700 Startup Founders Just Told the U.S. Government to Keep Its Hands Off Chinese AI Models. They Are Right for the Wrong Reasons.

700 Startup Founders Just Told the U.S. Government to Keep Its Hands Off Chinese AI Models. They Are Right for the Wrong Reasons.

Last week, a coalition of more than 700 startup founders signed an open letter urging the Trump administration not to restrict access to Chinese open-weight AI models — Qwen, DeepSeek, Kimi, and their descendants. The letter landed on Hacker News with over 1,000 points and 800 comments. That reaction tells you something. When a policy proposal gets that kind of attention from builders, it is not because they are philosophically opposed to export controls. It is because the policy would immediately break things they are shipping in production right now.

I have been watching this debate closely, and my read is that the founders’ coalition is correct in its conclusion — the ban would be counterproductive — but their stated reasoning is weaker than the actual engineering case against it. They argue access, cost, and competition. Those are real. But the deeper problem is that the proposed policy fundamentally misunderstands how open-weight models propagate through a software supply chain, and any enforcement regime built on that misunderstanding will create enormous compliance overhead while stopping almost nothing it claims to stop.

Let me explain what I mean by working through the actual technical and economic terrain here.

What the Policy Is Actually Trying to Do

The administration’s concern, as reported across multiple outlets and confirmed by the general shape of the HN discussion thread, centers on two claims. First, that Chinese labs — Alibaba’s Qwen team, the DeepSeek research group, Moonshot AI, and others — have used outputs from American frontier models to train their own systems, which constitutes a form of IP theft. Second, that running Chinese model weights on American infrastructure creates a data exfiltration or supply-chain risk analogous to the Huawei 5G dispute.

Both claims deserve scrutiny before you build policy on them.

The distillation-as-theft argument is the weaker of the two. The legal theory here is that if you query GPT-4o or Claude to generate synthetic training data, and then use that data to train a competing model, you have violated the terms of service and possibly committed some form of IP infringement. OpenAI’s terms explicitly prohibit using outputs to train competing models. That is a real contractual constraint. But the jump from “terms of service violation” to “grounds for a government ban on model weights” is enormous. American companies violate each other’s terms of service constantly. The remedy is civil litigation, not export controls.

More practically: the distillation window is already largely closed. Qwen3, released by Alibaba Cloud in April 2025, scored 81.5 on MMLU and 85.7 on MATH-500 — metrics comparable to GPT-4 class performance from 18 months earlier. DeepSeek R1 achieved scores on AIME 2024 that matched or exceeded OpenAI’s o1 on several benchmarks. These models got there through a combination of synthetic data, reinforcement learning from human feedback, and genuine algorithmic innovation in mixture-of-experts architectures. The idea that they are merely distilled copies of American models is, at this point, not credible as an engineering claim.

Consider the specific architectural choices in DeepSeek-V3. The model uses a multi-head latent attention mechanism combined with a mixture-of-experts routing approach that activates roughly 37 billion parameters per token from a 671 billion total parameter pool. That is not a copy of any American model. GPT-4’s architecture has not been publicly disclosed, but the mixture-of-experts approach in V3 appears to have been independently developed from published research by Google and academic groups, not reverse-engineered from model outputs. Alibaba’s Qwen series similarly uses architectural decisions — particularly in its tokenizer design for multilingual text and its efficient attention implementations — that differ meaningfully from the American models it supposedly copied.

The Supply Chain Argument Has More Substance, But the Policy Response Is Still Wrong

The second concern — that Chinese model weights represent an infrastructure risk — is more serious and deserves a more serious analysis than it usually gets.

Here is the genuine risk surface. When you run a model locally or self-host it, the weights themselves are passive. They do not phone home. A Qwen 2.5 72B instance running on your own hardware does not exfiltrate your prompts to Alibaba. The weights are just a large parameter tensor; they have no network connectivity of their own. This is categorically different from, say, the Huawei base station situation, where the hardware had opaque firmware with potential backdoor access to live network traffic. A physical device in your network infrastructure has persistent access to packet data; a model weight file is inert until you load it into memory and run it through your own inference stack.

