Watch or listen to the High Capacity podcast on:
Could China break America’s dominance in AI chips sooner than expected? What happens when China can produce enough AI chips to meet its own needs—and start exporting them around the world?
In this episode, I speak with Ryan Fedasiuk and Satvik Pendyala of the American Enterprise Institute (AEI), authors of the new report “Voltcraft: Industrial Competition in the Age of AI.” We talk about China’s push for AI chip self-sufficiency, the global competition over AI infrastructure, and the risks and opportunities of Chinese open-source AI models.
We discuss:
Could China meet most of its domestic AI chip demand by 2028?
How is China overcoming bottlenecks in advanced chipmaking, memory, and packaging?
What happens when China starts exporting AI chips and competing with the US AI tech stack globally?
Will greater compute capacity help Chinese AI labs catch up with the US frontier?
Will Beijing continue releasing powerful open-source AI models as security risks grow?
What are the risks and benefits of American companies building on Chinese open-source AI models?
Links:
Voltcraft: Industrial Competition in the Age of AI (Ryan Fedasiuk and Satvik Pendyala)
How to Win Friends and Export AI (Ryan Fedasiuk and Satvik Pendyala)
The Lithography Loophole: How China Is Printing Its Way to Chip Self-Sufficiency (Ryan Fedasiuk and Julia Torres)
Code Red: Is the Future of American AI Being Built in Beijing? (Ryan Fedasiuk)
Follow:
Transcript
Kyle Chan (00:00)
Welcome to the High Capacity Podcast. I’m your host, Kyle Chan, a fellow at Brookings. I’m super excited to be joined today by my guest, Ryan Fedasiuk, a fellow at the American Enterprise Institute, and Satvik Pendyala, a research associate also at AEI. They’re a powerhouse team doing incredible research on China, tech, and AI. Welcome, Ryan and Satvik, and thanks for coming on the show.
Ryan Fedasiuk (00:25)
Thanks for having us, Kyle. Good to be here.
Satvik Pendyala (00:27)
Yeah, thanks for having us.
Kyle Chan (00:28)
You guys recently published a really fascinating new report titled Voltcraft: Industrial Competition in the Age of AI about the rise of compute as a powerful force in geopolitics and how the US and China are rushing to build up compute capacity. What’s the main thesis of your report?
Ryan Fedasiuk (00:47)
I think it’s hard to distill into one thesis. We kind of ended up writing a few papers in one. But just to hit the high notes, it’s like a 50-page compendium. We find a few things. First of all, the US-led chipmaking ecosystem is currently the undisputed provider of global compute. I think most people understand that. And we model out exactly when and why global demand for AI accelerators will soon exceed supply if it hasn’t already. Then we also find, on the other hand, that despite massive constraints on China’s ability to make AI chips in terms of access to advanced memory, access to advanced packaging capacity, we do expect that Chinese chipmaking companies are going to rapidly scale up their production over the next two to three years.
And that leaves us with a pretty narrow window where the United States is effectively the world’s sole provider of compute. Time is kind of waning. The question is when exactly industry analysts expect certain production factors to scale up in China.
Satvik Pendyala (01:53)
Yeah, so I would say that our analysis really kinda hinges on a few factors. First of all, there is access to advanced packaging and memory for Chinese chips. There are also changes in chip architectures, and there’s the allocation of SMIC’s advanced logic manufacturing capacity to smartphones versus AI chips. And that really takes up a lot of SMIC’s advanced-node capacity. And based on how Chinese companies adjust these factors, in addition to their yield rates, which they can improve with better processes and iteration, that allows Chinese companies to grow rapidly. We looked at Huawei specifically. But even outside of Huawei, this allows Chinese chip production to scale rapidly.
Kyle Chan (02:47)
Great. Yeah. So you make this bold prediction where you forecast that China will be able to produce enough AI chips to meet the majority of its AI demand by 2028, perhaps. So you guys sketch this out a little bit. But flesh this out a bit more. How do you see China getting there? Aren’t they severely production-constrained today? Don’t they lack access to a lot of the chipmaking equipment and tools that are needed to scale up advanced semiconductor production? What do you see changing over the next few years and what are some of the big wildcard variables there?
Ryan Fedasiuk (03:22)
Yeah, this is the central debate in the United States, right? It’s how quickly China will be able to scale different aspects of its chipmaking supply chain. And so Satvik previewed some of these, but I think it’s worth drilling down on basically four variables that form the crux of the uncertainty in our report. The first of these is what the actual yield rate of new logic die is going to be. Well, let’s take a step back and just to quickly review, to make a modern AI accelerator, whether it’s an NVIDIA Blackwell or a Huawei Ascend, you need a few parts.
