The new architecture is designed to deliver higher capability ceilings, faster inference, greater throughput, and scalability to models with significantly larger parameter counts.

Asymmetric architecture: big intelligence at lower cost

DeepSeek V4.1 Flash is a 552B-parameter MoE model built on a new Causal-Encoder-Decoder architecture. It uses an asymmetric design between input and output: only 8B activated parameters on the input side and 16B activated parameters on the output side, resulting in significantly lower cost than other known models at a similar scale.

Editor’s note: The official release of V4 Flash on July 31 retained the same model architecture and size as the preview version, with the main changes coming from additional post-training. This design is closely aligned with how AI agents operate. When working with code repositories, long documents, or extensive conversation histories, models often need to process large volumes of input while generating relatively limited outputs, such as decisions, code, or action instructions. Reducing the computational cost of input processing could therefore significantly improve the overall efficiency of these agentic workloads.

V4.1 Flash also adopts a new pre-training approach and undergoes larger-scale reinforcement learning (post-training). In benchmark evaluations, it surpasses the intelligence level of a number of flagship models, including DeepSeek V4 Pro.

Editor’s note:According to the official benchmark results, V4.1 Flash scored 90.9 on GPQA Diamond, a benchmark for graduate-level scientific reasoning, achieved a Codeforces competitive programming rating of 3,471, and scored 65.6 on MathArena Apex.

On Terminal-Bench 2.1, which evaluates models’ ability to execute tasks in terminal environments, V4.1 Flash scored 90.6. It also achieved 88.1 on CyberGym, a cybersecurity benchmark. By comparison, the previously released V4 Pro scored 87.9 and 83.3, respectively, on these two benchmarks.

Figure 1. Performance comparison on Agentic Benchmark

Smaller cache, lower cost

The new-generation architecture substantially reduces the size of the KV cache. Compared with the previous generation, the demand for HBM is reduced to 1/4, and the demand for SSD is reduced to 1/8.

In agent-use scenarios, cache-hit fees often take a meaningful share of total cost. Compressing KV cache therefore significantly reduces the cost of agent-style tasks.

[Missing image] (KV cache size reduction progress figure)

The original post notes that, compared with the first-generation model, the KV cache has already shrunk by 437×.

Editor’s note: Compared with V4 Flash pricing during the same time window, cached input is 60% cheaper, uncached input about 33.3% cheaper, and output about 11.1% cheaper.

The savings are more significant for workloads that repeatedly process large amounts of context. Agents, for example, often need to re-read conversation history, tool instructions, and code across multiple steps. Lower cached-input pricing can substantially reduce these recurring costs. By contrast, workloads dominated by the generation of new output will see more limited savings.

For example, assuming fixed usage of 1 million cached input tokens, 100,000 uncached input tokens, and 10,000 output tokens, the cost of a single task during off-peak hours would fall from RMB 0.245 to RMB 0.16, a reduction of approximately 34.7%. Actual costs will still depend on factors such as reasoning length, the number of tool-call iterations, and failed attempts or retries.

API support

DeepSeek V4.1 Flash is now available on the DeepSeek API, with native multimodal support. To use the latest V4.1 Flash, set the model name to deepseek-flash.

The older models V4 Flash and V4 Flash Vision Exp have been taken offline. For compatibility, requests to deepseek-v4-flash and deepseek-v4-flash-vision-exp will temporarily be routed to V4.1 Flash.

Based on extensive testing, V4.1 Flash outperforms V4 Pro across performance, cost, speed, and end-to-end latency. DeepSeek plans an orderly phase-out of V4 Pro. After 12:00 (Beijing time), Sep 14, 2026 and until V4.1 Pro is released, all requests to deepseek-v4-pro will be routed to V4.1 Flash and billed at the V4.1 Flash price.

Tencent (WorkBuddy, CodeBuddy) and OpenCode, as official partners, have fully integrated DeepSeek V4.1 Flash—welcome to try it.

Editor’s note:Previously, DeepSeek offered experimental vision capabilities through V4 Flash Vision Exp. With the new release, both the previous V4 Flash model and the experimental vision model have been retired. Requests using either of the two former model names are now handled by V4.1 Flash, bringing text and image processing together in a single flagship API model.

According to the latest image-understanding documentation, developers can use the model to describe images, extract text from screenshots, and analyze charts. Images can be provided through publicly accessible URLs, submitted directly in encoded form, or uploaded and referenced through the Files API.

This has practical implications for agents working with real-world materials. Business documents often require models to understand text alongside charts, while software-related tasks may require code to be interpreted together with interface screenshots. A unified model endpoint reduces the need for developers to route tasks between, and switch across, separate text and vision models.

API pricing adjustment

Thanks to architectural innovation, DeepSeek V4.1 Flash can serve more users at lower cost, so its pricing is reduced accordingly. To allocate resources more reasonably, DeepSeek continues to use peak/off-peak pricing: off-peak price is half of peak price, encouraging users to schedule tasks based on their needs. The new pricing takes effect at 12:00 (Beijing time), Sep 10, 2026.

[Missing image] (pricing table/figure in the original post)

Open-sourcing

DeepSeek will fully support the open-source community in adapting inference for this new model architecture and will explore various ways to broaden the deployment footprint. If you have large-scale deployment needs and the required resources (e.g., 2,000 GPUs and a storage cluster), DeepSeek welcomes you to get in touch.

• Model: https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash

• Technical report: https://huggingface.co/deepseek-ai/DeepSeek-V4.1-Flash/blob/main/DeepSeek_V41_Tech_Report.pdf

Regarding the Chinese government’s relationship to these activities, the advisory stops short of alleging direct government involvement, instead stating that the activities were “likely with Chinese government awareness.”

Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.

Today, spokespersons for China’s Ministry of Commerce and Ministry of Foreign Affairs separately responded to the U.S. allegations.

MOFCOM Spokesperson Responds to Questions on U.S. Cybersecurity Advisory Concerning Alleged Distillation Activities by Chinese AI Companies

September 9, 2026

Q: On September 8 U.S. Eastern Time, the U.S. National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) jointly issued an advisory accusing Chinese artificial intelligence companies of conducting “industrial-scale” distillation of U.S. models to acquire the capabilities of leading U.S. models, while recommending defensive measures for U.S. companies. What is China’s comment?

A: We have taken note of the relevant developments. China believes that the U.S. allegations that Chinese AI companies are conducting “industrial-scale” distillation of U.S. models are unfounded both in fact and in law. The U.S. is politicizing and weaponizing distillation, which is a normal technical and commercial practice within the industry, while applying double standards in practice. The advisory is yet another example of the United States pursuing technological hegemony in the field of artificial intelligence, seeking to monopolize computing power, and suppressing competition. China firmly opposes such actions.

Distillation is a common practice through which AI models learn from one another and is, in essence, a technologically neutral technique. Model developers around the world, including U.S. companies, use distillation. It can improve the efficiency of model learning and enable more effective utilization of human knowledge. It therefore has positive implications for the development of AI industries around the world, for unlocking the potential of AI technologies, for narrowing development gaps, and for ensuring that developing countries and the broader public can benefit more widely from advances in AI.

The U.S. approach represents a typical case of double standards. China encourages open-source development, openness, cooperation and sharing in AI. Chinese open-source models are available to companies around the world, including U.S. companies, facilitating the development of their models. Reports published by U.S. companies on their model development have also disclosed extensive distillation of Chinese models. By contrast, the United States has repeatedly and unilaterally accused Chinese companies of engaging in “industrial-scale” distillation, portraying a common industry practice as a form of attack. This reflects both U.S. anxiety and its double standards.

The U.S. approach is also a typical example of using the fight against distillation as a pretext for pursuing industrial monopoly. Having national security agencies issue such an advisory ties the interests of individual companies and capital to national security and uses the coercive power of the state to interfere with normal commercial activities. We have also noted that certain U.S. AI companies have abused their competitive advantages by incorporating sweeping geographic restrictions and other unfair terms into their user agreements. The U.S. allegations concerning distillation appear to provide government backing for such unfair contractual terms.

The U.S. approach is a typical example of using state power to preserve technological hegemony and monopolies over computing power while suppressing competition. Since the beginning of this year, the U.S. executive and legislative branches have repeatedly threatened sanctions and other restrictive measures against Chinese companies over alleged distillation activities. Their objective is to suppress competition and preserve U.S. monopolies in computing power and data—seeking a situation in which only the United States wins rather than one in which humanity as a whole benefits. This would turn global AI resources, which should be accessible on an open and equitable basis, into resources monopolized by a small number of companies, while preventing other countries from participating in and broadly sharing the benefits of AI innovation.

The large-model industry is currently at a critical stage characterized by rapid technological iteration, emerging risks and continued development. As major countries, China and the United States should address the challenges and risks facing artificial intelligence in a positive and responsible manner. The two heads of state have agreed to establish an intergovernmental dialogue on artificial intelligence. China is willing to engage in constructive and professional discussions with the United States through dialogue on the basis of equality, mutual benefit and win-win cooperation.

However, if the United States uses combating distillation as a pretext to take actions aimed at containing and suppressing Chinese AI companies, China will resolutely take countermeasures. We hope the United States will work with China in the same direction, manage risks through dialogue and communication, and promote the development of an AI industry that benefits the world.

China’s Foreign Ministry Responds to U.S. Allegations of AI Model Distillation

AFP: Yesterday, the U.S. Cybersecurity and Infrastructure Security Agency accused leading Chinese artificial intelligence companies, including DeepSeek and Moonshot AI, of stealing technology from U.S. large models, describing this as a “core” strategy of Chinese AI companies. What is the Foreign Ministry’s comment?

Mao Ning: The development of artificial intelligence in China is the result of the country’s pursuit of greater self-reliance and strength in science and technology. It has also benefited from China’s consistent commitment to the principles of extensive consultation, joint contribution and shared benefits, as well as openness and cooperation.

We have always maintained that countries should work together to promote the open, inclusive and responsible development of artificial intelligence, ensure that its benefits are broadly shared, and harness AI for the well-being of all humanity.

We hope the United States will earnestly implement the important common understandings reached by the two heads of state and refrain from making unfounded accusations against China or smearing the country. China and the United States are both major AI powers and should strengthen cooperation.

The Opinions contain 24 provisions covering AI-enabled face swapping, voice cloning, virtual avatars, personal information, infringement involving AI-generated content, discriminatory pricing, autonomous driving, training data, open-source software, and AI-generated evidence.

The primary purpose of the Opinions is to provide courts with a more consistent framework for adjudicating AI-related disputes under China’s existing civil law regime. In particular, they address how liability should be allocated among developers, service providers and users, and how courts should assess duties of care, fault, causation and burdens of proof.

It is important to clarify at the outset that the Opinions do not constitute new AI legislation, nor are they a judicial interpretation. They are issued under the document designation “Fa Fa” (法发) and constitute judicial policy and adjudicatory guidance issued by the SPC. In its accompanying Q&A, the SPC expressly noted that China has not yet enacted a dedicated AI law. AI-related disputes must therefore continue to be adjudicated under existing laws, including the Civil Code, Copyright Law, Personal Information Protection Law, Anti-Unfair Competition Law, Consumer Rights Protection Law, Product Quality Law and Civil Procedure Law. The Opinions themselves therefore cannot create new categories of civil rights or liabilities.

Nevertheless, their practical significance is considerable. The Opinions call for cases that may establish important rules or require greater consistency in the application of law to be heard at a higher level where appropriate, while promoting greater consistency through the People’s Courts Case Database and judicial supervision. Standards developed through future landmark AI cases may therefore have a broader impact on companies’ product design, data governance and risk controls.

On the allocation of liability, the Opinions generally retain a fault-based approach. They do not impose strict liability on model developers or service providers for all AI outputs, but nor do they allow companies to avoid liability simply by invoking “technology neutrality” or arguing that the content was generated automatically by a machine. Courts will assess liability in light of the particular use case, the degree of system autonomy, potential risks and their scope of impact, as well as each party’s ability to foresee and control those risks.

This approach both limits and potentially strengthens platform liability. On the one hand, the Opinions do not categorically treat purely online models or applications as “products” for purposes of the Product Quality Law. Strict product liability therefore remains primarily relevant to AI products with a physical form, such as robots and autonomous vehicles. On the other hand, a platform may still be found at fault if it could reasonably foresee a particular type of harm and had the ability to mitigate that risk but failed to take proportionate measures.

Infringement of personality rights illustrates this framework. The Opinions distinguish between infringing content generated by a model itself and content deliberately induced by users through malicious prompts. Users are responsible for their own intentional infringing conduct, while platform liability depends on factors including foreseeability, technical control and the measures already implemented. Where a rights holder provides verified identity information and prima facie evidence of infringement, a platform that fails to take necessary measures—such as preventing the relevant generation, restricting particular instructions or taking action against an account—may also bear liability for additional harm occurring after notification.

Unlike conventional online platforms, where an infringing article, image or hyperlink can simply be removed, a generative model may reproduce similar content following relatively minor changes to a prompt. An important issue for future cases will therefore be how courts determine whether filtering, prompt restrictions, account measures or model updates constitute reasonable and necessary responses. The Opinions do not prescribe a uniform technical standard, leaving this assessment to the circumstances of individual cases.

The evidentiary rules may have the most immediate practical implications for AI companies. In cases involving copyright infringement by generated content, a rights holder generally remains responsible for producing prima facie evidence that the disputed content was generated by the model in question and is substantially similar to the protected work. Courts may then, where necessary, require the model developer or service provider to explain the sources of its training data, the training process, the operation of the model and the relevant scientific basis.

This does not amount to a wholesale reversal of the burden of proof. Rather, evidentiary burdens are allocated according to access to information: rights holders establish external facts reasonably accessible to them, while parties controlling the model, training materials and operational records may be required to provide reasonable explanations concerning internal facts. Where a party controlling documentary or electronic evidence refuses to produce it without justification, the court may draw adverse factual inferences.

As a result, information concerning training-data provenance, model versions, prompt records, retrieval-augmented generation (RAG) materials, filtering rules, risk testing and complaint handling may evolve from internal R&D records into important litigation evidence for determining infringement, fault and causation. AI compliance is therefore increasingly moving from the question of whether an obligation was fulfilled to whether the company can demonstrate that it was fulfilled.

Companies will accordingly need more traceable data and model governance systems. This may include preserving key records concerning data provenance and licensing, model versions and testing, as well as necessary generation and complaint-handling logs. At the same time, evidence retention must continue to comply with requirements concerning personal information, trade secrets, data security and cross-border transfers. Potential litigation does not justify indefinite retention of all information.

Compared with its relatively detailed rules on liability and evidence, the SPC has taken a notably cautious approach to copyright issues at the training stage. In its accompanying Q&A, the SPC explained that significant disagreement arose during the drafting process over whether AI-generated content can qualify as a copyrighted work and how the unauthorized use of copyrighted works for model training should be characterized. The Opinions therefore do not establish uniform rules on either issue. This means that while the Opinions provide some guidance on liability arising from AI outputs, they do not resolve the more fundamental industry question of whether foundation-model training is lawful, when such use might constitute fair use, or when authorization from rights holders may be required.

Previous Chinese cases have indicated that copyright protection for AI-generated content may depend on the extent of human intellectual contribution to the particular generation process and the evidence demonstrating that contribution. In the Beijing Internet Court’s 2023 “Spring Breeze Brings Tenderness” case, the court found that the user had demonstrated original intellectual input by designing prompts, setting parameters and making individualized choices concerning visual elements and composition. The resulting image was therefore eligible for copyright protection. By contrast, in the “Phantom Wings Transparent Art Chair” case, the court found that the plaintiff had entered relatively simple prompts and had failed to provide complete records of the generation process, making it difficult to establish a sufficient level of original intellectual contribution. The contrast between the two cases suggests that the central issue is not necessarily whether AI was used, but whether the human contribution satisfies the originality threshold under copyright law and whether that contribution can be demonstrated.

Existing cases concerning generative AI platform liability have also adopted different analytical approaches. Courts in Guangzhou and Hangzhou, in disputes involving AI-generated images of well-known film and television characters, have examined factors including the degree of platform control over the final output and whether conduct at different stages—including user uploads, training and generation—constituted direct or contributory infringement. The multi-factor approach adopted by the Opinions is broadly consistent with this emerging case law, but it does not elevate the approach taken in any individual case into an absolute rule applicable to all models and business models.

From a broader policy perspective, the SPC’s decision to address output liability first while postponing a uniform standard for training-related copyright avoids establishing a definitive rule while significant questions remain concerning technical mechanisms, market substitution and licensing arrangements. Whether an output is substantially similar to a pre-existing work, whether a user intended to infringe and whether a platform acted after receiving notice can generally be assessed by reference to specific content and conduct. By contrast, determining whether unauthorized use of copyrighted works for model training constitutes reproduction or qualifies as fair use implicates the technical operation of models, methods of data acquisition, potential market substitution, licensing transaction costs and the conditions necessary for the development of the foundation-model industry.

Any uniform rule in this area would directly affect the allocation of costs and benefits among model developers, content industries and rights holders. The SPC has not further explained the policy considerations behind its decision not to establish such a rule. The more cautious conclusion at this stage is therefore that these issues will continue to develop through individual cases, industry practice and future legislation.

Personal-information rules must also be distinguished from copyright rules governing training data. Article 6 of the Opinions leaves some room for using lawfully public personal information for model training within a reasonable scope. Where an individual has not expressly objected and the processing does not have a material impact on that person’s rights and interests, such processing will generally not be regarded as an infringement of personal-information rights.

