Chinese frontier AI models carry the fingerprint of export-controlled GPUs
unemploymentlabs.com
unemploymentlabs.com
“In facilities across the region, Megaspeed rents Nvidia chips to Chinese tech giants such as Alibaba, an arrangement that does not violate current US export control regulations.” See [1].
[1] https://www.atlanticcouncil.org/dispatches/beyond-the-spy-sc...
To be clear: I am not saying any of this is fair (or legal); I am only explaining how it works.
The same way they "jail" UN-appointed judges that go against their masters' interests: de-platform them from all US-controlled payment and software platforms.
if you are referring to people at the ICC, they are cut off from US services, but that is a long way from being in jail.
> He said: “We are going 30 years back in time. It’s like a time machine returning us to a pre-digital world,” he told France TV.
https://vinnews.com/2026/03/23/icc-judge-who-issued-netanyah...
There's no gotcha here, companies the world over could just ignore any sanctions they wanted, and some try to, but they do so knowing they themselves are (potentially) breaking local and international laws.
You might have well asked "what if a company helps you by importing contraband instead of you doing it directly"
Given the USA has completely torched its reputation amongst allies in the space of a year, I would expect this to happen more often.
Does anyone know why does the US allows Canada to trade with Cuba? That one always stood out to me as a bit odd. My guess: Canada is the largest trade partner with the US, so the US probably has more to lose by sanctioning Canada.
No way it could do the same to China without some major repercussions.
They do try workarounds, and when those are caught there are consequences
You can sit back down now.
Edit: Is there going to be more "laws can be broken so let's not bother" arguments, because that's lame and boring
Largely because other countries are willing to go along with it, and to the extent they are willing to do so.
Even NATO countries import Russian gas. The UK rolled back sanctions on Russia to import diesel earlier this year. Most of the rest of the world did not impose effective sanctions and lots of people trade with them (including huge economies like China).
The rest of the world is to dependent on China to want to get involved. The US might succeed in the current administrations attempt to split the world into new cold war spheres of influence (because people are scared of China too) but its not going to be easy, it will be painful, and its not going to get many countries to completely agree to what the US wants.
Lol. Yeh we can all see how well the sanctions worked on Russia and Iran. Thanks for proving my point!
Oh my poor sweet summer child, they are.
- USA doesn't have universal jurisdiction.
Not sure if you understand this, but nobody said they do, but, if you have a quick browse of the threads, it has been pointed out how they ensure cooperation from other countries.
- Electing someone USA doesn't like is not a crime.
Show me where anybody claimed anything close to that.
The truth is you've come here with a mindset based on a political ideology and that's blinded you to the objective discussion being held.
Further, the fact that I keep pointing out your argument is the same as the one where people claim laws are of no use because they are routinely broken does not mean anything other than I am telling you how pathetic your claim is.
Good day.
https://it.wikipedia.org/wiki/Organizzazione_Gladio
> I keep pointing out your argument
If you did more learning and less pointing out your conversations might turn out to have some value.
I was wondering why you wrote this part in French instead of English. Turns out it is a phrase that is sometimes loaned into English. It comes from the (French) writings of Voltaire.
https://wordhistories.net/2016/10/22/pour-encourager-les-aut...
Follow the money.
"A key player in getting Megaspeed off the ground was Alibaba, the Chinese e-commerce leader that has also been an aggressive player in AI, said people familiar with the negotiations at the time. The U.S. had begun imposing export controls on advanced chips in late 2022, preventing Nvidia from selling them directly to China over concerns they could boost China’s military and surveillance capabilities.
"Alibaba was looking for a partner that could help it access computing power from data centers stuffed with Nvidia chips located outside China, the people said."
I have no idea whether this is legit or not (there's no link to any code), I'm mentioning this because all the comments here are assuming truth without verifying the contents.
The supposed “China Hawk” you mention, on google searching, seems to be David Perdue.
Is there a chance you are confusing similar yet different last names as the same person?
There isn't even an allegation that the Chinese companies lied about this. They simply didn't disclose which chips were used. In all cases where they did disclose the training chips, this research found the disclosures to be accurate.
The method just strongly suggests that the initial values of the weights, before starting training, were generated with the NVIDIA cuRAND library on a Blackwell GPU (or on an AMD GPU, where the NVIDIA library is emulated for compatibility).
The training might have been done with thousands of GPUs of other types. It is plausible that the GPUs used for training or at least a part of them may have been of the same type with the one used for initializing the model, but it is not proven in any way.
A scenario that matches what is reported in the article, but in which there is only a single Blackwell GPU involved, is if the LLM was intialized on the workstation of some lead developer, who had the privilege to use the best GPU they had, and then it was transferred to a server cluster for training, where other kinds of GPUs were used.
