DeepSeek-V4-Flash, Kimi K3 and four other open-weight models were started on GPUs the US government has spent years keeping out of China. The evidence is not a leak or a shipping manifest. It is arithmetic inside the weights, and anyone with a laptop can check it.
Will DePue, a former OpenAI researcher who leads the nonprofit Unemployment Labs, published a report on 12 November 2026 recovering the random seed and GPU thread layout behind a model’s starting values and matching them against published weights. Six models from four labs matched NVIDIA’s Blackwell chips, and the report’s conclusion is that there is “strong evidence that six Chinese AI models were initialized on export-controlled NVIDIA hardware, and that for DeepSeek-V4-Flash the evidence is conclusive”. The evidence sits inside weight files anyone can download, and the checking script is public.
The fingerprint is a seed and a thread count
Every model needs initial values before training begins. They come from Philox, a deterministic pseudorandom number generator, and PyTorch spreads the work across GPU threads through NVIDIA’s cuRAND library. A sufficiently large initialization uses the maximum of 2,048 threads per streaming multiprocessor, or SM. Hopper has 132 SMs and 270,336 threads, a Blackwell B200 or B300 has 148 and 303,104, and a Grace-Blackwell GB200 or GB300 has 152 and 311,296. The seed picks the numbers, the SM count picks where they land, and both have to be right.
The rows that give it away are the ones training never touched. Embedding rows for tokens that never appear in training get no gradient and still hold their initial values, and the report notes that some weights, “such as those reserved for words or symbols never encountered during training, can remain untouched and retain their starting values almost exactly”. Finding the combination is brute force with a check: the reproduction code brute forces seeds across all 2^32 values, and the report picks a seed and layout on one set of weights before testing them on another set that played no part in the choice. Against roughly six trillion seed-and-layout combinations, chance would reach about 8 sigma. The evidence for the six models ranges from 49 to 1,385 sigma, and the weakest single test reaches 20 sigma.
Six models, four labs, one hardware generation
The findings, from the report:
| Model | Released | Chip class | Evidence |
|---|---|---|---|
| DeepSeek-V4-Flash | Apr 2026 | B200/B300, 148 SMs | Exact copy, 1,385 sigma |
| DeepSeek-V4-Pro | Apr 2026 | GB200/GB300, 152 SMs | Partial survival, 49 sigma |
| Kimi K3 | Jul 2026 | GB200/GB300, 152 SMs | Exact copy, 305 sigma |
| Kimi K3.1-Pro | Nov 2026 | GB200/GB300, 152 SMs | Same seed as K3, 305 sigma |
| MiniMax-M3 | Jun 2026 | B200/B300, 148 SMs | Exact copy, 323 sigma |
| Ling-3.1-flash | Oct 2026 | GB200/GB300, 152 SMs | Untrained rows, 244 sigma |
The switch is recent and visible inside each lab’s lineage: DeepSeek reads Hopper through V3 in December 2024 and Blackwell from V4 in April 2026, Moonshot flips between K2.5 in January 2026 and K3 in July, and MiniMax and Ant Group flip in the same window. Seeds make the lineage traceable: DeepSeek reused seed 953049583 for V3 and V4-Flash, and Kimi K3.1-Pro starts from Kimi K3’s seed 20256586. The report also estimates Kimi K3 needed about 4,500 Blackwell GPUs for around 70 days, with roughly 12,000 across the five runs it sizes, while stressing that those figures rest on assumptions the weights cannot confirm.
What you can run yourself: The repository README says the check “runs on a laptop in a few seconds” with numpy and scipy installed, rebuilding the untouched rows for five models. A second script repeats the comparison with stock PyTorch on real hardware: on an H100, DeepSeek-V3’s rows match bit for bit and V4-Flash’s do not match at all; on a B300, 461 of 469 V4-Flash rows and all 17 MiniMax-M3 rows match; on a rented GB200, all 13 Kimi K3 rows match. Changing the seed by one matches nothing. It pins the exact Hugging Face revisions, so the weights it checks are the published ones, including DeepSeek-V4-Flash.
AMD is the obvious alternative: an MI300X normally runs 304 compute units but can be configured to use 152 or 148. On a physical MI300X, in the 377 values where the vendors’ results differ, the published weight matches NVIDIA’s in 363 and AMD’s in none, which settles DeepSeek-V4-Flash. The report calls AMD very unlikely for the other five.
What the weights cannot establish
The method identifies the hardware that generated the starting weights, not every chip that later trained the model. As the report puts it, the findings “provide technical evidence of access to advanced computing hardware, but do not establish where the chips were located, how access was obtained, or whether export controls were violated”.
The method also only works where the pattern survives. Closed models cannot be checked at all, and frameworks that do not shape their numbers by chip leave nothing to read: Baidu’s PaddlePaddle carries no chip layout, and some Alibaba Qwen3 models were initialized on a CPU.
The policy backdrop explains the interest. The governing rule is 15 CFR 742.6, the Commerce Department’s “Regional stability” regulation, which requires a license to export advanced computing items (ECCN 3A090) to China (eCFR text). The report notes that the B200, B300, GB200 and GB300 have needed a US export license for China since before they shipped, and that none have been reported. TechCrunch describes the arrangement as a ban on Blackwell exports to China or Chinese-owned firms, with a circuitous shipping route still allowed for the less powerful H200 so the US can claim a 25% tariff.
What This Means
Export-control enforcement now has a tool that works on artifacts anyone can download: the report’s strongest claim, that DeepSeek-V4-Flash was initialized on Blackwell, comes with a script that reproduces it on a laptop, a different kind of evidence from a shipping manifest. The seeds, the pinned weights and the comparison code are all public, so the labs can check their own fingerprint.
For anyone running these models locally, the practical effect is nil. The finding is about provenance, not behavior: the weights are the same published weights, they load the same way, and the fingerprint says nothing about what a model can do. The six models released between April and November 2026 now carry a documented hardware history, and the next release can be checked the same way. The escape routes are concrete too: a publisher who wants no fingerprint can initialize on a CPU or use a framework without a chip layout.
The Bottom Line
Six open-weight models from DeepSeek, Moonshot AI, MiniMax and Ant Group carry a fingerprint of export-controlled NVIDIA Blackwell hardware, and the check that produced it is public code that runs in seconds on a laptop. For DeepSeek-V4-Flash the report calls the evidence conclusive; for the others it calls the evidence strong and stops short of saying who owned the chips. The weights themselves are unchanged, which is what matters to anyone who just wants to run the model.