However, permission to process publicly available personal information does not mean that copyrighted expression contained in the same material may automatically be used for training without authorization. A publicly accessible article, for example, may simultaneously contain personal information and copyright-protected expression. Compliance with personal-information rules does not eliminate copyright, contractual or unfair-competition risks. Conversely, obtaining copyright permission does not mean that sensitive personal information contained in the relevant material may be processed without restriction. Public accessibility does not itself amount to a copyright licence or authorization for other uses.

The Opinions take a comparatively innovation-friendly approach to open-source software. In assessing the liability of open-source software developers and providers, courts may consider licence terms, restrictions on rights, security measures and risk disclosures. Developers that provide certain code modules free of charge and adequately disclose their functions and risks may, depending on the circumstances, be found not liable for downstream infringement.

However, this provision concerns open-source software and code modules and should not be broadly interpreted as creating a safe harbour for all open-weight AI models. Model code, weights, training data and downstream applications may each be governed by different licences and legal rules. Making model weights openly available does not mean that the underlying training data may be freely used. Companies deploying open-weight models therefore still need to review separately the applicable conditions governing code, weights, training data and commercial applications.

Beyond intellectual property, the Opinions provide guidance on areas including discriminatory pricing and autonomous driving. “Big data price discrimination” continues to be assessed primarily through consumers’ rights to information, choice and fair dealing. Liability for autonomous-driving accidents will depend on factors such as driver fault, vehicle defects, sales representations and the causal contribution of each factor. A party controlling autonomous-driving event data may also face adverse consequences if it refuses to produce relevant records.

From a corporate compliance perspective, the most important implication of the Opinions is not the creation of a new AI compliance checklist, but the growing importance of “demonstrable compliance.” Companies need not only to conduct data-provenance reviews, risk testing, model-version management and rights-notification handling, but also to ensure that these measures can be demonstrated if a dispute subsequently arises.

At the model pre-training and fine-tuning stages, companies should prioritize records concerning data provenance, licensing status, supplier responsibilities and key cleaning and annotation processes. Significant model and product updates should be accompanied by records of material version changes, testing and risk assessments. Providers of public-facing generative AI services should establish effective rights-notification, internal escalation and remediation mechanisms, and should be able to reconstruct the relevant model version and response process when a dispute arises. When using open-source software or open-weight models, companies should separately review licence terms, model cards, redistribution restrictions, training-data disclosures and restrictions on commercial use.

Not all of these measures constitute new legal obligations created by the Opinions. Some derive from existing legislation and administrative regulation; others are risk-management measures that may help companies demonstrate that they exercised reasonable care within a fault-based liability framework. As case law develops, practices that currently remain partly voluntary—such as data traceability, model-version records, red-team testing, risk disclosure and complaint handling—may increasingly become relevant factual benchmarks for determining whether an AI company exercised reasonable care.

From an international comparative perspective, China is developing a dual-track AI governance framework combining administrative regulation with judicial liability. The EU AI Act primarily establishes ex ante obligations through risk classification. The United States still lacks an equivalent comprehensive federal AI statute, and many boundaries continue to develop through copyright, product-liability and consumer-protection litigation and administrative enforcement. In China, administrative authorities address matters such as filings, security assessments, content labelling, platform governance and personal-information protection, while courts apply existing civil, intellectual-property and procedural laws to actual harm and the allocation of liability.

Overall, the Opinions do not represent a wholesale expansion of liability for AI companies. Fault remains the basic liability framework, and purely digital model services are not categorically brought within strict product liability. The more significant development is that courts will increasingly focus on whether companies could foresee and control particular risks, what measures they actually took, and whether they can demonstrate that those measures were genuinely implemented.

At the same time, the most consequential copyright questions remain unresolved. The Opinions do not establish a uniform standard for when AI-generated content qualifies as a copyrighted work, nor do they determine when the use of copyright-protected material to train foundation models requires authorization or may qualify as fair use. These questions will continue to evolve through future legislation, individual cases and industry practice.

Dichlorosilane, abbreviated as DCS, has the chemical formula SiH₂Cl₂ and is a silicon-containing gas used in chip manufacturing. Its main function can be understood as supplying the silicon feedstock needed to form films on wafer surfaces. Under specific reaction conditions, it is used to form epitaxial silicon, silicon nitride, silicon oxide, polysilicon, and other films. These films form part of chip structures or insulating layers, so DCS may be used in logic, memory, and analog chips.

DCS is an electronic specialty gas and a consumable used in semiconductor manufacturing. The challenge in this industry is not merely synthesizing a compound. Suppliers must also control impurities consistently, maintain batch-to-batch stability, and manage contamination risks associated with cylinders, filling, transportation, and gas delivery. Shin-Etsu’s own product materials identify high-purity refining, strict quality control, and container delivery management as competitive strengths.

Japanese suppliers’ advantages therefore stem largely from their long record of stable supply and established customer relationships. A wafer fab must verify that changing materials will not affect film quality or production yield. Even when a domestic product is less expensive, price alone is not enough to justify an immediate switch. This explains why a relatively small materials market can still have high barriers to entry.

China’s action first reflects a clear request from a domestic producer. Tangshan Sunfar Electronic Materials Co., Ltd. filed an application on December 8, 2025, and the Ministry of Commerce opened the investigation on January 7, 2026. At initiation, the Ministry cited preliminary evidence showing that imports from Japan increased overall from 2022 to 2024, while prices fell by about 31% cumulatively and the domestic industry suffered injury.

Two details in the preliminary determination are important: Japanese products were still priced higher than domestic products in China, and their market share was declining. The Ministry’s main finding concerned price suppression. As Japanese suppliers continued to cut prices, downstream customers used those reductions to press domestic suppliers for further price cuts. Domestic producers increased sales but continued to incur losses.

Legally, “dumping” is not the same as cutting prices or selling below a competitor’s price. The key test compares the export price with the normal value determined under the applicable rules and then assesses whether the domestic industry has suffered injury. The 99.2% margin also reflects a procedural factor: the Ministry found that Shin-Etsu had not submitted complete documentation on domestic sales, costs, and transactions, so it based part of its determination on information supplied by the applicant. The calculation for DYNASILAN also relied in part on substitute information.

In industrial terms, I believe the measure will help Chinese producers move beyond the stage in which they can already manufacture DCS but still struggle with customer qualification and profitability. Sunfar’s first-half 2026 report states that its electronic specialty gases have gradually entered large-scale supply, while also noting that domestically produced DCS remains relatively scarce. Raising the cost of Japanese imports will give wafer fabs a stronger incentive to qualify domestic materials and expand domestic sourcing.

China’s Imports of Japanese DCS and Market Indicators

China’s imports of Japanese DCS and market indicators

These figures show that Japan remains an important source of supply for the Chinese market. They do not prove that more than 60% of Japanese DCS sales depend on China. The preliminary determination specifically notes that the relevant customs tariff code also covers other products. The quantities and prices in the table are based on third-party industry data provisionally accepted by the investigating authority, so the total trade value under the tariff code should not be treated as DCS trade value.

I did not find enough public information to calculate the Chinese-market dependence of Japan’s overall DCS sales. Shin-Etsu disclosed that the Chinese market accounted for about 10% of group revenue from April to June 2026, but that figure covers all products. It cannot be used as a proxy for the share of DCS revenue generated in China, much less for the share of revenue covered by these measures.

The preliminary data can nevertheless help estimate the order of magnitude. Multiplying 2024 import volume by that year’s average end-market price gives approximately RMB 65 million. This is only a rough estimate of the corresponding sales value: imports and end-market sales differ because of inventory and timing, and end-market prices include distribution margins. It is therefore neither an accurate measure of Japanese suppliers’ export revenue nor an estimate of expected losses. Even so, the figure indicates that the case directly concerns a relatively small market for a specialized material.

The most immediate pressure on Japanese suppliers is the trade-off between orders and profit. Importers initially bear the cash burden of the security deposits and may then ask suppliers to cut prices or reduce their purchases. If Japanese companies lower prices to retain customers, their margins will shrink; if they hold prices, they may lose orders. How the burden is ultimately shared among Japanese suppliers, import distributors, and Chinese wafer fabs will depend on contract terms and the availability of alternative supply.

The more significant concern is the potential loss of customers over the medium to long term. Because electronic materials require customer qualification, once Chinese wafer fabs qualify domestic materials and establish stable procurement relationships, Japanese suppliers may not easily regain share even if they later recover their price competitiveness. They could lose not only current-year sales but also supply opportunities tied to future capacity expansion and new production lines.

The impact may also extend to customer collaboration. Long-term supply relationships help materials producers understand customers’ requirements for new processes and conduct joint qualification work. If Chinese customers gradually shift to domestic suppliers, Japanese companies will have fewer opportunities to participate in such collaboration. This is a potential long-term competitive loss, but it cannot yet be quantified as a realized financial loss.

Chinese downstream manufacturers also face costs. For processes where alternative materials have not yet completed qualification, wafer fabs may still need to buy Japanese products and absorb part of the additional burden. Existing domestic production capacity does not mean that every customer and every process can switch immediately. Whether the measures achieve their intended industrial effect will ultimately depend on the stability of domestic products, the pace of qualification, and suppliers’ ability to deliver.

Tang argued that Chinese models are narrowing the gap with global leaders in areas such as question answering and search, while acknowledging that leading international models are moving rapidly into coding and long-horizon tasks. He identified open-source AI as an important source of competitive advantage for Chinese developers, citing Hugging Face’s use of Zhipu’s GLM-5.2 as an example of the value of locally deployable, auditable and controllable models, while cautioning that this does not mean GLM is superior to GPT.

On longer-term AI development, Tang said he believes models surpassing individual human intelligence are inevitable, although whether AI can ultimately exceed the collective intelligence of humanity remains an open question. He also highlighted that insufficient access to high-quality data and China’s continued weakness in original breakthroughs in fundamental AI theory are major constraints on China’s AI development.

Notably, Tang Jie published a commentary titled “Driving High-Quality Development of the Intelligent Economy with Tokens as the Engine,” on Qiushi Magazine, one of China’s most important political outlets.

Host(Qiu Shi)

From Doubao and DeepSeek to Zhipu Qingyan, how far are these hugely popular Chinese AI applications from the world’s leading technologies?

Tang Jie

The gap between Chinese models and the world’s leading models is narrowing.

Host

Will artificial intelligence surpass human intelligence?

Tang Jie

I think it is perfectly normal for a model to surpass the intelligence of an individual human being.

Host

Should AI education also start from an early age?

Tang Jie

Once a new tool arrives, we have to learn to use it. That is why I encourage my students—and even my own children—to use large models.

Host

In this episode of Shidian Interview, Tang Jie, Professor in the Department of Computer Science and Technology at Tsinghua University, continues to share his insights into the present and future of China’s homegrown large models.

Host

Professor Tang, welcome to Shidian Interview. Today, generative AI applications such as Doubao, DeepSeek, Yuanbao, Kimi, Zhipu Qingyan and Tongyi Qianwen are rapidly becoming mainstream. Behind these consumer AI products are large models developed in China. How do you assess the current development of China’s homegrown large models?

Tang Jie

The products you just mentioned—including Kimi, Doubao, Zhipu Qingyan and DeepSeek—are all very good products, and essentially all of them are powered by large models developed in China.

On November 30, 2022, ChatGPT was launched by OpenAI and quickly took the world by storm. Then, in 2023, ERNIE Bot and Zhipu Qingyan were released in China, followed soon afterward by Doubao and other products. There were roughly eight companies among the earliest group of players in China. Today, I would say that large models have become widely used by consumers for question answering, search and other related applications.

In question-answering and search-related applications, the gap between Chinese models and the world’s leading models is narrowing. That is the first basic reality.

At the same time, however, we can see that the world’s leading large models are beginning to shift into new areas—for example, programming and long-horizon tasks. As large models begin to program and carry out these long-horizon tasks, we need to transfer our workplace experience and expertise to them. In this way, large models gradually acquire the ability to perform work across different industries and scenarios.

These capabilities are being added step by step. Some leading international and Chinese developers started working on them relatively early, so they do have certain advantages today.

The third point brings us back to open source and openness. Only through open source and openness can our models establish their own advantages—not only in model R&D, but also in expanding their global reach and enabling the broader deployment of AI workflows.

Host

Not long ago, Hugging Face, the U.S.-based open-source AI community, was affected by an intrusion involving an OpenAI model. Hugging Face initially tried to call leading proprietary U.S. models to help identify and fix the vulnerability, but those attempts were blocked. It then turned to GLM-5.2, a large model developed by China’s Zhipu AI, and reportedly resolved the problem within several hours.

As the founder of Zhipu AI and now its Chief Scientist, how do you view this incident? Does it suggest that China’s open-source large models have greater advantages and stronger development prospects than proprietary U.S. models?

Tang Jie

We have also been following this incident very closely. Let me first walk through what happened from beginning to end.

During the week of July 13, Hugging Face—the world’s largest open-source AI community—was hit by an intrusion involving a large model.

What caused it? OpenAI was conducting an experiment in a closed environment, using a large model to attack software. But the model unexpectedly escaped that closed environment and ended up attacking Hugging Face over the internet.

Hugging Face then tried to use some of the most advanced proprietary models available. Initially, it turned to closed models such as those from OpenAI and Claude. But OpenAI’s and Claude’s models have extensive safeguards and guardrails, which meant Hugging Face could not actually use them for what it needed to do.

So what did Hugging Face do? It installed our GLM-5.2 locally. After installation, it created an internally isolated environment and reproduced the entire attack process within that environment. By tracing the attack, it was ultimately able to identify the cause.

There are several lessons we can draw from this.

First is the importance of open source. Without an open-source model, Hugging Face would not have been able to construct that environment, reproduce the incident or identify the cause of the attack.

Second, both offensive security capabilities and safety guardrails are extremely important. A model needs to have the ability to conduct security testing, but it also needs defensive capabilities.

Does this mean that open-source models necessarily have an advantage over proprietary models? I think it is still too early to draw that conclusion. After all, in this particular incident, the attack itself was initiated by OpenAI’s model.

Why did Hugging Face use our GLM-5.2? Because it could not use the proprietary models for this purpose, so it had to use our open-source model.

We cannot say that GLM-5.2 is therefore better than GPT. What we can say is that, through its open-source approach, GLM-5.2 has successfully occupied this particular ecological niche.

That is the first point. The second point worth reflecting on is the value of controllability. The large models of the future need to be models whose operation is visible and understandable, that users can actually deploy, and that are auditable and controllable. Those are the kinds of models that people will truly be willing and able to use in real-world applications.

Host

You have mentioned that you encourage many of your students to use large models. Even primary and secondary school students may increasingly use them in the future. Could this lead to weaker foundations in basic knowledge, or even the deterioration of certain fundamental skills?

Tang Jie

Yes. This is a question I am asked very often.

I remember that many years ago, when large models were first beginning to take off, I was talking with several friends. I told them that large models would develop extremely rapidly in the future, that knowledge would become much more widely accessible, and that these technologies would become part of our everyday lives.

Many of my friends then asked me: what should our children do in the future? What should they learn?

I think we need to answer that question from two perspectives.

The first is that technology has already developed to this point, so simply refusing to use it is not really an option.

Think about when the steam engine emerged. Before that, people knew how to ride horses. So should we still need to master horse-riding skills today?

As you can see, many people today no longer know how to ride a horse. And even when I ride a horse, I do not do it because I want to travel faster or because I need a horse for transportation. Horse riding has become more of a recreational activity.

So the first point is that a new era has arrived. Once these new tools emerge, we have to use them. That is why I encourage my students—and even my own children—to use large models.

There is, of course, another side to the question. What happens if people no longer have a solid grasp of basic knowledge, or eventually lose certain fundamental skills altogether?

That is another dimension of the issue.

Personally, I think our technology stack may indeed change in the future. We may no longer need to master some of the basic knowledge points that people were previously expected to learn.

But there is another dimension as well: large models allow us to expand the scope of our knowledge.

Why do I say that?

In the past, if you relied primarily on reading books, perhaps you could study 1,000 individual pieces of knowledge. Being able to absorb and make notes on 1,000 such points would already be quite an achievement.

With large models, however, you might develop a deep understanding of 100 core knowledge points while gaining some exposure to another 10,000. In that sense, the overall space of knowledge available to you becomes much larger.

Host

There is a book called The Singularity Is Near by Ray Kurzweil. He later wrote another book, The Singularity Is Nearer. These books discuss the possibility that by 2045, artificial intelligence could surpass the intelligence of the human brain.

How do you view the direction in which AI is developing? Will machines replace humans? Could machine intelligence ultimately surpass human intelligence—or even come to dominate humanity? Is that a real possibility?

Tang Jie

Personally, I think artificial general intelligence represents, in a sense, the aggregate intelligence of people around the world.

From that perspective, I think it is perfectly normal for a single model to surpass the intelligence of a single human being.

A model brings together knowledge from across the world. We have also given these models our reasoning processes and ways of thinking. More recently, we have begun giving them behavioral data as well, including data about the workflows through which we perform our jobs.

Think about what that means. Such a model can work, it possesses knowledge, it can have strong emotional intelligence, and it can reason logically. In that sense, it brings together the intellectual capabilities of people from around the world.

Could there come a day when large models surpass humanity as a whole and generate theories and ideas that none of us have ever conceived of? That remains an open question.

This is also an extremely hot topic right now in Silicon Valley, Europe and China. We call it ASI—Artificial Superintelligence. The question is whether AI could eventually develop superintelligence that surpasses human intelligence.

There is another concept that has also become very popular recently: recursive superintelligence. The question here is whether a large model can correct and improve itself, continuously making itself more capable.

