Checkpoint forensics: reading the GPU out of the weights
Published weights turn out to carry a fingerprint of the hardware they were initialized on. Will DePue at Unemployment Labs recovers traces of a model's initial random values from its released checkpoint, then searches about 6 trillion seed and layout combinations for the GPU configuration that reproduces them. The report is dated Nov 12 (https://unemploymentlabs.com/checkpoint-forensics) and went wide on Nov 13, when TechCrunch picked it up at 18:40 UTC: https://techcrunch.com/2026/11/13/export-banned-nvidia-chips-are-behind-chinas-most-powerful-ai-models-uh-oh-jensen/
The result is the headline. The report finds Blackwell-class fingerprints in six Chinese open-weight models: DeepSeek-V4-Flash and DeepSeek-V4-Pro, Kimi K3 and K3.1-Pro, Ling-3.1-flash and MiniMax-M3. The SM counts point to B200/B300 parts for some and GB200/GB300 for others. Earlier models from the same labs read as Hopper. The newest Qwen, GLM, Tencent, Xiaomi and StepFun models still read as Hopper, and Meituan's LongCat-2.0 shows no Nvidia fingerprint at all. Blackwell is the chip generation the US export rules were meant to keep out of China.
Why take it seriously: the method agrees with all 24 models whose developers have disclosed their hardware, including Nemotron-3 Ultra. Signals range from 49 to 1,385 sigma against about 8 sigma expected from chance, and the result was confirmed on physical Blackwell hardware for V4-Flash and K3. The report also rules out AMD for V4-Flash.
What it does not prove matters just as much, and the report says so. The fingerprint shows where the weights were initialized, which supports, without proving, that the model was trained on Blackwell. The scale estimates, about 12,000 Blackwell GPUs across five runs with a range of 7,000 to 22,000, rest on assumed utilization, token counts and run lengths, and the authors say they are not confident in them. Nothing here says how the chips were obtained or where they sit.
For anyone building on open weights, the bigger story is the method. Provenance used to mean trusting a model card. Now part of it can be read straight from the checkpoint, the way a forensic lab reads a printer's dots off a page. Expect labs to start scrubbing initialization, and expect regulators to start asking for this kind of test.
← Back to all articles
The result is the headline. The report finds Blackwell-class fingerprints in six Chinese open-weight models: DeepSeek-V4-Flash and DeepSeek-V4-Pro, Kimi K3 and K3.1-Pro, Ling-3.1-flash and MiniMax-M3. The SM counts point to B200/B300 parts for some and GB200/GB300 for others. Earlier models from the same labs read as Hopper. The newest Qwen, GLM, Tencent, Xiaomi and StepFun models still read as Hopper, and Meituan's LongCat-2.0 shows no Nvidia fingerprint at all. Blackwell is the chip generation the US export rules were meant to keep out of China.
Why take it seriously: the method agrees with all 24 models whose developers have disclosed their hardware, including Nemotron-3 Ultra. Signals range from 49 to 1,385 sigma against about 8 sigma expected from chance, and the result was confirmed on physical Blackwell hardware for V4-Flash and K3. The report also rules out AMD for V4-Flash.
What it does not prove matters just as much, and the report says so. The fingerprint shows where the weights were initialized, which supports, without proving, that the model was trained on Blackwell. The scale estimates, about 12,000 Blackwell GPUs across five runs with a range of 7,000 to 22,000, rest on assumed utilization, token counts and run lengths, and the authors say they are not confident in them. Nothing here says how the chips were obtained or where they sit.
For anyone building on open weights, the bigger story is the method. Provenance used to mean trusting a model card. Now part of it can be read straight from the checkpoint, the way a forensic lab reads a printer's dots off a page. Expect labs to start scrubbing initialization, and expect regulators to start asking for this kind of test.
Comments