The fingerprint
that fits on a laptop.
A working reproduction of the “1,385σ Blackwell” checkpoint-forensics claim — and the three places where it stops being evidence. Every number on this page was produced by the audit code in poc/, on the test machine — an RTX 4070 Ti SUPER — or on no GPU at all.
The GPU fingerprint is one integer.
PyTorch’s CUDA random-number kernels size their launch grid from two device properties — and that grid is the only way the hardware enters the random stream. Reproduce the grid, and you reproduce the “fingerprint”, on anything.
Click a device — the wall, the barcode and the number all change.
The first 101,376 values of the Ada stream and the GB200 stream are identical. They diverge only where the launch-grid cap begins to bite.
We minted a Blackwell checkpoint on the CPU.
The forensic method is a faithful reimplementation: brute-force the seed and the launch grid, regenerate the initialization, count bit-exact values. It is perfect on step-0 data — including data generated by NumPy three seconds ago.
$ waiting for you to commit a crime against epistemology…Test machine: RTX 4070 Ti SUPER · Ada · 66 SMs · 16 GB · 0 Blackwells. The forged checkpoint is bit-identical to what a 148-SM device would emit — because the only difference is the integer 1184.
One optimizer step and it’s gone.
A real 10.2M-parameter transformer, initialized on the GPU, trained with AdamW. Drag the slider and watch the fraction of parameters that are still bit-identical to step 0.
Step 0 is the only moment his “bit-for-bit” claim is even well-defined. It is also the one checkpoint no lab ever publishes.
1,385σ and 0.999995 cannot both be true.
Significance grows with sample count: z = r·√N / √(1−r²). A correlation of
0.999995 over a billion weights is ~107σ. To get 1,385σ at that correlation you
need about 19 independent samples. The two headline numbers are not measurements of
the same thing.
His reported range, 49–1,385σ, sits below the 369,435σ our RTX-4070-initialized model produces after a single optimizer step. The number measures sample size and distance from init — not hardware.
Init is not training. It costs about a hundred dollars.
Initialization is a one-time, I/O-bound step every training run performs anyway. Moving it to rented Blackwell hardware is a cloud invoice, not a smuggling operation — and it leaves exactly the fingerprint he describes.
“do not establish the physical location of the chips, how they were acquired, or whether export control regulations were violated” — the report’s own executive summary
A layout match is consistent with a legal rented node, a partner lab, a cloud region, a deliberate decoy, a stale config, or a genuinely smuggled cluster. It cannot tell them apart. That is not a forensic result; it is a Rorschach test with a p-value.
A PRNG can be made
to say anything.
Every number on this page came from the audit code in poc/, running on the test machine — an RTX 4070 Ti SUPER — or on no GPU at all. The “smoking gun” took three seconds and cost nothing. The training cluster it supposedly proves was never observed.