You need a logic chip capable of conducting processing at scale. And then you need a memory stack to hold the model weights. And then you need a third component, which is the packaging process. You need to stick logic with memory on a single processor. And to actually scale production of each of those components is actually quite hard. The thing that Huawei and its main supplier, SMIC, currently struggle with is producing enough logic chips at scale. Everybody, I think, or a lot of your listeners understand that China can’t make a lot of logic chips.
It lacks access to high-end lithography machines and equipment needed to do so. And so they’ve had to rely on older techniques or kind of jankier techniques like multi-patterning to run the same piece of silicon through a machine multiple times. And this basically severely degrades your logic chip yields. So the first measure of uncertainty is: will Huawei make progress in cutting a huge number of logic die off of a single run to improve the yield of logic chip fabrication?
That’s piece of uncertainty number one. Piece of uncertainty number two is, even if you assume yields remain the same, and they’re pretty low right now, about one in five to one in four accelerator units are usable off the shelf by most industry estimates using these kind of multi-patterning techniques. So if yields remain the same, you could still think there’s a world where Huawei makes tons of logic die by shifting away what it’s making logic die for. Right now the company’s making tons of smartphones, right?
It’s a huge market. They can more reliably create Kirin chipsets using that fabrication process with better margins. But there is a world where maybe demand is so high for logic chips in China that the company decides to shift over more of its limited production capacity away from making smartphones and more toward making chips that you would install in data centers. And so that is another variable. It’s a question of how much logic chip capacity the company dedicates to producing AI accelerators.
And then the third piece of uncertainty in our analysis is how quickly they’re going to be able to acquire high-end memory to package with all of the logic die? How much memory is there? And this is where companies like CXMT and YMTC come into play, paying attention to how quickly they’re able to build high-bandwidth memory and also DRAM, older forms of memory, which are being used in different chip architectures to try to save on cost. And then, of course, packaging capacity, the fourth and final variable of uncertainty.
Who is actually able to take all of these components and stick them together in a completed accelerator unit? That’s a very difficult process. Really, it’s been TSMC in Taiwan that leads on packaging. And so the question is: who will emerge as China’s packaging and OSAT champion?
Satvik Pendyala (07:06)
Yeah, I would also add that in our analysis, we kind of use a range. So we don’t give a single number for the kinds of chips that China will be able to produce in the next two to three years. We instead give a banded range of whether they could meet certain thresholds, like 50 percent or 25 percent. And from there, even in our lower bounds, by 2028, we get China achieving a significant amount, almost a third or so of its domestic AI demand from Huawei chips alone. And that in itself is very significant and is gonna change how China builds out its AI infrastructure and the limitations that Chinese domestic labs really face as well.
Kyle Chan (07:58)
Yeah, okay. So the implications could be huge, but each of these bottlenecks is extremely challenging. Is there any one of these bottlenecks in particular that you think is gonna be the toughest for China to overcome? Is it HBM? Is it CXMT now trying to develop HBM3 and scale it up? Or is it access to the advanced lithography machines? How might this get scrambled up if, say, China can no longer buy DUV immersion lithography machines from ASML at scale?
Ryan Fedasiuk (08:32)
Each of these four variables we’ve outlined—logic chip allocation, logic chip yield, memory chip production, and packaging capacity—is a constraint on the production possibilities curve, right? It necessarily shrinks it. And so the question is how quickly each of them will scale and which will serve as the most acute bottleneck in any particular moment in time. I think right now the central bottleneck, not just for China but for most of the world, is in memory. This component has become just so expensive, it now accounts for more than a quarter of the cost of a leading-edge NVIDIA accelerator in the West.
The same, I think, is true in China, even though Huawei has been able to print at least some high-end logic die. About 1.3 million over the course of 2026 is, I believe, the target. Even though that is likely to remain on track, the question is where are they gonna get memory to pair with this stuff? And so it’s a question of how quickly CXMT and YMTC can scale. This is also why I think many people in the United States have different opinions about the wisdom of importing memory chips from CXMT.
Apple was considering using Chinese-made memory. For example, there are pros and cons of doing that. One upside is that it’ll make memory cheaper for American consumer electronics. But one downside potentially is you’re basically creating a ton of liquidity to inject into CXMT to make it much, much easier for this Chinese memory company to make this extremely valuable component. And that’s memory in those supply chains that are going to run right back into producing AI chips for China.
