For three years, Washington has tried to keep China's AI labs away from Nvidia's best chips. On Thursday, a former OpenAI researcher said he could show it hadn't worked, using nothing but files the labs posted online themselves.

Will DePue says DeepSeek, Moonshot, MiniMax and Ant Group built their newest models on Nvidia's Blackwell chips, which the US bans from export to China. The claim lands the same week Nvidia's CEO, Jensen Huang, resigned amid reports of a relationship with a woman US intelligence has identified as a Chinese intelligence asset, and as Congress prepares to question him.

DePue worked on Sora and on training OpenAI's models before he left. He laid out his findings in a post on X, backed by a longer report from Unemployment Labs, a nonprofit he runs. He names six models: DeepSeek-V4-Flash and V4-Pro, Moonshot's Kimi K3 and K3.1-Pro, MiniMax-M3 and Ant Group's Ling-3.1-flash. All came out this year. All are open-weight, meaning anyone can download them, and that detail turns out to be the whole story.

There's no leak here and no inside source, he says. Just math, run on the models the labs chose to publish.

Born on a chip

Start with what an AI model actually is. Strip away the chat window and it's a giant file of numbers, billions of them, called weights. Training is the slow process of adjusting those numbers until the model gets good at its job.

Before training can start, every one of those numbers needs a starting value. Labs fill them in with what looks like random noise. It isn't really random. A standard formula takes a single number, called a seed, and churns out all the rest. Same seed, same numbers, every time.

This is where the chip comes in. A GPU doesn't produce those numbers one by one. It splits the job across thousands of tiny workers running side by side, and how it divides the work depends on the chip's design. DePue's report counts 132 processing cores on Nvidia's older Hopper chips, 148 on the Blackwell B200 and B300, and 152 on the GB200 and GB300.

Think of dealing cards. Deal the same shuffled deck to four players, then to five. Every card is the same, but each player ends up with a different hand. Chips behave the same way. Give two different chips the same seed and they produce identical numbers in a different arrangement. That arrangement is the fingerprint.

The surprising part is that it survives. Training rewrites most of the numbers, but not all of them. Some never get touched, such as the ones tied to words that almost never show up in training data. Those sit in the finished model looking nearly the way they did on day one. The rest keep a fainter trace, because numbers that started high still tend to end up high.

Six trillion guesses

To read the fingerprint, DePue had to work backward. He tried more than six trillion combinations of seed and chip layout against the published weights, hunting for the one that fit. Then, to make sure he wasn't fooling himself, he tested each match on a separate batch of weights he hadn't used to find it.

Next came real hardware. Using ordinary, off-the-shelf software, he says a Blackwell B300 regenerated DeepSeek-V4-Flash's untouched starting numbers exactly, digit for digit. An older H100 got none of them. A rented GB200 rebuilt Kimi K3's starting numbers almost perfectly, to a correlation of 0.999995. Change the seed by one and the match fell apart. Four of the six models, he says, line up with the GB200 and GB300, the parts inside Nvidia's top-end rack systems.

He also argues it can't be luck. Across six trillion tries, he writes, the best chance match should score about 8 sigma, which is a statistician's way of measuring how far a result sits above random noise. His matches run from 49 to 1,385. The weakest single test hits 20.

The method passed one more check. DePue says it named the right hardware in all 24 cases where a developer has said publicly what it used, including Meta's Llama 3.1, which ran on H100s. It even gives a timeline. DeepSeek's models read as Hopper through V3, released in December 2024, and as Blackwell from V4 in April. Models from Qwen, GLM, Tencent, Xiaomi and StepFun all read as Hopper.

The fine print

DePue's post on X calls the evidence conclusive. His report is more restrained, and the gap between the two matters.

Strictly speaking, the fingerprint shows which chip set a model's starting numbers. It doesn't prove which chip did the training. The report says the evidence "supports, without proving, the inference that Blackwell also performed the training." A lab could in theory generate the numbers on one machine and train on another, though it's hard to see why anyone would bother.

A specially configured AMD chip could also mimic the same layouts. DePue says a numerical test points to Nvidia for DeepSeek-V4-Flash and calls AMD very unlikely for the other five. And the method only works on models whose weights are public. The leading American models, which sit behind paid apps and APIs, can't be checked this way.

The biggest caveat is about location. The report says the weights can't reveal who owned the chips or where they sat, and that the finding alone doesn't prove smuggling or a broken law.

Renting isn't buying

That's where the policy fight lives. The report notes that Blackwell systems can be rented from data centers outside China, and US rules generally allow Chinese firms to rent chips abroad, even though selling the chips to them is banned. A Beijing lab renting servers in Thailand may be breaking nothing at all.

US officials have said for months that DeepSeek and Moonshot had Blackwell access, without showing technical proof. In April, a senior Trump administration official said DeepSeek V4 was trained on a Blackwell cluster in Inner Mongolia. DeepSeek denied it, saying it used Nvidia H800s, which were legal to export before the rules tightened, along with Huawei's Ascend 910C chips. Nvidia had rejected an earlier report that DeepSeek was using smuggled Blackwells.

In July, White House science adviser Michael Kratsios said Moonshot had acquired GB300 servers and used GB300s in Thailand. A person familiar with Moonshot's purchasing told Bloomberg the company has a route to Blackwell chips through Southeast Asia, but wouldn't say whether that meant renting or buying. CNBC later reported that Moonshot discussed renting clusters of more than 8,000 Blackwell GPUs from European cloud providers. The Commerce Department's export enforcement arm has reportedly opened a review of how Chinese AI firms reach Nvidia chips overseas.

The sums are not small. DePue estimates the two biggest runs, Kimi K3 and DeepSeek-V4-Pro, used 2,000 to 3,000 Blackwell GPUs each. In his post, he prices each cluster at $150 million to $200 million and puts the total across these labs above half a billion dollars, before counting experiments. He suspects the real figure runs into the billions.

Not everyone is alarmed. One widely followed watcher of Chinese AI, posting as @teortaxestex, called a few thousand Blackwells "utterly insufficient" for keeping up at the frontier. Read that way, the chips got through, just nowhere near enough of them.

Nvidia's worst week

For Nvidia, there was never going to be a good week for this, and this is about the worst one available. Huang resigned on Thursday after 33 years, and CFO Colette Kress is running the company on an interim basis. Huang has agreed to testify behind closed doors before three House committees before Thanksgiving, and House Foreign Affairs Chairman Brian Mast has named disagreements over export controls as one of the things he wants to ask about.

Lawmakers now have a fresh exhibit. A repeatable method suggesting the company's most restricted chips trained China's best models is exactly the kind of thing that finds its way into a hearing room.

Open by design

The Chinese labs face an irony of their own. Their models are popular around the world because they're free to download and run. That same openness is what let DePue read them. Publish your weights and you publish the fingerprint with them.

For companies building products on these models, it adds a new line to the checklist: where was this thing made? It also puts at least one lab's public account of its hardware under real pressure. A US official warned earlier this year that DeepSeek might try to scrub technical signs of the chips it used. Now that the method is out, the next round of models may arrive wiped clean.

What happens next

Everything rides on whether someone else can reproduce it. DePue's code is available to reviewers on request rather than published, and the OpenAI and Anthropic researchers he says verified the work haven't been named. He says more findings are coming. As of Thursday, none of the four labs or Nvidia had commented on the report.

If it holds up, checking where a Chinese model was trained no longer takes a spy agency. It takes a download, a rented GPU and six trillion guesses.