Chinese AI companies are free to use any Nvidia GPU they want as long as the GPU is not physically located within China. It is entirely consistent with US export controls for Chinese AI companies to remotely use GPUs located in Singapore or Malaysia.
“In facilities across the region, Megaspeed rents Nvidia chips to Chinese tech giants such as Alibaba, an arrangement that does not violate current US export control regulations.” See [1].
Literally my first thought. Noone can stop them from training in data centers that are located elsewhere. It's not like some military hardware that needs to be physically shipped to China for them to make use of it. In fact why would they bother with Chinese compute providers if those are limited because of GPU export controls? They knew this for a long time and probably have been knocking on the door of providers in other countries for a while. Heck, they could be training inside the US. They already distribute their open model weights from the US.
The US definitely has the power to stop most of it. It just looks like the executive branch doesn’t yet have the legal authority to do it, but it’s in an advanced legislative state.
How are you going to monitor who is logging into a system, or who a job is being run for? If you want that level of control the machines should not be exported at all.
The author of this piece is a SWE-turned-influencer "China hawk" from OpenAI (i.e. the primary advocate of export bans along with Anthropic), and this isn't an academic paper despite the theming.
I have no idea whether this is legit or not (there's no link to any code), I'm mentioning this because all the comments here are assuming truth without verifying the contents.
The method seems sound and the findings correct. But I think many are missing that (as the research itself says) this doesn't prove any illegal behavior. It's perfectly legal for Chinese companies to train models on GPUs that they rent outside of China. It's also legal for companies to buy GPUs and install them in Malaysia with the intention of renting them to Chinese companies.
There isn't even an allegation that the Chinese companies lied about this. They simply didn't disclose which chips were used. In all cases where they did disclose the training chips, this research found the disclosures to be accurate.
I have run some large open models on neoclouds and the KYC has been minimal, even if the USG stops all GPU exports it will be extremely difficult to crack down on Chinese renting GPUs on Western servers.
There will be a black market of renting IDs to KYC and gain access to the chips, and then the hosts will monitor their servers for what is being trained, it will be a cat and mouse game.
We are headed for an increasingly unfree computation landscape and the politicians are going to make demands that will be hard to deliver.
Not seeing how that could happen since all the "distillation" attacks i've seen are just token level, not logprob level, and definitely not vector level. So, I don't see how that could be the case.
yes. The USA hasn't force an embargo on China to other countries (e.g. by threatening to cut off Swift access). We aren't technically at war either, so its highly unlikely that the US would go that far.
What is surprising, I guess, is that the US allows GPUs to be exported at all to most countries. Since...as long as they are exported to a country that is friendly to china (which is basically most countries on the planet), China has access to GPUs on which to train with, making GPU purchasing restrictions mainly symbolic.
Black & grey market devices marked up many times cost buyers heavily, while still suppressing motivation to develop sovereignty.
If nvidia selling to China tolerated for the realpolitik and gets undone by incoming powers to create an appearance of change, is it really the right thing to do? Is it the smart thing to do?
It's an interesting thought experiment, though, we will probably never know.
Why on earth would that be suppressing motivation to develop sovereignty? The whole thing makes developing sovereignty an existential priority. When one critical part of your AI technology stack is subject to whims of your adversary, it's not really fully your AI technology stack. Today they turn the tap partially on, but only unofficially, tomorrow they'll shut it off. Time to buy your own tap.
Yup, I think the same applies to traffic of arms regulations.. Private firms sell to countries they are 'allowed' to, passing it between organisations in a chain until they get to the original customer they couldn't sell to directly.. Cuts are taken along the way, and people making money look the other way..
When Xi visited, Trump offered to sell him US made weapons.
What's the chance that these GPUs got to China without Trump getting a cut somehow?
Pretty much zero. Trump sat on knowledge of the affair for an entire year. That's extremely guilty behavior, he was either extorting Huang or covering g for him.
The whole thing is the most corrupt thing we have ever seen at the presidential level.
i dont know what is expected of export controls... they are never effective. they also find western chips in iranian drones etc. there is a huge gray area of resellers who resel to resellers etc. its pretty much uncontrollable....
During the Cold War, America used various shell companies to get valuable titanium out of Russia for building spy planes. If someone is willing to pay, smugglers will find a way.
Export controls inherently raise the cost of doing business with parties you don't like, the other party has to either invest more resources acquiring them, or make the decision to forego acquiring them. The grey market exists precisely because there's an opportunity to exploit this for profit. At the end of the day, when these effects of these export controls are discussed, they usually seem to revolve around export controls setting a specific program or effort back by a span of months, not in stopping a specific commodity from accessing another market whatsoever (excepting some hyper-specific components).
As Hezbollah discovered in 2024, covert supply-chain interdiction is very possible and I'd be surprised if the CIA didn't know what was going on, at least to some extent.
