Chinese AI models carry fingerprints of export-banned Nvidia Blackwell chips
The study and its findings
The study was conducted by Unemployment Labs and led by former OpenAI researcher Will DePue. Its report, titled "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs", examines the publicly released weights of frontier models developed in China for statistical traces left by the hardware on which those weights were produced. The report names six models that carry the Blackwell fingerprint, from four organisations: DeepSeek-V4-Flash and DeepSeek-V4-Pro (DeepSeek), Kimi K3 and Kimi K3.1-Pro (Moonshot AI), MiniMax-M3 (MiniMax), and Ant Ling-3.1-flash (Ant Group). The report was published on 12 November 2026 and was covered the following day by TechCrunch and by The Register.
The central claim is narrow and precise. The study does not assert that any model was trained on Blackwell hardware. It asserts that the numerical patterns in the model weights are consistent with the weights having been initialised on Blackwell chips, and that the strength of the match makes alternative explanations unlikely. For one model, DeepSeek-V4-Flash, the authors describe the identification as conclusive. For the remaining five models, the evidence is described as strongly suggestive rather than conclusive.
How the fingerprint was detected
The method rests on a property of modern AI training. When a model is initialised, the starting values of its weights are generated by a pseudorandom process that depends on the hardware and software stack in use, leaving a faint statistical signature in the final weights even after training has altered them. By comparing the weights of a released model against the signatures produced by known hardware, the researchers were able to test which chip family most plausibly produced them.
According to the report, the researchers tested approximately 6 trillion combinations of random seeds and data layouts to rule out the possibility that the match arose by chance. The statistical strength of the matches ranges from 49 sigma to 1,385 sigma, a range that, in the language of the report, places the observed patterns far outside what random variation could produce. The identification was also checked against physical hardware. The fingerprint for DeepSeek-V4-Flash was confirmed on a physical Nvidia B300 chip, and the fingerprint for Kimi K3 was confirmed on a rented GB200 system.
The report considers one alternative explanation. The AMD MI300X accelerator could in principle produce a similar signature. For DeepSeek-V4-Flash, the MI300X explanation was excluded; for the other five models, the authors describe it as very unlikely. No other candidate hardware is identified in the report.
The six models named
The six models named in the report represent some of the most capable systems released by Chinese laboratories in 2026. DeepSeek-V4-Flash and DeepSeek-V4-Pro are the latest generation from DeepSeek. Kimi K3 and Kimi K3.1-Pro come from Moonshot AI, MiniMax-M3 from MiniMax, and Ant Ling-3.1-flash from Ant Group. The report does not name every recent Chinese model. DeepSeek-V4.1-Flash, for example, shows no Blackwell fingerprint, and the newest models from Alibaba, Zhipu, Tencent, Xiaomi, and StepFun read as having been produced on the older Hopper generation of Nvidia hardware. The pattern is therefore selective rather than universal, and it does not support a claim that every new Chinese model is implicated.
What the evidence does not establish
The authors are explicit about the limits of their findings, and those limits define how the study should be read. The fingerprints support, but do not by themselves prove, the use of Blackwell chips for training. The findings do not establish where any chips were located, how access to them was obtained, or whether export controls were violated. The report does not identify a supply route, a seller, or a buyer. It does not state that any named company knowingly used restricted hardware, and it does not claim that any law was broken. The distinction between initialisation and training is also material. A model initialised on one chip family may have been trained on another, and the fingerprint evidence addresses the former, not the latter.
The report expresses limited confidence in its own estimates of scale and presents no firm figure for the number of Blackwell chips that may have been involved. The study is best understood as a detection result, not as an audit of the supply chain.
Export controls and the wider context
Blackwell chips, including the B200, B300, GB200, and GB300, require a licence from the United States government for export to China, and no such licence has been reported for these chips. The controls form part of a broader set of restrictions intended to slow the development of advanced AI capability in China by limiting access to the most powerful accelerators, and their effectiveness has been a subject of sustained debate. This study adds a new form of evidence to that debate.
Independent estimates suggest that restricted hardware has continued to reach China through indirect routes. Epoch AI, a research institute cited by TechCrunch, estimates that approximately 2 million advanced chips entered China in 2024 and 2025. The same reporting notes that 275,000 Nvidia AI accelerators were imported to Malaysia in 2024 and 2025, a figure that has drawn attention because Malaysia has been identified as a possible transit point for chips destined for China. These are third-party estimates, not findings of the Unemployment Labs study, and they should be read as context rather than as corroboration.
Why it matters
If the fingerprint findings hold, they would suggest that the most capable Chinese AI laboratories have had access to hardware at least one generation ahead of what export policy permits them to hold, narrowing the hardware gap the controls were designed to preserve and raising questions about enforcement and about the routes through which restricted chips move. The study also demonstrates a new tool for oversight. Hardware fingerprints in public model weights offer a way to test claims about the provenance of AI systems without access to the data centres where they were built, and the method could be applied to future releases as they appear.
What comes next
Further work will be needed to determine whether the fingerprints reflect training as well as initialisation, to establish how any Blackwell hardware reached the laboratories involved, and to test whether the pattern extends to models not yet examined. The researchers have published their method, which allows independent groups to reproduce the analysis. Until that work is done, the study stands as a carefully bounded claim: six models carry the fingerprint of export-controlled Blackwell chips, the evidence is strong, and the conclusions that can be drawn from it remain limited by the method itself.
Source: Unemployment Labs report, "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs" (12 November 2026); TechCrunch (13 November 2026); The Register (13 November 2026).
