DePue report claims six Chinese models trained on Blackwell GPUs

The loudest argument in open-weights circles today is a report, not a fact. Will DePue published "checkpoint forensics" research on November 12 claiming that six Chinese open-weights models, including DeepSeek-V4 and Moonshot AI's Kimi K3, carry initialization fingerprints matching Nvidia's Blackwell GPUs, and the post driving traffic to it drew more than 26,000 likes and over 3 million views within a day. No independent party has reproduced the finding, and the report itself says it does not prove an export-control violation.

Key facts

• The report claims recovered PyTorch init seeds and streaming-multiprocessor layouts match six models to Blackwell-class GPUs, per the report itself — a claim, not a verified finding.
• The named vendors are DeepSeek, Moonshot AI, MiniMax, and Ant Group; the named models are DeepSeek-V4, Kimi K3, Kimi K3.1-Pro, MiniMax-M3, and Ling-3.1 variants.
• The report's own conclusion states the fingerprint work "supports, without proving, the inference that Blackwell also performed the training."
• The report notes its results are from "one analysis pass, not yet re-run," and no code repository accompanies the publication.
• The announcement post on X drew 26,000+ likes and 3 million+ views, per public engagement counts — velocity, not verification.

What's driving the conversation

Will DePue, a developer known in open-weights circles, posted the report link on X on November 12 with the claim that the models' published weights carry the fingerprint of export-controlled hardware. The post took off fast. Kyle Chan, an anthropologist who writes on Chinese industrial policy, amplified it to a policy-audience following, and Elon Musk's engagement pushed it into the platform's widest feeds. Replies split into two camps: people treating the finding as proven espionage-era forensics, and practitioners pointing out that a seed match in untouched embedding rows says nothing about where training compute came from.

A second line of argument concerns the sourcing. The circulating summary included a line about "OpenAI and Anthropic researchers" having verified the analysis. That attribution does not appear in the report itself, and no named researcher has claimed it on the record. The people repeating it are repeating an unattributed sentence, which is exactly the kind of claim that hardens into fact by retweet.

The substance

The technical method is the part worth understanding, separate from the claims built on it. PyTorch initializes model weights with a deterministic random generator (Philox) whose output depends on a seed and on how many GPU threads share the work. The thread count is a function of the GPU's streaming multiprocessor count. A Blackwell B200/B300 with 148 SMs produces a 303,104-thread layout; an H100 with 132 SMs produces 270,336 threads. Weights that training never touches, like rows for token embeddings the model never saw, keep their initialization values exactly. The report says it recovered seeds and matched thread layouts against those preserved values, with correlations above 0.999 on untouched weights and a weaker statistical trace (r = 0.066, 20 sigma or higher) on trained ones.

If all of that held up under independent replication, it would be a real forensic technique. Nothing published so far lets anyone check it. There is no code, no search script, and no pre-registered method. The report says the lowest of its six results took 20 sigma on a single analysis pass that has not been re-run, which is a self-assessment, not a replication. What would verify it: an independent rerun of the seed search against the published checkpoints, a public repository with the extraction code, a named on-record reviewer, or responses from the four named labs. None of those exist as of this morning.

The export-control claim is a further step removed. The report is explicit that a fingerprint in the weights shows the weights were initialized on certain hardware, and "supports, without proving" that the same hardware did the training. Initialization and training can happen in different places. Whether any listed entity acquired Blackwell-class GPUs in violation of US rules is a question for regulators with subpoena power, not for a statistical match in an embedding table.

Why builders are watching

Two practical stakes sit under the noise. The first is provenance tooling: if checkpoint forensics becomes reproducible, "who trained this and on what" becomes a due-diligence question anyone mirroring third-party checkpoints can ask, which cuts both directions — it makes supply chains auditable and it makes every released checkpoint a potential exhibit. The second is the models themselves: DeepSeek-V4 and Kimi K3.1-Pro are live, widely served options that we cover for API placement and self-hosting, and none of today's discourse changes what the weights do. Watch for a code release or an independent rerun. Until one lands, this is a claim package moving at the speed of the timeline, and it should be quoted as exactly that.