It's insane how many articles have dropped in the past 24 hours that all have a similar tone. At this point it's hard to see this as anything other than a broad coordination from someone who wants to destroy Jensen/Nvidia.
if we're going paranoid mode, on 9th of November Trump said that "leader of one large company connected to artificial intelligence" was almost sent to prison by Ministry of Justice due to wrongdoings connected to Ai, and this threat caused immediate correction by that company
Cute trick but it's not exactly a secret, e.g. deepseek recently published their own inference engine -- and it only has kernels for SM100 (blackwell) and Huawei Ascend 950, and all its published performance results using blackwell.
No one found it remarkable a couple weeks ago, ... but now the fact that DS is using blackwell is apparently some super secret requiring clever RNG init stats???
@dang curious, is this post getting heavily downvoted or flagged?
I get that the geopolitical angle is sensitive, especially with the backdrop of today's big news - but I thought this was a really well-researched technical deep dive, right up HN's alley. (TIL: you could fingerprint gpu hardware just from an llm weights!)
I need to double check PyTorch code, I am not sure how robust this fingerprinting is without PyTorch "bug". Parallel philox based PRNG is a well-researched area and I am surprised (even if it is not secure-PRNG) it can fingerprinting like this. But obviously there are more people who are more knowledgeable on this can give their perspectives here.
Chinese AI companies are free to use any Nvidia GPU they want as long as the GPU is not physically located within China. It is entirely consistent with US export controls for Chinese AI companies to remotely use GPUs located in Singapore or Malaysia.
“In facilities across the region, Megaspeed rents Nvidia chips to Chinese tech giants such as Alibaba, an arrangement that does not violate current US export control regulations.” See [1].
[1] https://www.atlanticcouncil.org/dispatches/beyond-the-spy-sc...
Literally my first thought. Noone can stop them from training in data centers that are located elsewhere. It's not like some military hardware that needs to be physically shipped to China for them to make use of it. In fact why would they bother with Chinese compute providers if those are limited because of GPU export controls? They knew this for a long time and probably have been knocking on the door of providers in other countries for a while. Heck, they could be training inside the US. They already distribute their open model weights from the US.
The US definitely has the power to stop most of it. It just looks like the executive branch doesn’t yet have the legal authority to do it, but it’s in an advanced legislative state.
How are you going to monitor who is logging into a system, or who a job is being run for? If you want that level of control the machines should not be exported at all.
The author of this piece is a SWE-turned-influencer "China hawk" from OpenAI (i.e. the primary advocate of export bans along with Anthropic), and this isn't an academic paper despite the theming.
I have no idea whether this is legit or not (there's no link to any code), I'm mentioning this because all the comments here are assuming truth without verifying the contents.
This post is from Will Depue
The supposed “China Hawk” you mention, on google searching, seems to be David Perdue.
Is there a chance you are confusing similar yet different last names as the same person?
No, the names are correct. OpenAI has quite a few SWEs who spend a lot of time advocating for positions on social media.
The method seems sound and the findings correct. But I think many are missing that (as the research itself says) this doesn't prove any illegal behavior. It's perfectly legal for Chinese companies to train models on GPUs that they rent outside of China. It's also legal for companies to buy GPUs and install them in Malaysia with the intention of renting them to Chinese companies.
There isn't even an allegation that the Chinese companies lied about this. They simply didn't disclose which chips were used. In all cases where they did disclose the training chips, this research found the disclosures to be accurate.
it's funny because it convinces me that export controls don't work so why do them
It's like the war on drugs, just one more crackdown will fix everything this time.
I have run some large open models on neoclouds and the KYC has been minimal, even if the USG stops all GPU exports it will be extremely difficult to crack down on Chinese renting GPUs on Western servers.
There will be a black market of renting IDs to KYC and gain access to the chips, and then the hosts will monitor their servers for what is being trained, it will be a cat and mouse game.
We are headed for an increasingly unfree computation landscape and the politicians are going to make demands that will be hard to deliver.
Not doubting that they have access to these.
But, could the fingerprints be due to distillation from Blackwell trained models rather than training?
Not seeing how that could happen since all the "distillation" attacks i've seen are just token level, not logprob level, and definitely not vector level. So, I don't see how that could be the case.
as the post mentions, the models could have been trained on 1. GPUs within China or 2. GPUs outside China for example datacenters in Singapore.
The 2nd option is perfectly legal and allowed by US government.
Is the U.S. government OK with this if the money to buy those GPUs and run inference on them comes from Chinese companies?
yes. The USA hasn't force an embargo on China to other countries (e.g. by threatening to cut off Swift access). We aren't technically at war either, so its highly unlikely that the US would go that far.
What is surprising, I guess, is that the US allows GPUs to be exported at all to most countries. Since...as long as they are exported to a country that is friendly to china (which is basically most countries on the planet), China has access to GPUs on which to train with, making GPU purchasing restrictions mainly symbolic.