Now that this has been published, it would be very simple in the future for any Chinese AI company to avoid this "fingerprinting", by just using a different PRNG, instead of cuRAND.
There were cases being considered as recently as yesterday. https://www.icc-cpi.int/case-records
Yes it has nukes. However china also has nukes. That poses some legal limitation.
Why would US introduce export controls in sectors where they are already not very competitive?
One bigger aspect of this is that it was all saved from being leaked until right after the election.
Somebody was playing partisan politics with national security.
One key question: did Trump recently sell NVDA? How much and when? He's known of this for more than a year.
I think the frontier models are definitely in a healthy dynamic where it seems the near-but-not-quite performance of open-weight models are what is pushing the most innovation and price competition from OpenAI, Anthropic and co
If GPUs are going to be priced out of consumer reach anyway, I would rather see the GPUs used to create open weight models than just to make these AI companies richer.
Their government is not really the type to violently take over other countries and impose their laws. Taiwan is a special case because they see it as a rebel state on their own land. The rest of us are probably better off with China being the top superpower than Trump's America.
Taiwan would like a word. Taiwanese govt was the original government in China before CCP violently took over in the aftermath of WW2 with help from the Soviet Union.
China was also involved in destabilizing Vietnam by backing the communists and then after having a fall out with the communists there, proceeded to engage in border conflicts for almost two decades before normalizing relations.
China hasn't lifted a finger for Ukraine. It hasn't lifted a finger for Venezuela. It hasn't lifted a finger for Iran. Nobody knows what China's long term intentions are or how China will change after Xi Jinping's reign.
You don't surrender your culture's lead in tech willingly as it could be existential down the road.
To be fair the relationship between China and Taiwan has been reasonably peaceful and highly economically beneficial to both sides over the last several decades (aside from occasional sabre rattling)
> China was also involved in destabilizing Vietnam by backing the communists
That was mainly the USSR? But regardless it was > 50-60 years ago.
> China hasn't lifted a finger for Ukraine
Yes but why would they care? US/Europe rarely does anything about brutal conflict in Africa or Asia either unless they threaten their strategic interests.
> It hasn't lifted a finger for Venezuela. It hasn't lifted a finger for Iran
You mean by defending the governments of those countries from the US? Well if anything that just proves their point China prefers stability over keep control of countries which were partially in their “sphere of influence”
From my (very cursory, naive, layman's) glance at the summary, they're identifying and tracing some characteristics that specific hardware imparts into a model's initialized weights. But then concluding that this indicates the models were also "trained on" that same hardware.
But is that a valid assumption? Is it possible that a model was initialized on one system configuration, while the bulk of the training was performed on another?
In fact, it would seem reasonable for the "okay, I'm setting up this new model on my workstation, prepping it for training next month" pipeline step to be far removed from the "okay, now deploy the [initialized, but not yet trained] model across our giant fleet of beefy training machines".
> The method identifies the hardware that generated the starting weights, not every chip that later helped train the model. When a training run creates its weights on the same GPUs that will train it, the fingerprint points to both. But a lab could generate the weights on one system and move them to another, or continue training an existing model on new hardware. The weights alone cannot rule out those possibilities.
There will be a black market of renting IDs to KYC and gain access to the chips, and then the hosts will monitor their servers for what is being trained, it will be a cat and mouse game.
We are headed for an increasingly unfree computation landscape and the politicians are going to make demands that will be hard to deliver.
The 2nd option is perfectly legal and allowed by US government.
What is surprising, I guess, is that the US allows GPUs to be exported at all to most countries. Since...as long as they are exported to a country that is friendly to china (which is basically most countries on the planet), China has access to GPUs on which to train with, making GPU purchasing restrictions mainly symbolic.
Black & grey market devices marked up many times cost buyers heavily, while still suppressing motivation to develop sovereignty.
If nvidia selling to China tolerated for the realpolitik and gets undone by incoming powers to create an appearance of change, is it really the right thing to do? Is it the smart thing to do?
It's an interesting thought experiment, though, we will probably never know.
Given the track record of this administration, they were probably paid to tolerate said exports.
This, providing access to the gpus but at a large markup plays into that dynamic.
Entities being myopic shouldn't be surprising.
Look at their demographics issue, as well as things like the real estate bubble.
Their economy is below what it was supposed to be by a real margin.
What's the chance that these GPUs got to China without Trump getting a cut somehow?
Pretty much zero. Trump sat on knowledge of the affair for an entire year. That's extremely guilty behavior, he was either extorting Huang or covering g for him.
The whole thing is the most corrupt thing we have ever seen at the presidential level.
