12,000 banned GPUs hid in China's open weights - I checked

I reproduced the check in 6 seconds on my own machine: five of China's top open-weight models carry the exact numerical fingerprint of export-banned Blackwell GPUs.

The author estimates about 12,000 Blackwell GPUs across five training runs - and the evidence is the weights themselves, not a leak.

What I ran

Will DePue, a former OpenAI researcher now at the nonprofit Unemployment Labs, published the report on November 12, 2026, with the code to reproduce it.

I cloned the repo and ran python replay.py on CPU. It took about 6 seconds, and my output matched the author's table exactly:

The controls are what make this convincing, not the matches. Change the seed by 1 and the correlation collapses to about 0.0016 - noise. Try the next-best SM count and the correlation is 0.02 at best.

The fingerprint is a two-key lock: the right seed and the right thread layout, and only one combination opens it.

How a weight remembers its GPU

Before training starts, a model's weights get initial values from a pseudorandom generator called Philox, seeded with a single number. PyTorch's CUDA normal_ splits that work across 2,048 threads per streaming multiprocessor (SM), so the number of SMs decides where each number lands.

A Hopper H100 has 132 SMs (270,336 threads); a Blackwell B200/B300 has 148 (303,104); a GB200/GB300 has 152 (311,296). Same seed, different chip, different arrangement - and only about 6% of the values land in the same positions.

Most weights get overwritten by training. But embedding rows for tokens that never appear in training never receive a gradient, so they still hold their starting values almost exactly. Regenerate those rows from a candidate seed and SM count, and a correlation above 0.9999 means you found the chip that created them.

The method gets known answers right: for 24 models whose developers publicly disclosed their hardware, it agrees in every case.

DePue also confirmed two of the matches on physical hardware - a B300 reproduced 461 of 469 DeepSeek-V4-Flash rows, 445 of them bit-for-bit, while an H100 reproduced all of DeepSeek-V3's rows and zero of V4-Flash's. A GB200 reproduced all 13 Kimi K3 rows.

The timeline is the story

The switch is recent, and it is consistent across four labs:

• DeepSeek read as Hopper through V3 (December 2024), Blackwell from V4-Flash and V4-Pro (April 2026).
• Moonshot read as Hopper through Kimi K2.5 (January 2026), Blackwell from K3 (July 2026) and K3.1-Pro (November 2026).
• MiniMax read as Hopper through M2.7 (April 2026), Blackwell from M3 (June 2026).
• Ant Group's Ling-3.0-flash (August 2026) reads as Hopper; Ling-3.1-flash (October 2026) reads as Blackwell.

Not every lab switched. The newest models from Alibaba (Qwen), Zhipu (GLM), Tencent, Xiaomi, and StepFun still read as Hopper. That split is itself a useful check: the method is not just returning "Blackwell" for everything new.

How strong is the evidence?

Across roughly 6 trillion seed-and-layout combinations searched, the strongest match chance alone could produce is about 8 sigma. The strongest evidence for each of the six models ranges from 49 to 1,385 sigma; even the weakest individual test reaches 20 sigma.

The scale math - and its error bars

DePue estimates the five runs needed about 12,000 Blackwell GPUs in total (range 7,000-22,000): roughly 4,500 for Kimi K3 and 3,000 for DeepSeek-V4-Pro, each running two to three months. At about $70,000 per GPU, the largest cluster costs roughly $200-300 million, and the five together more than half a billion dollars.

Read the error bars before the headline number. The report says, in its own words, "We are not confident in these estimates." They assume the GPUs ran at about 20% of peak speed, token counts that are partly estimated from the weights, and run lengths estimated from release timelines - and halving a run length doubles the GPU count.

Two disclosed Blackwell runs of similar size show the spread: Mistral trained a comparable model on 3,800 Grace Blackwell GPUs, while Microsoft says it trained one on 16,000 in 38 days. The honest range for the two largest runs is probably 8,000-9,000 GPUs, not a single number.

What is not in doubt is the direction: data-center-scale Blackwell access, not a handful of smuggled cards.

What this does not prove

The fingerprint identifies the hardware that created the starting weights. The report's own wording is careful: it "supports, without proving" the inference that Blackwell also did the training. It does not establish where the chips were, how access was obtained, or whether any export control was violated.

The chips could have been in an offshore data center - a route the report and TechCrunch both note has become common, with Epoch AI estimating about 275,000 Nvidia accelerators imported to Malaysia in 2024 and 2025.

There is one identified alternative: a specially configured AMD MI300X in two-way partition mode also has 152 SMs. DePue says that alternative is excluded for DeepSeek-V4-Flash and very unlikely for the other five - but it is the reason the claim is "Blackwell-class," and the reason a 152-SM match is not, by itself, a court exhibit.

The policy hole this exposes

U.S. officials had already alleged that DeepSeek and Moonshot were using Blackwell chips - White House technology adviser Michael Kratsios said so earlier this year, citing U.S. intelligence. What was missing until now was technical evidence anyone could check. This is the first time the claim is verifiable from public artifacts, in seconds, on a laptop.

That matters because export controls, as written, track ownership and location: who bought the chip, where it was installed. The fingerprint tracks use. If a lab can initialize a model on Blackwell hardware it does not own, in a jurisdiction where the chips are legal, and publish the weights, the control regime has nothing to seize and no shipment to intercept.

China hawks have long called for controls on who uses chips, not just who owns them. This report is the first technical demonstration of why that distinction now matters - and of how hard it would be to enforce, since the evidence only surfaces after the model is already published.

TechCrunch ties the report to Nvidia's week - Jensen Huang resigned on November 12 after admitting to an affair with Alice Huang, an executive of Megaspeed, a company implicated in smuggling Nvidia chips into China. Keep the two stories separate. The report makes no allegation about what Huang knew, and Nvidia has said its officials visited Megaspeed's data centers and found them legitimate.

The forensics stand on their own: six models, five of them reproducible on a laptop, pointing at hardware that was not supposed to be there. The uncomfortable part is not that the check exists. It is that the check is this easy, and nobody ran it in public until the models were already out - six of them, across four labs, over seven months.

Sources: Will DePue / Unemployment Labs, "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled NVIDIA Blackwell GPUs" (November 12, 2026, revised); reproduction code at github.com/macrogrants/checkpoint-forensics - my python replay.py run, November 13, 2026, ~6 seconds on CPU, output matched the author's table exactly; TechCrunch, "Export-banned Nvidia chips are behind China's most powerful AI models" (November 13, 2026); Epoch AI estimates via TechCrunch. Scale figures (12,000 GPUs, $200-300M largest cluster) are the author's estimates with stated assumptions, not confirmed counts.