The US Can Restrict Chinese AI. It Cannot Unpublish It

The United States can ban an AI service.

It can remove an app from government devices, prohibit federal agencies from using it, restrict American cloud providers from hosting it, or sanction the company behind it.

What it cannot easily do is make a set of open model weights disappear after those weights have been downloaded, copied and distributed around the world.

That distinction is becoming increasingly important as Chinese-developed models from DeepSeek, Alibaba’s Qwen, Moonshot AI’s Kimi and Z.ai’s GLM gain users inside the United States.

The political conversation tends to compress all of this into a simple story about American AI versus Chinese AI. But that framing ignores the nature of open-weight software—and it risks confusing where a model was developed with who controls it after deployment.

Are these really “Chinese models”?

Models from Qwen, Kimi, DeepSeek and GLM are unquestionably Chinese-developed. Their original developers are Chinese companies. Their training decisions, organisational incentives and release strategies emerged from China’s technology ecosystem.

But that does not mean every deployment remains under Chinese control.

Suppose an American company downloads Qwen’s weights, stores them on American infrastructure and runs the model inside an isolated environment with no external network access. Alibaba does not automatically receive the company’s prompts. It cannot remotely change the model or suddenly switch it off.

The model remains Chinese in provenance, but its operation is now controlled by the company running it.

This is why I find the blanket label “Chinese AI” insufficient. It conflates two different questions:

1. Who developed the model?
2. Who controls this particular deployment?

The Linux analogy is useful, even if it is not perfect. Linux began with a Finnish developer, but we do not describe every Linux server as being under Finnish control. Linux now has international governance and contributors, while models such as Qwen and DeepSeek remain more closely associated with identifiable companies.

Still, the underlying point holds: technological origin does not necessarily imply continuing operational control.

A Chinese-hosted API processing American corporate data is one thing. An offline copy of Chinese-developed weights running in an American data centre is another.

Policy should recognise the difference.

What would a ban actually mean?

The word ban conceals several very different policies.

The US government could:

• prohibit Chinese AI apps on government devices;
• prevent federal agencies from procuring designated models;
• extend restrictions to government contractors;
• restrict American cloud providers from hosting them;
• sanction specific Chinese AI companies;
• remove first-party APIs from American commercial platforms;
• require regulated companies to disclose which foundation models they use;
• prohibit private companies from possessing or deploying certain weights.

The first few options are relatively straightforward. Governments already impose procurement and device restrictions on technology they consider a supply-chain or national-security risk.

The proposed No Adversarial AI Act, for example, would establish a list of AI systems produced or developed by foreign adversaries. Federal agencies would be expected to consider excluding those systems, with exceptions for research, testing, counterintelligence and mission-critical activities.[1]

That would be a government procurement restriction. It would not amount to a general ban on private American companies using Qwen or DeepSeek.

A nationwide ban on privately deployed weights would be much more difficult.

Exact copies of a model can be identified through file hashes. But quantisation, fine-tuning, pruning, weight merging and other modifications change those hashes.

A company could take a Qwen model, fine-tune it, package it under a new name and distribute it through an organisation based in another country. Regulators would then have to decide whether the new model was still legally “Chinese.”

That raises some difficult questions:

• How much modification makes it a new model?
• Does a fine-tuned Qwen remain Chinese?
• What about a model trained using synthetic data produced by Qwen?
• What if it uses a Chinese model’s architecture but not its weights?
• What if American, European and Chinese weights are merged?
• What if the model is repackaged by a company in Singapore or France?
• Who has the burden of proving the model’s ancestry?

The government could demand model bills of materials, provenance documentation and independent audits. It could require companies to report which foundation models they deploy. It could punish businesses that intentionally conceal a model’s origin.

Those measures could reduce mainstream commercial adoption. But enforcement would depend heavily on corporate compliance.

A ban could push the weights out of major American cloud platforms. It could not erase every copy already in circulation.

Open-weight does not necessarily mean open-source

It is also important to use the right terminology.

Many of these systems are described as open-source models, but open-weight is usually more accurate.

The weights may be downloadable and modifiable, but the developer may not publish the complete training dataset, data-cleaning process, training code or internal evaluation results. The licence may also impose conditions that would not qualify as open source under stricter software definitions.

This matters because the release of weights gives users substantial control, but not necessarily complete transparency.

An enterprise can inspect the model, modify it and run it locally. That does not mean the enterprise knows everything about how the model was trained or what may have been encoded into it.

Open weights reduce some risks while introducing or preserving others.

What the OpenRouter numbers actually show

Data reported from OpenRouter suggest that Chinese-developed models recently accounted for approximately 58% of tokens associated with US firms on the platform. Their share briefly reached 63% during the first week of July, up from less than 10% at the beginning of 2025.[2]

That is a remarkable shift.