Bigger than Watergate by far
Yeah makes sense. They are in transition. This article doesn't really tell us anything new (or interesting). There's nothing wrong w Chinese labs using GPUs that are already in the country. An export ban just means reduced import of new GPUs
This doesn't really call the overall results of the report in the question (the strongest finding is the perfectly matching weights for dead-weight rows which weren't touched by an optimizer at all), but it does suggest that the explanation in the twitter thread[2] of how this works is way too simplistic. Are the patterns in question somehow "special" and not erasable even with muon?
[1] https://docs.modula.systems/examples/weight-erasure/
[2] https://twitter.com/willdepue/status/2120992457630326841
No twice.
First, banning them doesn't necessarily even make the price go up. If all you have to do to get the product is put someone else's name on the form, that raises the price by a number that rounds to zero. It probably costs your own companies more in bureaucracy and paperwork to try to enforce the pointless rules than it costs the other one to put a different name on the form.
Second, suppose it actually worked somehow. What happens then? The other country pays the higher price temporarily while throwing out some big government subsidies to develop a domestic version of the technology. Soon your own companies have a new foreign competitor in the world market which is receiving large government subsidies.
Export controls are a failed policy.
This may work when its against an smaller. When deployed agianst a (near) peer - there usually isn't a price to high for a field of national security interest. China could get all the GPUs it wants / the US could get all the rare-earth magnets it wants over the objections of the other country.
That's implicit in "there's no price too high". However higher the price is, the difference is still a rounding error when your budget is trillions of dollars.
I present this short-form documentary — or animated infographic, if you will — on how much governments are prudent in saving money in areas considered of vital national interests, denominated in GPUs instead of dollars: https://www.youtube.com/shorts/F6jMsMBVB34
As Hezbollah discovered in 2024, covert supply-chain interdiction is very possible and I'd be surprised if the CIA didn't know what was going on, at least to some extent.
> We recovered no signature from DeepSeek-V4.1-Flash (after an exhaustive search),
DS v4.1 is the latest version, no signature found in this model.
"Western AI models using GPUs export controlled by China"
The decline of the USA and the West has been precipitous.
But, could the fingerprints be due to distillation from Blackwell trained models rather than training?
Distillation might shape the weights similarly in some way to the source model, but that would come from the signal, not the noise. I think it would be very surprising if the initial untrained weights were encoded with any fidelity into the outputs such that training another randomly-initialized set of weights (likely of completely different size and shape) on them could leave a signature of the source model's initial state, does that make sense?
US businesses need two things:
1. access to the very best frontier models for hard problems
2. good enough open models from China, the US (I like poolside.ai, but lots of good choices), and even other countries like France that make smaller investments in Digital Sovereignty.
If the ‘super rich fucks’ in the US who have been making risky AI bets succeed in convincing the US government to curtail the use of small efficient models for easier problems, that will just hurt our economy.
I get that the geopolitical angle is sensitive, especially with the backdrop of today's big news - but I thought this was a really well-researched technical deep dive, right up HN's alley. (TIL: you could fingerprint gpu hardware just from an llm weights!)
And these were completely openly disclosed as headline properties of the software: https://github.com/deepseek-ai/DeepInfer/tree/main/#performa...
No one found it remarkable a couple weeks ago, ... but now the fact that DS is using blackwell is apparently some super secret requiring clever RNG init stats???
Which means, in future, we maybe cannot expect such large capability increases.
Only Anthropic was stupid enough to let be caught red-handed but get away with some ridiculously low penalty.
"Specially configured AMD hardware, which is also restricted from export to China, is the only alternative we have identified; we have excluded it for DeepSeek-V4-Flash"
This sounds as if they are using something VERY fuzzy to "match" things, and if they are ALSO matching against completely different hardware which this makes it sounds like.... then I dont know if this means anything.
AMD has a library that emulates it, for compatibility.
Their methodology is interesting, but it only proves access to a single Blackwell GPU, which would have been sufficient for initializing an LLM with random values, before the start of its training.
There is no evidence whatsoever about which GPUs were used for training, except the supposition that if they had access to 1 Blackwell, they might have had access to more of them. Such a supposition may be justified about the number of cockroaches in a kitchen, but less so about the components of a training cluster, which might be heterogeneous.
The LLM could have been initialized on the workstation of a developer, before being transferred to a server cluster, for training.
I’m best known for my work at OpenAI, where I helped create Sora and Sora 2
*conditions apply
Two other mechanics people miss: releasing controlled technology to a foreign national is itself a "deemed export", so staffing matters as much as shipping; and the control lists are keyed to ECCN, not to marketing names, so the classification question is per-part-number and per-performance-threshold, not per-product-line.
None of that makes enforcement easy across borders — the jurisdiction argument above is exactly why the extraterritorial reach fights keep landing in the same place: the US can reach the item and the US-person nexus far more reliably than it can reach a foreign reseller's intent.