Satvik Pendyala (10:15)
Yeah. And additionally, even though that in our specific analysis there is this memory constraint and that’s also largely a function of the fact that we’re looking at a certain type of chip, Huawei-type accelerators, ch Chinese chip companies have been experimenting with different sorts of memory arrangements, such as using DDR5 or DDR memory, and also SRAM instead. And so if there are significant constraints on one type of memory chip, that does not constrain other types of chip architectures from emerging from China, that try to mitigate this. And they may have, different degrees of effectiveness and different compute capacity as a result of that. But that doesn’t really change the underlying picture: if China finds a way to get access to memory or finds a way to adapt around the lack—
Kyle Chan (11:06)
Yeah, that’s very helpful. I mean, you guys are kind of laying out this multi-pronged approach that China’s taking where they might face bottlenecks or challenges in some areas, like for HBM, but they might try to get around that through the use of other forms of memory or for the advanced logic node production, right? Really relying on those, despite the low yield, the multi-patterning techniques. And maybe you don’t care about the economics and you just want to produce like a threshold of absolute number of logic die at the end of the day.
And so you can just sort of like do this unprofitably, but you’re state-backed, you have that sort of central government long-term focus, and then maybe you’re able to at least satisfy some of those constraints. So I guess these are some of the different variables and you can kind of see China trying to adapt along the way. When they run into roadblocks for different scenarios.
Ryan Fedasiuk (12:05)
That’s right, and I don’t mean to interrupt you, Kyle, but I think that’s exactly right. That’s kind of how we are envisioning it. China will do what China does. And like you say, maybe the profitability isn’t the main concern right now. Maybe the concern is national domestic self-sufficiency for an end-to-end chip supply chain. So I think the central point of uncertainty, our report is pretty rosy on China’s capabilities. It’s really optimistic, and I think it’s probably the furthest end of the spectrum of analyses of how quickly China will be able to do and achieve certain things.
But even if you think our numbers are wrong, even if you think it’s going to take a bit longer, the question is really: when do you expect scale up of which of these four components we’re talking about? Does it happen in 2028, in 2030, in 2032? Maybe it’s going to take a few years longer, maybe it’s going to take even a decade longer. But ultimately we can see the tidal wave coming. And so really, the report, in large part, is about the strategy of how to adapt to this growing production capability.
Satvik Pendyala (13:09)
I would also say that, even if you take our two- or three-year estimate and extend it like maybe a couple of years afterwards, the things that actually really change, that we really highlight, are the capabilities of Chinese labs and the export capacity that China really gains. And that in itself is not actually that affected by a one- or two-year gap between one prediction or the other. In fact, if it is the case that Chinese labs have access to almost 50 percent of compute from domestic sources only, and that is something that they can reliably rely on for their scale-up and for inference, that means that they become more reliable partners for foreign companies, for domestic companies in China. They don’t always have to rely on just hyperscaler buildout to host their open-source models.
So a large commercial opportunity opens up for them. In addition, this also opens up the possibility for Chinese exports. And a lot of countries, even now I think we are already seeing a chip supply crunch in the United States where people who just want chips can’t get them. And it’s cost-prohibitive for them. If China enters the market, it doesn’t really matter if it’s an inferior chip, people just want compute.
Kyle Chan (14:29)
Yeah, this is really helpful. Yeah, I wanna dig further into what this all means for China reaching a kind of semi-self-sufficiency state for AI chips and starting to export at scale globally. Because I think right now we see fairly minimal efforts, the analogy I often use is like you’re kind of selling a car without the engine if you are trying to export the broader AI stack, but you don’t have like the most crucial component there. And so we see like little efforts by say Huawei to offer, really a small number of Huawei Ascend 950 chips to a country like Egypt.
But then that’s quickly sort of overwhelmed by a counteroffer from the US because we have that difference in compute scale today and production scale today. But if we do see that kind of tipping point where China can not only roughly satisfy some of its own domestic demand, but then can start to export, what does that mean in terms of global competition with the US AI stack? Do you see this becoming a broader sort of contest over what the world will run on, the US or Chinese AI stack?
Satvik Pendyala (15:42)
I would say that, currently the United States does enjoy a massive advantage in that it is the sole provider of compute at scale. And that basically incentivizes countries to enter into forward partnerships with US chip companies, to adopt CUDA training for example in a lot of the universities, and that specifically primes their developer community to work with NVIDIA chips. And that’s good for the United States. It’s good for developer community cooperation between the US and whatever host country that is.
The difference is that if China starts to make these at scale, now there’s an actual option. Before, there was not an option. There was no real optionality that these countries had. And now by gaining optionality, they will be able to drive harder bargains with the United States. They’ll be able to shift their developer ecosystem to becoming more Chinese, especially if China continues to lead in open source models. There’s also an incentive to move towards Chinese chips because all these models will be optimizing for Chinese chip architectures.