What if the gov tolerated gpu exports on purpose?
Black & grey market devices marked up many times cost buyers heavily, while still suppressing motivation to develop sovereignty.
If nvidia selling to China tolerated for the realpolitik and gets undone by incoming powers to create an appearance of change, is it really the right thing to do? Is it the smart thing to do?
It's an interesting thought experiment, though, we will probably never know.
> What if the gov tolerated gpu exports on purpose?
Given the track record of this administration, they were probably paid to tolerate said exports.
Why on earth would that be suppressing motivation to develop sovereignty? The whole thing makes developing sovereignty an existential priority. When one critical part of your AI technology stack is subject to whims of your adversary, it's not really fully your AI technology stack. Today they turn the tap partially on, but only unofficially, tomorrow they'll shut it off. Time to buy your own tap.
Post-Trained To Reinforce Western Values
Yup, I think the same applies to traffic of arms regulations.. Private firms sell to countries they are 'allowed' to, passing it between organisations in a chain until they get to the original customer they couldn't sell to directly.. Cuts are taken along the way, and people making money look the other way..
When Xi visited, Trump offered to sell him US made weapons.
What's the chance that these GPUs got to China without Trump getting a cut somehow?
Pretty much zero. Trump sat on knowledge of the affair for an entire year. That's extremely guilty behavior, he was either extorting Huang or covering g for him.
The whole thing is the most corrupt thing we have ever seen at the presidential level.
> The whole thing is the most corrupt thing we have ever seen at the presidential level.
Bigger than Watergate by far
... So far
i dont know what is expected of export controls... they are never effective. they also find western chips in iranian drones etc. there is a huge gray area of resellers who resel to resellers etc. its pretty much uncontrollable....
During the Cold War, America used various shell companies to get valuable titanium out of Russia for building spy planes. If someone is willing to pay, smugglers will find a way.
Simply banning things causes the price to go up. That alone is good enough to motivate the policy decision.
Export controls inherently raise the cost of doing business with parties you don't like, the other party has to either invest more resources acquiring them, or make the decision to forego acquiring them. The grey market exists precisely because there's an opportunity to exploit this for profit. At the end of the day, when these effects of these export controls are discussed, they usually seem to revolve around export controls setting a specific program or effort back by a span of months, not in stopping a specific commodity from accessing another market whatsoever (excepting some hyper-specific components).
> its pretty much uncontrollable
As Hezbollah discovered in 2024, covert supply-chain interdiction is very possible and I'd be surprised if the CIA didn't know what was going on, at least to some extent.
Yes or indeed supplying cards to the Chinese market with extras...
Just further proof that export controls rarely restrict the ones they are designed to restrict
Not too many years before the headline reads
"Western AI models using GPUs export controlled by China"
The decline of the USA and the West has been precipitous.
Such a great domain name by the way.
It's insane how many articles have dropped in the past 24 hours that all have a similar tone. At this point it's hard to see this as anything other than a broad coordination from someone who wants to destroy Jensen/Nvidia.
This is how the news works on a story of major importance. As details of corruption come out, they all get reported.
One bigger aspect of this is that it was all saved from being leaked until right after the election.
Somebody was playing partisan politics with national security.
One key question: did Trump recently sell NVDA? How much and when? He's known of this for more than a year.
if we're going paranoid mode, on 9th of November Trump said that "leader of one large company connected to artificial intelligence" was almost sent to prison by Ministry of Justice due to wrongdoings connected to Ai, and this threat caused immediate correction by that company
Huang-gate
Well, d'uh...
So export controls are more like export friction
Cute trick but it's not exactly a secret, e.g. deepseek recently published their own inference engine -- and it only has kernels for SM100 (blackwell) and Huawei Ascend 950, and all its published performance results using blackwell.
And these were completely openly disclosed as headline properties of the software: https://github.com/deepseek-ai/DeepInfer/tree/main/#performa...
No one found it remarkable a couple weeks ago, ... but now the fact that DS is using blackwell is apparently some super secret requiring clever RNG init stats???
Are (ex-)OpenAI/Anthropic employees leading the charge here to protect their portfolios?
@dang curious, is this post getting heavily downvoted or flagged?
I get that the geopolitical angle is sensitive, especially with the backdrop of today's big news - but I thought this was a really well-researched technical deep dive, right up HN's alley. (TIL: you could fingerprint gpu hardware just from an llm weights!)
I need to double check PyTorch code, I am not sure how robust this fingerprinting is without PyTorch "bug". Parallel philox based PRNG is a well-researched area and I am surprised (even if it is not secure-PRNG) it can fingerprinting like this. But obviously there are more people who are more knowledgeable on this can give their perspectives here.
WAIT! Are you saying the giant plagiarism machine was built with…stolen IP?!?!
I guarantee you this isn't an "accident". Whatever is being sent over there is loaded with its own special spyware lol