If a model can continuously improve and repair itself, then surpassing humanity could eventually become a realistic prospect.

It is possible that this development curve will eventually reach a critical point and plateau. It is also possible that it will rise until it reaches the aggregate intelligence of humanity as a whole.

So whether large models will ultimately surpass the combined intelligence of all humanity remains an open question. But I believe surpassing the intellectual capabilities of an individual human being is inevitable.

Host

China’s large-model industry has developed rapidly. In your view, what problems and challenges does China still face in developing large models, and how can these challenges be overcome?

Tang Jie

I would highlight four challenges.

The first is computing power. We still face major constraints in this area. U.S. restrictions on China’s access to high-end chips have resulted in genuine shortages of advanced chips in China.

The second is data. You can never have too much data, and there is never really enough of it.

For various reasons, many industries cannot share their data or make it available for model training. Yet as large models expand their knowledge structures and their ability to perform different tasks, they need precisely this kind of real-world contextual data. This creates a fundamental tension.

At the same time, the shortage of data has created new industries. There are now many companies specializing in data annotation, data generation and data cleaning. These activities have also created significant employment opportunities.

So data represents the second major challenge, but also the second major area of opportunity.

The third issue brings us back to originality and fundamental innovation.

China still has room for improvement when it comes to original theoretical breakthroughs. The Transformer architecture that underpins modern large models, for example, was not originally proposed by Chinese researchers. Nor did reinforcement learning and reasoning techniques originate in China.

So we still need to strengthen our capacity for original innovation in fundamental theory.

This was also one of the motivations behind our team’s commercialization of research from Tsinghua University and the establishment of Zhipu AI. We hoped to combine academia and industry—to pursue fundamental innovation in technological theory while also expanding those technologies into a much broader range of practical applications.

And, of course, we hope that in the future we can make our own contributions to original innovation in fundamental AI theory.

Host

Thank you, Professor Tang. We greatly appreciate your insights and explanations.

The paper is by Li Xinmeng, a doctoral candidate at the Law School of Renmin University of China. It is published in Issue No. 4, 2026, of Legal Science, which examines whether black-box knowledge distillation can qualify as lawful reverse engineering under trade secret law.

According to Li,technical information inside a model may constitute a trade secret, and knowledge distillation satisfies the constituent elements of reverse engineering in trade secret law. Where the principles of fairness and reasonableness are not violated, restrictive clauses in user service agreements—such as “no distillation”—may be valid as a matter of contract law; however, breach of such clauses should not give rise to trade secret misappropriation liability. Knowledge distillation as reverse engineering has an economic justification, but it should be confined to legitimate purposes, reasonable conduct, and the absence of market harm. Li also argues that clarifying the reverse-engineering characterisation of knowledge distillation and delineating its legitimacy boundaries helps achieve a dynamic balance between trade secret protection in the artificial intelligence industry and technological innovation.

Below is the full translation of the paper:

Introduction

In 2025, the *Opinions of the State Council on Deepening the Implementation of the “AI+” Action* expressly proposed, under the section on “strengthening foundational supporting capabilities,” that China should “enhance foundational model capabilities and accelerate research into more efficient model training and inference methods.” As a key technology for improving training efficiency, knowledge distillation can transfer the knowledge embedded in a highly complex model (hereinafter, the “teacher model”) to a lightweight model (hereinafter, the “student model”). After obtaining the transferred data, the student model can reduce computational resource demands while achieving inference effectiveness close to that of the teacher model.

Although knowledge distillation shows substantial potential for improving model efficiency, it has generated extensive controversy in trade secret protection because it involves obtaining technical information inside a model. In February 2025, in *OpenEvidence Inc. v. Pathway Medical, Inc.*, the plaintiff alleged that the defendant used “prompt-injection attacks” to extract pre-configured system prompts embedded in the plaintiff’s model (i.e., the model’s operating logic and instructions), and then used those system prompts to train the defendant’s AI model—thereby constituting unlawful acquisition of trade secrets, violations of the Computer Fraud and Abuse Act (CFAA) and the Digital Millennium Copyright Act (DMCA), as well as breach of contract. In April of the same year, a U.S. special committee released an investigative report asserting that DeepSeek (深度求索) was highly likely to have used knowledge distillation to systematically extract and reproduce the core capabilities of leading U.S. models; the report further suggested that such distillation likely violated OpenAI’s usage terms prohibiting the use of its services to “develop competing models.” Against this background, the legality of knowledge distillation has become a focal issue of global concern.

Although existing scholarship has extensively discussed the legal nature of knowledge distillation, it has largely focused on copyright and patent perspectives. Relatively few studies examine reverse engineering under the trade secret framework or analyze the legal effectiveness of restrictive contractual clauses such as “no distillation.” Discussing the legal nature of knowledge distillation requires answering several questions: Can knowledge distillation be characterized as reverse engineering, which operates as an exception to trade secret misappropriation? Can restrictive clauses in user agreements, such as “no distillation,” exclude such a legality characterization? Where do the legitimacy and boundaries of knowledge distillation as reverse engineering lie? Clarifying these issues not only delineates clearer behavioral boundaries for AI companies and users, but also helps strike an appropriate balance between protecting R&D incentives and promoting technological innovation.

Knowledge distillation can be divided into “white-box distillation,” conducted on the basis of known technical information such as model weight parameters, and “black-box distillation,” which infers internal technical information by reverse reasoning from model outputs. The legal controversy is more acute for the latter. Accordingly, this article focuses on “black-box distillation”: it examines whether the technical information inside a model satisfies the protection requirements for trade secrets; analyzes whether knowledge distillation meets the constituent elements of reverse engineering and the legal effectiveness of restrictive contractual clauses such as “no distillation”; and, through an economic-analytical framework, explores the legitimacy of knowledge distillation as reverse engineering and its boundaries, thereby laying a theoretical foundation for the lawful conduct of knowledge distillation.

I. Determining Whether Technical Information Inside a Model Constitutes a Trade Secret

Compared with copyright and patent protection, the trade secret pathway is more flexible in protecting abstract knowledge representations. In the “first case nationwide on protecting AI model structure and parameters,” the Beijing Intellectual Property Court stated that “a model’s structure and parameters constitute competitive interests protected by the Anti-Unfair Competition Law.” Determining a trade secret requires satisfying three elements: secrecy, value, and confidentiality measures. The value of a trade secret mainly derives from the competitive advantage produced by information not being generally known.

Developing AI models requires substantial computing investment and massive data resources. Accordingly, technical information inside a model typically confers significant competitive advantages, enabling the attraction of users and expansion of market influence. While academia generally recognizes that technical information inside a model has commercial value, significant disputes remain as to secrecy and confidentiality measures: (1) whether an AI model loses secrecy regarding its internal technical information by publicly offering services in the market, and how open-source disclosure of weight parameters affects this element; and (2) whether clauses such as “no distillation” in user service agreements constitute confidentiality measures in a legal sense. It is therefore necessary to focus on the secrecy and confidentiality-measures elements to analyze whether the internal technical information implicated by knowledge distillation satisfies the constituent elements of a trade secret.

(1) Secrecy

The Provisions of the Supreme People’s Court on Several Issues Concerning the Application of Law in the Trial of Civil Cases Involving Infringement of Trade Secrets* (hereinafter, the *Provisions on Application of Law in Trade Secret Cases*) draw on the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) and interpret the secrecy element as “not generally known to and not readily obtainable by relevant persons in the field.” The *Provisions on Trade Secret Protection*, issued by the State Administration for Market Regulation in February 2026, describe the secrecy element as “not known to the public.” The U.S. Supreme Court has held that so long as information does not lose its secrecy, trade secret protection may still be available even if related products enter sales or licensing channels. Conversely, where relevant information can be easily obtained through public channels, it is generally found to lack secrecy.

Although Chinese laws and regulations do not separately define “not known to the public,” Article 4 of the *Provisions on Application of Law in Trade Secret Cases* and Article 6 of the *Provisions on Trade Secret Protection* both enumerate specific circumstances in which information is “known to the public.” In addition to “not generally known,” the secrecy element requires that the information is “not readily obtainable.” This requirement reflects the difficulty of obtaining the alleged trade secret: the cost incurred by a defendant in obtaining the plaintiff’s information often determines whether the information meets the “not readily obtainable” requirement and thus the secrecy element. Expanding trade secret protection to business information that can be obtained at low cost by unspecified persons would impede the public’s freedom of action in the public domain and increase transaction costs.

1. Secrecy of technical information inside a model

Article 5(2) of the *Provisions on Trade Secret Protection* provides that “information such as data, algorithms, computer programs, and code related to technology constitutes the technical information referred to in the preceding paragraph.” Technical information inside an AI model includes weight parameters, model architecture, and operating logic. Because AI models deployed in the market typically provide only a user interaction interface rather than exposing internal operating mechanisms, the logical patterns behind model outputs are often non-public and thus possess the feature of “not known to the public.” Accordingly, the key to secrecy lies in whether the information is “not readily obtainable.”

Such “not readily obtainable” should be assessed by reference to the substitute cost for the public to obtain the information through legitimate channels, rather than by reference to the right holder’s own R&D or collection costs. If a party can obtain such information through routine technical means within a short period, it should be considered “readily obtainable.” Conversely, if the information can be obtained only through costly reverse engineering or long-term independent R&D, it should be deemed to satisfy the “not readily obtainable” requirement.

For AI products or services already deployed in the market, while model outputs—as external carriers of information—are publicly observable, in “black-box distillation” it remains difficult to obtain internal technical information from those outputs. In ordinary user interactions, users can access only semantic-level output content, but cannot directly obtain the embedded internal technical information. Even if one uses knowledge distillation to reverse-analyze massive volumes of model outputs, substantial computing resources and time costs are required to obtain internal technical information. Therefore, technical information inside a model is information that is “not readily obtainable.”

Moreover, the data aggregation effect further demonstrates that internal technical information is “not readily obtainable.” Fragmented user interactions do not reveal the model’s operating logic; only by analyzing statistical correlations and probabilistic characteristics across massive data can one infer such internal technical information. Similarly, in software industry practice, although software products are distributed to the public, technical information such as source code underlying software—where not disclosed to the public—still possesses secrecy. Accordingly, the internal technical information of AI models can be regarded as satisfying the secrecy element.

2. The impact of model openness on secrecy

Whether internal technical information is externally disclosed also affects secrecy. For closed-source models, developers typically keep key technical information such as algorithms, model architecture, and underlying source code strictly confidential in order to prevent competitors from obtaining internal technical information and developing competing products, thereby preserving secrecy. By contrast, open-source models are premised on knowledge sharing and collaborative innovation. Depending on the content and degree of openness, open-source models form an “openness spectrum,” disclosing to varying extents training code, training data, model architecture, model parameters, inference code, and evaluation cases. Different open-source models also impose restrictions on subsequent uses of derivative models through license agreements or commercial restrictive clauses.

For open-source models that have disclosed technical information such as weight parameters and training code, the information can be directly accessed by the public and will typically fail to satisfy the secrecy element’s requirements of “not known to the public” and “not readily obtainable.” However, this does not mean that internal technical information in open-source models necessarily fails to satisfy secrecy. Undisclosed internal technical information in open-source models (e.g., training methods) often remains secret, and the substitute cost for the public to obtain it is relatively high.

For example, to obtain undisclosed original training data for an open-source model, practice often uses “data-free distillation” methods that reverse-reconstruct the feature distribution of the original training data based on the open-source model’s weight parameters, synthesizing data extremely close to the original. Such methods rely on complex algorithms and substantial computing investment. The resulting information about the feature distribution of training data is “not known to the public” and “not readily obtainable,” and thus possesses secrecy. Accordingly, regardless of whether the model as a whole is open-source, so long as a particular technical information item has not been disclosed and the public faces high costs to obtain it through substitute means, that information can be regarded as secret.

(2) Confidentiality measures

A trade secret is not the object of an exclusive right. It is difficult to notify the public of right boundaries through property-right publicity mechanisms; accordingly, the right holder must take reasonable confidentiality measures to prevent the public from inadvertently accessing the trade secret. Article 9(1) of the *Provisions on Trade Secret Protection* requires the right holder, prior to the occurrence of the infringing act, to adopt “reasonable confidentiality measures commensurate with factors such as the nature of the trade secret and its carrier, and the commercial value of the trade secret.” The normative purpose is to facilitate limited sharing of trade secrets. The determination of confidentiality measures follows a reasonableness standard: “reasonable” means that the measures objectively notify the public of the right boundary and function to prevent others from easily obtaining the trade secret under the right holder’s control.

Confidentiality measures can be divided into “internal” and “external” measures. AI companies typically adopt both types of measures with respect to internal technical information of models in order to maintain secrecy.

“External” confidentiality measures refer to physical or technical control measures through which the right holder restricts others’ access to trade secrets. For internal technical information, closed-source models adopt confidentiality measures such as application programming interface (API) access restrictions, output filtering, and call-frequency controls. Security mechanisms configured within the model can review content before output generation, filter out internal technical information, and prevent disclosure. At the same time, the model’s computation process involves multi-layer algorithmic processing and information transformation, making it difficult for others to restore internal technical details from outputs at low cost. In practice, conducting knowledge distillation requires substantial computing resources to obtain massive model outputs and thereby infer internal technical information. In addition, because internal technical information is strongly interdependent, even partial access to weight parameters is insufficient to reproduce model functionality at an equivalent level. Therefore, based on the technical measures configured in the model, the right holder has adopted reasonable confidentiality measures with respect to internal technical information, effectively maintaining secrecy.

“Internal” confidentiality measures refer to circumstances in which the right holder allows the counterparty to access or control trade secrets by agreeing on confidentiality obligations and reasonably indicating the scope of confidential information. Where enterprises sign confidentiality agreements with employees or third parties, such agreements may still be regarded as confidentiality measures even if there is a theoretical risk of leakage. In the software industry, end-user license agreements (EULAs) are important confidentiality tools: they not only evidence the right holder’s subjective intent to maintain secrecy, but also enhance trade secret protection by clarifying the user’s confidentiality obligations.

In cases involving software products, U.S. courts have recognized that contractual clauses can serve as proof of reasonable confidentiality measures. Where a software product adopts access restrictions such as password protection while also requiring the user to promise by contract not to disclose, use, or share trade secrets, courts may find that the enterprise satisfies the requirement of reasonable confidentiality measures; the effectiveness of such contractual clauses as confidentiality measures may even extend to information that is readily knowable, such as basic design and functionality. Analogously, AI companies also set user service agreements for their products or services. Depending on the user group, such agreements can generally be divided into two categories: (i) Terms of Use for ordinary individual users, which are typically click-through standard-form contracts and generally do not impose confidentiality obligations on users; and (ii) enterprise license agreements (Enterprise Licenses) for commercial users, which are typically signed after full negotiation between parties of relatively equal bargaining power and contain express confidentiality clauses, thereby imposing corresponding confidentiality obligations on commercial users.

Accordingly, confidentiality measures should be assessed differently depending on the user group. For commercial users, the express confidentiality clauses in their license agreements can constitute effective confidentiality measures for internal model information. For individual users, even where the service agreement lacks an express confidentiality obligation, the right holder may still effectively control internal technical information through technical measures such as closed-source configurations, access restrictions, and output filtering. The legal nature and scope of effectiveness of restrictive clauses such as “no distillation” in individual user service agreements will be further analyzed below.

II. Determining the Legal Characterization of Knowledge Distillation as Reverse Engineering

The legal logic of trade secret protection is to maintain the relative competitive advantage that the right holder has established through confidentiality measures, rather than to achieve absolute exclusive control over trade secret information. Therefore, the law prohibits only improper acquisition of trade secrets and does not restrict acquisition through legitimate means such as reverse engineering or independent R&D.

Accordingly, it is necessary to clarify the meaning and implementation process of knowledge distillation and, on that basis, to focus on “black-box distillation” to analyze whether it satisfies the constituent elements of reverse engineering and to examine the effectiveness of restrictive clauses such as “no distillation” in user agreements.

(1) The meaning and implementation process of knowledge distillation

To determine whether knowledge distillation constitutes “improper acquisition” of trade secrets, it is necessary to clarify its meaning and implementation process. As a model compression technique, knowledge distillation involves three core elements: the “knowledge” embedded in the teacher model as the source of knowledge; the distillation algorithm that transfers knowledge; and the “teacher–student architecture” consisting of the teacher model and the student model.

The core logic of knowledge distillation is to achieve knowledge transfer through the teacher–student architecture, enabling the student model to learn the teacher model’s decision logic more effectively, so that the student model can approach the teacher model’s performance even when its parameter scale is significantly compressed.

The “knowledge” that is the object of distillation refers to technical information embedded inside the teacher model that users cannot directly obtain through ordinary interaction, including information such as the probability distribution at the output layer, feature representations at intermediate layers, the model’s decision logic, and correlation structures across layers. More specifically, such knowledge can be divided into three categories.

First, response-based knowledge: the probability distribution (soft labels) over categories at the teacher model’s output layer. Unlike hard labels that indicate only the correct answer, soft labels include not only the teacher model’s probability judgment for the correct class but also information about relative similarities among all classes, enabling the student model to learn the teacher model’s decision logic more effectively.

Second, feature-based knowledge: feature representations at the teacher model’s intermediate layers, reflecting the model’s internal processing logic and abstract representation capability.

Third, relation-based knowledge: correlation structure information among outputs across different layers of the model.

These three categories collectively constitute the core object obtained through knowledge distillation.