I think DeepSeek very recently announced that it was making its next big training runs on mainly Huawei chips. And it’s now helping Huawei set up their CANN ecosystem and a bunch of the other developer libraries needed for AI training. So all the adjacent parts of the AI supply chain, once chips start getting in the picture, really start filling out for China. And that makes it a much more formidable threat to the US AI stack. But I would like to actually just zoom out and not just look at the AI tech stack itself.
I think this is a larger electrostack kind of competition. When Chinese hyperscalers do start getting export capacity out, they’re not gonna be going alone to these countries. They’re gonna be partnering with Chinese solar companies, battery storage companies, grid management companies, to basically offer package solutions for a country to be like, ‘We’ll just buy Chinese.’ All these suppliers work together, work well together, they know each other. And this is where China can start to leverage places in the industrial supply chain where it has a clear advantage, such as in green energy and energy storage.
Ryan Fedasiuk (17:56)
I think that’s exactly right. And the only couple of things I would add are, in sum, we want the world to run on American rails and be answerable to American technical standards. And unfortunately, a key issue that we can see coming is that demand is going to outstrip American supply pretty shortly. There’s going to be a gap in unmet compute need, at least overseas. There already is in the United States. I don’t know if you saw the recent news that OpenAI is apparently so strapped for compute they are considering trying to partner with Google as a provider of TPUs.
Right? This is a brand new era for major AI labs in the United States exploring different chip architectures, trying to build their own compute, trying everything they can do to create devices that turn electricity into tokens. And so like Satvik said, the rest of the world needs this stuff. And the question is, will America step up to the plate to provide it? I’ll tell you one specific angle that kind of troubles me: I’m worried there might be this narrative that emerges in Washington that the United States needs compute so desperately, we can’t afford to export any of this scarce and valuable resource overseas.
Our report kind of makes the case, and we’ve been doing some additional writing on this recently, about the need for a strategic approach to exports, that really it is incumbent on the United States and on the US government to try to pave the way to serve global demand, especially in markets that are poised to grow in strategic importance to the United States. There’ll be really important developer ecosystems, like Satvik mentioned, before China is able to fill that capacity.
Kyle Chan (19:39)
Yeah, this is fantastic. I mean, there’s an argument that the compute will get built somewhere, and it needs to get built. And so countries that might have land or energy, but not the chips, there could be a partnership there. And that could help the US sort of address some of our bottlenecks in other areas. So to just see it as a sort of pure domestic issue and focus on the domestic ecosystem is sort of missing a broader range of possibilities here. I have a question about how China’s AI chip sort of developments affect Chinese AI capabilities, right?
And you guys make an interesting distinction between how compute will affect training versus inference. I think a lot of focus is on the frontier and training ever larger, more capable models. And so a question is: as China ramps up its own chip production and builds out its own compute capacity, do you think this will have more of an effect on the sort of gap between leading Chinese AI models and the US frontier? Or do you think that has bigger implications in other domains?
Ryan Fedasiuk (20:48)
I think the answer is both. And this is where it’s possible Satvik and I have some different interpretations. I mean, my view at least is constraining China’s compute access isn’t just good because it bounds frontier AI development. It’s good because it constrains overall inference capacity. And that should really be the way the United States thinks about it, right? To my mind, frontier AI competition has become an industrial systems competition, right? It takes basically a whole NVL72 server rack to run Kimi K3.
It’s a three trillion parameter model. You need tons and tons of memory to store the weights in silicon. You need tons and tons of energy just to power the thing. And that’s why on the greatest day of Moonshot’s life, on the release of K3, at least so far, the company stopped taking new user signups. Why? Because it ran out of computing capacity. It couldn’t handle the load of having so many people use its product at once. And so that to me is success. It’s pushing people to be able to choose and have the freedom to choose where they’re running compute, to own compute for themselves, and to choose which kind of service they are ultimately delegating cognition to.
So part of China’s compute constraints are what have given rise to an open-weight model ecosystem to begin with for exactly the reasons that we’re describing. But it is a second thing entirely. It’s probably beneficial to the United States strategically for national security reasons to attempt to ensure that Chinese AI labs struggle to directly serve their models to global publics because we really worry about the transaction of data across borders, the processing of sensitive user information in APIs that route to servers in China.
