An Unemployment Labs analysis by Will DePue, published November 12, 2026, found initialization patterns consistent with NVIDIA’s export-controlled Blackwell GPUs in six open-weight models from DeepSeek, Moonshot AI, MiniMax and Ant Group.
The analysis associates DeepSeek-V4-Flash and MiniMax-M3 with initialization on B200 or B300 chips, and DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ling-3.1-flash with GB200 or GB300 chips. The matches identify the hardware layout behind the starting weights; whether those chips also performed training is a separate inference.
Successive releases place the apparent changes in time. DeepSeek-V3 produced a Hopper reading in December 2024, followed by the two Blackwell-reading V4 models in April 2026. Moonshot AI’s Kimi K2.5 read as Hopper in January 2026 before K3 in July 2026; MiniMax-M2.7 and M3 followed the same pattern in April 2026 and June 2026, respectively; Ant Group’s Ling-3.0-flash and Ling-3.1-flash did so in August 2026 and October 2026.
The pattern was not universal. The newest readable models from Alibaba, Zhipu, Tencent, Xiaomi and StepFun produced Hopper rather than Blackwell readings.
How Initialization Reveals a Hardware Layout
The technique begins with weights, the numerical parameters that training adjusts. Before training, the PyTorch/cuRAND setup examined uses the Philox generator to produce repeatable values from a seed. GPU threads distribute those values among weight positions, and a sufficiently large initialization uses 2,048 threads per streaming multiprocessor (SM). Changing the SM count therefore changes where the same generated numbers land.
In the configurations tested, Hopper H100 SXM, H200 and H800 chips have 132 SMs and 270,336 threads; B200 and B300 chips have 148 SMs and 303,104 threads; GB200 and GB300 chips have 152 SMs and 311,296 threads. A reading identifies one of these groups, not a specific chip within it.
Weights reserved for words or symbols absent from training can preserve their initial values almost exactly, while trained weights may retain a weaker statistical relationship to those values. The investigators select a seed and layout on one set of weights, then test that unchanged combination on a separate set excluded from the search.
Under its statistical model, the report estimates that roughly 6 trillion seed-and-layout combinations would produce an expected strongest chance match of about 8 sigma, a statistical measure of distance from random variation. The strongest results for the identified models range from 49 to 1,385 sigma, and every individual test included reaches at least 20 sigma.
Physical Checks and Training-Scale Estimates
DePue’s physical-chip reproductions provided another check. Using DeepSeek’s recovered seed, an H100 reproduced DeepSeek-V3’s preserved values but not V4-Flash’s, while a B300 did the reverse. On the B300, unmodified PyTorch reproduced 461 of 469 selected V4-Flash rows with correlations above 0.99, including 445 complete bit-for-bit row matches. A rented GB200 reproduced all 13 preserved Kimi K3 rows with Moonshot’s seed; changing either recovered seed by one produced no matching rows.
The report says the method agreed with all 24 cases where a developer publicly named a specific model’s hardware, while cautioning that 11 involve step-zero checkpoints and related models are not independent. That makes the comparison a consistency check rather than a measured accuracy rate.
Kimi K3.1-Pro uses K3’s seed and may be a K3 checkpoint with further post-training. Assuming the initializing hardware also performed training, DePue estimates five distinct final runs at roughly 500 to 3,000 Blackwell GPUs each, generally over two to three months. The calculation divides training compute by chip throughput at 35% utilization, using DeepSeek’s disclosed token counts and weight-based token estimates for the other models. Applying the same arithmetic to DeepSeek-V3 produced 2,000 to 2,500 chips, compared with DeepSeek’s disclosed 2,048.
Limits for Export-Control Enforcement
A match concerns initialization alone; it cannot inventory every processor used during later training. A lab could create initial values on one system and transfer them, mixed clusters could leave only some hardware traces, and a Hopper result does not exclude subsequent Blackwell training. Nor can weights establish chip ownership, location or acquisition. DePue’s report notes that Blackwell systems can be rented outside China and says this evidence alone establishes neither smuggling nor an export-control violation.
AMD’s MI300X is the identified hardware alternative. It normally uses 304 processing units but can be divided into two groups of 152 or configured to use 148, reproducing the layouts in physical tests. For DeepSeek-V4-Flash, 363 of 377 preserved values that differ between vendors matched NVIDIA and none matched AMD. That numerical test did not settle the other five models, although the report considers a specially configured AMD cluster very unlikely.
The report states that B200, B300, GB200 and GB300 exports to China require a U.S. license and that no such licenses have been reported; it also says the MI300X is controlled. The method itself requires public weights and a recognizable hardware-dependent initialization pattern. CPU initialization leaves no GPU layout, and Baidu’s PaddlePaddle generator does not carry the examined chip layout.
The analysis gives policymakers technical evidence of hardware access without supplying an enforcement conclusion: public weights can expose an initialization pattern, but determining whether export controls were breached would still require evidence about where the hardware was used, who owned it and how access was obtained.
Credit: Source link