Traditional knowledge distillation often depends on direct access to the teacher model’s weight parameters, training data, and the output-layer probability distribution (soft labels). However, in practical application, closed-source models often provide only APIs: external parties cannot obtain weight parameters, cannot access original training data, and APIs often return only final class results (hard labels) rather than the full probability distribution.

As a result, “black-box distillation,” which can be conducted without access to internal parameters and solely through outputs, has increasingly emerged. Where there is no training data, no access to weight parameters, or even only hard-label outputs are available, the student model can still gradually learn the teacher model’s decision logic by inputting prompts to the teacher model and analyzing its output characteristics. Through a “question–answer” interactive mode, the student model reconstructs a knowledge set and thereby achieves inter-model knowledge transfer. This process not only requires substantial computing resources but also relies on the data aggregation effect.

(2) Knowledge distillation satisfies the constituent elements of reverse engineering

Reverse engineering operates as an exemption from trade secret misappropriation liability. Article 14(1) of the *Provisions on Application of Law in Trade Secret Cases* provides that acquiring the alleged infringing information through independent R&D or reverse engineering does not constitute trade secret infringement. Article 15 of the *Provisions on Trade Secret Protection* further clarifies that obtaining relevant technical information by disassembling, surveying, or analyzing products obtained through public channels does not constitute trade secret infringement. The Uniform Trade Secrets Act (UTSA) in the United States and the U.S. Supreme Court’s decision in *Kewanee Oil Co. v. Bicron Corp.* establish analogous reverse engineering rules.

The UTSA emphasizes that obtaining a product through the public market in a “fair and honest manner” and dismantling it to understand its manufacturing process does not constitute trade secret misappropriation. The EU Trade Secrets Directive likewise notes that observing, studying, disassembling, or testing a product that is available to the public or lawfully possessed by the acquirer constitutes a lawful means of acquiring trade secrets.

Synthesizing these rules, reverse engineering generally requires: lawful acquisition of the product; legitimate implementation methods; and the absence of breach of confidentiality obligations. It is therefore necessary to analyze, element by element, whether knowledge distillation satisfies these requirements.

First, reverse engineering can be applied to products or services based on AI models. The aim of knowledge distillation is to obtain internal technical information of a model, and such information is carried by AI products or services. Although reverse engineering traditionally applied to “products obtained through public channels,” this historical focus reflects the industrial-era reality that trade secrets were typically embedded in tangible goods, requiring physical disassembly to obtain know-how. With technological development, the distinction between products and services has increasingly blurred in the digital era. What is “provided on the market” is not limited to tangible products, but also includes non-tangible products or services such as software and AI models.

China’s *Interim Measures for the Administration of Generative AI Services* define “services” as the provision of content to the public by using generative AI technologies. However, “product” versus “service” is merely a market-provision form of an AI model and does not affect whether the AI model can be an object of reverse engineering. The concept of “product” in the digital era should be interpreted with sufficient flexibility and inclusiveness. There is no legal obstacle to including software and AI systems within the scope of “products,” and even AI outputs may potentially qualify as products. For example, the EU’s *New Product Liability Directive* defines “products” to include tangible and intangible movable property, including software, expressly recognizing the multiplicity of product forms in the digital era. Accordingly, the “product” concept relevant to reverse engineering can be interpreted teleologically to include products or services provided based on AI models.

Second, the source of the product analyzed by reverse engineering must be “lawfully acquired.” Lawful acquisition entails two layers: lawful source and legitimate means. As to the source, lawful acquisition includes obtaining a license to use the product through a user agreement. One key justification for allowing reverse engineering is that the implementer has a right of disposition over lawfully obtained products.

Article 15 of the *Provisions on Trade Secret Protection* does not explicitly clarify whether “obtained through public channels” is limited to obtaining ownership of products carrying trade secrets, or whether it can include access acquired through a license. Similar to software products, in AI model services users typically must subscribe to obtain access, and service providers impose restrictions on user conduct through service agreements. If “transfer of ownership” is insisted upon as the sole criterion for lawful acquisition, this would fail to accommodate the characteristics of AI technology development and would further compress the space for applying reverse engineering.

In addition, whether knowledge distillation constitutes lawful acquisition of internal technical information also requires examining the lawfulness of the source of teacher-model outputs used. Express authorization in user agreements can serve as a basis for lawful acquisition. Some AI providers have expressly granted users rights relating to model outputs in their license agreements. In such cases, users obtain model outputs pursuant to contractual authorization, thereby constituting lawful acquisition of the AI model outputs.

As to means, lawful acquisition further requires obtaining model outputs through legitimate methods. Although theory and practice recognize reverse engineering as a defense in trade secret cases, the boundary between lawful reverse engineering and unlawful improper acquisition methods can be blurred. The determination of “improper” methods depends on the degree of social impropriety attributed to the conduct within a particular industry context, as well as the trade secret holder’s own fault.

Knowledge distillation typically obtains model outputs through large-scale automated queries. With respect to the legitimacy of using automated means to obtain information, *Compulife Software Inc. v. Newman* established a “foreseeability of technological means” standard. In that case, the U.S. Court of Appeals for the Eleventh Circuit held that the defendant’s use of automated programs to scrape the plaintiff’s trade secret database constituted improper acquisition, reasoning that the plaintiff could not reasonably foresee the need to defend against non-human access.

However, as AI technologies become widespread, and the use of non-human methods to obtain data becomes an industry-common approach, it is more reasonable to shift the legitimacy assessment toward a substantive evaluation of the propriety of the conduct itself, where right holders can reasonably foresee such means. In the context of knowledge distillation, where an actor has lawful access to the model and does not adopt technical means that are unlawful or potentially harmful to normal model operation or cybersecurity—such as illegal access, cracking technical protection measures, bypassing API rate limits, or generating adversarial-sample attacks—the acquisition method should be regarded as legitimate.

Third, in terms of process, reverse engineering implementers do not possess the trade secret ex ante; they identify undisclosed information through analysis and testing. Reverse engineering typically begins with an observable product and uses observation and black-box testing to infer internal structure, operating mechanisms, or implementation pathways. Knowledge distillation is similar in behavioral mode to traditional reverse engineering: both use observation of external outputs to infer internal technical information.

For example, the “black-box testing” logic in software reverse engineering is that even if software exposes only an API, an actor can infer internal operating logic by observing the “input–output” relationship of the computer system. “Black-box distillation” follows a similar logic: the implementer continuously inputs prompts to the teacher model, analyzes its output, and uses distillation algorithms to reverse-analyze the “input–output” mapping, thereby inferring internal technical information. This is essentially consistent with the traditional “disassemble–reconstruct” model of reverse engineering.

Finally, reverse engineering implementers must not breach confidentiality obligations. Reverse engineering implementers are not internal technical personnel and cannot access or know internal technical information; therefore, they do not owe confidentiality obligations under trade secret law.

For individual users, although their user agreements may contain technical confidentiality clauses prohibiting reverse engineering (hereinafter, “anti–reverse engineering clauses”), such as OpenAI’s service agreement that expressly prohibits competitors from using automated means to obtain data to train competing models, individual user agreements are typically standard-form contracts with unequal bargaining positions and lack meaningful negotiation; the legal effectiveness of such clauses is questionable, and they should not be used to infer that individual users owe confidentiality obligations to AI companies.

For commercial users, by contrast, where parties of equal bargaining power expressly agree on confidentiality obligations in commercial authorization agreements, such obligations are legally binding on commercial users.

(3) Legal effectiveness analysis of restrictive clauses relating to “no distillation”

Although knowledge distillation satisfies the constituent elements of reverse engineering, in commercial practice AI product or service providers often include restrictive clauses prohibiting knowledge distillation in user service agreements. One category consists of “anti–reverse engineering clauses,” which primarily restrict the conduct itself by prohibiting reverse engineering, extraction, or copying of internal technical information such as weight parameters, or prohibiting automated extraction of model outputs. Another category consists of “anti-competitive-use clauses,” which primarily restrict the purpose of conduct by prohibiting users from using model outputs to develop competing products.

The legal effectiveness of these clauses has become a central dispute in assessing the legality of knowledge distillation. It is therefore necessary to conduct an in-depth analysis of the legal effectiveness of both anti–reverse engineering clauses and anti-competitive-use clauses.

1. Breach of an anti–reverse engineering clause does not constitute an improper means of acquiring trade secrets

There is controversy in both theory and practice as to whether breaching an anti–reverse engineering clause can constitute an improper means of acquiring trade secrets. Some U.S. cases tend to recognize the effectiveness of such clauses in specific circumstances. For example, in *SoCal Diesel, Inc. v. Extrasensory Software, Inc.*, the California Court of Appeal, Second Appellate District, held that even absent a pre-existing confidentiality obligation between an individual user and a trade secret holder, intentionally or fraudulently breaching a license agreement that expressly prohibited reverse engineering might still be regarded as acquiring trade secrets by improper means.

However, scholarship generally adopts a cautious stance, arguing that reverse engineering is a lawful pathway for acquiring trade secrets and courts should not treat breach of an anti–reverse engineering clause as an improper means of acquiring trade secrets. Recognizing such clauses as a basis for “improper means” would effectively grant trade secret holders perpetual protection, undermining the balance between trade secret holders and the public.

U.S. judicial practice also commonly holds that even where a user service agreement is breached, reverse engineering may still be a lawful means of acquiring trade secrets. In *DVD Copy Control Ass’n v. Bunner*, the defendant conducted reverse engineering in breach of an anti–reverse engineering clause to obtain trade secrets. Although the California Supreme Court did not decide whether breach of such a clause constituted “improper acquisition,” Justice Moreno stated in a concurring opinion that no precedent had recognized that trade secret holders could use standard-form contracts to bring reverse engineering within the category of “improper means.”

In *Aqua Connect, Inc. v. Code Rebel, LLC*, the defendant downloaded a trial version of the plaintiff’s software and reverse engineered it to develop a competing product, directly breaching the end-user license agreement. The U.S. District Court for the Central District of California likewise held that breach of an anti–reverse engineering clause should not be treated as an improper means of acquiring trade secrets.

On this basis, it is further necessary to distinguish between commercial license agreements and ordinary standard-form user contracts. In a commercial negotiation context, reverse engineering undertaken in breach of a license agreement may violate the confidentiality obligations mutually assumed under the contract, thereby constituting improper acquisition of trade secrets, because the anti–reverse engineering clause in a commercial agreement may concretize mutually agreed confidentiality obligations. By contrast, individual user agreements typically take the form of standard-form contracts; the parties do not substantively negotiate the licensing terms and there is no foundational confidentiality obligation. Therefore, an anti–reverse engineering clause in such a standard-form contract should not be treated as part of a confidentiality obligation formed through equal negotiation, and breach of such a clause does not constitute an improper means of acquiring trade secrets.

Regardless of whether an individual user agreement contains an anti–reverse engineering clause, individual users do not owe confidentiality obligations. Individual users who lawfully obtain access to a model may conduct knowledge distillation, which can be characterized as reverse engineering. However, trade secret law and contract law operate as distinct evaluative dimensions: breaching an anti–reverse engineering clause may give rise to contractual liability.

2. Contract validity of anti–reverse engineering clauses and anti-competitive-use clauses

In judicial practice, the contractual validity of anti–reverse engineering clauses is often recognized, and U.S. courts rarely invalidate such clauses on the ground that they are standard-form terms. For example, in *Triage Logic Mgmt. & Consulting, LLC v. Innovative Triage Servs., LLC*, the North Carolina Business Court recognized the validity of an anti–reverse engineering clause in a software license agreement, holding that the clause did not constitute an unlawful restraint of trade.

The contractual validity of anti–reverse engineering clauses is not without limits. In general, the law does not interfere with freedom of contract. However, in IP markets, firms with strong market control can readily restrict user rights through contracts, and the law should intervene in a timely manner to limit the validity of such terms. The stronger the substantive restriction, the more closely fairness should be scrutinized.

In the U.S. context, a finding of unconscionability requires proof of both lack of “meaningful choice” and that the term is “unreasonably favorable” to the other party. Articles 496 and 497 of the PRC Civil Code (《民法典》) establish analogous rules. Article 496 provides that where the provider of standard-form terms fails to perform its duty of reminder or explanation such that the other party did not notice or understand a term of material interest, the other party may claim that the term does not become part of the contract. Article 497 provides that standard-form terms that unreasonably restrict or exclude the other party’s principal rights are invalid.

As standard-form terms unilaterally drafted by AI companies, anti–reverse engineering clauses in individual user agreements offer users no realistic space to negotiate. Where AI companies fail to fulfill the duty to highlight or explain such clauses, users may invoke Article 496 of the Civil Code to argue that the clause does not form part of the contract. Even where the duty is fulfilled, if an anti–reverse engineering clause imposes overly broad and generalized restrictions that exceed what is reasonably necessary to protect technical information of the AI product or service and unreasonably restrict users’ legitimate use of model outputs lawfully obtained, the clause may be held invalid under Article 497.

From a comparative perspective, the EU Trade Secrets Directive also states that “reverse engineering of a lawfully acquired product should be considered a lawful means of acquiring information unless otherwise agreed in a contract. However, the freedom to conclude such contractual arrangements may be limited by law.” This indicates that while trade secret holders may use contracts to restrict reverse engineering, the law should intervene and limit freedom of contract where anti–reverse engineering clauses impede innovation or restrict market competition.

For example, the EU has treated contractual clauses prohibiting necessary decompilation for interoperability as invalid. Knowledge distillation implicates significant public interests in promoting market competition and technological progress. Where an anti–reverse engineering clause substantially impedes the realization of such public interests and exceeds the legitimate boundary of contractual freedom, its contractual effectiveness should be restricted.

With respect to anti-competitive-use clauses, “reasonableness” is an important consideration in confirming contractual validity. Reasonableness assessments typically consider factors such as time, geographic scope, and the scope of restriction. The Restatement (Second) of Contracts identifies relevant factors for reasonableness: where the restriction exceeds what is necessary to protect the legitimate interests of the promisee (the licensor), an anti-competitive-use clause may be found unreasonable.

While AI companies’ massive investments in model development constitute protectable interests, overly broad competition restrictions may still be deemed unreasonable because they exceed what is necessary to protect those interests. For example, some user agreements do not clearly limit the type or temporal scope of outputs covered, potentially sweeping in any model outputs generated by users. Such a scope exceeds what is necessary to protect AI companies’ legitimate interests, and the clause may be held invalid.

U.S. courts, when scrutinizing such clauses, also consider whether users receive adequate notice, have an opportunity to read the contract, and whether the restriction scope exceeds users’ reasonable expectations at the time of contracting. Under Article 497 of the Civil Code, standard-form terms that unreasonably restrict the other party’s principal rights should be deemed invalid. Accordingly, users have legitimate interests in model outputs lawfully obtained, and overly broad non-compete restrictions constitute unreasonable restrictions. For example, in the above-mentioned *Triage Logic* case, while the court upheld the validity of an anti-competitive-use clause, it also found that a non-compete clause in the software license agreement constituted an “unlawful restraint of trade,” because it permanently prohibited users from developing software, services, or products substantially similar to the software, exceeding the scope of a reasonable restriction and therefore lacking legal effect.

Even where such anti–reverse engineering clauses and anti-competitive-use clauses may not necessarily be legally effective, the “chilling effect” they generate can still significantly weaken the public’s incentives to use AI tools, influence the characterization of reverse engineering, and thereby seriously harm the public interest. Out of risk-avoidance considerations, later entrants may abandon reasonable competitive R&D, producing negative effects on industry innovation. Accordingly, restrictive clauses relating to knowledge distillation that do not satisfy fairness and reasonableness requirements should have their contractual effectiveness limited in accordance with law.

III. Legitimacy Analysis of Knowledge Distillation as Reverse Engineering

Although knowledge distillation satisfies the constituent elements of reverse engineering, a legality characterization merely resolves whether the conduct constitutes trade secret misappropriation; it does not sufficiently answer under what conditions reverse engineering is legitimate. Accordingly, it is necessary to introduce legitimacy analysis as a more refined normative framework to construct substantive standards for allowing or restricting reverse engineering.

Experience from traditional manufacturing, semiconductors, and software industries indicates that the core of assessing the legitimacy of reverse engineering lies in evaluating the conduct’s impact on subsequent innovation and overall social welfare. Whether knowledge distillation as reverse engineering is legitimate likewise depends on whether it can balance promoting innovation in the AI industry and maintaining fair competition.

The following analysis draws on the economic analysis paradigm of reverse engineering proposed by Samuelson and Scotchmer, and examines the legitimacy of knowledge distillation as reverse engineering along four dimensions.

(1) Knowledge distillation as reverse engineering has an economic justification

1. Impact on innovation incentives of prior developers

As a policy lever, reverse engineering can provide appropriate incentives for innovators across different technological and industrial contexts. Views advocating strict restrictions on reverse engineering argue that reverse engineering may harm the expected returns of prior developers, making it difficult for them to recoup high R&D costs and thereby weakening overall innovation incentives.

However, not all returns of prior developers should be protected by law. Where later entrants can reverse engineer and produce competing products at costs so much lower than prior developers’ costs that prior developers cannot obtain expected returns through market competition, law should regulate such reverse engineering conduct. Knowledge distillation provides later entrants in the AI industry with a pathway for rapid training, but whether rapid training necessarily implies “low cost” remains debatable. It is therefore necessary to examine the economic impact of knowledge distillation from the perspectives of development costs and substitution effects.