And so that is ultimately a good thing to the United States. That’s why, at least in my book, it’s so important that the US continue to maintain stringent controls on the availability of compute to China. And just to quickly plug, two very time-sensitive policy hooks, the MATCH Act and the Remote Access Security Act, are two specific pieces of legislation that I at least have been writing about and trying to champion as ways to restrict the availability of compute to China’s AI labs for the foreseeable future.
Satvik Pendyala (23:08)
And I would actually go further to say, right now the disparity in training—I think people reference a six-month-or-so gap between the US frontier and the Chinese frontier. There is already a near 1-to-20 disparity in just the amount of compute that you had between the US and China anyway. And yes, of course, China does remotely access servers in Southeast Asia, but even despite this disparity, this gap is still very small. And I think that, when China can build up more of its compute domestically, it can start to offload certain compute-intensive tasks to the already extant supply of Blackwell chips versus whatever Ascends they need to train on as well.
So they get greater granularity with task allocation, which I think will improve the training runs. It’ll improve their inference capacity to actually serve these models. And I think one thing is that it also improves the ability for China to train non-frontier models. Right now China is already a leader in edge compute models and mobile on-device AI models. And despite the fact that they only take a lower amount of compute to run, they still take a lot of compute to train.
So it also is important for China’s other forms of AI play, such as the physical AI play as well. So I think that the greater amount of compute availability to China just basically on domestic compute alone gives greater flexibility across the AI supply and use chain for China.
Kyle Chan (24:46)
Yeah, awesome. So now I want to shift to open source as a strategy for China, or more accurately, open weight. And first I want to focus on sort of China and their domestic open source push, but then I wanna also ask about implications for the United States given growing popularity of Chinese open source models here. So first, how do you see China’s open source strategy evolving over time, especially given the classic dilemma between development and security, right? Beijing is always trying to find that balance between hitting the gas on accelerating AI progress or technological progress, but super paranoid about implications for national security, party control, social political instability, especially at a time when the technology itself is getting more difficult to control objectively.
We see more incidents of sort of runaway or rogue AI systems. This is something that I could imagine folks in Beijing would be a bit nervous about. So how do you see this open source strategy evolving, especially given this particular moment where, arguably we’re hitting some inflection points in terms of capabilities and risks.
Ryan Fedasiuk (26:04)
Yeah, this is the central question and it’s a topic that Satvik and I have a lot of fun debates about in the office all the time, but I’m happy to articulate one steelman, one pole of this debate. On April 8th, the day after Mythos, I had a pretty spicy Twitter take where I basically said, I don’t think that China will ever open source truly destructive superintelligence. Frankly, even today, as of recording in late fall 2026, I don’t know how ZAI got away with the release of GLM 5.3.
Right? It’s an incredibly capable model, with really incredible cyber exploit capabilities. And my position, as soon as Mythos came out was basically like I don’t know how Liang Wenfeng or some of these other executives in China are going to reliably go to folks in the security apparatus in China and say, ‘You know what? We wanna release this tool and make it available to everybody.’ As soon as there’s any kind of incident of misuse, as soon as any Chinese teen gets the wrong idea, running his OpenClaw setup in Shenzhen and connecting it to an obliterated, open-weight Chinese model that is capable of real damage, you’re gonna have a threat to social stability.
And so I’ve been writing a few commentary pieces and making this case on the road. Basically, I think we are starting to see already what I have been predicting for a few months, and that is a bifurcation in China’s strategy. At the low end of the value chain, of course, China will want to lead. Of course, China will want to remain a leader in open source. Xi Jinping committed to that at the World AI Conference over the summer. There’s no way that China will deviate from that strategy of building the best free tools, uplifting the capacity of the Global South, for example.
On the other hand, the crown jewels of computation, the 3 trillion parameter K3s and above, I don’t think will be freely available for much longer. We’ve already seen some changes in licensing requirements. We’ve already seen some Chinese AI labs try to shift the burden of liability away from the developers and onto model hosts like Hugging Face, so that if there is a problem with their model, then it will be the host that gets in trouble, the compute provider, the hyperscaler, not the lab that built the multi-trillion-parameter language model.
But I don’t know how tenuous that fight is, and I certainly wouldn’t want to end up on the losing side of it. And so I think there is a real possibility, just based on some commentary coming out of party mouthpieces, journals written by the Central Party School, some of the updates to some of the technical guidelines released by technical advisory committees in China in mid-September. All of these indicators are pointing out to me at least that the party is taking AI security risk seriously where it wasn’t before.
They’re pretty worried about democratizing really disruptive and destructive capabilities into the hands of individuals who might threaten their rule or who might cause real problems for ordinary Chinese people that they are responsible for governing. So I don’t think that we’ll see truly disruptive systems at the capabilities we’ve been seeing available for much longer in future releases. But I want to see if Satvik has any pushback or any different interpretation.
