China’s Top SI Labs Used Nvidia Chips America Banned, a Researcher Says.

On Thursday afternoon, former OpenAI researcher Will Depue published what he calls conclusive forensic evidence that China’s four leading SI labs have built their newest models on Nvidia’s most advanced chips, the ones barred from export to China.

“I’ve found conclusive forensic evidence that the top 4 Chinese AI labs—DeepSeek, Moonshot, MiniMax and Ant Group—have built their newest models on NVIDIA’s most advanced Blackwell chips, which are barred from export to China,” Depue wrote. He worked on Sora and on post-training at OpenAI, and now does this work at a group he calls Unemployment Labs.

He says the evidence did not come from a leak or an insider. It came from the model files the companies published themselves.

The starting numbers still give the chip away

An SI model is a long list of numbers, called weights. Training slowly changes those numbers until the model gives useful answers. Before that work starts, the list is filled with starting values from a formula that begins with one number, called a seed, so an engineer can repeat a run.

The catch, Depue says, is that the software most labs use splits that job across a huge number of parallel workers on the chip. Different chips have different numbers of processors, so they lay the same seed out in different patterns. A faint trace of that starting pattern, he says, survives in the finished model. He showed that by arranging a photograph of himself into starting weights, then training the model. “The photo fades but the sky and the treeline can still be made out at the end,” he wrote.

He searched more than six trillion combinations of chip layout and seed and compared them with the published models. On DeepSeek-V4-Flash, he says, every processor count produced noise until 148, the count for Nvidia’s Blackwell B200 and B300 chips, where the weights lined up. Four of the six models he flags match Grace Blackwell, the GB200 and GB300 parts used in Nvidia’s flagship liquid-cooled racks.

He then ran the test on real hardware. With the seeds he had recovered, a Blackwell B300 reproduced DeepSeek-V4-Flash’s untouched starting weights bit for bit, he says, and a rented GB200 reproduced Moonshot’s Kimi K3 almost exactly. An older Hopper H100 reproduced none of the DeepSeek values, and changing the seed by one broke the match.

He argues this is far beyond a lucky hit. Across those trillions of combinations, he says, the best accidental match should reach only about eight standard deviations above chance. The real matches, he reports, range from 49 to 1,385. The full write-up is posted on the Unemployment Labs site.

Two of the four labs had not been publicly tied to these chips

Depue names six models released since April. DeepSeek-V4-Flash and MiniMax-M3 match the B200 or B300. DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro and Ant Group’s Ling-3.1-flash match the GB200 or GB300. Earlier models from the same labs, he says, still match the older Hopper generation.

“Critically, MiniMax and Ant have not been publicly tied to Blackwell before,” he wrote. MiniMax’s models match Hopper through M2.7 in April and Blackwell from M3 in June. Ant’s Ling-3.0-flash, released in August, still reads as Hopper; Ling-3.1-flash, released in October, reads as Blackwell. Ant’s own GitHub repository, cuLA, includes benchmark logs labeled “GPU: NVIDIA GB300” and auto-generated on March 31.

U.S. officials and earlier press reports had already alleged that DeepSeek and Moonshot were using these chips, Depue notes, without publishing technical evidence. What’s new, if the work holds, is the public forensic case, and the first public tie to MiniMax and Ant. He estimates the largest runs, Kimi K3 and DeepSeek-V4-Pro, used 2,000 to 3,000 Blackwell chips each, in clusters that “cost on the order of $150 to $200 million each to buy, and across these labs alone would add up to more than half a billion dollars of export-controlled GPUs.”

“I am highly confident in this result, and it has been independently verified by senior researchers at OpenAI and Anthropic,” he wrote. He says he will share a GitHub repository and a full paper soon.

The traces don’t say where the machines are

Depue is careful about what the fingerprints do not show. “Of course, this tells us nothing about where these chips physically are,” he wrote. “They could have been smuggled into China or the labs are using them abroad through gaps that Congress has not closed. In either case, it’s clear that the export bans are deeply failing.”

His report makes the same limit plain. The method identifies the hardware that generated the starting weights. It supports, but does not by itself prove, that the same chips also did the training, and it cannot show who owned the machines or whether an export rule was broken. Blackwell systems can be rented in data centers outside China, a path we reported on Wednesday when Nvidia itself began squeezing that overseas door.

The finding lands on the same day Nvidia’s longtime chief, Jensen Huang, resigned and Republicans said they want him in front of Congress before Thanksgiving, a fight we covered this morning. Export controls were already in that conversation. A forensic case that four Chinese labs used the banned chips will add fuel to it, even if it does not settle how the labs got access.

Not everyone treated the result as a shock. Dylan Patel of SemiAnalysis replied that it was obvious, because the code DeepSeek and Moonshot have open-sourced “is only for Blackwell.” Depue answered that some things Patel knows are not common knowledge. In another reply, he called the result “100% confirmation of something everyone already knew,” and said the extra certainty “is just worth a lot on the world stage.”

As of publication, the House Select Committee on China, the Commerce Department, Nvidia and the four labs had not issued a public response. Depue said he sat on the findings, consulted advisers and corresponded with officials before posting them. He also warned that the window to check other models may be closing. “Unfortunately, it’s of note that now that this is public any lab can erase many of these signatures,” he wrote.

The models are already public. If Depue is right, the traces of the chips that started them are already in the files. That is a narrower claim than a smuggling case, and a harder one for Washington to ignore.