China’s Open-Weight AI Models Are Winning Adoption—What It Means for the US-China Race

China’s AI challenge is no longer only about whether its laboratories can produce a model that matches a leading US system. It is increasingly about distribution: who can put capable AI into the hands of the most developers, companies and governments at the lowest cost.

DeepSeek, Moonshot AI’s Kimi and Alibaba’s Qwen have made open-weight deployment central to that contest. Assessments from Stanford researchers found that Chinese open-weight models had rapidly narrowed—and in some areas matched or exceeded—the capability and adoption gap. Qwen also surpassed Meta’s Llama as the most-downloaded large-language-model family on Hugging Face in September 2025. 18

The result is a strategic dilemma for Washington. Restricting Chinese models could reduce exposure in sensitive environments, but a broad ban could also concede the open development layer to China and eliminate some of the transparency and local control that make self-hosted models attractive.

Open-weight is not the same as fully open-source

An open-weight model makes its trained parameters available for download, allowing third parties to run or adapt the finished system. That is fundamentally different from a closed model, which users typically access through a vendor-controlled application or API. 33

But releasing weights does not necessarily provide:

• The original training code
• The training data or its provenance
• A reproducible training recipe
• Complete evaluation results
• Unrestricted commercial or redistribution rights
• Transparent information about filtering, safety tuning or model development

That is why “open” must be assessed release by release. A model may be downloadable while remaining difficult to reproduce, subject to a restrictive license or opaque about the data that shaped its behavior. Fully open-source AI is a stronger standard involving meaningful access to the code, data-related information and other components needed for study and reproduction. 41

This distinction is especially important when comparing DeepSeek, Kimi and Qwen. Their availability, licensing and technical disclosures can differ by release, and public reporting may lag behind changes to a model’s status.

China is competing on adoption, not just benchmark scores

Chinese laboratories have combined competitive performance with low prices, efficiency and the ability to deploy models locally. That gives startups, researchers and enterprises an alternative to relying entirely on expensive US-hosted APIs. Reporting and policy research describe a feedback loop in which low-cost releases attract users, users create tools and derivatives, and that ecosystem accelerates further iteration. 1720

The advantage is not limited to the number of people using a chatbot. Every deployment can contribute to:

• Fine-tuned and specialized derivatives
• Developer tools and integrations
• New benchmarks and bug reports
• Familiarity with a model family
• Commercial dependencies and technical defaults

Stanford’s analysis found that Chinese developers accounted for 17.1% of Hugging Face downloads between August 2024 and August 2025, slightly ahead of US developers at 15.8%. 18 Other reporting has also documented growing use of Chinese models by US companies seeking lower costs. 31

If Chinese-origin models become embedded in software, devices, government services and industrial systems around the world, Beijing could gain influence over technical defaults, updates and surrounding supply chains. That is a potential geopolitical leverage point—not evidence that every locally deployed model is compromised.

The security debate has several different parts

The phrase “Chinese AI risk” can describe at least four distinct concerns, and they should not be treated as interchangeable.

1. Hosted-service data access

When a user sends prompts, files or identifiers to a China-hosted service, that information leaves the user’s environment and may be subject to the provider’s jurisdiction and applicable law. Sensitive government, defense, health, critical-infrastructure and proprietary business workloads therefore require a formal risk assessment before being sent to any external service.

A locally hosted model changes that specific data-flow question. Properly configured infrastructure can keep prompts and documents inside an organization’s network. It does not, however, guarantee that the model package, serving software or connected tools are safe.

2. Censorship, bias and model behavior

A model’s training and alignment can produce politically shaped refusals, omissions, framing or misinformation. A US congressional report alleged that DeepSeek’s hosted product transferred Americans’ data to China and manipulated responses; those are findings and allegations from a congressional investigation, not proof that every downloadable weight file contains malicious code. 2

The behavior of a hosted product may also differ from that of a locally run derivative. A model’s wrapper, system prompts, moderation layer, retrieval tools and update process can all affect its output.

3. Backdoors and supply-chain compromise

A downloaded model package or its surrounding software could theoretically contain insecure loading code, poisoned behavior or hidden triggers. But a model’s country of origin alone is not evidence of a backdoor. Security teams need to verify provenance, hashes and signatures, inspect network behavior, sandbox components and test the complete deployment stack.

4. The risks of closed models

Closed proprietary models have their own concentration and accountability risks. Users generally cannot inspect their weights, training data, hidden prompts, telemetry, filtering or update process. Centralized APIs can become high-value targets for surveillance, outages, compromise and unilateral policy changes.