Satvik Pendyala (29:30)
Yeah. I would say that regarding the capabilities in the open source, my initial take is that the cat’s already out of the bag. Capabilities already in the open source today can pose major threats to cybersecurity and since it’s already in the open source, in open weights, it’s like closing the barn door after the horse has left, and it’s not just important that these are extant capabilities; the fact that these models are now in the open means that these can be used to train better models.
That in itself, I feel, is not always a constraint in the sense that if GLM 5.3 is already out, that means that you could distill whatever model weights that you have easier because it is an open-weights model. You can actually see what’s there. The real big constraint, I think, here is just the training data that a lot of these models are really working with. And we’ve seen recently some restrictions on, I think, two-trillion-parameter-plus models and beyond, I think, a certain exaflop of compute.
But I do think that these restrictions are not durable. I think there are two ways to look at it. I think that if there is a two-trillion-parameter threshold, that means that China is going to have the world’s best 1.99-trillion-parameter models out there, and Chinese companies will compete for it. They’ll get ever-improving capabilities at that threshold, and it may be that, yes, it’s a two-trillion-parameter model, but it may have the capabilities of a three- or four-trillion-parameter model because it’s much more efficiently allocated. They’re much better at getting sparsity down.
Any restriction that they do place now also, I feel, is not going to be durable for more than a year or two. I think that capabilities in the open source itself will evolve so that the threshold will just keep moving. China itself also doesn’t want the rug pulled out from underneath it because other countries will start improving on this open source side of things faster if China feels the need to not actually give them the best access to the best open source frontier capabilities.
So I feel that there are multiple factors that make it so that yes, China may have concerns regarding cybersecurity and the threats that certain open source models may provide. But I think that it is actually frankly more concerned that its larger developer community in addition to its AI labs may be left unprepared against US frontier models. What recent US frontier model hacks have shown them is that it is best to diffuse top-tier open source capabilities amongst its own developer ecosystem as a form of almost active defense because they can’t just rely on access to US frontier models.
Ryan Fedasiuk (32:21)
I can’t help but chuckle just a little bit.
Kyle Chan (32:24)
Ha ha.
Ryan Fedasiuk (32:25)
When Satvik is mentioning that Chinese labs will probably build the best 1.999-trillion-parameter language models they can, still available for export, it kind of echoes the experience of the United States in trying to craft its own export controls. And I remember—
Kyle Chan (32:41)
Right.
Ryan Fedasiuk (32:42)
At least back when the US first made the decision to restrict GPU exports to China and finally scoped that regulation based on the physical component and transistor size. I think it was 12 or 14 nanometers back on October 7, 2022. And almost immediately you had American industry design around the restriction to build capable chips that could still be sold to China. And then Secretary Raimondo warning companies that they ought to comply with the spirit, if not the letter of the regulation.
And I’m imagining Wang Wentao or Chinese officials struggling with this same dynamic. But part of my hunch is that the CCP wields more influence and might have to deal with this problem less than regulators in the United States. But I take Satvik’s point, and I think he’s basically right that technology is moving. We’re gonna be able to squeeze more cognition into a cubic square foot of computing capacity no matter how we try to design a box around it.
Kyle Chan (33:50)
Yeah, these are great points. It’s also interesting to see all this in light of recent moves by Moonshot with Kimi K3.1, trying to basically have its cake and eat it too, where they are wary of the argument about open source open-weight models having their guardrails fine-tuned away. So then they try to do data filtering, where on the training data itself, at least for the post-training, they try to remove certain cyber-related data and try to kind of keep that out of the training environment.
So that’s harder to remove as a guardrail. But at some point you’re gonna have some trade-off here with capabilities, right? So it’s like you either release powerful models that are useful for a lot of things, but then they have perhaps some of these cyber risks, or you release less powerful or you release, quote unquote safer models. But then they’re less powerful and less useful, including for defenders. So it’s a tough circle to square.
Satvik Pendyala (34:52)
I mean, the funny thing is that the more capable a model is, even if you take out some cyber capabilities, the more capable it is at obliterating all these guardrails. Like, even if you try to post-train something out, you get to post-train something right back in.
Kyle Chan (35:07)
Mm-hmm.
Satvik Pendyala (35:08)
And so the question will then be, if the public release of Chinese open source models, even in China, if they have these capabilities obliterated, that also means people in China who are using these models may be left more vulnerable if they didn’t do that. So it harkens back to an almost deterrence sort of logic, if any of you guys are fans of Thomas Schelling and the arguments he made back when he was there.
