Level one · Level two
The B200 was NVIDIA's flagship AI chip in 2025. The B300 and Rubin have come since, but they are built on the same ideas. Learn the B200 and you have learned the family.
It's a GPU: a chip built to do one simple sum on millions of numbers at once. This page starts with that sum and zooms out, one level at a time, until you are looking at a rack of 72 chips. Then it turns to the question behind all of this: how could anyone check, from outside, what a chip is doing?
On this page: the six levels, bits, memory, what counts as one chip, how a chip proves things, what isn't public.
Each level is built out of the one before it. Use the tabs, use the buttons, or click the blue part of a drawing to zoom in. Words with a dotted underline explain themselves when you hover or tap.
Every number in a chip is stored as a fixed number of bits. More bits mean finer steps between the values you can write down. Fewer bits mean each number takes less memory, and the tensor cores get through more of them a second.
Pick a weight with the slider and see where each format would store it. The slider stops at 6 because 6 is the largest number 4-bit can hold.
Blackwell's headline feature is 4-bit numbers. A 4-bit number can take only 16 values, and most weights in a real model are tiny, far below its smallest step. The trick is to give each small block of numbers a shared scale, like writing "× 0.001" once at the top of a column instead of on every row. NVIDIA's version, NVFP4, shares one scale across 16 numbers. The scale is stored once per block, so it costs half a bit per number. 4-bit is really 4.5.
For verification The same B200 does about 2.25 quadrillion operations a second in 16-bit, 4.5 quadrillion in 8-bit, and 9 quadrillion in 4-bit. Training thresholds like the EU AI Act's 10²⁵ operations are plain counts. They do not care about bits. A 4-bit operation counts the same as a 16-bit one, so the same chip reaches the line in a quarter of the time. And two models with the same count may have had very different amounts of real computation put into them.
US export controls, which decide which chips may be sold to China, do it differently. Their score, "total processing performance", is speed in trillions of operations a second times bits per number. For the B200, 4,500 × 8 and 9,000 × 4 both come to 36,000. The chip scores the same whichever format it uses. A chip comes under control at 4,800, so the B200 is seven and a half times over the line.
When a model writes a reply, it produces one token at a time. For every token, the chip has to read every weight out of memory once. The arithmetic is quick. Reading the weights is slow. Try a few model sizes:
This is why AI companies serve many users at once. One read of the weights can serve everyone's next token, and the math finally has something to do. The calculator is simplified. It assumes every weight is used for every token, which is not true of "mixture of experts" models; those wake only a slice of their weights for each token.
For verification Serving a model and training one stress the chip differently. Serving waits on memory. Training keeps the tensor cores busy. The difference shows up in power draw and in the chip's activity counters, and that is one proposed way to tell from outside what a chip is doing.
Here is one NVL72 rack, drawn as a map of its silicon. Pick a unit to count by.
For verification Any rule that tracks or caps "chips" has to pick one of these, and the answers differ by a factor of 144. Export controls dodge part of the problem by scoring performance instead of counting units. Proposals to register chips, or to count them in a data center, still need a unit.
NVIDIA's data-center GPUs since the H100 support confidential computing. The GPU proves it is genuine and running approved software. Then it works on data that stays hidden even from the people who run the data center. Blackwell extends that protection to the links between GPUs, with little slowdown. The proving step is called attestation. Step through it:
In December 2025, NVIDIA said it had built opt-in software for Blackwell chips that estimates where a chip is from how long it takes to answer NVIDIA's servers. NVIDIA says the data only flows out, and that there is no kill switch.
The physics is simple. Nothing travels faster than light, and in fiber-optic cable light covers about 200 km each millisecond. A round trip is there and back, so a 20 ms reply means at most 10 ms each way: 2,000 km. Real networks are slower, because every router on the way adds delay, so this is the loosest bound there is. Suppose the checking server sits in northern Virginia, where many data centers are:
For verification A fast reply proves a chip is close. A slow reply proves nothing, because a nearby chip can always wait before answering. That is why proposals put checking servers in many places. Each fast reply rules out more of the map.
A lot is documented, because NVIDIA had to tell programmers how to use the hardware. These things are not:
Those gaps are where most of the open work on hardware verification sits.
Level two picks up from here: the numbers behind the shape, and what a verifier would really have to check.