DeepSeek’s AI Models Carry Nvidia Blackwell ‘Fingerprints,’ Researcher Says

Researcher Will DePue says the numbers inside DeepSeek’s AI models carry a hidden Nvidia Blackwell fingerprint, raising fresh questions about Chinese developers’ access to restricted American computing hardware.

His claim spans six models from DeepSeek, Moonshot AI, MiniMax and Ant Group. The unusual evidence trail is the models’ publicly released weights: the enormous collections of numbers that determine how they work.

But the distinction between a striking technical finding and a proven export-control breach matters. The research identifies patterns left when models were initialised. It cannot, by itself, establish where the hardware was located or how access was obtained.

DeepSeek Blackwell claim turns model weights into evidence

“This evidence isn’t based on any insider information or leaking,” DePue wrote in his post on X. He says he searched more than six trillion combinations of hardware layout and random seed to find matches in published models.

The premise is that initialisation leaves a numerical trace. Before training adjusts a model’s weights, software must generate their starting values. DePue argues that how a GPU distributes that work can leave a recognisable pattern that survives subsequent training.

In plain language, the claim is that the finished model still contains clues about the machinery that first set it up. That would make releasing weights a form of transparency extending beyond the model’s capabilities to aspects of its production history.

What the hardware tests showed

DePue says a Blackwell B300 reproduced 445 entire preserved rows in DeepSeek-V4-Flash bit for bit, while a Hopper H100 did not. He also reports reproducing Kimi K3’s pattern on a rented GB200. These are his reported tests; BNC has not independently reproduced them.

DePue has also published a verification repository with selected weight rows and scripts for five models, including the older DeepSeek-V3. It lets readers replay these comparisons; releasing code is not the same as an independent replication.

The November 12 Unemployment Labs report associates DeepSeek-V4-Flash and MiniMax-M3 with B200/B300-compatible patterns. DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ant Group’s Ling-3.1-flash match GB200/GB300-compatible layouts. The method does not distinguish individual chip models within those groups.

There is an established reason to care about the exact environment in these comparisons. PyTorch’s reproducibility documentation explains that fixed seeds can reproduce random sequences under controlled conditions, while identical seeds do not guarantee identical results across platforms, versions or CPU and GPU execution.

That documentation does not verify DePue’s findings. It helps explain why a convincing reproduction must specify the software, hardware and settings, rather than rely on a matching seed alone. The engineering details are part of the evidence, not incidental background.

The limits are as important as the fingerprint

An unusually configured AMD MI300X can mimic these layouts. The report excludes that alternative for V4-Flash, but not the other five models. Initialisation also need not use the hardware that subsequently trains a model.

The report is explicit that its findings “do not establish where the chips were located, how access was obtained, or whether export controls were violated.” A hardware match therefore cannot be read as a customs record or proof of a shipment into China.

Those qualifications leave room for a consequential result without accepting every broader inference attached to it. Evidence about one stage of model development can be valuable even when the rest of the supply chain remains unknown.

Why the export-control question is live

The political context predates this report. In February, Reuters quoted a senior Trump administration official alleging that DeepSeek had trained a model on Blackwell despite U.S. restrictions. The official did not disclose how the government obtained its information. That earlier allegation is context, not independent confirmation of DePue’s new tests.

The legal framework also reaches beyond a simple map of chip locations. In May 31 guidance, the Bureau of Industry and Security said pre-existing licensing requirements continued to apply to covered advanced-computing items destined for certain China- or Macau-headquartered entities, including entities outside those destinations, unless an applicable exception was available.

That guidance concerns specified transactions and regulated items. Establishing a violation would require evidence about the parties, permissions and circumstances involved. A technical paper can raise questions for investigators without answering every legal element itself.

Running DeepSeek on Blackwell is a different question

Nvidia’s own technical documentation already describes serving DeepSeek-V4 on Blackwell and Hopper systems. That is inference: running a released model to produce answers. DePue’s analysis concerns the hardware used to generate starting weights, with possible implications for training.

Confusing those stages would make ordinary deployment documentation look like evidence of the disputed development process. It is not. An open model can run on hardware different from the equipment that originally created it.

For investors, the broader issue is how hardware access shapes AI competition and the economics of supplying computing capacity. BNC’s CoreWeave earnings analysis examined the financing burden behind that infrastructure buildout. This report adds a different question: how much outsiders can learn about computing access from the models themselves.

The next useful evidence would be independent reproductions, scrutiny of alternative explanations and responses addressing the findings from the companies named. For now, DePue has supplied a detailed, testable claim. The intrigue lies in what the numbers might reveal—and in the gap between identifying a machine’s trace and reconstructing how it came to be used.