Kyle Chan (35:40)
Yeah, definitely. Well, now I want to turn to implications for the United States of Chinese open source models. There are a lot of different views about this, pretty heated debates online. How do you guys see the pros and cons of US developers, companies, users building on Chinese open source models? Like what are the advantages? What are the risks?
Ryan Fedasiuk (36:04)
I’m happy to come out on kind of one end of the spectrum of the debate. I wrote a report for AEI in February this year called China’s Transition to Scalable Tech Intelligence that basically said, look, this is the year that Chinese models are going to take off. And then they did. And there are a lot of issues with that. We had a whole war between big tech and little tech in the United States over the summer with that open letter spearheaded by Jensen Huang and others advocating for a place for Chinese open source or open weight LLMs in the United States.
My position is that I worry. I’ll just give you the steel man of what I worry about. I worry about maybe three or four discrete things. The first thing probably ranks least on the list, and that is if Chinese AI labs are directly serving their models to people over an API. They have compute, and then people are paying for tokens directly to Moonshot. That’s a huge source of data collection. That’s like a hundred times worse than the TikTok issue was in the United States, right?
And so this isn’t normally an issue because people are running models locally or they’re finding a hyperscaler to serve that model to them. They’re not transacting with servers in China. But it could be an issue. It could especially be an issue if China scales compute production, which is why I’m so adamant on limiting that capacity. A second threat, the one that’s really, I think, actually concerning, is about software and supply chain poisoning. And Kyle, you and I have been in some media on this, I think together recently, describing how this works, right?
When you’re training a model, it’s what we were just talking about. You could deliberately omit certain training data to prevent it from having certain capabilities. You could also augment the training data to deliberately poison some documents in a training data set, to deliberately elicit a specific behavior. This happened as recently as this week. An American company called Cohere filed a report, pretty technical blog post claiming that in their testing, Qwen 3.8 reached out to a Chinese server, tried to push a document toward a server located in China.
Probably that was an accident. Probably it was just an artifact of the training data that was used to build Qwen 3.8. But you can imagine this kind of activity could be deliberately designed. It could be designed surreptitiously. And the thing that worries me is that we really have no idea what we’re looking for. When you’re talking about a large language model, tens of billions of parameters or trillions at the frontier, unless you know what the needle looks like, you’re not going to find it in the haystack.
And so a security team will find it very, very difficult to go in and correct for that exploit or vulnerability that is inherent in a training model. Now I’ll back up a little bit and say, we have been able to correct for issues of political censorship in Chinese models, right? People are, like Satvik is saying, obliterating models. They’re removing guardrails, but that’s because they know what those guardrails are. And they know roughly the shape of them. They know what part of the haystack to look in, and they know roughly what shape they’re looking for.
But in the kinds of supply chain attacks we’re describing, you could engineer a backdoor in a frontier model today with as few as a few hundred poisoned training data set documents, and people would have no way of knowing. And so people often tell me, Ryan, I don’t care if I’m building my B2B SaaS app on DeepSeek 4.1 Flash because I know it’s gonna censor outputs relating to Chinese politics or Tiananmen Square or Taiwan or Hong Kong or Xinjiang or Tibet. But my B2B SaaS application has nothing to do with China.
It has nothing to do with geopolitics. And so the censorship doesn’t bother me. But my answer to those folks is you just don’t know what you’re building on. And even if you build a successor model, even if you try to take a Chinese model as the base and do some post-training, you’re going to carry forward some of those vulnerabilities. And so this is a real concern. Just to concede, this is also an issue for American software. You really have to trust the vendor. You have to know how it’s being built and have it pass certain certs.
But ultimately they’re models, they’re unpredictable. And there are certain ways of eliciting certain behaviors that are very difficult to detect in the process of building them.
Kyle Chan (40:43)
Yeah, and just to clarify, some of those issues that you’re pointing out are not just using the direct API from, say, the Chinese companies. We’re talking about even if you were to download the open
Ryan Fedasiuk (40:55)
Right.
Kyle Chan (40:56)
weight model onto a different system, say US servers, and run them, there are potential ways that it could send data back to China, for example.
Ryan Fedasiuk (41:05)
Right. I mean, basically at its core, at its most basic, we’re talking about a model, learning to prompt itself to execute actions on your behalf. And so as you give it more tool access, as you’re running more cognition, more sophisticated capabilities that are deploying agents on your behalf, those models could be poisoned. It doesn’t matter where you’re running them or what infrastructure they’re running on. The risks exist theoretically, and we’re starting to see cases where the risks are manifesting even on accident. Satvik, go ahead.