The realistic threat vectors are different and narrower. If you use a Chinese model through a cloud API — Alibaba’s DashScope, for example — then your prompts and outputs are passing through infrastructure that could, in principle, be subject to Chinese government access requirements under the 2017 National Intelligence Law. That is a legitimate concern for organizations handling sensitive data. The 2017 law requires Chinese companies to cooperate with intelligence work upon request, and the scope of that requirement is deliberately vague. But the solution to that concern is already available: run the weights yourself. Which is exactly what the open-weight release enables you to do.

There is a certain irony here that the HN commenters picked up on immediately: the policy proposal would restrict access to the open-weight versions of these models, which are the versions you can run in a data center you control, while doing nothing to prevent Chinese cloud API access. If the goal is supply chain security, the open-weight models are actually the more secure option. The founders’ letter makes this point but buries it under economic arguments. It deserves to be the lead.

The one scenario where the supply chain argument has more bite is model backdoors — the theoretical possibility that the weights themselves encode hidden behavior that activates on specific inputs to produce biased outputs, leak information through statistical patterns, or perform other covert functions. This is technically possible. It has been demonstrated in academic research contexts for narrow, carefully constructed attack scenarios. But no credible evidence has been presented that any major Chinese open-weight model released for commercial use contains such a backdoor, and the research community performs extensive red-teaming and analysis on these models. A backdoor in Qwen or DeepSeek that was significant enough to matter would likely have been found by the thousands of researchers and developers who work with these models daily.

The Engineering Reality on the Ground

I want to be concrete about what is at stake for the companies that signed that letter, because the abstract policy debate obscures what is actually happening in production systems right now.

Qwen2.5-72B-Instruct, the flagship model from Alibaba’s open-weight series, runs at roughly $0.15 per million output tokens on Together AI and similar inference providers as of mid-2025. GPT-4o is approximately $15 per million output tokens on the high end. That is a 100x cost differential at comparable capability levels for many tasks. For a startup doing document processing, code review, or structured data extraction at scale, that gap is not a rounding error — it is the difference between a viable unit economics model and an unviable one.

DeepSeek’s open-weight models present a similar picture. DeepSeek-V3, released in December 2024, achieved scores within a few percentage points of frontier proprietary models on standard benchmarks while being available for self-hosting with weights distributed under the MIT license. The DeepSeek-R1 series pushed reasoning capability further, with performance on competition math problems that matched or exceeded American models that cost multiples more to run.

The table below captures the rough capability-to-cost landscape as of Q2 2025 for the models most relevant to this policy debate:

The pattern is clear. The Chinese open-weight models occupy the bottom-right quadrant of this space: high capability, low cost, full self-hosting rights. No American open-weight model comes close on the cost dimension. Meta’s Llama series is excellent and genuinely competitive on capability, but it runs at inference costs 3–6x higher than the Chinese alternatives on commodity hardware.

When the founders in that letter say that restricting these models would harm their businesses, they are describing a real operational dependency. This is not lobbying hyperbole. These models are in production pipelines. I have spoken with teams at three different startups in the past two months who are running Qwen or DeepSeek variants in their core inference stacks — not as experiments, but as the primary model for customer-facing features. Removing them would require either accepting a significant cost increase, migrating to proprietary American models with different latency and rate-limit characteristics, or attempting to close the capability gap with smaller domestic open-weight models that do not yet exist at equivalent quality.

The migration cost is not trivial. An organization that has spent months optimizing prompts, fine-tuning, and building retrieval-augmented generation pipelines around a specific model architecture faces real engineering work to switch base models. Tokenization differences alone can invalidate hundreds of prompt templates. Behavioral differences in how models handle edge cases, multi-turn context, and instruction following require extensive re-evaluation of output quality across the entire use case portfolio. For a small team, this is a multi-month distraction from product development.

Why the Enforcement Logic Fails

Even if you accepted the premises of the proposed ban — that Chinese models are primarily distilled from American ones, and that running their weights poses security risks — the enforcement mechanism would be essentially unworkable.