Closed access can make it easier for a vendor to monitor abuse, roll out safety changes and prevent uncontrolled redistribution. It does not make a model inherently trustworthy. Open and closed systems involve different risks and different forms of control.

Why local hosting is the strongest argument against a blanket ban

Self-hosting can give an organization more control over the threat model. A security team can pin a model version, verify artifacts, restrict outbound connections, scan dependencies, sandbox the service, conduct red-team testing and keep sensitive prompts on internal infrastructure. Open access can also allow independent researchers to reproduce failures and investigate bias or hidden triggers.

That transparency is valuable, but it is not automatic safety. Most organizations cannot audit the learned behavior of a very large model in full. Fine-tuning can introduce new vulnerabilities, and an air-gapped deployment protects data egress only if the entire serving stack is correctly configured.

The practical lesson is to evaluate the deployment—not just the label attached to the model. A China-hosted API, an audited local deployment and an unverified third-party derivative present different risks.

Distillation is central to the controversy

Distillation trains a smaller or newer “student” model using information from a stronger “teacher” model.

• Black-box distillation uses observable outputs, often collected through API queries. It can be legitimate when authorized, but high-volume extraction may violate terms of service, evade safeguards or copy proprietary behavior.
• White-box distillation uses internal information such as weights, logits or hidden states. It can transfer capabilities more efficiently, but access to those internals generally requires authorization; unauthorized acquisition raises more direct security and trade-secret concerns.

OpenAI and Anthropic have accused Chinese companies, including DeepSeek, of using model outputs in training. The US-China Economic and Security Review Commission described allegations involving fraudulent accounts, proxy services and coordinated extraction, while Reuters reported OpenAI’s accusation that DeepSeek was attempting to “free-ride” on US frontier-model capabilities. These remain allegations rather than settled findings in a court or other adjudicative process. 35

The policy challenge is that black-box extraction can resemble legitimate high-volume use, while proving it publicly may require revealing sensitive investigative evidence. The answer should not be to treat every form of distillation as illegal: authorized distillation is a standard technical method.

What this means for Silicon Valley and Washington

Chinese open-weight releases put pressure on the US business model built around expensive, proprietary APIs. US companies must decide whether keeping weights closed protects a capability lead—or allows Chinese and other competitors to capture developers, integrations and global distribution.

Qwen’s download lead over Llama is one concrete sign that the open-model contest matters. 18 At the same time, the available evidence does not establish a specific current response by Nvidia or Meta to DeepSeek V4 Pro or Kimi K3. Claims about company-by-company reactions should be tied to dated primary statements rather than inferred from the broader market shift.

Washington is responding with increased scrutiny. House committees announced a joint investigation into the national-security and cybersecurity risks associated with the adoption of PRC-developed models, including low-cost open-weight and API-accessible systems from companies such as DeepSeek, Alibaba and Moonshot AI. 14

Reports have also described discussions about restrictions, but the provided evidence does not establish that the US has enacted a blanket commercial ban on Chinese open-weight models. 912

Policy options beyond “ban everything” or “do nothing”

A more targeted framework could combine several measures:

1. Control high-risk uses. Require authorization or prohibit unvetted models in defense, intelligence, critical infrastructure, sensitive government systems and other environments handling high-impact data.
2. Set secure-deployment requirements. Require provenance records, signed packages, software bills of materials, independent testing, red-team results and network-isolation options for sensitive deployments.
3. Distinguish hosted services from local weights. A China-hosted API creates a different data-access risk from an independently audited, locally hosted artifact.
4. Enforce against unauthorized extraction. Improve account verification, query-rate monitoring, abuse detection, provenance techniques and contractual enforcement without defining all distillation as theft.
5. Use targeted export and investment controls. Focus on advanced chips, manufacturing equipment, cloud access and entities credibly linked to military or intelligence end uses, while recognizing that overly broad restrictions can accelerate domestic substitutes.
6. Build a US and allied open-model ecosystem. Invest in secure, well-documented models, multilingual evaluation, efficient inference and deployment tools. A competitive alternative addresses China’s adoption strategy more directly than restricting user choice alone. 10

The bottom line

China’s open-weight models are reshaping the AI race because they make capable systems cheaper to adopt, easier to customize and harder to contain once released. Their strategic importance lies in ecosystem scale as much as in model quality.

The security concerns are serious, particularly for hosted services, sensitive data, supply-chain integrity and alleged unauthorized distillation. But nationality alone does not reveal whether a deployment is safe, and closed US models are not risk-free simply because their weights are unavailable.

The most defensible response is therefore a risk-based one: secure the supply chain, restrict sensitive uses, investigate credible evidence of model theft, and build an American and allied open-model ecosystem capable of competing on distribution as well as performance.