A forensic analysis by Unemployment Labs reports that six models from DeepSeek, Moonshot AI, MiniMax and Ant Group carry numerical signatures matching Nvidia Blackwell chips, which the United States restricts from export to China. The method reads only published model files, so it cannot prove who owned the chips or that export rules were violated.
Six AI models from four Chinese developers carry numerical signatures that match Nvidia's Blackwell chips, according to a forensic analysis that suggests the companies have been training on hardware the United States restricts from export to China.
How did researchers identify the chips behind these models?
The report, published by Unemployment Labs under the name of researcher Will DePue, examined the publicly released weights of models from DeepSeek, Moonshot AI, MiniMax and Ant Group. Weights are the billions of adjustable numbers that determine how a model processes information. Before training begins, those numbers need starting values, and the software that generates them leaves a trace of the hardware it ran on. DePue's team found that the newest models carry the Blackwell pattern, while earlier models from the same companies match the older Hopper generation.
Which Chinese AI models show signs of Blackwell chip training?
The six models are DeepSeek-V4-Flash and DeepSeek-V4-Pro, Kimi K3 and Kimi K3.1-Pro from Moonshot, MiniMax-M3, and Ling-3.1-flash from Ant Group. DeepSeek's models read as Hopper-era through V3, released in December 2024, then as Blackwell from V4 in April. Moonshot's models switched with K3 in July. MiniMax's switched with M3 in June, and Ant's with Ling-3.1-flash in October.
Officials and press reports had already accused DeepSeek and Moonshot of using Blackwell chips, but without public technical evidence. The new report says its evidence comes entirely from the published model files, not from leaks or insiders. The team also confirmed the match on physical Blackwell chips for two of the models, and it says the same method correctly identified the hardware for 24 models whose developers had publicly disclosed their chips.
The analysis also estimates how large the training runs were. Kimi K3 and DeepSeek-V4-Pro, the two largest, would have needed roughly 4,500 and 3,000 Blackwell GPUs, respectively, running for about two to three months. Across all five runs that could be read for scale, the report estimates about 12,000 Blackwell GPUs. Using a per-chip price of about $70,000, implied by a Wall Street Journal report on a Blackwell installation in Malaysia for ByteDance, DePue puts the largest cluster at roughly $200 million to $300 million. The author says the earlier version of the report had estimated 2,000 to 3,000 GPUs for the largest runs and was revised because it assumed chips ran at Nvidia's benchmark efficiency, which disclosed Blackwell training runs have not reached.
Does the evidence prove export controls were broken?
The report is careful about what it cannot show. The fingerprint identifies the hardware that generated the starting weights. It does not prove that the same chips did all the training, since a lab could create weights on one system and train on another. The weights also cannot reveal who owned the chips or where they sat. Blackwell systems can be rented from data centers outside China, and the report says the evidence does not establish that chips were smuggled into China or that an export-control violation occurred.
Alternatives and gaps in the evidence
DePue's team considered AMD hardware, which is also restricted from export to China, as an alternative explanation. A specially configured AMD MI300X can reproduce the same layouts, but the team said tests on one model pointed to Nvidia, and it considers the AMD explanation very unlikely for the other five.
Not every Chinese lab appears to be using Blackwell. The newest models the team could read from Alibaba, Zhipu, Tencent, Xiaomi and StepFun all carry Hopper signatures. Meituan says its LongCat-2.0 was trained on "AI ASIC superpods," and the team found no Nvidia fingerprint in it. The method also cannot read closed models, and it found no usable signature in several others, including DeepSeek-V4.1-Flash and some Qwen models that were initialized on a CPU.
The report's author also flags uncertainty in the scale estimates. They depend on assumptions the weights cannot confirm, including how efficiently each lab used its chips, how many tokens each model was trained on, and how long each run lasted. The author says no lab has published those details for these runs. The report notes that its findings are consistent with the numbers but do not settle every question about how the chips were obtained.
Questo articolo è stato scritto con l'assistenza dell'IA.
News Factory APP - notizie agentiche per potenziare il tuo SEO e AEO.