But it should not be described as Chinese models capturing 58% of the entire American AI market.

OpenRouter is a marketplace and routing platform that lets developers access models from multiple providers. Its users are more likely than the average enterprise to compare models, experiment with new releases and optimise for cost.

Token volume is also not the same as revenue, customer numbers or production deployments.

A long-context model processing large documents can consume far more tokens than a smaller model answering short questions. Agentic applications can generate enormous token counts through repeated model calls. Free access and promotional pricing can also temporarily distort usage.

OpenRouter’s own research highlights the diversity of activity on its platform, including substantial roleplay and creative usage alongside coding, technical and productivity workloads. It also acknowledges that smaller models are likely undercounted because they are frequently self-hosted rather than accessed through OpenRouter.[3]

The data therefore give us a valuable view of an important segment of the market, not a census of corporate America.

Even with those caveats, the direction is difficult to ignore. Chinese-developed models are gaining adoption because they offer an increasingly competitive combination of capability, price and flexibility.

That looks less like geopolitical loyalty and more like ordinary economic decision-making.

Adoption does not prove that the risks are imaginary

It would be a mistake, however, to conclude that widespread adoption proves there are no meaningful risks.

Businesses do not necessarily make an all-or-nothing choice between American and Chinese models.

A company might use DeepSeek for low-sensitivity coding tasks while keeping customer data inside another system. It might use Kimi for document summarisation but prohibit it from accessing regulated information. It might download the weights and host them internally rather than sending data to the model developer’s API.

Some deployments will be carefully isolated. Others will be experiments. And some companies will simply make poor security decisions.

Adoption demonstrates that the price-performance advantage is valuable enough to overcome some perceived risks. It does not prove that every risk is fictional.

There are legitimate issues to investigate:

• the security of first-party apps and APIs;
• data retention and legal jurisdiction;
• model supply-chain integrity;
• political bias and censorship;
• concealed backdoors or trigger behaviours;
• licence restrictions;
• the quality of safety testing;
• long-term dependence on foreign model ecosystems.

But those risks should be evaluated based on how the model is deployed, not simply on its nationality.

The congressional investigation into DeepSeek, for example, alleges that its consumer app sends American user data through infrastructure connected to China and produces answers aligned with Chinese political requirements.[4]

Those are serious allegations about the service and its infrastructure. But data-transfer claims about the DeepSeek app do not automatically apply to an offline deployment of the weights.

Likewise, prompt injection is not a specifically Chinese vulnerability. It is a broader architectural weakness affecting American, Chinese, European and Japanese AI systems.

A serious security policy should distinguish between risks inherent to a model, risks created by its hosting provider and risks introduced by the application surrounding it.

The stronger argument is enterprise sovereignty

The more interesting issue is not whether American businesses should trust China. It is whether businesses should place their entire AI strategy in the hands of any external model provider.

The recent interruption to Anthropic’s Fable and Mythos models made that risk unusually visible.

On June 12, the US government directed Anthropic to suspend access to the models for foreign nationals. Anthropic concluded that it had to disable the models for all customers to ensure compliance. The restrictions were lifted on June 30, with access restored from July 1.[5]

Whatever one thinks of the government’s justification, the episode demonstrated that access to a closed model can be changed by forces outside the customer’s control.

A company might build products, workflows and internal systems around a model only to discover that the model can be withdrawn, restricted or repriced with little warning.

Alex Karp has made a similar argument. He says enterprises want control over their compute, models, data stack and proprietary advantage rather than remaining dependent on token-based access to a handful of AI providers.[6]

Microsoft CEO Satya Nadella has gone further, warning that businesses may effectively pay for AI twice: first through token fees, and again through the institutional knowledge they must reveal to make the model useful.[7]

Every correction an employee gives an AI system can contain valuable information about how the company operates. Every tool call can reveal a workflow. Every successful prompt can become part of the organisation’s operational intelligence.

That does not mean OpenAI, Anthropic and Google automatically use every business prompt for training. Their published commercial policies generally say that business and API data are not used for training by default.[8][9][10]

The argument for private AI infrastructure should not depend on a claim that is contradicted by those policies.

Training is not the only concern.

Enterprises should also care about:

• model availability;
• data retention;
• contractual protection;
• government access;
• auditability;
• pricing changes;
• vendor lock-in;
• model portability;
• ownership of evaluation data;
• ownership of employee and agent feedback loops.

A private AI stack does not necessarily mean owning a data centre or training a frontier model from scratch.

