Checkpoint Forensics: Blackwell Fingerprints in Six Chinese Open-Weight Models

On November 12, 2026, Will DePue at Unemployment Labs published checkpoint forensics showing six open-weight frontier models from Chinese labs carry initializer patterns that match NVIDIA Blackwell streaming-multiprocessor counts—while earlier releases from the same companies match Hopper. The story lands beside Congress pushing tighter chip curbs, the Wyden–Neal preservation demand, and Jensen Huang’s resignation. Unlike press attributions alone, this release is reproducible math on public weights.

The authors are explicit about scope: they show access to Blackwell-class hardware at initialization, not proof of smuggling, not proof of where GPUs sat, and not proof that every training flop ran on NVIDIA silicon.

Update (November 13, 2026): DeepSeek-V4.1-Flash shows no fingerprint

Readers asked about DeepSeek's newest model. The report's own limitations section answers it: the authors write that they "found no fingerprint" in DeepSeek-V4.1-Flash "despite an exhaustive search," on the primary page. They give the same result for Meituan's LongCat-2.0, which Meituan says it trained on "AI ASIC superpods."

What this means, and what it does not:

• It is not a clean bill of health. The method needs a recognizable, hardware-dependent pattern in the starting weights. If the weights were initialized on a CPU, or a different framework produced them, no GPU trace exists. The report states this for Baidu's PaddlePaddle-trained ERNIE-5.5 and several Alibaba Qwen3 models.
• The report does not say what chips trained V4.1-Flash. It links no Huawei chip to DeepSeek. Its only Ascend reference is a deleted fine-tuning configuration in LongCat-2.0, which the authors read as Huawei Ascend 910. Treat any claim that the report "confirmed" Ascend training for DeepSeek as unverified.
• Serving is a separate question. The method looks only at initialization traces in weights, so it says nothing about the chips that serve a model.

The six-model result above is unchanged. For the policy side, see the Megaspeed routing coverage and the Commerce remote-access rule.

TL;DR

Why weights can carry a GPU signature

Modern large language models start training from billions of pseudo-random initial values. In the PyTorch stacks most frontier labs use, Philox seeding runs through cuRAND workers mapped to streaming multiprocessors (SMs). Change the SM count and the same seed lands numbers in different matrix positions.

The Unemployment Labs walkthrough (their Figures 1–3) builds intuition on toy grids, then maps to production counts:

Training updates most weights, but untouched rows and weak residual orderings can survive—enough to search trillions of seed-and-layout pairs and test hold-out tensors.

Which models flipped from Hopper to Blackwell

The report’s Table 1 is the anchor. Summarized for builders tracking which checkpoint era you are fine-tuning:

Blackwell-class parts named in the report require U.S. licenses for export to China, and the authors note no reported licenses for those six lines. That is a policy juxtaposition, not a legal finding from weights.

If you deploy Kimi K3 on Bedrock or other listed families, inference behavior does not change because of this paper. The insight is supply-chain and geopolitics, not API parameters.

Preserved tensors and SM peaks

Checkpoint forensics chart comparing DeepSeek-V3 Hopper preserved weights versus V4-Flash Blackwell fingerprint Image: Unemployment Labs

Figure 4 in the primary report compares preserved starting values against regenerated layouts. DeepSeek-V3 dots line up on the Hopper diagonal; V4-Flash lines up on Blackwell.

Blackwell GPU fingerprint peaks at 132 versus 148 versus 152 streaming multiprocessors in checkpoint forensics Image: Unemployment Labs

Figure 6 shows single clear peaks at 132, 148, and 152 SMs for the showcased models—other tested layouts near zero. That is the core visual claim.

Scale the authors infer from token budgets

Using disclosed or estimated token counts, the report estimates rough final-run cluster sizes on the assumption initialization hardware matches training hardware:

DeepSeek-V3’s disclosed 2,048 chips sit inside the band their arithmetic gives for that generation. These are order-of-magnitude figures, not audited financial statements. They matter for readers parsing whether Chinese labs are rushing overseas capacity versus domestic ASIC paths like Meituan’s LongCat claims.

