-class computation, while the path that access took remains unresolved.
