Chinese AI labs are training models on Nvidia's Blackwell despite export controls, says ex-OpenAI engineer

Forensic report finds Blackwell's fingerprint in DeepSeek, Moonshot AI, MiniMax and Ant Group models

US export controls are not stopping AI labs in China from using restricted Nvidia chips, according to a report from a former OpenAI engineer.

Will DePue, who left the AI giant earlier this year to launch Unemployment Labs, an AI research consultancy, published forensic evidence showing that "DeepSeek, Moonshot AI, MiniMax and Ant Group have gained access to Nvidia's Blackwell GPUs, despite restrictions on exporting these chips to China, and are using that hardware to create their AI models."

"This sounds insane, but I discovered that almost every AI model carries a hidden signature of the GPU that trained it," said DePue in a social media post. "When a model is first set up, the starting values of its weights are laid out in a pattern that depends on the exact GPU. Each combination of GPU and seed number produces a unique pattern – a sort of fingerprint of the hardware used to create the model. Traces of that pattern survive training into the published model."

REG AD

It doesn't sound that insane. The resignation of Nvidia CEO Jensen Huang followed from revelations that he had an affair with Chinese businesswoman Alice Huang, who, in 2023, founded Singapore-based Megaspeed International. That company is reportedly under investigation by US authorities for allegedly smuggling Nvidia chips to China.

REG AD

Huang's departure coincides with a renewed push to tighten US chip export controls. House Speaker Mike Johnson supports the idea. And there are at least four bills awaiting consideration that aim to limit China's access to leading edge AI tech: the AI Overwatch Act, the Chip Security Act, Match Act, and the Cloud Security Act.

On Monday, US Senators Jim Banks (R-Ind.) and Elizabeth Warren (D-Mass.) cited Jensen Huang's "relationship with a suspected Chinese spy" as a justification for passing the AI Overwatch Act, which would codify the Trump administration's existing chip export controls. The Trump administration on Thursday said it's not sure whether Alice Huang was a spy, an allegation denied by Beijing and currently under investigation by the FBI.

Whatever the case, the current rules clearly are not working. Only a few weeks ago, Lava, an Israel-based security company, said it had found "32 Nvidia B300 GPUs, part of Nvidia's Blackwell Ultra generation, through publicly exposed monitoring endpoints with IP addresses geolocated to China."

These GPUs, Lava noted, are subject to US export controls [PDF]. The security biz said its findings followed from the exposure of monitoring systems intended for internal infrastructure management that were publicly exposed.

How DePue reached his conclusion

The analysis published through DePue's consultancy, "Top Chinese Frontier AI Models Carry the Fingerprint of Export-Controlled Nvidia Blackwell GPUs," takes a different approach: analyzing the published weights of various models from Chinese AI labs.

As described in the report, model weights – the parameters that change in relation to training data – must be initialized with some value. One method for doing so involves a pseudorandom number generation (PRNG) algorithm called Philox. The algorithm starts with a seed value that produces the same set of initial values whenever it's run.

Using PyTorch, initialization can be done by creating multiple GPU threads that work in parallel, with the help of Nvidia's cuRAND library. And because this process is not truly random, it's possible to select a chip and a seed value, generate the initial weights for that hardware and compare that pattern to a model's published weights.

REG AD

"I searched more than six trillion combinations of chip layout and seed number and matched them to open-weights models," said DePue. "In doing so, I found conclusive evidence that six Chinese AI models – including DeepSeek-V4-Pro, Kimi K3, and MiniMax-M3 – were initialized on Nvidia Blackwell systems. Four of the models match Grace Blackwell, the GB200 and GB300 parts in Nvidia's flagship liquid-cooled rack-scale systems."

Noting that this is the first time MiniMax and Ant Group have been publicly linked to usage of Nvidia's Blackwell, he also cited several limitations to his approach. One is that usage of Blackwell GPUs doesn't prove where the GPUs were located, so it's possible some of these Chinese labs used this hardware through US providers – a loophole the Cloud Security Act aims to close.

DePue's report includes initial seed values that linked DeepSeek-V3 to Nvidia's Hopper and DeepSeek-V4-Flash to Blackwell, for those who wish to attempt to reproduce the results. DuPue claims that multiple senior researchers, both independent and inside frontier AI labs like OpenAI and Anthropic, have confirmed the result.

Coincidentally, OpenAI and Anthropic have each complained about Chinese labs copying their models through distillation, a pastime also noted by the US Cybersecurity and Infrastructure Security Agency. ®