What the study does not claim

The limitations section is worth reading in full on the primary page. Highlights for practitioners:

• Closed weights cannot be tested.
• PaddlePaddle or CPU-only initialization leaves no NVIDIA GPU trace—several Alibaba Qwen3 variants fall here.
• Mixed clusters or continued training on new silicon blur “initialization-only” reads.
• Geography and ownership are invisible in checkpoints.
• AMD misconfiguration is theoretically possible; authors argue against it for five of six models and show NVIDIA alignment on physical B300 for V4-Flash.

None of this replaces Commerce remote-access rules or Entity List procurement stories. It adds open, checkable evidence to a week already shaped by Megaspeed routing reporting and Alice Huang investment claims.

What developers are saying

The Hacker News thread is early but mixes policy fatalism with skepticism about enforcement:

• saidnooneever argued export controls are routinely ineffective, comparing the GPU gray market to western chips found in Iranian drones (comment).
• cadamsdotcom floated a thought experiment that tolerated gray-market sales could suppress domestic chip ambition—a hypothetical, not evidence (comment).
• exabrial speculated exported gear might ship with spyware—also unverified (comment).

Treat these as discussion, not corroboration of the forensics math.

Step-by-step: what the search actually does

If you have only read headlines, the method can sound like guessing. The Unemployment Labs pipeline is closer to cryptanalysis on public tensors:

1. Download open weights for a target checkpoint.
2. Identify preserved regions—rows tied to unused tokens, embedding rows lightly updated, or other tensors that stayed near initialization.
3. Fix a candidate seed by brute-forcing Philox parameters until preserved values align on a trial layout.
4. Score layouts by SM count—132 versus 148 versus 152—and measure correlation on trained weights where order statistics survive noise.
5. Hold out separate tensors that did not participate in seed picking; report sigma against a chance model that accounts for trillions of tried combinations.

Step 5 is what separates this from p-hacking a single matrix. The authors say even their weakest reported hold-out test cleared 20 sigma, while accidental peaks in a search space of roughly six trillion seed-layout pairs should top out near 8 sigma under their model.

Closed API models never enter that pipeline. That is why the story is about open weights geopolitics, not about guessing GPT-family training sites.

Export politics versus reproducible weights

Blackwell GPU fingerprint analysis sits inside global AI chip supply and export-control enforcement

November policy fights rarely ship new BIS rule text overnight. They do shift risk premiums on who may host which checkpoint. If your organization mirrors Chinese open weights for research, document why—license compliance, not rumor.

Where this sits in a crowded news week

November 12 already had overlapping threads: committee Democrats demanding Commerce preserve Section 232 tariff records, intelligence briefings on Huang’s resignation, and outlets repeating unverified smuggling narratives without tensor proof. Forensics does not adjudicate any single executive’s conduct.

It does give engineers a falsifiable artifact. When a lab claims Hopper-only training but ships a checkpoint whose preserved rows peak at 152 SMs, outsiders can ask for cluster logs, not just blog posts. Several labs in the same study never flipped—Qwen, GLM, Tencent, Xiaomi, StepFun still read Hopper in the newest public weights the authors checked—so the fingerprint story is not “every Chinese model is Blackwell.”

Meituan’s LongCat-2.0 is called out separately: the company cites ASIC superpods, and the authors report no NVIDIA fingerprint in released weights. That contrast matters for readers betting on domestic alternative silicon versus continued NVIDIA dependence.

How to reproduce or challenge the result

Engineers with hopper and Blackwell rentals can mirror the verification paragraph:

1. Recover the published Philox seed the authors report (for example 953049583 on DeepSeek-V4-Flash).
2. Run unmodified PyTorch initialization on H100 versus B300 (or GB200 for Kimi’s seed 20256586).
3. Compare preserved rows bit-for-bit where training did not overwrite them.

Disagreement belongs in replication, not hot takes: if a lab shows a Hopper-only cluster log that still reproduces weights, that would challenge the “initialization equals training silicon” assumption for that run.

What this means for what you build

You do not need to stop downloading weights. You do need sharper language than “they definitely smuggled Blackwell”—the authors refuse that jump, and so should we.

Related on explainx.ai

• Congress NDAA chip curb momentum
• Wyden–Neal Commerce preservation letter
• Commerce remote NVIDIA use rule
• Chinese labs overseas capacity rush
• Singapore Megaspeed enforcement narrative
• Kimi K3 builder guide

Forensic figures and SM tables reflect Unemployment Labs as of November 12, 2026. Export status of any chip shipment requires government records, not matrix algebra alone.