A Chinese Military University on a U.S. Blacklist Bought Nvidia’s Top SI Chips Anyway

The paperwork was sitting on the school’s own website.

On Oct. 21, Northwestern Polytechnical University in Xi’an posted a routine procurement notice. Its management school had bought two Nvidia H200 chips for 874,700 yuan, about $123,000. The seller wasn’t Nvidia. It was a little-known local company called Shaanxi Bosuan Network Technology.

That would be an ordinary purchase anywhere else. It isn’t ordinary here. Northwestern Polytechnical builds research for military aircraft, missiles and satellites, and it has been on the U.S. Commerce Department’s Entity List since 2001.

Reuters found the record and reported it Wednesday, along with a broader look at how Chinese schools with defense ties keep getting American SI computing power, according to the full report carried by The Straits Times.

A blacklisted school with a shopping list

The H200 is one of Nvidia’s most capable chips for training and running advanced SI systems. Each one carries 141 gigabytes of fast memory, which is exactly what you need to build and fine-tune large models.

Northwestern Polytechnical is one of China’s “Seven Sons of National Defense,” a group of elite universities that do defense research for Beijing. Washington blacklisted it over alleged involvement in missile proliferation and tightened the rules in 2019. Since then, licenses to send it controlled U.S. technology have been denied in most cases.

The October buy wasn’t the only one. Unite.AI, reviewing the same records, found a separate Sept. 4 notice from the university’s cybersecurity school listing two more H200 cards for 796,000 yuan from a Shanghai supplier. The October notice has since been pulled from the school’s website, it reported.

Then there’s the rented computing. Buying a chip leaves a paper trail. Renting time on someone else’s server leaves far less of one.

In January, the cybersecurity school signed two seven-month contracts, worth 441,700 and 441,000 yuan, for access to servers holding eight H200 chips apiece. One covered fine-tuning SI models. The other covered reinforcement-learning training, the technique labs use to sharpen a model by rewarding good answers.

The school also rented servers packed with Nvidia A100 and A800 chips. Those two are banned for export to every Chinese buyer, blacklisted or not.

In total, Reuters counted five rental contracts at Northwestern Polytechnical this year.

The middlemen are the whole game

No one is saying Nvidia shipped chips to Xi’an. Every one of these deals ran through Chinese middlemen, and the records say almost nothing about where the processors came from or where the rented servers physically sit.

That’s the gap. A blacklist names the buyer. It doesn’t stop a local reseller from buying hardware somewhere else and selling it on, or a cloud company from renting out time on chips the end user never touches.

The Reuters review went well beyond one campus. It examined 26 Chinese procurement and corporate records from this year and found universities and research institutes buying restricted Nvidia chips or renting computing built on them.

Shenzhen University bought three H100 processors, another chip the U.S. bans for China, for 769,800 yuan in September. Wuhan University of Technology bought a server with an H100 in June and four A100s separately. Beihang University, another of the Seven Sons, bought four A800 processors in April. Beihang works on military aviation and space programs.

Two government notices this summer picked suppliers to rent H800 and A800 computing to the University of Chinese Academy of Sciences. One listed H800 time at 10 yuan per chip-hour. That’s about $1.40 an hour for access to hardware Washington says China shouldn’t have.

Nvidia, the Bureau of Industry and Security and the university didn’t respond to Reuters. Neither did the other schools named.

Where the rules stand

The January policy change matters here, and it’s easy to get wrong. Starting this year, the U.S. began approving some H200 sales to Chinese buyers case by case. To get a license, sellers have to screen customers, arrange independent testing in the United States, and certify the chips won’t go to military users or anyone on the Entity List. They also have to keep restricted parties from getting remote access.

None of that opened the door for Northwestern Polytechnical. Its own blacklist restrictions stayed exactly where they were. If anything, the January rules spell out that a school like this is the customer the system is built to keep out.

Meanwhile, Beijing has been holding back approval for large-scale H200 imports. Reuters reported last week that small amounts of H200s had still reached China through indirect routes.

Congress wants teeth

Lawmakers didn’t wait long to react. The House Select Committee on China, chaired by Michigan Rep. John Moolenaar, used the report to push its own fix.

Members of both parties have called for chip-tracking requirements and more congressional oversight of exports. The idea behind tracking is simple: if every high-end chip can report where it is, a reseller in Xi’an can’t quietly make it disappear.

The timing is rough for Nvidia. Three Republican committee chairmen have asked CEO Jensen Huang for a Nov. 18 briefing about his reported contacts with an alleged Chinese intelligence operative, Al Jazeera reported. Huang admitted to an affair on Sunday, and the company has said it has no reason to believe national security or confidential information was compromised. Nvidia’s board has opened an independent investigation.

Huang has long argued that selling to China keeps Chinese buyers hooked on American technology instead of building their own. Records like these give critics an easy reply. A school that designs missiles is already using the best American hardware it can find, and it didn’t need an export license to do it.

Two chips and a handful of rental contracts won’t build a military SI program by themselves. But the paper trail shows the pipeline is open, and it runs through ordinary-looking local vendors that nobody in Washington ever approved.