Ex-OpenAI Researcher Says GPU Fingerprints Point to Blackwell

Will DePue, a former OpenAI researcher who worked on Sora, has published a "checkpoint forensics" report claiming that six open-weight models carry NVIDIA Blackwell hardware fingerprints: DeepSeek-V4-Flash, DeepSeek-V4-Pro, Kimi K3, Kimi K3.1-Pro, MiniMax-M3 and Ling-3.1-flash. Within four hours his thread had 17,800 likes, nearly 9,000 bookmarks and more than 1.7 million views.

There is no leak and no supply-chain source. The evidence comes entirely from weights the labs themselves posted to Hugging Face.

How it works: the random numbers are fixed, where they land depends on SM count

Before training, every weight gets a random starting value. PyTorch on NVIDIA GPUs uses cuRAND's Philox generator, so the same seed always yields the same sequence. What changes is placement. A large initialization runs 2,048 threads per SM, and thread 0 fills positions 1, N+1, 2N+1 and so on, where N is the total thread count.

So the SM count decides which slot each number lands in:

• Hopper (H100 SXM, H200, H800): 132 SMs, 270,336 threads
• Blackwell B200 and B300: 148 SMs, 303,104 threads
• Grace Blackwell GB200 and GB300: 152 SMs, 311,296 threads

Right seed with the wrong SM count gives the right numbers in the wrong places. Right SM count with the wrong seed gives the wrong numbers. Only both together reproduce the original matrix.

Training rewrites most weights but never erases the start. Vocabulary rows for tokens that were never seen keep their initial values almost exactly. Trained weights still correlate weakly with their starting values across hundreds of thousands of samples: averaged over 42 layers of DeepSeek-V4-Flash, r = 0.066, which is 57 sigma under the Blackwell layout and zero under Hopper.

The hard proof: bit-exact on a B300, gone with seed + 1

DePue searched about 6 trillion seed and layout combinations. The best accidental match across that space should reach about 8 sigma. The six models range from 49 to 1,385 sigma, and the weakest single test still hits 20.

Then came real hardware:

• DeepSeek's seed is 953049583, shared by V3 and V4-Flash. On unmodified PyTorch, an H100 reproduced all 57,344 preserved values in V3 bit for bit and none of V4-Flash. A B300 did the reverse: 461 of 469 selected V4-Flash rows above 0.99 correlation, 445 of them bit-exact.
• A rented GB200 with Moonshot's seed 20256586 reproduced all 13 of Kimi K3's preserved rows.
• Add one to either seed and every match disappears.

The method was calibrated too. For 24 models whose developers disclosed hardware, every reading agrees. Llama 3.1 reads 132 (H100), Pythia reads 108 (A100), and NVIDIA's own Nemotron-3 Ultra, whose report names GB200, reads 152, exactly like Kimi K3.

The timeline says more than the verdict

The switch points are strikingly clean:

• DeepSeek: V3 (Dec 2024) Hopper, then V4 (Apr 2026) Blackwell
• Moonshot: K2.5 (Jan 2026) Hopper, then K3 (Jul 2026) GB200/GB300; K2.7-Code in between is a merged checkpoint, about 80% Hopper-era weights and 20% a new 148-SM draw
• MiniMax: M2.7 (Apr 2026) Hopper, then M3 (Jun 2026) B200/B300
• Ant Ling: 3.0-flash (Aug 2026) Hopper, then 3.1-flash (Oct 2026) GB200/GB300

Meanwhile the latest Qwen3.8, GLM-5.3, Hunyuan Hy4-preview, MiMo-V2.5-Pro and Step-5-Preview weights all still read as Hopper. Meituan says LongCat-2.0 trained entirely on "AI ASIC superpods," and its weights carry no NVIDIA fingerprint at all. Baidu's ERNIE-5.5 uses PaddlePaddle, so its seed (2760) is recoverable but its chip is not.

On scale, DePue estimates each of five runs needed about 1,500 to 3,500 Blackwell GPUs for 1.5 to 3 months, roughly 12,000 in total (range 7,000 to 20,000). At about $70,000 per GPU, the largest cluster is around $200 million and the five together exceed half a billion dollars, for final training runs alone.

Don't misread it: this is where the model was born, not proof of smuggling

DePue is explicit about the limits, and they matter:

1. The fingerprint identifies initialization hardware. A lab could initialize on one cluster and train on another. But Kimi K3 shows at least 64 separately seeded processes all leaving the same 152-SM layout, which makes "Blackwell only for the init" a stretch.
2. It says nothing about location or ownership. Renting Blackwell in an overseas cloud leaves the same fingerprint. The report does not find any export-control violation.
3. AMD is the only known alternative. An MI300X limited to 152 or 148 CUs reproduces the same layouts, confirmed on real hardware. But in the 377 values where the two vendors' math differs, V4-Flash matches NVIDIA in 363 and AMD in none. The other five can't be settled the same way and are rated very unlikely, and the MI300X is export-controlled anyway.
4. There are blind spots. Closed models can't be checked, and CPU initialization (some Qwen3 models), PaddlePaddle and Ascend leave no GPU fingerprint. No reading doesn't mean no Blackwell.

What actually changes

For a year, U.S. officials and the press have said DeepSeek and Moonshot were using Blackwell without publishing technical evidence. Now the evidence sits in open weights, and anyone with a B300 can reproduce it.

For Chinese open-weight labs, that is an awkward paradox: the more completely you open your weights, the easier you are to audit for hardware. Expect the next wave to initialize on CPU or resample untrained embedding rows. That kind of anti-forensics costs almost nothing.

For Washington, the timing is pointed. Jensen Huang has just stepped down as NVIDIA's CEO and the fight over export controls is at full heat. A reproducible report with sigma values carries more weight than any anonymous source.

For the industry, checkpoint forensics may outlive this verdict. DePue says similar methods have already turned up more, with details coming soon. Weights are no longer just a store of capability. They are a birth certificate written in numbers.