Telltale random numbers point to restricted Nvidia chips behind China's top AI models

What this is about

Who built their AI on which chips? It's a politically sensitive question, because the US only allows Nvidia's most advanced GPUs to be exported to China with a license. An analysis by Will DePue (Unemployment Labs), published on November 12, 2026 and reported by Techmeme, now offers the first technical evidence. According to the analysis, six models from four Chinese AI companies, all released since April 2026, carry a "fingerprint" of Nvidia's Blackwell generation.

The models are DeepSeek-V4-Flash and DeepSeek-V4-Pro (DeepSeek), Kimi K3 and Kimi K3.1-Pro (Moonshot AI), MiniMax-M3 (MiniMax) and Ling-3.1-flash (Ant Group). No US export license to China is known for any of these chips. US officials and media had already accused DeepSeek and Moonshot of using Blackwell chips, but without publishing any technical evidence.

What stands out is where the evidence comes from. There are no leaks and no insider sources. Everything comes from the models' own weights, which anyone can download. You can read the full analysis at unemploymentlabs.com/checkpoint-forensics.

How the chip fingerprint works

Before a model is trained, it needs initial values. In PyTorch, the widely used framework, these come from a pseudorandom number generator called Philox, an algorithm that produces numbers that look random but can be reproduced exactly. The starting point is a number called the seed. Same seed, same numbers.

The trick lies in how the work is split up. To fill billions of values quickly, PyTorch (via Nvidia's cuRAND library) spreads the job across many parallel threads, small units of work. On the Nvidia chips examined, large jobs use 2,048 threads per streaming multiprocessor (SM), one of the compute cores on a GPU. So a chip with more SMs puts the same random numbers in different positions.

The authors explain it with a row of empty boxes. With 48 threads, the first thread fills boxes 1, 49, 97 and so on. With 40 threads, it fills boxes 1, 41, 81. The numbers are the same, but they end up in different places. In this simplified example, only 6 percent of the values still line up. The layout therefore gives away how many compute cores the chip had:

Chips within a group can't be told apart. A Hopper match could be an H800 (the throttled version made for China) just as easily as an H100 or H200.

But do the initial values even survive training? Partly, yes. Some weights, such as those for words or characters that never showed up in training, barely change and keep their initial values almost exactly. Trained weights often carry a faint trace too: weights that start higher tend to end higher. Across hundreds of thousands of values, that trace becomes measurable. The researchers then search for the combination of seed and thread count that best reproduces the pattern, and test it on weights that weren't used in the search.

The results over time

The data shows a clear switch:

Kimi K2.7-Code, released six weeks before K3, is a special case. About 80 percent of the values examined come from K2.5's Hopper heritage, while about 20 percent match a 148-SM chip. Because the mix is the same in every row, the authors read this as a merged checkpoint rather than mixed hardware, and they don't count the model among the six.

Not every Chinese lab has switched. The latest readable models from Alibaba (Qwen3.8, Qwen3.5-397B), Zhipu (GLM-5.3), Tencent (Hy4-preview), Xiaomi (MiMo-V2.5-Pro) and StepFun (Step-5-Preview) show Hopper traces. Meituan's LongCat-2.0, which the company says was trained on "AI ASIC superpods," shows no Nvidia fingerprint at all. Baidu's ERNIE-5.5 (built on the PaddlePaddle framework) and DeepSeek-V4.1-Flash also showed no usable traces.

How solid is this?

The authors checked the method in several ways. First, against known cases. In all 24 cases where developers have publicly named their hardware, the result matches. Meta's Llama 3.1 (H100) reads as 132 SMs and EleutherAI's Pythia (A100) as 108. Nvidia's own Nemotron-3 Ultra, which its technical report says was trained partly on GB200, reads as 152, just like Kimi K3. The authors themselves point out that because many of these models are related, this is a consistency check, not a measured accuracy rate.

Second, on real hardware. Using DeepSeek's seed 953049583, which appears in both V3 and V4-Flash, an H100 reproduced all 57,344 surviving initial values of DeepSeek-V3 bit for bit, but none of V4-Flash. A B300 reproduced 461 of 469 selected rows of V4-Flash with correlations above 0.99, 445 of them bit for bit, but none of V3. A rented GB200 reproduced all 13 surviving rows of Kimi K3 using Moonshot's seed 20256586. Change the seed by one and nothing matches.

Third, statistically. With roughly 6 trillion combinations of seed and layout searched, you'd expect a chance hit of about 8 sigma. Sigma measures how far a result sits above normal random noise. The strongest evidence for the six models falls between 49 and 1,385 sigma, and the weakest single test comes in at 20 sigma.

The researchers took one alternative seriously. AMD's MI300X, which is also subject to export restrictions, normally has 304 compute units but can be limited to 152 or 148 and can generate the same random sequences. On a real MI300X, they confirmed that it can reproduce the Blackwell patterns. For DeepSeek-V4-Flash, though, tiny numerical differences ruled AMD out. At 377 positions where the two vendors produce different values, the published weights match Nvidia 363 times and AMD not once. For the other five models, the authors consider AMD "very unlikely," because entire clusters would have had to be configured in an unusual way. There's more circumstantial evidence. Ant Group's public cuLA repository contains benchmarks that were run on a GB300 on March 31, 2026. In June 2025, by contrast, a DeepSeek engineer wrote on GitHub that the company had "no SM100 GPUs" (SM100 refers to Blackwell).

Scale and limits

The authors estimate the hardware needed from model size and the amount of training data. They assume training ran on the same hardware the model was initialized on:

As a sanity check, the same calculation gives 2,000 to 2,500 chips for DeepSeek-V3, and DeepSeek reported 2,048. At about $70,000 per GPU (based on a Wall Street Journal report about Blackwell chips for ByteDance in Malaysia), the largest cluster would cost $150 million to $200 million, and all five together more than half a billion dollars. The authors say the labs' total spending likely runs into the billions.

The authors are clear about what the method can't do. It only works on open weights and only with PyTorch on GPUs. It shows the hardware that generated the initial values, not necessarily every chip used for training later on. Weights can be moved and clusters can be mixed, for example with Huawei chips. Above all, the weights don't reveal who owned the chips or where they were. Blackwell systems can be rented in data centers outside China. So the analysis explicitly does not prove that chips were smuggled or that export rules were broken.

Our take

The analysis matters because it backs up a claim that until now was made politically but never proven, using verifiable techniques. And it does so with the very thing the companies chose to publish. The authors call the finding "conclusive" for DeepSeek-V4-Flash and "strong evidence" for the other five models. The report also suggests that US export controls aren't stopping China's leading labs from getting access to cutting-edge hardware, by whatever route.

There are caveats. The work comes from a small, independent lab, it hasn't been reviewed by third parties yet, and according to the source the companies haven't commented. The method is also easy to get around. If you generate initial values on a CPU, as Alibaba did for some Qwen3 models, or add noise to them before release, you leave no trace. Future models will probably give away less. Still, for the debate over export controls and open Chinese models, the report offers hard numbers instead of hints for the first time.