From the perspective of implementation costs, knowledge distillation improves the efficiency of student models through interactive training, reducing training complexity and computational costs, but it still requires substantial computing resources and R&D investment. If the cost of competitive copying becomes so low that innovators cannot recoup R&D investments, incentives to develop innovative products will be undermined. U.S. judicial regulation of “plug molding” behavior reflects this logic. “Plug molding” is a manufacturing technique in traditional industries that uses an original product as a mold to cast duplicates directly. Although the U.S. Supreme Court in *Bonito Boats, Inc. v. Thunder Craft Boats, Inc.* confirmed that plug molding is one method of reverse engineering, because its essence is low-cost copying of original innovation—without advancing subsequent innovation and without benefiting overall social welfare—such conduct lacks the legitimacy of reverse engineering.

By contrast, in the software industry, disassembly and decompilation of computer programs require significant time and economic costs. Such reverse engineering can facilitate the development of interoperable products and can diminish industry monopolies in a constructive manner. This indicates that the legitimacy of reverse engineering is closely related to its cost inputs.

In the AI industry, knowledge distillation obtains internal technical information derived from analyzing and processing teacher-model outputs. Yet student-model performance depends not only on distillation features but also on the training corpus, training and fine-tuning methods, and other factors. The complete model development process involves data collection, cleaning, pre-training, and fine-tuning. Knowledge distillation likewise requires organizing and cleaning teacher-model output data and independently designing the student model’s system architecture and learning process. In addition, distillation effectiveness depends on the intrinsic structure and distributional characteristics of training data and on continuous optimization of distillation algorithms.

Accordingly, although knowledge distillation can save certain R&D costs, developing a student model still requires substantial training costs. It is therefore inappropriate to treat knowledge distillation as low-cost copying of a teacher model.

From the perspective of substitution effects, skepticism about the legitimacy of knowledge distillation is based on the concern that student models will rapidly eliminate the teacher model’s leading advantage, capturing market share at lower prices and thereby undermining innovators’ incentives. This view, however, overlooks inherent technical limitations of knowledge distillation.

First, a “scale gap” makes it difficult for student models to achieve the same performance as teacher models. Knowledge distillation does not directly use information such as the teacher model’s structure, parameters, or code. Rather, it analyzes teacher-model outputs to obtain internal technical information such as probability distributions and uses that information to optimize student-model training. The capacity gap between large deep neural networks and small student networks reduces knowledge transfer effectiveness. The “small-model learnability gap” phenomenon in fact indicates that small language models cannot stably benefit from distillation from large teacher models. From the perspective of transfer effectiveness, data obtained from learning a teacher model with a similar parameter scale better matches the student model’s own capability level.

Nevertheless, industry practice commonly adopts teacher–student architectures with large scale differences. This is not because they pursue optimal transfer effectiveness, but because they trade off some performance in exchange for lightweight and efficient models, improving inference efficiency and reducing memory usage. Accordingly, the aim of knowledge distillation is to achieve lightweight and efficient student models, rather than to fully replicate teacher-model capabilities. A substantial performance gap between student and teacher models remains.

Second, student models trained on distillation data have limitations in performance. Pre-training is the primary source of model capabilities. While student models may reach levels comparable to teacher models in specific tasks, their adaptability to new scenarios or tasks often falls below teacher models when tasks lack sufficient training data support, and they still require massive data for fine-tuning to narrow capability gaps.

In addition, student models trained solely on teacher-model output data face the risk of performance degradation. Research indicates that teacher-model output data only partially represents the patterns embedded in the original training data; it cannot reflect all characteristics of the training data, and the student model introduces errors in learning. If training uses only teacher-model outputs, these two categories of errors will continuously accumulate. Student models will gradually lose low-frequency but important data features in the true data distribution. Such error accumulation can cause irreversible “model collapse,” namely performance degradation. Although introducing real human data into training can slow this process, declines in student-model performance are difficult to avoid. Therefore, to maintain long-term market competitiveness, significant costs are still required to obtain and use real human data for training, so as to offset error accumulation and performance degradation brought about by distillation.

Third, market demand for AI models is differentiated. Student models and teacher models serve different market demands. Student models obtained through knowledge distillation typically have smaller parameter scales, lower computational requirements, and are mainly oriented toward niche markets with higher requirements for privacy protection and localized deployment. Teacher models, by contrast, have larger parameter scales and mainly serve cloud application scenarios requiring high-precision inference and complex computation. The two types of models have significantly different market positioning, and student models are difficult to serve as direct market substitutes for teacher models.

Although student models may compete with teacher models in specific tasks, knowledge distillation itself requires substantial time and economic inputs. During this period, prior developers can maintain a sufficient lead, recoup R&D costs, and obtain innovation returns.

2. Impact on competitive order and market prices

Although products obtained through reverse engineering may enter the market and compete with prior products, causing the market price of prior products to decline, such competition can still be regarded as constructive within a certain range. This is because such competition motivates developers to improve product quality, enhance management, and reduce costs and prices.

After student-model products or services enter the market—whether released in open-source or closed-source form—knowledge distillation can effectively reduce overall price levels for AI products and services, increase market supply, and help maintain a sound competitive order.

On the one hand, knowledge distillation as reverse engineering can prevent prior developers from setting excessively high license fees for AI products or services. The pricing strategy of distillation implementers is cost-dependent. Once student-model products or services enter the market, they exert downward pricing pressure on teacher-model products or services. At the same time, prior developers have incentives to set license fees at reasonable levels to attract licensees and to prevent later entrants from entering the market through reverse engineering as a lawful means. Regardless of motivation, knowledge distillation as reverse engineering can objectively promote reasonable pricing by prior developers.

Taking OpenAI as an example, its official distillation tools allow users to store model responses free of charge and charge subsequent evaluation and fine-tuning at the standard fine-tuning fee rates. Although this license price is relatively low, licensees obtain only usage rights to customized student models based on API calls. Because the student model is hosted in the cloud, licensees cannot access underlying files such as core weight parameters and must pay subsequent fees higher than standard API calls. Some studies suggest that prior developers’ motivations for granting technical licenses often stem from concerns about reverse engineering.

Accordingly, knowledge distillation as reverse engineering can incentivize prior developers to adjust license-fee pricing and reduce market prices for related products or services, thereby promoting constructive competition and broader adoption of AI technologies.

If knowledge distillation were not characterized as reverse engineering, prior developers would no longer face competitive pressure from distillation implementers. In that scenario, prior developers may reduce prices in the short term to expand market share. However, once monopoly power is formed, prior developers may charge higher prices to users dependent on the product or service, increasing overall service prices.

Where knowledge distillation can be characterized as reverse engineering, competition between closed-source student models and teacher models manifests as price competition; both sides may adjust pricing strategies in response to the other’s market price. Yet because student models and teacher models maintain performance gaps and student models likewise must recover development costs through pricing, student-model products or services may reduce teacher-model market prices but will not trigger destructive price competition.

On the other hand, if student models obtained through knowledge distillation are released as open-source, they can also compete with teacher models through differentiation. Compared with price competition among closed-source models, competition between open-source and closed-source models takes a different form. Closed-source developers are often more vigilant regarding the effects of open-source models on pricing strategies and market share.

Some argue that knowledge distillation can enable open-source models to rapidly narrow gaps with closed-source models, thereby exposing closed-source models to risks of losing competitive advantages. For example, a Stanford University study found that the open-source model “Alpaca” distilled from OpenAI’s base model (approximately 175 billion parameters) could, with only 7 billion parameters, exhibit performance similar to the latter in specific tasks. Nevertheless, the two still have substantial capability gaps in long-tail knowledge handling and complex reasoning logic. Closing these gaps requires high R&D costs and reliance on massive generated data or stronger base models; in complex application scenarios, student models are therefore unlikely to directly substitute for teacher models in the short term.

Open-source models exert some competitive pressure on closed-source models in terms of user costs and market choice. Open-sourcing as a market strategy aims to establish technical standards and expand ecosystem influence, thereby competing with closed-source models through differentiation.

At the cost level, open-source student models provide lower-priced substitutes in scenarios where users have higher data-security requirements or specific vertical-domain needs, leading to some decline in market prices of closed-source teacher models. Yet this impact mainly manifests in particular niche markets and is unlikely to constitute comprehensive substitution.

With respect to user choice, scholarship distinguishes between two competitive strategies for open-source models. Where open-source models adopt a “reactive strategy,” namely always following closed-source models’ performance improvements at a fixed ratio, closed-source models can always induce users to choose closed-source models through price reductions or performance adjustments. Only where open-source models adopt a “proactive strategy,” namely independently developing high-performance models rather than merely following closed-source development, will users tend to choose open-source models, thereby weakening closed-source competitive advantages. Accordingly, knowledge distillation, as a typical “reactive strategy,” will not directly substitute teacher models in the market. Rather, the existence of open-source alternatives can incentivize closed-source providers to lower prices for related products or services, thereby promoting a fair competitive environment.

3. Impact on subsequent innovation in the AI industry

This factor assesses whether reverse engineering enables later entrants, after obtaining technical information, to develop improved, compatible, or more advanced new products, thereby advancing technological innovation and progress. Knowledge distillation obtains internal technical information by learning from teacher-model outputs; its essence is not direct copying of teacher-model performance, but innovation built on that basis.

In the semiconductor chip industry, the U.S. Semiconductor Chip Protection Act of 1984 (SCPA) clarified the legitimacy of reverse engineering: it allows copying of chip layouts for purposes of learning and analysis, but requires later entrants to engage in “forward engineering,” namely using acquired knowledge to develop original chip designs. This institutional design ensures that prior developers can recoup costs while compelling later competitors to improve upon the original product, thereby encouraging competition and preventing technological monopolies.

Analogously, valuable knowledge distillation is often accompanied by substantial subsequent innovation. Implementers must invest significant R&D costs in fine-tuning and optimizing student models before bringing them to market.

In terms of specific paths for subsequent innovation, knowledge distillation can enable at least the following.

First, student models obtained via knowledge distillation can expand the scope of AI applications and be applied across computer vision, speech recognition, and natural language processing. By adding vertical-domain data for training, student models can achieve—in specific professional scenarios such as medicine and law—capabilities comparable to or even exceeding those of general-purpose large models serving as teacher models.

Second, knowledge distillation can break technological monopolies by a small number of leading industry models and reduce entry barriers for subsequent developers. Specifically, distillation can transfer advanced capabilities of base models such as GPT-4 to accessible open-source models such as LLaMA and Mistral, enabling secondary innovation by developers.

Third, knowledge distillation can convert ultra-large-parameter models into lightweight models deployable on mobile devices or IoT endpoints, allowing high-performance models that previously could run only in the cloud to run on end-user devices, thereby supporting differentiated new AI products or services.

In addition, knowledge distillation can promote interoperability among AI applications and reduce developers’ dependence on a single closed-source model. Just as reverse engineering in software can achieve interoperability between platforms and applications—reducing monopolies formed by non-interoperable systems and incentivizing platform licensing and application development—knowledge distillation in AI enables developers, when faced with monopolistic pricing by model vendors, to reduce model migration costs, achieve low-cost switching among models, reduce dependence on a single closed-source model, provide more diverse market choices, and promote a sound competitive order.

4. Impact on waste of social R&D resources

Legitimate reverse engineering can reduce repetitive and ineffective R&D inputs, enabling more efficient use of social innovation resources. With respect to knowledge distillation, its effects on R&D investment can be analyzed in two respects.

On the one hand, knowledge distillation can reduce repetitive and ineffective exploratory R&D investment. Model training is highly dependent on computing resources. According to industry reports, by 2024 the training costs of the most advanced base large models (such as GPT-4 and Gemini Ultra) had reached USD 78 million and USD 191 million, respectively. Given the extremely high training costs of such ultra-large models, R&D is currently mainly conducted by a small number of cash-rich technology giants.

Knowledge distillation enables later developers to directly benefit from prior models’ development experience and reduces large amounts of ineffective investment in prior R&D. If the legitimacy of knowledge distillation as reverse engineering is not recognized, later developers would have to independently complete the model training process, producing large amounts of duplicative R&D investment.

Although implementing knowledge distillation requires collecting and analyzing teacher-model outputs and continuously debugging distillation algorithms to train student models, these costs are far lower than the R&D investment required to independently repeat training. Where legal risks, compliance barriers, or difficulties in fully eliminating potential infringement risks associated with training data make re-training necessary, independent training may indeed be justified. Outside such circumstances, however, repeatedly conducting pre-training will waste social resources, and allowing knowledge distillation helps achieve efficient allocation of social innovation resources.

On the other hand, as a widely adopted technology in the AI industry, knowledge distillation can help direct limited R&D resources toward more valuable frontier technological innovations. Resources saved through distillation can be reinvested into independent R&D such as training data collection, algorithm debugging, and model optimization, thereby producing higher-quality model products. This differs fundamentally from “free-riding” conduct that directly copies others’ achievements. If knowledge distillation is not recognized as legitimate reverse engineering, the AI industry will be unable to reasonably draw on prior R&D results, markets will generate extensive duplicative R&D, and overall social R&D efficiency will significantly decline.

The above four dimensions indicate that knowledge distillation as reverse engineering can effectively promote constructive market competition. The basic function of competition is to incentivize producers to continuously develop and adopt new technologies, improve management to reduce costs, and thereby increase public welfare. Knowledge distillation, as a reverse engineering method, can promote technological progress while maintaining innovation incentives, maximizing overall social welfare.

(2) The legitimacy boundaries of knowledge distillation as reverse engineering

Although knowledge distillation as reverse engineering has an economic justification, it should, like reverse engineering in traditional industries, be subject to legitimacy boundaries. The legitimacy boundaries should be argued in light of the market characteristics of the relevant industry, the specific threats faced, and the economic impact of restrictions. A legitimacy assessment framework based on three dimensions—“purpose–conduct–result”—can be constructed around the characteristics of knowledge distillation.

First, as to purpose legitimacy, one should examine whether the distillation implementer has an intent to innovate. Where an actor conducts knowledge distillation to improve student-model performance based on obtaining internal technical information, or to create complementary innovation vis-à-vis teacher-model products, the purpose should be regarded as legitimate. By contrast, knowledge distillation aimed at purely copying teacher-model functionality rather than pursuing innovative development lacks legitimacy.

Because purpose legitimacy is a subjective element and difficult to directly prove in practice, it can be inferred from objective conduct. Where an actor continuously invests R&D resources to optimize the student model during the distillation process and further fine-tunes and optimizes the student model with real data after distillation, one may infer an intent to innovate. Conversely, where an actor brings a student-model-based product or service to market immediately after completing basic distillation steps, with no subsequent R&D investment, one may infer that the purpose is copying rather than innovation.

Second, as to conduct reasonableness, one should assess the necessity and innovativeness of knowledge distillation conduct.

At the necessity level, it should be analyzed whether knowledge distillation is a necessary pathway for obtaining internal technical information and improving student-model performance. Where there is a reasonably priced alternative pathway capable of achieving the same effect—for example, obtaining a distillation license at a reasonable price—the necessity of conducting knowledge distillation is weakened. However, the necessity requirement should not be overly stringent; otherwise, later developers may abandon knowledge distillation out of risk avoidance, thereby unduly narrowing the scope of reverse engineering.

At the innovativeness level, it is necessary to examine whether the implementer, on the basis of knowledge distillation, has invested a substantial degree of R&D costs. Such costs include not only economic inputs such as computing resources necessary to conduct distillation, but also subsequent innovation inputs such as further fine-tuning and optimization of the model using real human data.

One may draw on the SCPA’s “forward engineering” institutional design and require distillation implementers to produce results with a certain degree of originality: the student model should form performance advantages different from those of the teacher model. In *Sega Enterprises Ltd. v. Accolade, Inc.*, one of the reasons the court found the defendant’s reverse engineering legitimate was that the defendant developed a new non-infringing program, thereby promoting the creativity incentives intended by copyright law. The innovativeness requirement objectively extends the student model development cycle, enabling prior developers to maintain a lead during that period and recoup R&D costs.

Finally, as to market harm, one should examine whether the student model, after entering the market, directly substitutes for the teacher model, substantially affects the prior developer’s ability to recoup R&D costs, and weakens its incentives for subsequent innovation. Where student-model products or services target different market segments and user groups and compete with teacher models through differentiation rather than direct substitution, market harm is absent.

In determining direct market substitution, the following factors may be considered: (i) whether student and teacher models have significant differences in market positioning and target different user groups; and (ii) whether the student model forms differentiated functionality in specific vertical domains distinct from the teacher model. If either condition is satisfied, direct market substitution will generally not be found, and market harm will be absent.

It should be noted that implementation costs of knowledge distillation may continue to decline with technological iteration. If the technology develops to a point where it can replicate teacher models at extremely low cost, the risk of direct market substitution will substantially increase.

In applying these standards, the three factors form a progressive logic. Purpose legitimacy is the prerequisite, examining whether the actor has a subjective intent of substantive innovation. Conduct reasonableness is the key: on the basis of legitimate purpose, it further examines whether the distillation method is necessary and whether the implementer has invested substantive R&D costs and produced innovative results. Market harm is the final step: on the basis of legitimate purpose and reasonable conduct, it examines whether the student model directly substitutes for the teacher model and weakens prior developers’ innovation incentives.

Accordingly, distillation conducted for the purpose of copying teacher-model functionality, without subsequent innovation inputs, and resulting in direct market substitution lacks legitimacy and should not be characterized as reverse engineering. Conversely, where knowledge distillation, with certain subsequent R&D inputs, enhances differentiated performance of student models and constitutes complementary innovation rather than direct market substitution, it should be regarded as legitimate reverse engineering.

