Weights Tell the Story: Chinese AI Models Show Blackwell Signs

A new technical analysis argues that several of China's leading AI labs have been training their newest models on NVIDIA's Blackwell GPUs, hardware that cannot legally be exported to China without a U.S. license. The evidence does not come from leaks or insider accounts. It comes from the published model weights themselves.

U.S. officials and press reports had already alleged that DeepSeek and Moonshot AI were using Blackwell chips, but no one had put forward technical evidence. This study tries to supply it.

How a model keeps a hardware fingerprint

Before training starts, a model's billions of weights need initial values. In PyTorch, those values typically come from a pseudorandom generator called Philox, which produces the same numbers from the same seed. To fill huge weight tensors quickly, the work is split across parallel GPU threads, and the number of threads depends on how many streaming multiprocessors (SMs) the chip has.

That detail is the fingerprint. Hopper-generation chips (H100, H200, H800) have 132 SMs. Blackwell B200 and B300 chips have 148, and GB200 and GB300 chips have 152. Change the SM count and the same seed places its numbers in different positions in the weight tensor.

The question is whether that starting pattern survives training. Some weights, such as those tied to tokens never seen in training, stay nearly untouched. Even trained weights can retain a faint statistical resemblance to their starting values. By searching for the seed and thread count that best reproduce the surviving pattern, then testing the result on weights held out of the search, the researchers can infer which hardware configuration created the initialization.

What the analysis found

Six models released since April 2026 read as Blackwell-initialized, while earlier models from the same labs read as Hopper:

• DeepSeek: Hopper through V3 (December 2024), Blackwell from V4 (April 2026)
• Moonshot AI: Hopper through Kimi K2.5, Blackwell from K3 (July 2026)
• MiniMax: Hopper through M2.7, Blackwell from M3 (June 2026)
• Ant Group: Ling-3.0-flash reads as Hopper, Ling-3.1-flash as Blackwell

Not every lab has moved. The newest models the study could read from Alibaba's Qwen, Zhipu, Tencent, Xiaomi and StepFun still read as Hopper-trained. Meituan says it trained LongCat-2.0 on custom ASIC hardware, and no NVIDIA fingerprint turned up in its weights.

The authors say the method agrees with publicly stated hardware for 24 models where developers disclosed it, including an NVIDIA model trained partly on GB200s. For DeepSeek-V4-Flash and Kimi K3, they confirmed the match on physical Blackwell chips. They also report statistical strength far beyond chance, with the six models' strongest evidence ranging from 49 to 1,385 sigma.

Scale and cost estimates

From model size and training data, the study estimates the largest runs, Kimi K3 and DeepSeek-V4-Pro, needed roughly 4,500 and 3,000 Blackwell GPUs over two to three months. It puts the five largest runs at about 12,000 GPUs combined, with the largest clusters costing perhaps $200 million to $300 million. The authors openly call these numbers uncertain: they depend on assumed training efficiency, token counts and run lengths that no lab has published. Their own comparison with disclosed Western runs suggests the true GPU counts could be higher, around 8,000 to 9,000 for the two biggest runs.

What it does and does not prove

The caveats matter. A fingerprint shows how the weights were initialized, which supports but does not prove that Blackwell also did the training. Specially configured AMD hardware, also export-restricted, is the only alternative the authors identified. They excluded it for DeepSeek-V4-Flash and consider it very unlikely for the others. The analysis also says nothing about where the chips were located, how they were obtained, or whether any export rule was broken. A Hopper reading cannot distinguish an H800, the China-market part, from an H100 or H200.

Why it matters

For developers, the interesting part is the technique. Open weights are not just a model; they carry forensic traces of the environment that produced them. As more frontier models ship open weights, provenance questions about compute may become answerable from the artifacts alone, without trusting anyone's disclosure.

For policy, the findings add technical weight to a long-running debate over whether chip export controls are being enforced effectively. Watch for responses from the named labs and NVIDIA, any follow-up from U.S. regulators, and whether other researchers replicate the method on additional models. The authors have also said they will publish more on how they estimate training token counts, which would let others check the compute figures.