Open-weight model weights, once released, propagate through the internet in ways that are structurally similar to open-source software. The Qwen2.5 weights are currently mirrored on Hugging Face, ModelScope, and hundreds of individual users’ storage systems globally. DeepSeek weights are available through similar channels. A U.S. policy restricting access to these weights would not prevent a developer in Germany from downloading them and serving inference to U.S. customers over HTTPS. It would not prevent a developer in the United States from downloading them before the effective date and running them indefinitely thereafter. It would not prevent fine-tuned derivatives — which exist in the thousands on Hugging Face already — from continuing to circulate.

The commenter on the HN thread who made the EU-ASML retaliation point was half-joking, but they identified a real constraint: the U.S. has limited leverage over the global distribution of model weights once they are released under permissive licenses. ASML, the Dutch company that manufactures the extreme ultraviolet lithography machines necessary for cutting-edge chip fabrication, exports those machines under Dutch export law with Dutch government oversight. The U.S. has been able to influence that process through diplomatic pressure because ASML relies on American semiconductor IP in its machines and because the U.S. is a major customer. There is no analogous chokepoint for software weight files.

The enforcement regime that would actually stop access to Chinese open-weight models would require something like a real-time filter on model inference at the network level — a system capable of detecting AI inference traffic, identifying the underlying model architecture from the traffic pattern, and blocking requests to models of Chinese origin. That is technically implausible. Inference requests look like normal HTTPS traffic. Encrypted API calls to a self-hosted Qwen instance are indistinguishable from encrypted API calls to any other HTTPS endpoint. You cannot ban a weight file once it has propagated globally any more than you can un-publish a research paper.

What the ban would accomplish, in practice, is creating compliance overhead for American companies, forcing them to document that they are not using Chinese models, and creating legal uncertainty for anyone building on multi-model infrastructure. Larger companies with legal teams would adapt by establishing procurement policies and paperwork trails. Small startups would face the choice of paying compliance lawyers or quietly ignoring the restriction and hoping they are not audited. Neither outcome advances the stated policy goals.

The Argument the Founders Should Be Making

The 700 founders focused heavily on economic impact and competitive dynamics, which makes sense from a lobbying strategy perspective. Congressional and executive audiences respond to jobs and economic harm. But the stronger technical argument, which got less airtime in the letter, is about the structural nature of open-weight model propagation and why the proposed policy category does not map onto the actual technology.

Open-weight models, once released, are not a supply chain in the traditional sense. They are more like a mathematical formula that has been published in a journal. The weights are a specific instantiation of a function — a mapping from input tokens to output token probabilities — encoded in a set of floating-point tensors. Once that function is public, the question of “where did it come from” becomes irrelevant to its operational properties. You are not connected to Alibaba when you run Qwen locally any more than you are connected to a Chinese publisher when you use a Chinese-authored algorithm implemented in your own codebase.

The security argument for restriction requires you to believe that the weights themselves carry some form of hidden functionality — a backdoor embedded in the parameter tensor that activates under certain conditions to perform covert actions. This is a theoretically possible but extremely difficult-to-execute attack vector, and there has been no credible evidence presented that any major Chinese open-weight model contains such a backdoor. The research community would likely detect it; these models are studied intensively by academics and security researchers at universities and commercial AI safety organizations who have no particular incentive to protect Alibaba or DeepSeek’s reputation and every incentive to publish significant security findings.

There is a separate and more credible argument about model behavior — whether open-weight Chinese models exhibit systematic biases or refusals on topics that the Chinese government finds sensitive. This is verifiable and has been studied. Qwen models do show refusal behavior on topics like Tiananmen Square and certain Taiwan-related queries in their default configurations, even in the international versions. But this is a content moderation policy choice embedded in the model’s training data and RLHF stage, not a security backdoor. It is visible and auditable by anyone who wants to test it. Derivative fine-tuned versions without these restrictions are widely available, and organizations with specific requirements can fine-tune the weights themselves to adjust this behavior.

What Should Actually Be Done

The policy debate here is being framed as a binary: either ban Chinese open-weight models or allow them unrestricted. That framing is wrong, and it produces bad options on both sides.