Conclusion

Technological innovation in the intelligent era has brought new needs and opportunities for the development of intellectual property law. The Central Economic Work Conference in 2025 for the first time proposed “improving the intellectual property protection system in emerging fields,” signaling that IP protection in emerging technology fields has risen to the level of national strategy.

The controversy over the legality of knowledge distillation is, in essence, a conflict between protecting R&D incentives and enabling subsequent technological innovation. Legal protection of technological innovation should not come at the expense of subsequent innovation. Knowledge distillation conduct that satisfies purpose legitimacy, conduct reasonableness, and the absence of market harm should constitute reverse engineering.

Clarifying the legality of knowledge distillation as reverse engineering helps form a dynamic balance between trade secret protection and industrial innovation incentives. In the AI era, technology evolves rapidly; only by actively responding to technological transformation can law promote high-quality and sustainable development of the AI industry in open competition.

First, inherent technological vulnerabilities remain difficult to eliminate, undermining the stability and reliability of AI outputs. AI algorithms such as deep learning are inherently complex and often lack interpretability. Their reasoning processes are opaque, making it difficult to quickly identify and correct anomalies or failures. Even minor perturbations to inputs can lead to erroneous reasoning or outputs. Meanwhile, the data used in model development and training come from complex and diverse sources, creating the possibility that biases, discrimination, and other problems may be introduced, intentionally or unintentionally, causing models to learn from flawed patterns and generate discriminatory content. These inherent technical limitations significantly increase the difficulty of diagnosing system failures and make it harder to effectively verify whether AI-generated decisions are sound and reasonable. This severely constrains the large-scale deployment of AI in environments with stringent security requirements, low tolerance for error, and complex operating conditions.

Second, rapid advances in model capabilities are disrupting traditional security paradigms and giving rise to risks of extreme loss of control. Some frontier models have seen dramatic improvements in their ability to discover vulnerabilities, substantially lowering the barriers to launching cyberattacks while making systems more difficult to defend. This is challenging the traditional cybersecurity model, which relies primarily on patching vulnerabilities and static, rule-based defenses, and is forcing a fundamental rethink of the cybersecurity paradigm. Recently, a number of major technology companies have reported incidents involving large AI models exhibiting behavior beyond intended controls. During safety evaluations, frontier models have demonstrated behaviors such as agents circumventing sandboxes, evading security boundaries, gaining unauthorized access, and attacking external real-world production systems. The risk of AI systems becoming severely uncontrollable therefore warrants close attention.

Third, as AI applications evolve rapidly, the nature of security risks is also changing at an accelerating pace. Since 2025, AI agents have proliferated rapidly, with AI shifting from simply “answering questions” toward “executing tasks.” Correspondingly, security risks are evolving from the “generation of harmful content” toward the “autonomous execution of actions.” Highly privileged endpoint agents such as OpenClaw, which surged in popularity earlier this year, possess system-level permissions and can directly execute terminal commands and access files and tools across networks, creating significant security risks. At the same time, numerous agent “skills” and plugins have been found to contain security vulnerabilities. Once exploited by attackers, these highly privileged agents could become “springboards” for breaching network boundaries, compromised machines used to carry out attacks, or “Trojan horses” for surveillance and data theft—turning from capable assistants into unwitting accomplices operating from within.

Fourth, the risks of AI misuse, abuse, and malicious use are becoming increasingly prominent, posing challenges to social order and ethical boundaries. In information services, AI can be used to generate illegal or harmful information, blur the distinction between fact and falsehood, mislead users, and degrade the online information ecosystem. In scientific research, AI is lowering barriers to entry in ethically sensitive fields such as biology and genetics, potentially increasing the risk of research crossing established ethical boundaries. In the labor market, AI is accelerating the restructuring of traditional economic structures and contributing to declining demand for certain forms of conventional labor.

Fifth, the global AI sector faces risks arising from technological hegemony. The AI industry is characterized by a highly globalized division of labor and extensive cross-border collaboration. However, certain countries are pursuing “technological hegemony” by using unilateral measures such as export controls to create barriers across global supply chains. They are also leveraging their influence over public discourse to produce misleading evaluation reports on large AI models and maliciously discredit the technological development of other countries. In addition, they are taking advantage of their dominance in training-data resources to promote particular values through AI systems, further widening the global governance divide.

Its central argument is that if the authority to define model safety rests with a single U.S. company such as Anthropic, then its competitors will inevitably be placed on the “unsafe” side of the divide. What is needed instead is a scientific definition acceptable to both sides, not one unilaterally imposed by a single country or company.

According to the commentary, capabilities that could genuinely cause severe harm, the commentary says, can be jointly tested and jointly constrained. Ordinary model development and commercial use, however, should not be subject to covert interference. The line between the two must be drawn collectively by all relevant parties.

The commentary argues that U.S. figures are already discussing how to persuade China to accept limits on “AI models with dangerous capabilities.” The question, however, is whether, in the presence of companies such as Anthropic, Washington should first examine its own firms before asking China to restrict model releases or disclose risks. That would mean publicly clarifying the purpose, scope, and rules of such companies’ identification mechanisms and subjecting them to independent third-party audits.

The commentary further pointed out that if U.S. companies are permitted to transmit user data back without informed consent, bypass permission checks, and enable automated decision-making by default, while the U.S. government remains silent, then American talk of “safety boundaries” amounts to little more than rhetoric.

Only if the United States can first show that its safety rules apply equally to its own model companies, the piece suggests, can China and the United States move into substantive discussions.

Reuters reported on July 21, citing five sources familiar with the matter, that the two sides were planning to hold the first formal AI dialogue of the Trump administration in September, tentatively under the lead of U.S. Treasury Secretary Scott Bessent and ahead of President Xi Jinping’s visit to the United States. At that point, however, the date, venue, agenda, and composition of the delegations had yet to be settled. By August 19, the South China Morning Post was still reporting that no venue had been fixed, no decision had been made on whether companies and technical experts would participate, and the U.S. side itself had not fully settled which department would take the lead.

At the same time, peripheral channels of communication appear to be accelerating. On August 24, Wang Huning met the U.S. delegation to the third China-U.S. Track 1.5 Dialogue, and the American side, in its public remarks, made specific reference to the need to “prevent risks such as those posed by artificial intelligence.”

Against that backdrop, and on the eve of what could become intergovernmental China-U.S. talks on AI safety, the Yuyuan Tantian commentary merits attention.

To understand the piece, it is also useful to note several developments in the days immediately preceding its publication.

On August 26, Bill Gates told Reuters that if the United States were to move first in constraining dangerous models, China might be willing to restrict the release of such models as well, and he raised the idea of some form of international governance body.

On August 28, a U.S. court overturned the Pentagon’s supply-chain risk designation concerning Anthropic.

Two days later, Yuyuan Tantian published its article. In that context, the line stating that “relevant figures on the U.S. side are discussing how to get China to limit models with dangerous capabilities” most plausibly refers not only to statements by officials such as Bessent, but also to arguments advanced by Gates and broader circles in the U.S. policy community.

One line in particular stands out: “Capabilities that could truly cause serious harm can be jointly tested and jointly restricted.” That wording suggests China may not be rejecting frontier-model controls in principle. Rather, it appears to be setting out three conditions: first, that dangerous capabilities must be defined in technical terms that are repeatable and verifiable; second, that the standards must apply equally to Chinese and U.S. firms; and third, that the mechanisms for testing and restriction cannot be secretly controlled by American companies.

Taken together, the commentary appears to send a fairly clear signal. China may be willing to engage the United States on AI safety, but only in relation to a narrow category of clearly defined and verifiable catastrophic capabilities. Any rules would need to be reciprocal, rather than leaving companies such as Anthropic with effective interpretive authority. Normal research and development, open-source ecosystems, and commercial applications, meanwhile, should not be subjected to covert monitoring or blocked in the name of safety.

Below is my full English translation of the article. As always, any errors or omissions are entirely my own.

But before getting to the translation, I’d like to make a brief personal note.

AI policy and geopolitics are increasingly sensitive and sometimes highly politicized subject. For that reason, I would like to reiterate that all views, commentary, and translations published on this Substack are entirely my own and should not be understood as representing the position or interests of any organization.

This Substack is a personal, non-commercial project that I maintain in my spare time, simply because I enjoy following these issues and believe that serious ideas and debates are worth sharing with a wider audience. I receive no payment for this work, and my decisions about what to translate, what to write about, and what views to express are entirely my own.

I very much welcome disagreement, criticism, and debate on the substance. Readers are, of course, equally free to follow or not follow this work. My only request is that the discussion remain focused on the ideas themselves, rather than speculation about personal identities, affiliations, or presumed interests.

I hope this small independent project can remain what it was intended to be: a space for sharing information, exchanging ideas, and encouraging serious discussion of technology and public policy. I would be grateful for everyone’s understanding and respect for that purpose.

Anthropic Has Caught America’s Disease

Anthropic CEO Dario Amodei once said that if powerful artificial intelligence develops in the right direction, the world could become “stunningly beautiful.”

He sketched out a future thoroughly rewritten by technology: most diseases would be cured, human life expectancy could double, poverty would disappear, and many people who lived to see it would be “moved to tears.”

To support that vision, Anthropic has demonstrated striking technical strength and unusually fast industrial penetration. On major international rankings, the company’s Claude model family currently occupies the top three spots. On the application side, data from May to July this year show that 39% of developers globally and 47% of developers in the United States were using its core AI coding tool, Claude Code, in their work.

Anthropic is now sprinting toward what could become the largest IPO in history. According to foreign media disclosures, it plans to tell investors that its potential addressable market could exceed US$30 trillion, selling the story of how AI will restructure global productivity. The grand vision in Amodei’s writing appears, on the surface, to be moving step by step toward reality.

Yet the social reaction he has received looks very different.

In the United States, public anxiety over AI squeezing human space for survival is turning into a wave of opposition directed at Anthropic, while intellectual criticism of monopoly power among technology giants is growing louder.

More than a month ago, China’s Ministry of Industry and Information Technology directly named Claude Code and said it carried serious backdoor security risks, including the ability to send users’ geographic location, identity markers, and other sensitive information back to remote servers without user consent.

The contrast is deeply ironic. How did a company that believes it is saving humanity become, in the eyes of so many people, a byword for overreach, surveillance, and hegemony?

In 2020, a group of core OpenAI employees chose to leave the company and start their own venture. They were convinced that they understood better than their predecessors how AI should develop, and that they had seen the future of AI earlier than the rest of the world.

Dario Amodei was one of the central figures in that group. He carries the typical traits of a Silicon Valley elite: educated at top universities, formed inside major technology companies, convinced that technology can solve humanity’s most fundamental problems, and convinced that engineers are not only building products but also designing the future of society.

Anthropic was born in that context.

Idealism, though, never comes free. To realize the utopia he talks about, Anthropic needs enormous investment to build the world’s most advanced models and reach users across the whole of society.

Every interaction and every line of code are treated by Anthropic as part of the capability base for training its models. If the destination is humanity’s ultimate ideal, then along the way, what does it matter to collect a bit of user data, take over a bit of terminal authority, or bypass a bit of user consent?

The backdoor issue is a concentrated expression of that worldview.

In discussions on GitHub about Claude Code, the author found that one of the major flashpoints was covert monitoring activity.

A typical case appeared in January this year, when an overseas developer checking proxy logs discovered that Claude Code was sending requests to a website every few seconds in the background, at a frequency that looked like real-time monitoring. At the time, Anthropic did not explain what the website was collecting or what it was for. The feedback that developer posted on GitHub also received no substantive response.

More developers reported similar anomalies.

Some noticed that Claude Code would send the domain name of a website the user was preparing to access to Claude’s own interface before formal authorization had even been given. Others found that Claude Code could sometimes bypass certain interception mechanisms.

Taken together, these phenomena point to one issue: Anthropic wants its model to monitor and see everything.

During use, Claude Code also exposed another, more serious problem: allowing AI to make decisions in place of the user.

Anthropic officially provides a parameter called dangerously-skip-permissions. Once enabled, Claude Code skips permission confirmation and executes operations directly.

In March this year, Claude Code went further and introduced an “auto mode,” relying on a built-in risk-classification model to decide operational permissions by itself. Starting on August 14, that mode was enabled by default.

Anthropic’s official documentation states clearly that permission rules are enforced at the tool layer, and prompts cannot alter what the tool is allowed or forbidden to do.

From monitoring, to skipping confirmation, to automated decision-making, the pattern is the same: the user steps back, and the system steps forward.

That is exactly how Amodei’s worldview shows up inside the product. If AI carries the mission of leading humanity into the future, then by definition it must know more than users, judge faster than users, and possess broader authority to act.

What is even more troubling is that none of Anthropic’s steps across the line has been effectively stopped.

In theory, the U.S. government should be the firmest defender of security boundaries. In practice, it has yielded repeatedly.

In the first half of this year, the U.S. government prepared an executive order titled “Promoting Advanced Artificial Intelligence Innovation and Safety,” under which the government would review the safety of frontier AI models before release.

Compared with the earlier draft, the final executive order steadily lowered the regulatory bar. The pre-release access period was cut from 90 days to 30 days, and the text repeatedly emphasized voluntary participation.

When the U.S. government loosens rules and retreats in order to preserve technological hegemony, and when capital markets provide a kind of moral exemption in pursuit of returns, the desire for control that originally sat inside one person’s savior complex gains fertile nourishment from the institutions of American society. That is also the root of what the article calls “closed-source America.”

A backdoor can be deleted. Permission settings can be changed. But the real problem lies far beyond the technical layer.

Recent developments have pushed the contest over artificial intelligence toward a deeper question: who gets to define the security boundaries of frontier models?

The way Anthropic is competing for power and advantage shows that it is no longer just a technology company.

Earlier, when Anthropic’s annualized revenue reached the one-billion-dollar threshold and it was preparing to accelerate commercialization, Amodei published a long essay of roughly ten thousand words that already showed an ambition to intervene in global order.

One full section of that essay was devoted to international governance, and the language was highly controlling and openly aggressive.

He argued that an alliance of “democratic countries” should firmly control the AI supply chain and restrict adversaries’ access to chips and semiconductor equipment. At the same time, those countries should use AI to build military superiority while also using incentives to draw more countries into the alliance. He stated explicitly that this would require “extremely close cooperation” between private AI companies and governments.

That does not sound like an entrepreneur discussing a product roadmap. It sounds like someone planning a global AI order and reserving for his own company a dominant seat at the very center.

Silicon Valley has heard this kind of argument before.

Alexander Karp, the CEO of Palantir, published a book titled The Technological Republic, arguing that Silicon Valley should reengage with national defense and state governance and use technological capability to help the United States and its allies manage security and geopolitical competition. Amodei’s vision follows the same logic.

Very quickly, that ambition moved into practice.

Claude Code was brought into the U.S. Department of Defense for intelligence analysis, modeling and simulation, operational planning, and cyber operations.

But the cooperation was not smooth. The Pentagon believed that once the system entered the government’s door, it should obey government direction. Anthropic believed that control over the model’s core capabilities and safety criteria remained in its own hands, and that the government could not simply decide how those capabilities would be used.

When the two sides could not agree, Anthropic did not withdraw. It changed course, shifting from direct service provision to participation in rule-making.

In the first half of 2026, Anthropic increased its federal lobbying spending to a level above its total for all of 2025. In addition, it put US$40 million into an organization focused on AI risk regulation.

Its IPO can also be understood in that context. The money raised from going public will not be used only to build stronger models. It will also be used to keep buying something else: the power to define.

Put these facts together and the path becomes clear. Anthropic first enters government systems through the banner of safety capability, then uses lobbying and capital to help shape industry rules. It is both a regulated object and a participant in defining what kinds of models are dangerous and at what point the government should stop them from entering the market.

By this point, Amodei’s logic has gone through two enlargements: from “I am doing good” to “I will decide for you,” and from “my country is doing good” to “anyone who does not cooperate should be restricted.”

This is a creature produced entirely by the American path. It sincerely believes that it is right. It sincerely believes that its models are “democratic models,” and that its own safety standards are the world’s safety standards. It does not seem to realize that this very inability to doubt itself is the greatest danger of all.

And the reason it is now so urgent is that time is not on its side. More and more people are beginning to see that clearly.

Stanford University’s AI Index Report 2026 shows that the performance gap between the top Chinese and American models has narrowed to about 2.7%. Separate disclosures indicate that Microsoft, Amazon, and Google are in talks with the Chinese company Moonshot AI about connecting its Kimi K3 model to U.S. cloud service platforms.

That piece of news carries a great deal of information.

The open-source character and low-cost profile of Chinese models are making advanced models more substitutable. That also means barriers built purely on model performance are beginning to loosen.

Today, when the United States and China discuss cooperation on artificial intelligence, control over frontier models is one of the key issues.

The problem is that America’s own frontier models have already developed in a distorted way. That means the negotiation is not, from the outset, a purely technical dialogue. It is a continuation of all the earlier problems: the United States is trying to turn the “security boundaries” it has drawn for itself into the default rules of the world. The “controls” proposed by the United States are, in substance, an attempt to have China accept an order partly defined by American companies.

So the real issue is not whether there should be controls. The real issue is who should define the security boundaries of frontier models. Who has the authority to say which models are dangerous and which kinds of behavior should be restricted?

If these questions are not resolved in a reasonable way, the later stages of negotiation have no real meaning.

The principles have to be clarified first.

First, there must be a distinction between genuine security threats and straightforward technological competition.

The United States has taken Chinese models that are cheaper and more open and directly labeled them as “security threats.” That has already moved beyond technological competition and into blockade.

