Six Chinese model checkpoints show Blackwell-compatible GPU initialization fingerprints

A reproduced seed from a Chinese open-weight model offers an unusual clue about the computer that created it. Researcher Will DePue recovered the initialization of DeepSeek-V4-Flash and then regenerated its preserved weights on physical NVIDIA B300 hardware: 445 complete rows matched bit for bit, while an older H100 reproduced the earlier DeepSeek-V3 initialization instead. The result is part of a November 12 investigation of six model checkpoints from four Chinese developers. It raises a concrete question about access to export-controlled accelerators, but does not establish where those accelerators were located or how any developer acquired access.

How an initialization becomes a hardware fingerprint

PyTorch generates many initial model weights using a deterministic Philox pseudorandom sequence. The seed determines the values, whereas the GPU's parallel thread layout determines where those values land in the weight matrix. Under the CUDA initialization implementation examined by DePue, the grid uses 2,048 threads per streaming multiprocessor (SM). That yields 270,336 threads on the tested 132-SM Hopper configuration, 303,104 on the 148-SM B200/B300 configuration, and 311,296 on 152-SM GB200/GB300. Even with the same seed, those different layouts place the same generated numbers at different coordinates.

Training changes many weights, but rarely used token rows can retain their original values, and some trained layers preserve weaker correlations with initialization. DePue searched candidate seeds and execution layouts, then tested the recovered configuration against held-out weights. This is a signature of initialization under a particular software and hardware configuration, not an embedded serial number or a record of every machine subsequently used for training.

Six checkpoints, four developers, two Blackwell-class layouts

The study also found Hopper-class signatures in earlier models from these developers. DeepSeek-V3 and Kimi K2.5 illustrate the older 132-SM pattern, although a fingerprint alone cannot distinguish H800 from H100 SXM or H200. A subtler intermediate example is Kimi K2.7-Code, whose preserved rows combine inherited Hopper-layout values and a newly initialized 148-SM component. DePue interprets that as a merged checkpoint rather than proof of a mixed training cluster, and does not count it as a seventh Blackwell model. MiniMax's M3.1-Flash also shares the M3 initialization in the report's larger appendix.

What was checked, and what was not

The search covered roughly six trillion seed/layout candidates. A single impressive correlation would be insufficient after so many comparisons: the author's approximate multiple-testing benchmark is eight sigma. The strongest reported evidence across the six models ranges from 49 to 1,385 sigma; selected seeds and layouts were also tested on previously unused weights. Separately, DePue reports agreement with 24 model/hardware combinations disclosed by their developers. These are author-performed consistency checks, not 24 independent external replications.

Physical reproduction provides a more interpretable control. On an unmodified B300 PyTorch setup, 461 of 469 selected DeepSeek-V4-Flash rows correlated above 0.99 with regenerated starting weights, including 445 rows identical bit for bit. An H100 reproduced 57,344 preserved DeepSeek-V3 values instead. On a rented GB200, all 13 preserved Kimi K3 rows matched the recovered seed, and shifting the seed by one removed the matches. The author published code, selected rows and a replay procedure so that others can inspect the calculations. The available repository documents these checks, but independent reproduction is a separate task.

There is an important hardware alternative. The author showed that a specially configured AMD MI300X can reproduce either candidate thread layout. For DeepSeek-V4-Flash, vendor-specific numerical differences favor NVIDIA: of 377 values that differentiate the two implementations, 363 match NVIDIA and none match AMD. Equivalent discrimination was inconclusive for the other five models. Consequently, a strong layout match is not, by itself, absolute identification of the manufacturer across every configuration.

What the cluster estimates measure

DePue revised his original November 12 calculations. His current best estimates are about 1,500 Blackwell GPUs for DeepSeek-V4-Flash, 3,000 for DeepSeek-V4-Pro, 4,500 for Kimi K3, 1,500 for MiniMax-M3 and 1,500 for Ling-3.1-flash. He gives a combined best estimate of approximately 12,000 across five inferred training runs, with a combined range of 7,000 to 22,000. Kimi K3.1-Pro shares K3's initialization and is not counted as a separate initial cluster. The estimates depend on guessed run durations, training-token totals, utilization and, crucially, the assumption that training used the same GPU class as initialization. None of these fleet sizes can be read directly from the published weights.

At the author's assumed equipment price of about $70,000 per GPU, the larger individual clusters would imply roughly $200 million to $300 million of hardware value. That is an illustrative cost calculation, not a verified purchase, invoice, deployed inventory or new financial loss.

A strong forensic clue is not a custody chain

U.S. export controls restrict shipments of the identified Blackwell configurations to China without the relevant authorization. Nevertheless, the forensic pattern cannot locate a machine, identify its owner, distinguish rental access in another country, reconstruct the procurement route or prove that export rules were violated. A checkpoint could be initialized on one architecture and subsequently trained on another. Conversely, failure to find a signature does not rule out a GPU: CPU initialization and other software frameworks can leave no comparable layout trace.

The finding extends Digging Beagle's model-artifact provenance investigation into hardware-origin evidence. It is related to, but different from, research in which weights are deliberately modified to change model behavior. Reproducible parameter patterns can support an attribution hypothesis; establishing a training location, a transfer of controlled equipment or a compliance violation would require independent infrastructure, contractual and custody evidence. The next useful verification is not another extrapolated cluster total, but independent reproduction of the published method and evidence about how the matching initialization environment was accessed.