Some of the strongest open models from China appear to have been built on Nvidia chips that cannot legally be exported there without a licence. That is the conclusion of a forensic analysis by Will DePue of Unemployment Labs, which reads the hardware out of the published weights themselves. For anyone running DeepSeek, Kimi or MiniMax models, nothing about the models changes, but the method is new and the policy implications are large.
The technique is clever and checkable. Before training, a model's weights are filled with pseudorandom starting values. In PyTorch on Nvidia GPUs, the way those numbers are laid out depends on how many processing units the chip has: 132 on Hopper chips such as the H100, H200 and H800, 148 on the Blackwell B200 and B300, and 152 on the GB200 and GB300. Some weights, such as those for tokens never seen in training, survive almost untouched, so searching across seeds and layouts can recover the original arrangement. DeepSeek reuses one seed, 953049583, across generations. Reproduced on a physical B300, the method matched 461 of 469 selected rows in DeepSeek-V4-Flash, 445 of them bit for bit.
The findings cover six models from four labs. DeepSeek-V4-Flash and MiniMax-M3 match the 148-unit layout; DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ant Group's Ling-3.1-flash match the 152-unit layout. Earlier models from the same labs read as Hopper. The method agreed with all 24 cases where a developer had publicly named its hardware, and the strongest evidence for each model ranges from 49 to 1,385 sigma, far above the roughly 8 sigma expected by chance across about 6 trillion combinations searched. Rough estimates put the largest runs at about 4,500 and 3,000 Blackwell GPUs.
For the models we review, including DeepSeek V4 Pro, Kimi K3 and MiniMax M3, this changes nothing about how they perform. It does undercut the common story that Chinese labs reached the frontier on older or domestic chips alone, and it shows open weights can reveal more about their origins than their makers intend.
The author is careful about the limits, and so should readers be. The fingerprint shows where the weights were initialised, not necessarily where training happened. It cannot show where the chips were, who owned them or whether any law was broken, since Blackwell capacity can be rented outside China. A specially configured AMD MI300X can mimic the layouts; that was ruled out for DeepSeek-V4-Flash only. The GPU-count estimates rest on assumptions the author says he is not confident in, and the work has not been peer reviewed.