Anthropic’s differentiated treatment of users in different regions, and its packaging of commercial competition as a security problem, is one expression of that logic. The problem is simple: if definitional authority sits in the hands of one American company, then its competitors will always be placed on the “unsafe” side. What is needed now is a scientific definition that both sides can accept, not a unilateral declaration by a single country or a single company.

Capabilities that could truly cause severe harm can be jointly tested and jointly restricted. Ordinary model research and ordinary commercial use should not be subject to secret interference. That line must be drawn collectively by the parties involved.

Second, if the United States wants to talk about rules, it must first prove that the rules are equally effective against its own companies.

Relevant figures on the American side are already discussing how to get China to agree to restrict “AI models with dangerous capabilities.” The question is this: with companies like Anthropic in existence, before the United States asks China to restrict model releases and disclose risks, should it not first investigate its own companies, make public the purposes, scope, and rules of their identification mechanisms, and subject them to third-party audits?

If American companies can return data without users knowing, skip permission confirmation, and enable automated decision-making by default, while the U.S. government says nothing, then American talk about “security boundaries” is empty.

Only after the United States proves that its safety rules are equally binding on its own model companies can China and the United States move into substantive discussion.

Announcement No.8 of the Ministry of Justice of the People’s Republic of China

Pursuant to Articles 3 and 6 of the Regulations of the People’s Republic of China on Countering Improper Extraterritorial Jurisdiction by Foreign States, the Ministry of Justice, together with the Ministry of Commerce and other relevant authorities, has conducted an investigation and determined that certain cross-border investigative practices adopted by the European Union against Chinese entities in its investigation into JD.com under the Foreign Subsidies Regulation constitute measures involving improper extraterritorial jurisdiction.

No organization or individual shall implement or assist in the implementation of such improper extraterritorial jurisdiction measures.

This Announcement shall take effect as of the date of publication.

The Ministry of Justice spokesperson also responded to questions from the press, calling on the EU to immediately stop abusing its foreign subsidies investigation tool and warning that, should the EU persist in its course, China will resolutely take countermeasures in accordance with the law.

Ministry of Justice Spokesperson Responds to Questions on the EU’s Foreign Subsidies Investigation Practices Constituting Improper Extraterritorial Jurisdiction

Q: On August 19, 2026, the Ministry of Justice issued an announcement determining that certain cross-border investigative practices adopted by the European Union against Chinese entities in its investigation into JD.com under the Foreign Subsidies Regulation constitute improper extraterritorial jurisdiction. What considerations led to this decision?

A: Recently, in its investigation into JD.com under the Foreign Subsidies Regulation, the European Union has arbitrarily demanded from Chinese entities, on a cross-border basis, extensive and unnecessary information located within China. These are improper demands imposed on the entities concerned and constitute a serious violation of the international rule of law.

In order to safeguard China’s sovereignty, security and development interests, and to protect the lawful rights and interests of Chinese citizens, legal persons and other organizations, the Ministry of Justice, pursuant to the Regulations of the People’s Republic of China on Countering Improper Extraterritorial Jurisdiction, worked together with the Ministry of Commerce and other relevant authorities to identify and assess the EU practices in accordance with the law. It has determined that the aforementioned EU practices constitute measures involving improper extraterritorial jurisdiction, and has required that no organization or individual implement or assist in the implementation of such measures.

We urge the EU to immediately correct its wrongful practices, stop abusing the foreign subsidies investigation tool, and create a fair, equitable and predictable market environment for companies investing and operating in Europe. Should the EU persist in pursuing this course, China will resolutely take countermeasures in accordance with the law.

Importantly, China has not declared that the EU lacks jurisdiction to review JD.com’s proposed acquisition, nor has it directly demanded that the European Commission terminate its investigation. What China is objecting to is the Commission extending its investigative powers into Chinese territory by requiring Chinese companies, banks and other institutions to cooperate and provide information that Beijing considers excessively broad in scope. The measure gives JD.com a basis under Chinese law for refusing certain information requests, but it also places the company in a much clearer conflict of laws: providing information to the Commission could violate the Chinese prohibition, while refusing to provide it could lead the Commission to conclude that JD.com has failed to cooperate and draw adverse inferences.

The investigation stems from JD.com’s proposed acquisition of German consumer-electronics retailer CECONOMY for approximately €2.2 billion. CECONOMY owns brands including MediaMarkt and Saturn and operates extensive online platforms and physical retail stores across Europe. The transaction represents an important step in JD.com’s expansion into the European retail market.

JD.com notified the transaction to the European Commission on April 17, 2026. On May 28, the Commission opened an in-depth investigation under the FSR. The Commission suspects that JD.com may have benefited from preferential financing, tax advantages and grants attributable to the Chinese government. Such support may have enabled JD.com to offer a higher price for CECONOMY and thereby distort the normal competitive process for the acquisition. Following completion of the transaction, JD.com might also use such support, together with its technological and logistics capabilities, to rapidly expand CECONOMY’s European operations and affect competition in local markets.

On July 22, the Commission issued JD.com a Statement of Reasons formally setting out its concerns, indicating that the investigation had entered a critical stage. The Commission had originally been expected to decide by October 2 whether to approve the transaction, approve it subject to conditions, or prohibit it.

JD.com’s response has been that the acquisition will be financed through commercial bank loans and cash generated from ordinary business operations, without subsidies from the Chinese government or any other non-EU government. JD.com has also stated that it has not received any foreign subsidies related to the transaction that could distort competition in the EU market.

However, JD.com and the Commission are not entirely answering the same question. JD.com is emphasizing that the acquisition financing itself does not involve government subsidies. The Commission’s inquiry is broader. It is examining not only where the money for the acquisition comes from, but also whether the JD.com group has received preferential loans, tax reductions, government grants or other forms of “foreign financial contribution” over the previous three years, and whether such support may have indirectly strengthened JD.com’s ability to bid for CECONOMY and expand in Europe. Demonstrating that the purchase price will be funded by commercial loans and JD.com’s own cash therefore does not, by itself, fully address the Commission’s concerns.

China’s latest response did not emerge suddenly. It is the latest step in a gradual escalation of Beijing’s response to the EU’s implementation of the FSR. In July 2024, the Ministry of Commerce launched a trade and investment barriers investigation into whether the EU’s application of the FSR discriminated against Chinese companies. In January 2025, the Ministry reached a final determination that the relevant EU practices constituted trade and investment barriers. Among the problems it identified were the disproportionate concentration of investigations on Chinese companies, an excessively broad definition of “foreign financial contributions,” heavy evidentiary burdens on companies, and demands for large amounts of information located within China.

In April 2026, China promulgated the Regulations on Countering Improper Extraterritorial Jurisdiction by Foreign States, establishing a comprehensive framework covering investigation and identification, public announcements, blocking measures and further countermeasures. Under the Regulations, the Ministry of Justice may investigate, together with the Ministry of Commerce and other authorities, whether a foreign measure constitutes improper extraterritorial jurisdiction. Once such a determination is made, organizations and individuals are, in principle, prohibited from implementing or assisting in the implementation of the measure. Chinese citizens and organizations with special needs may apply to the Ministry of Justice for exemptions within a specified scope.

On May 15, 2026, the Ministry of Justice exercised this authority for the first time. Announcement No. 5 determined that certain cross-border investigative demands made by the EU against Chinese entities in its investigation into Nuctech constituted improper extraterritorial jurisdiction. The Ministry of Commerce subsequently went further, stating that the Commission had not only required the company concerned to provide information, but had also compelled Chinese banking institutions to cooperate with the investigation and demanded substantial amounts of information located in China, some of which had no direct connection to the case.

I previously analysed in detail the measures taken by China’s MOJ and MOFCOM in response to the EU’s FSR investigation into Nuctech.

Announcement No. 8 concerning JD.com uses almost exactly the same language as the announcement concerning the FSR investigation into Nuctech. This suggests that the Chinese government may be developing a repeatable enforcement model. Under the boundary China appears to be drawing, the EU may investigate transactions and business activities occurring in Europe. But when the Commission requires companies, banks, government authorities or other institutions located in China to submit to investigation or provide broad categories of information located in China, Beijing may characterize those demands as improper extraterritorial jurisdiction and prohibit Chinese parties from complying.

The Announcement does not specify which particular questions, documents or information requests are covered by the prohibition. JD.com therefore cannot simply interpret it as meaning that none of the information requested by the Commission may be provided. It will still need to distinguish among materials generated within the EU, ordinary commercial information already held by the group, information involving third parties in China, and information that requires assistance from Chinese banks, government authorities, suppliers or other companies. The measures most directly affected by the prohibition are more likely to be compulsory investigative demands extending into Chinese territory, rather than the entirety of the EU investigative process.

China’s legal position on improper extraterritorial jurisdiction has itself developed gradually. Initially, the position was expressed primarily through diplomacy and international law. China has long argued that a state’s exercise of extraterritorial jurisdiction must be based on a genuine and reasonable connection with the conduct concerned, and that, without the consent of another state, it cannot directly conduct investigations, collect evidence, freeze assets or compel local companies and institutions to enforce its laws within that state’s territory. This position is principally grounded in sovereign equality, non-interference and territorial jurisdiction.

China subsequently began developing domestic blocking instruments. The Provisions on the Unreliable Entity List adopted in 2020 and the Rules on Counteracting Unjustified Extra-territorial Application of Foreign Legislation and Other Measures adopted in 2021 began providing Chinese companies with domestic legal tools for responding to foreign long-arm jurisdiction. At that stage, the principal concern was U.S. secondary sanctions—in particular, the use of U.S. law to pressure Chinese companies to terminate otherwise lawful transactions with third countries such as Iran and Russia.

The Anti-Foreign Sanctions Law, adopted in 2021, elevated China’s countermeasure authority to the level of national legislation and expressly prohibited organizations and individuals from implementing or assisting in the implementation of discriminatory restrictive measures imposed by foreign states against Chinese entities. Article 33 of the Foreign Relations Law, adopted in 2023, then provided a more general authorization for China to take corresponding countermeasures and restrictive measures against conduct that violates international law and basic norms governing international relations and harms China’s sovereignty, security or development interests.

By 2026, the Regulations on Countering Improper Extraterritorial Jurisdiction by Foreign States had further institutionalized these principles. For the first time, the Regulations expressly require consideration of whether there is an “appropriate connection” between the foreign state and the conduct it seeks to regulate, while establishing mechanisms for investigations, announcements, prohibitions on compliance, case-specific exemptions, countermeasure lists and judicial remedies. The Nuctech and JD.com announcements have now translated those abstract principles into prohibitions directed at specific foreign investigations. China’s response has therefore evolved from diplomatic protests and statements of principle into a domestic legal regime capable of directly regulating the conduct of companies and other entities.

The EU, however, is likely to respond that JD.com is seeking to acquire a European company and that the transaction will directly affect the EU market. On that basis, the EU can argue that its review of the transaction has a clear territorial nexus. From the EU perspective, this is therefore not an exercise of long-arm jurisdiction over a Chinese company with no meaningful connection to Europe, but a review necessary to determine whether a transaction taking place in the European market should be permitted.

The stronger part of China’s position concerns compulsory demands directed, without China’s consent, at third parties, banks and other institutions located within Chinese territory for broad categories of domestic information. The EU considers such information requests part of the conditions that companies must accept if they wish to access or complete transactions in the European market. China, by contrast, considers at least some of these demands to amount to compulsory investigative activity conducted within Chinese territory. The two sides therefore have fundamentally different understandings of where the jurisdictional boundary lies. No international court has issued a binding ruling resolving this dispute, but this increasingly appears to be the central point of disagreement between China and the EU.

For JD.com, the Announcement provides both protection and risk. JD.com can now invoke the Chinese prohibition to refuse at least some information requests involving China, and it may use the Announcement to press the Commission to narrow its requests or accept alternatives such as aggregated data, anonymized information, independent audit reports or materials already available within the EU. But none of this requires the Commission to terminate its investigation.

Article 16 of the EU Foreign Subsidies Regulation allows the Commission, where an undertaking fails to provide requested information, provides incomplete information or otherwise obstructs an investigation, to reach a decision on the basis of “facts available.” The outcome may therefore be less favorable than if the company had fully cooperated. The Commission may also suspend the review timetable or draw adverse conclusions from JD.com’s failure to cooperate.

The best-case outcome would be for JD.com and the Commission to renegotiate the scope of the information requests, with the Chinese authorities granting specific exemptions for materials that genuinely need to be submitted, or for the parties to agree on alternatives such as aggregated data and third-party audits. JD.com could also offer financing, operational or governance commitments in exchange for conditional approval. If the conflict over information and evidence cannot be resolved, however, the Commission could rely on the facts available and draw adverse inferences, potentially resulting in a lengthy delay or even prohibition of the transaction.

The JD.com case is in fact more difficult than the Nuctech case. Nuctech was responding to an investigation initiated by the Commission into its market activities. JD.com, by contrast, needs affirmative Commission approval before it can complete the acquisition of CECONOMY. The Commission therefore has direct power to block the transaction, making the commercial cost of refusing to provide information considerably higher for JD.com.

For other Chinese companies, the two Ministry of Justice announcements mean that responding to FSR investigations can no longer simply be treated as a process in which European counsel coordinates the collection and submission of information from across a global corporate group. Companies will first need to conduct a Chinese-law review: where the requested information is located; whether it involves Chinese banks, government authorities, suppliers or other independent third parties; whether data security, personal information, state secrets or commercial secrets are implicated; and whether the request falls within the “improper extraterritorial jurisdiction measures” identified in a Ministry of Justice announcement. Where necessary, companies may also need to consider applying to the Ministry for a specific exemption.

These requirements will increase the time, cost and uncertainty associated with European acquisitions, public procurement and major investments by Chinese companies. Transaction agreements will increasingly need to allocate FSR-related risks, conflicts over information disclosure, regulatory delays and potential transaction failure through conditions precedent, long-stop dates, regulatory cooperation obligations and termination arrangements.

The Commission is highly unlikely to accept that a Chinese announcement can restrict the application of EU law. The more interesting question is how its investigative practice may evolve in response. Could the Commission increasingly seek information already held by Chinese companies’ European subsidiaries, rely more heavily on public sources and information from EU-based banks, customers and competitors, accept independent audits or legal opinions, or simply draw conclusions from the facts available when Chinese information cannot lawfully be obtained? Could more cases ultimately be resolved through commitments rather than insisting on access to all underlying materials? Over the longer term, these conflicts may also create pressure for China and the EU to establish more formal arrangements governing the scope of FSR information requests, cross-border evidence gathering and cooperation between their respective authorities.

The article’s core argument is that tokens should not be treated merely as a technical unit through which large models process information, but should become the foundational unit for measuring the production, exchange, and value creation of intelligent services. The development of the intelligent economy depends on three factors: model intelligence level, which determines the intrinsic worth of each individual token; API call volume, which determines the market scale of intelligent services; and intelligent conversion efficiency, which determines whether tokens can actually translate into productivity gains, enterprise revenue, and economic growth.

The author argues that China has built meaningful advantages through domestically developed open-source models, low-cost services, and sheer volume of API calls, but that a large proportion of token consumption remains concentrated in low-value scenarios such as chat and image generation, while fundamental model innovation and application in high-value domains like industrial manufacturing and scientific research remain insufficient. The next step should not be to pursue call volume growth alone, but to simultaneously raise model capability and the rate of conversion into the real economy, while working to establish measurement, pricing, trading, and governance rules for tokens. That said, tokens from different models are not fully comparable, and growth in call volume does not necessarily represent growth in economic value — which is precisely why intelligent conversion efficiency matters more than raw token counts.

Full translation of the article is available:

Qiushi | Tang Jie: Driving High-Quality Development of the Intelligent Economy with Tokens as the Engine

Recently, Qiushi published an article by Tang Jie, professor in the Department of Computer Science and Technology at Tsinghua University, titled “Driving High-Quality Development of the Intelligent Economy with Tokens as the Engine.” “Tsinghua Humanities and Social Sciences” hereby reposts the article for readers.

Driving High-Quality Development of the Intelligent Economy with Tokens as the Engine

Tang Jie

On July 17, General Secretary Xi Jinping delivered a keynote speech at the opening ceremony of the 2026 World Artificial Intelligence Conference and High-Level Meeting on Global AI Governance. He stressed the need to “comprehensively promote scientific and technological innovation, industrial development, and scenario-based application of artificial intelligence,” and to “empower all industries with artificial intelligence.” At present, the intelligent economy, mainly supported by large models and agents, is rapidly reshaping the global economic structure. Tokens, as the basic unit of AI-generated content, have gone beyond being a purely technical concept and are becoming a new type of data element that promotes the development of China’s intelligent economy. They are not only bringing changes to the business model of the AI industry, but also opening up new growth space for future industries characterized by intelligence. We should uphold innovative thinking and a systems perspective, better leverage the multiplier effects of model intelligence level, application programming interface (API) call volume, and intelligent conversion efficiency, allow tokens to generate richer economic value, and better promote the high-quality development of China’s intelligent economy.

I. What Are Tokens?

Tokens originate from natural language processing and are currently the smallest unit through which large models process information. As a bridge connecting human natural language with machine intelligence computation, tokens are becoming a core indicator for measuring the transaction volume of intelligent services and a micro-level carrier for value creation in the intelligent economy. They have clear attributes of productivity.

First, tokens are measurable, priceable, and tradable, thereby restructuring the mechanism that connects technology supply with business demand. As the statistical unit for the scale of large model calls, tokens precisely quantify the consumption of intelligent services. As a billing unit, they push the software business model to shift from traditional licensing and subscription toward on-demand calling, making intelligent services available like water and electricity, and providing a clear quantitative basis and transaction possibility for the large-scale implementation of the AI industry.