A more coherent approach would differentiate by deployment context. Using Qwen weights to run a customer service chatbot for a consumer fintech app is categorically different from using those weights in a defense contractor’s code review pipeline with access to sensitive systems. The first case presents essentially no risk that a reasonable policy framework should care about. The second case presents real questions about supply chain auditing that defense procurement rules already have mechanisms to address — the Defense Federal Acquisition Regulation Supplement already requires contractors to disclose software supply chain elements, and extending this to AI model origins is straightforward in principle.

The appropriate policy response looks something like this: maintain existing restrictions on GPU exports to China, which constrain their ability to train future frontier models at scale; require documented supply chain auditing for AI models used in sensitive government and defense contexts through existing procurement frameworks; invest in domestic open-weight model development through DARPA programs, NSF grants, and direct funding to national laboratories; and leave the commercial and startup ecosystem to make its own cost-benefit decisions about model selection.

This approach would actually advance the goals the policy proponents claim to care about — maintaining American AI leadership, protecting sensitive government systems, ensuring supply chain resilience — without destroying the economics of the domestic startup ecosystem that is doing the actual building. The founders who signed the letter want to keep access to tools they depend on. The appropriate response to that legitimate interest is not “too bad” but rather “here is how we distinguish your use case from the genuinely sensitive ones.”

The GPU export controls are actually working in the way semiconductor-level restrictions can work. Nvidia’s H100 and H800 chips, and their successors, remain restricted in export to China. Chinese labs are training on older hardware at higher cost and lower throughput than their American competitors. That constraint is real and accumulates over time. Extending the same restriction logic to software weights that are already globally distributed is not the same kind of policy — it is a different intervention on a different technology layer, and the enforcement mathematics are completely different.

The Deeper Problem: Policy Is Chasing Technology at the Wrong Speed

I have been in engineering long enough to have watched several cycles of this dynamic. A technology emerges that has both commercial utility and perceived national security implications. Policy makers, working with mental models inherited from hardware and physical supply chains, attempt to apply those models to software. The models do not fit. The resulting policies create compliance costs without achieving security objectives. The technology continues to propagate through channels the policy did not anticipate.

This happened with cryptography export controls in the 1990s, where the U.S. spent years trying to prevent the export of strong encryption algorithms that were already available in published academic papers and implemented in open-source software globally. Phil Zimmermann’s PGP was technically under investigation for export violation while the underlying RSA algorithm was being taught in university computer science courses worldwide. The controls eventually collapsed because they were unenforceable, and the U.S. ended up liberalizing crypto export rules in 2000 — too late to prevent the damage to American credibility in the global software market and too late to prevent the proliferation of strong encryption everywhere anyway.

It happened with drone technology, where export restrictions on American consumer drones effectively handed the consumer and commercial drone market to DJI while doing nothing to prevent other countries from acquiring the underlying hardware and software. DJI now holds roughly 70% of the global consumer drone market. American companies that might have competed in that space faced compliance complexity that Chinese competitors did not. The restrictions protected no meaningful security interest while eliminating the domestic industry they were ostensibly meant to protect.

The specific failure mode with open-weight AI models is that the policy imagines a clean distinction between “Chinese AI” and “American AI” that the actual technology does not support. DeepSeek’s architecture borrows from transformer improvements published by researchers at Google Brain, Meta AI, and academic institutions worldwide — researchers who published their work in open venues precisely because they believed in the free exchange of scientific ideas. Qwen’s training methodology draws on RLHF techniques developed primarily at American labs and described in papers that Alibaba’s researchers read and built upon. American frontier models, in turn, are trained on data that includes substantial amounts of content created by Chinese researchers, engineers, and writers. The idea of cleanly national AI, suitable for export-control-style restrictions, does not correspond to how this technology actually develops.