A company can rent compute while retaining control over its weights, retrieval systems, orchestration layer, logs, evaluation data and model-routing infrastructure.

It can still use frontier APIs where they offer the best performance. The objective should not be complete isolation. It should be avoiding a situation in which one model provider becomes an irreplaceable dependency.

China’s open-weight strategy is not an act of charity

China’s embrace of open-weight releases is strategically intelligent, but it should not be mistaken for pure generosity.

Open-weight models spread faster because other people supply the infrastructure.

Developers can download the weights from repositories, deploy them through third-party hosts and optimise them for their own hardware. Cloud providers compete to serve the same models, pushing inference prices down.

The original Chinese developer does not need to operate every server or establish direct commercial relationships in every country.

Open-weight releases also build technical ecosystems. Developers become familiar with a model’s architecture, prompting patterns, tooling and fine-tuning methods. Companies create products around it. Researchers publish improvements. Infrastructure providers optimise for it.

Over time, a model family can become a default technical foundation even when the original developer does not control individual deployments.

That creates influence without requiring direct operational control.

There is a trade-off. When a model is self-hosted, the original developer may not receive the prompts, logs, corrections or usage data. It may also struggle to monetise global adoption directly.

But China’s immediate objective may not be to maximise API revenue. It may be to build a global ecosystem around Chinese-developed technology and weaken the assumption that frontier AI must come from closed American labs.

In that respect, the strategy is already working.

What about the claim that Chinese models are “stolen”?

American AI companies have accused Chinese labs of using distillation to reproduce capabilities from leading US models.

Those allegations should not be casually dismissed. If a company created thousands of fake accounts, evaded access controls or systematically violated API terms, that could raise legitimate contractual and legal claims.

But American AI labs should also expect scrutiny when they describe distillation as theft while defending the ingestion of enormous amounts of internet content as fair use.

The two practices are not legally identical. Accessing an API through fake accounts and violating explicit restrictions may produce legal claims that ordinary web training does not.

Still, the rhetorical asymmetry is difficult to ignore:

Training on everyone else’s work is described as learning. Training on an AI lab’s outputs is described as stealing.

The argument becomes even more complicated if Chinese or other non-US models take the top positions on leading evaluations.

Artificial Analysis currently places Kimi K3 third on one of its composite intelligence indexes, behind Fable 5 and GPT-5.6 Sol.[11] One benchmark cannot definitively tell us which model is “best,” but the result demonstrates how narrow the capability gap has become.

If Kimi, Qwen, DeepSeek—or perhaps Mistral in Europe or Sakana AI in Japan—eventually surpasses every American model, will American labs stop studying their outputs?

Of course not.

They will examine the model, reproduce its techniques where legally possible, learn from its behaviour and attempt to surpass it. That is how technological development works.

Innovation in AI has always been cumulative. No country or company invented the entire stack on its own.

The US can restrict distribution, but it cannot erase knowledge

Washington can make Chinese AI harder to use.

It can prohibit designated models in government systems. It can regulate American cloud platforms. It can sanction companies and impose reporting requirements on regulated industries.

Those measures would matter. They could remove Chinese models from mainstream American procurement and create substantial compliance risks for businesses.

But once open weights have been distributed globally, a comprehensive ban becomes less like blocking an online service and more like trying to ban an algorithm.

The weights will be copied, quantised, fine-tuned, merged, renamed and redistributed from countries outside American control.

The more effective US strategy would be to compete:

• release credible American open-weight alternatives;
• create security standards that apply equally to all models;
• evaluate models based on evidence rather than nationality;
• support independent testing and auditing;
• give companies better tools for private deployment;
• preserve American AI services as reliable global products;
• distinguish the risks of hosted services from those of local weights.

China’s open-weight strategy exports a technical ecosystem. A sweeping American ban might reduce its adoption inside the United States, but it could also encourage the rest of the world to build AI infrastructure that no longer depends on American providers—or American permission.

The US can ban Chinese AI at the chokepoints it controls.

It cannot unpublish model weights that have already entered global circulation.

And in the long run, attempting to prohibit the best available models may be a weaker strategy than building better ones.

Sources

1. US Congress: No Adversarial AI Act
2. Reported OpenRouter token-share figures
3. OpenRouter: State of AI—An Empirical 100 Trillion Token Study
4. US House Select Committee report on DeepSeek
5. Anthropic’s statement on the Fable and Mythos suspension
6. CNBC: Alex Karp on open-weight models and enterprise control
7. TechCrunch: Satya Nadella’s enterprise-data argument
8. OpenAI business-data policy
9. Anthropic commercial-data policy
10. Google Cloud generative AI privacy policy
11. Artificial Analysis: Kimi K3