Satvik Pendyala (41:34)
Yeah, I think that, this risk has become most apparent in the libraries that AIs choose to use. There’s a lot of like, we’ve discovered, especially over the last few months, all frontier AI companies have kind of run into trouble with the libraries that they’re using, either being used as a way to get out and access the larger internet or creating behaviors that you don’t want to see in the AI you have prompted, a whole bunch of that. My thing regarding open source usage of Chinese models in the United States is that there are some concerns, but right now I think with all the cyber issues that we’re seeing in the open internet and for all these companies, we are realizing that we’re standing in a house full of mold.
And we’ve now got the first mold inspectors to actually come look at everything. And they’re like, my god, there’s so many vulnerabilities everywhere. Regardless of if it’s a US or a Chinese model, the fact is that we’re learning that so much of our extended infrastructure was not built with the level of rigor that we may have wanted it to. And I think that the vulnerabilities that need to be patched up in the immediate sense are almost so severe that you just kind of want to have anything you have access to.
And of course, I think the Chinese models are a risk and there could be certain concerns and certain guardrails that should be put up regarding the use of these models, especially for critical applications. The security and the competitiveness of US companies does rely in large part in being in conversation with these open model companies in China. I mean, largely because China already has the largest developer ecosystem in the world. I think even just for Nvidia, its CUDA libraries, I think almost a quarter of them had been written and developed by Chinese engineers.
And if the United States stops really engaging with the Chinese open source ecosystem, it loses access to those developers, especially as those developers are pressured by the state in China to shift their priorities to domestic labs and domestic tooling. So there is a case not just in the bilateral sense, but in the multilateral sense as well. If you look at developers all across the world, for example, in a country like India, even though there are severe concerns regarding China, I think almost 80 percent of the AI engineers in India are using DeepSeek for their own personal use cases because it’s cheaper, it’s open source, it’s open weights.
They can look at the actual things and host them locally. If the United States does not engage on this, it also risks losing out on conversation with the larger global AI ecosystem as well.
Kyle Chan (44:33)
Yeah, really smart points. There’s sort of this balance of risks, balance of concerns. And then also, who knows where this decision will ultimately be made, right? Like maybe it’ll be Washington, maybe it’ll be Beijing, maybe it’ll be the companies or the users. There’s like this weird phenomenon now where it’s like, You can’t ban my technology, I export-controlled it. And so it’s like in some cases, if China kind of goes towards closing the frontier, this discussion might be somewhat moot in the US because it won’t be decided by the US, it will just be China controlling it, for example. So it can go in any number of directions.
Satvik Pendyala (45:14)
Yeah, and I would say that we were using this idea, this one definition of frontier AI as in like what these big labs are doing with their Opus models or Mythos or GPT-5 and all these things, there are multiple definitions of what a frontier really consists of. You have this sort of frontier where you especially have US labs pursuing this RSI, recursive self-improvement goal. But China is also already at the frontier in some other aspects of AI, such as edge compute, on-edge AI, and also physical AI.
And these are different sorts of competencies. So that even if there is a frontier capability on one end, it may not actually translate into the frontier capability on the other. There still may be a large US dependence on, let’s say, Chinese physical AI providers and may want to reduce its reliance on Chinese LLMs, but like, this is a mixed bag of things, so there’s not just one frontier.
Kyle Chan (46:16)
Yeah, yeah, fantastic point. So I will be sure to include links to your Voltcraft report and the other pieces that we discussed in the show notes. How else can people follow you guys and your work?
Ryan Fedasiuk (46:30)
Thanks. I don’t want to speak for Satvik, so he can promote his own channels. But I’m on Twitter, for better and for worse, as Ryan Fedasiuk.
Kyle Chan (46:38)
Ha ha.
Ryan Fedasiuk (46:39)
And LinkedIn sometimes too. Occasionally even Substack, but usually you can pretty reliably find me on X and writing for AEI.
Satvik Pendyala (46:49)
Yeah. I’m also on Twitter as well [handle unclear in transcript], with similar engagement on X, similar writing style. And find me at AEI as well.
Kyle Chan (47:03)
Awesome. Thank you guys for an awesome conversation.
Ryan Fedasiuk (47:06)
Thanks for having us, Kyle.
Satvik Pendyala (47:07)
Thank you.
Kyle Chan (47:09)
So if you like this episode, please rate and subscribe on YouTube, Spotify, or Apple Podcasts. You can find episode transcripts and more information on the High Capacity newsletter at highcapacity.org. I’m your host, Kyle Chan. Thanks for joining and see you next time.