The founders who signed that letter are correct that a ban would be economically disruptive and technically ineffective. What would help more than a ban is sustained investment in domestic open-weight model development, which currently lags the Chinese open-weight ecosystem on cost efficiency even when capability is comparable. Meta’s Llama program is the most serious American effort in this space, and it is genuinely excellent work. But it needs more competition from domestic players — AI2, EleutherAI, and others — and it needs business models that make self-hosted inference economically attractive for startups at the cost level that Qwen and DeepSeek have established. Import restrictions that paper over the gap without closing it serve neither commercial interests nor genuine national security.

What This Looks Like From Inside a Startup

Let me make this concrete from an operational perspective. Imagine you are running a legal tech startup building automated contract review. Your system needs to extract clauses, identify risks, summarize obligations, and flag unusual terms. You are processing thousands of contracts per month. Your unit economics depend on inference cost per document.

At GPT-4o pricing, a typical contract review workflow might cost $0.80–$1.50 per document in inference. At Qwen2.5-72B pricing through a commodity inference provider, the same workflow costs $0.08–$0.15. That difference compounds into your gross margin, your ability to price competitively, your runway, and ultimately your probability of reaching profitability before your next fundraise.

The contracts being processed contain confidential business information. You have correctly identified that you should not send client documents to a Chinese cloud API that might be subject to government data requests. You have solved this problem by self-hosting the Qwen weights on your own cloud infrastructure — AWS or GCP, fully under your control, with no network connection back to Alibaba. The weights are a local asset. The inference is running on your own GPU instances. The data never leaves your network perimeter.

Under the proposed policy, your solution — which is the correct security solution — becomes non-compliant. You would be required to switch to a model without Chinese-origin weights, accepting a 5–10x cost increase that may make your business model unviable, or demonstrating through a compliance process that your self-hosted deployment does not create the risks the policy is designed to address. The compliance process, if it exists at all, would likely be designed for large contractors, not for a 15-person Series A company.

This is the actual scenario the founders are describing. It is not hypothetical. It is the specific decision calculus that their engineering and finance teams have already made, which the policy would retroactively invalidate.

Falsifiable Predictions

Let me put some specific claims on record that can be checked over the next 12–18 months.

First: if any form of U.S. restriction on Chinese open-weight model weights is implemented, Chinese models will remain accessible to American developers through European mirrors and inference providers within 60 days of any effective date. The compliance burden will fall primarily on large companies with legal teams, while individual developers and small startups continue accessing the models through non-U.S. channels. This is the same pattern we saw with VPN usage following various internet restriction attempts — the friction increases but the access does not stop for anyone sufficiently motivated to work around it.

Second: DeepSeek will release a model that matches or exceeds GPT-4o-class performance on at least three major benchmarks before the end of 2026, regardless of what happens with export controls on weights. The capability development trajectory is already established and does not depend on access to American model outputs at this stage of development. The distillation-as-dependency theory will be empirically refuted by the models themselves within the policy’s own timeframe.

Third: if the U.S. does not implement restrictions on open weights and instead invests in domestic alternatives at scale, at least one American company or research organization will release a commercially viable open-weight model at Qwen-class inference cost efficiency within 18 months. The capability gap on cost efficiency is a business model and infrastructure problem, not a fundamental technical barrier. The outcome depends heavily on whether frontier American labs see strategic value in the open-weight space rather than protecting their API revenue, which is currently uncertain.

Fourth: the specific models being debated in this policy discussion — Qwen2.5, DeepSeek-V3, DeepSeek-R1 — will be largely superseded by next-generation releases from both Chinese and American labs within 12 months. The policy is debating a snapshot of the technology that will have moved substantially by the time any regulatory process reaches implementation. Whatever restrictions are implemented will be regulating yesterday’s models while the frontier has moved on. This is not a criticism of the people designing the policy; it is a structural feature of regulating a technology that advances faster than any policy process can track.

The right call is to let the market work in the commercial sector, invest in domestic alternatives, and reserve regulatory intervention for the specific contexts — defense, intelligence, critical infrastructure — where the actual security calculus justifies the compliance cost. That is not the blanket ban being proposed. It is not the all-or-nothing binary the debate has settled into. But it is what the engineering situation actually calls for, and it is what 700 startup founders are trying to say when they write letters to an administration that may not have the technical background to hear what they are actually saying.