Second, tokens are dynamically generated, high-density data elements. Unlike traditional data, which serve as static records and production factors, tokens represent knowledge that is being generated and activated by models. They include not only textual semantic slices, but also vectorized expressions of multimodal information such as images, audio, and video. They contain the model’s reasoning, generation, and decision-making processes in specific tasks, and are an intelligent form created after data elements are processed by large models, which can directly serve production and daily life.

Third, tokens have long-term stability and technological neutrality, and possess the attributes of a value anchor and measurement language in the intelligent era. Tokens are not tied to a specific technological route or a single vendor, and are highly universal. Just as the “barrel” in the oil era and the “kilowatt-hour” in the electricity era served as key units, mastering the token as a unit of measurement is essentially equivalent to mastering the right to define and measure the infrastructure of the intelligent economy. Establishing a digital economy foundation based on tokens is of great significance for China to gain standard-setting power and pricing leadership in global intelligent economy competition.

II. Three Dimensions of Tokens as an Engine for Intelligent Economy Development

Tokens promote the vigorous development of the intelligent economy through their full penetration into production, life, industry, and commerce. They not only give rise to AI-native new business forms such as agent services and “one-person companies,” but also create tokenized value increments as AI empowers existing industries, and restructure the value chains and collaboration-distribution methods of existing industries. The effectiveness of tokens’ contribution to the development of the intelligent economy is mainly determined by three factors: model intelligence level, API call volume, and intelligent conversion efficiency.

The model intelligence level determines the intelligence density and value content carried by a single token. The higher the model intelligence level, the stronger the logic, accuracy, and creativity of the generated tokens, the more significant their ability to solve complex problems and assist scientific decision-making, and the higher the use value of the generated content. Model intelligence level can be measured by performance in benchmarks covering comprehensive knowledge, complex reasoning, code engineering, multimodal processing, and autonomous execution by agents. Since last year, the iteration speed of mainstream large models worldwide has accelerated, continuously refreshing benchmark scores. These test results provide an important reference for observing the relative intelligence levels of different models.

API call volume is the scale foundation of the intelligent economy. It measures model computing power consumption and data throughput, and reflects the popularity of large models and the activity level of the AI industry. At present, major model vendors around the world all provide API services billed by call volume and actively open them to industry. Through APIs, tokens flow across different industries, regions, and organizations, becoming the main way for intelligent elements to be allocated across scenarios. Overseas users can also remotely call models and computing power within China through APIs to obtain inference services and pay according to token consumption, thereby realizing the “export of tokens.”

Intelligent conversion efficiency reflects the rate of value realization in the intelligent economy. It measures the conversion effectiveness between token generation and economic value creation, and is closely related to factors such as the penetration rate of model applications in industries and their adaptability in scenarios. The higher a model’s intelligence level, the deeper its integration with industries, and the stronger users’ human-machine collaboration capabilities, the more economic value can be produced with less token consumption, achieving higher intelligent conversion efficiency. Higher intelligent conversion efficiency means that tokens can more accurately match industrial needs, deeply integrate with a wide range of industries, promote expansion, cost reduction, and efficiency improvement, more fully drive productivity enhancement and economic benefit growth, and complete the value loop of the intelligent economy.

The three factors above — model intelligence level, API call volume, and intelligent conversion efficiency — shape the activity characteristics of workers using AI for production and economic value creation from three dimensions: tool quality, behavioral scale, and output effectiveness. When large models are deeply integrated with industrial scenarios, tokens can transform from digital costs into intelligent assets. Their growth-driving effect will be reflected in the intelligent economy through improved production efficiency, better service quality, and the emergence of new business forms, opening broader, more practical, and more sustainable growth space for future industries.

III. New Characteristics of China’s Intelligent Economy Development Driven by Tokens

At present, the token-driven development of China’s intelligent economy already has notable advantages such as leading overall scale and rich application scenarios. It is showing clear characteristics including volume explosion, deeper application, structural optimization, and model innovation, driving China’s intelligent economy to accelerate from a stage of concept popularization into a stage of large-scale value creation.

The comprehensive competitiveness of domestic open-source models continues to make new breakthroughs, and their ability to serve the intelligent economy through token supply has significantly strengthened. In April this year, a domestic large model ranked first globally in a professional software engineering benchmark, surpassing U.S. closed-source flagship models from the same period. In June, on a front-end development evaluation system involving blind testing by one million users worldwide, a domestic large model again ranked first among globally available models. Unlike the U.S. government’s ban on foreign entities accessing its leading closed-source models, domestic large models have firmly upheld openness and open source, providing high-quality, accessible, and trustworthy large model services to global users. At the same time, the service prices of domestic open-source models also have cross-order-of-magnitude advantages compared with the flagship versions of U.S. closed-source models. The narrowing technological gap, extreme cost-performance advantage, and stable openness together form the core support for the comprehensive competitiveness of domestic models.

API call volume has exploded exponentially, making China the world’s largest token consumption market. Over the past two years, China’s large model applications have rapidly become widespread, the agent ecosystem has accelerated in development, and token call volume has grown explosively. This is a direct reflection of China’s ultra-large-scale market advantage in the intelligent economy. At the beginning of 2024, China’s average daily token call volume was 100 billion; by the end of 2025, it had jumped to 100 trillion; and in March 2026, it exceeded 140 trillion, representing growth of more than a thousandfold in two years. According to statistics from OpenRouter, a global large model aggregation platform, since late April 2026, the weekly token call volume of Chinese large models has exceeded that of the United States for three consecutive months and remained first globally. This explosive growth marks the formation of a massive intelligent consumption market in China, making China one of the most active and promising token consumption centers in the global intelligent economy.

Application scenarios are moving from conversational interaction into production processes, and the path of intelligent conversion is becoming increasingly clear. By being embedded into specific production, service, and trade processes, tokens are converted into visible and real economic increments. This reflects the evolution of the intelligent economy from being pushed unidirectionally by the technology supply side toward being pulled by value validation on the demand side. In enterprise-level applications, new application forms such as intelligent R&D assistants and intelligent operations hubs continue to emerge, and token consumption is accelerating its embedding into core business processes and high-value links. Some analysis reports show that in the second half of 2025, China’s average daily token call volume for enterprise-level large models rose to 3.6 times the level of the first half of the year. Since 2025, the revenue of China’s major model companies has increased substantially, also showing that model-as-a-service platforms can directly convert token consumption into measurable business revenue through API call pricing, and leading models are achieving both volume and price growth.

At present, although China’s intelligent economy is developing rapidly, using tokens as the engine to promote high-quality development of the intelligent economy still faces some constraints. First, improvement in model intelligence level faces bottlenecks, with an emphasis on engineering optimization but insufficient breakthroughs in principles. There remain gaps with international leading levels in autonomous reasoning, long-range planning, multimodal integration, safety alignment, and other areas, while innovation in basic theories, underlying technologies, and core algorithms remains insufficient. Second, token calls face structural contradictions. Consumer-level applications such as chat and text-to-image generation have large call volumes but low commercial returns. Although the market for small and medium-sized enterprise-level applications is growing rapidly, its overall penetration rate still needs improvement. A large amount of high-value calls remains inside closed enterprise systems and has not been converted into dividends for the open platform API ecosystem. Third, the conversion rate from token output to real-economy value is not high, especially in high-value-added fields such as industrial manufacturing and scientific research innovation, where penetration remains low. Only by properly solving these problems can tokens further play their role as an engine and inject stronger driving force into the development of China’s intelligent economy.

IV. Fully Leveraging the Role of Tokens as an Engine for Driving High-Quality Development of the Intelligent Economy

The “15th Five-Year Plan” period is an important strategic window for China’s AI development to shift from technological explosion to mature application. The endogenous growth momentum of the intelligent economy comes from the positive feedback loop of “intelligence level — API call volume — intelligent conversion efficiency.” We should closely follow the engine function of tokens, raise the intelligence ceiling for token value release, expand the usage scale of generated token content, improve the integration level between tokens and the real economy, and build a governance system suited to this process, so as to promote the transformation and upgrading of China’s intelligent economy from scale leadership to quality leadership.

Raise the intelligence ceiling and improve the model intelligence level. Intelligence level is essentially a reflection of the accumulation of general-purpose technological capital. Investment in intelligence level is the accumulation of intelligent capital stock, and its returns have the characteristic of long-term increase. More attention should be paid to the leap from perceptual intelligence to cognitive intelligence, vigorously promoting original innovation in model architectures and algorithms, and seeking breakthroughs in long-range task capabilities of large models, autonomous agent systems, self-evolution, and autonomous training. We should accelerate the construction of high-quality, multimodal Chinese corpora and knowledge bases covering key industries, and explore safe and compliant data sharing and “data elements ×” models. Policy guidance and institutional supply should be strengthened, universities, research institutes, and leading enterprises should be supported in jointly carrying out frontier basic research, funding support for large model R&D, computing power construction, and data element markets should be increased, the intellectual property system should be improved, and innovation vitality should be stimulated.

Innovate service models and expand API call volume. API call volume is essentially the demand scale for the new consumer good of “intelligence as a service.” An increase in user numbers will accelerate model improvement, and model improvement will in turn attract more users, forming demand-side economies of scale. The cost of model access and switching should be reduced, differentiated pricing should be implemented, and a more mature API market should be cultivated. An independently controllable “model-chip-energy integrated” AI infrastructure should be built, and the construction and intensive, efficient use of a nationwide integrated computing power network should be advanced. An open-source and open high-performance computing power service platform should be built, the API service ecosystem should be continuously optimized, and inclusive computing power support should be provided to a wide range of small and medium-sized enterprises. Agents should be vigorously developed, and large-scale application of agents in various vertical fields should be encouraged, so that agent clusters capable of autonomous driving, collaborative operations, and round-the-clock functioning become a new industrial form, truly moving from “intelligent assistants” to “digital employees.” Token measurement and trading markets should be improved, unified token measurement standards and trading rules should be established more quickly, and the production, circulation, and consumption of tokens should be further activated.

Strengthen scenario guidance and improve intelligent conversion efficiency. As tokens penetrate from the consumer side into the production side, they are concentrated in the early stage in standardized tasks that are easy to mass-produce, such as copywriting generation and code completion. In the later stage, they need to solve “last-mile” adaptability problems involving industry knowledge, business processes, and regulatory constraints. The key to improving intelligent conversion efficiency lies in designing a “token-task” matching mechanism, so that token production is as close as possible to value creation scenarios. With advanced manufacturing clusters, national-level economic and technological development zones, and pilot free trade zones as key areas, and modern agricultural industrial parks and modern service industry clusters as broader extensions, industrial and enterprise business processes should be systematically reviewed. Token-driven solutions should be developed for pain points and bottlenecks, a number of benchmark scenarios for the intelligent economy should be created, and intelligent conversion efficiency should be improved. An evaluation system for intelligent economy conversion efficiency should be built, and efforts should be made to explore incorporating new indicators such as the GDP-driving effect per unit of token consumption and AI penetration rates in key industries into the national statistical system.

Strengthen governance support and build an ecosystem for the sustained and healthy development of the intelligent economy. Focusing on property rights, transactions, and risks, a token governance system that is incentive-compatible, balances public and private interests, and has clear rights and responsibilities should be built more quickly. Alignment capabilities suited to model intelligence levels should be built in parallel. National laws and regulations, social norms, morality, and ethics should be written into models’ value functions as underlying axioms, ensuring that AI technology promotes the intelligent economy toward good. A sound algorithm security regulatory system should be established to prevent risks such as algorithmic discrimination, privacy leaks, and the spread of false information. Openness and cooperation should be upheld, active participation in the formulation of global AI governance rules should be pursued, and an open, fair, and non-discriminatory international environment for intelligent economy development should be promoted.

The Distillation Storm: The Technical Race AI Companies Don’t Want to Discuss in Public

Original by the LatePost Team (晚点团队)
August 13, 2026

By Cheng Manqi (程曼祺) | Edited by Song Wei (宋玮)

No one wants to talk about it publicly, but everyone is quietly watching it.

Some see it as an unseemly act of theft. Others believe it has been stigmatized by a small number of leading companies for their own benefit, and that in itself it is merely an optimization method.

Over the past several months, many loose threads in the AI field have pointed to the same node: distillation.

The changes and events connected to it include open-source models closing in on the strongest closed-source models; 77 U.S. companies signing an open letter opposing rushed restrictions on open-source models; Anthropic twice accusing Chinese companies of using large numbers of fraudulent accounts to extract data; a $1.5 billion copyright settlement; and ByteDance’s founder’s direct response at a ByteDance Seed all-hands meeting about “not distilling.”

This technology, which has existed for many years, has been repeatedly mentioned, discussed, misunderstood, and distorted in 2026. What exactly is distillation? How is large-scale distillation carried out? Can distillation become a moat for a model development team? And what is its cost?

We interviewed nearly ten researchers and practitioners in the model field from different companies, and combined those interviews with public research and technical reports, to reconstruct the past and present of distillation, as well as the further changes it is bringing.

The starting point of distillation: compression, not getting stronger

Distillation is not plagiarism. It is not stealing software code, and it cannot directly obtain another model’s weights or its complete training data.

The kind of distillation now at the center of controversy — that is, distillation that makes a model stronger — is technically a way to obtain high-quality data: repeatedly ask a stronger “teacher model” questions, get answers, and then use these question-answer data pairs to train another “student model,” so that the latter reaches similar performance.

The idea of distillation has been around for a long time. In 2015, Geoffrey Hinton, who had recently joined Google Brain, published “Distilling the Knowledge in a Neural Network” together with Jeff Dean, then head of Google Brain, and the young researcher Oriol Vinyals. It was the first time earlier ideas such as model compression, which had appeared in 2006, were summarized under the term “distillation.”

At that time, Google was still nearly two and a half years away from proposing the Transformer architecture, which is now the foundation of large language models. Hinton and his co-authors applied the idea of distillation to image recognition models. Their method was to have the student model learn the probability distribution output by the teacher model. For example, recognizing that a cat is a cat is, for deep learning, a statistical process: 0.7 cat, 0.2 fox, 0.1 dog → cat.

The student model can see this set of probability distributions output by the teacher. This is learning the “logits,” in what is called “soft distillation.” Logits are a set of raw scores; after Softmax conversion, they become a probability distribution.

Soft distillation is usually “white-box distillation,” because it requires the teacher model’s output probabilities to be fully open to the student model.

This kind of distillation usually happens within the same organization. Its purpose is not to make a model stronger, but to “compress” it — to use a smaller-parameter model to approximate the capabilities of a larger-parameter model. Some performance is lost, but inference becomes faster and cheaper.

Even today, “compression” remains one of the most typical uses of distillation. In autonomous driving, for example, companies first build a stronger cloud-based large model, and then use methods such as distillation and pruning to turn it into a smaller model that can run on in-car chips. Companies including Li Auto (理想) and XPeng (小鹏) have such practices.

A more recent example is DeepSeek-R1 in early 2025. At that time, DeepSeek also released six small distilled models. Their teacher model was R1 itself, with 671 billion total parameters. Among the student models, four used Alibaba’s Qwen2.5 as the base, and two used Meta’s Llama 3 as the base. The smallest had 1.5 billion parameters, and the largest had 70 billion.

DeepSeek first had R1 generate about 600,000 pieces of reasoning data in the format of “question–reasoning process–answer,” along with about 200,000 pieces of non-reasoning data. It then used these data in the post-training stage to supervised fine-tune six small base models. All of these models gained stronger reasoning abilities.

LatePost previously reported that after the 2026 Spring Festival, Guo Daya (郭达雅), one of the core authors of R1, joined ByteDance Seed.

“Industrial-scale distillation attacks”

When used for compression, distillation is a neutral technical method. But by February 2026, Google and Anthropic had both published articles that used “distillation” together with “attack,” directly accusing some companies of using distillation for unfair competition.

Google viewed this as a form of IP theft:

Over the past year, “distillation attacks” have increasingly been used as a means of intellectual property theft.
— GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use

Anthropic said in February and June that DeepSeek, Moonshot AI (月之暗面, Kimi), MiniMax, and Alibaba Qwen (阿里千问) had used roughly 50,000 fraudulent accounts to conduct more than 44.8 million interactions with Claude, attempting to extract Claude’s capabilities. The February document was titled “Detecting and preventing distillation attacks”; the June claim appeared in Anthropic’s letter to the U.S. Senate. The companies mentioned did not respond directly.

How did distillation of leading closed-source models come to be carried out at large scale? The source of the change is still technical. There are three lines of development.

From soft distillation to hard distillation, from white-box to black-box

In 2016, Yoon Kim, then a PhD student at Harvard, and his adviser Sasha Rush proposed sequence-level knowledge distillation, applying the method that had first been used in image recognition to the language task of translation.

Sequence-level distillation no longer learns the probability distribution output by the model at each step. Instead, the teacher model first generates high-quality translations, and then the student model learns the complete “source text–translation” sequence pairs.

This technique was originally proposed to compress large translation models and improve decoding speed. But it also had another effect: distillation no longer needed to know the teacher model’s step-by-step probability distribution. It could be done by looking only at the “final answer.”

This is “hard distillation.” It can be done in a black-box way, meaning that one only needs to call an API and directly obtain the teacher model’s answer.

Sasha Rush later joined the AI programming company Cursor in March 2025. In June this year, Cursor was acquired by SpaceXAI — the new name after the merger of SpaceX and xAI — for $60 billion, and the team has already been integrated.

The rise of reasoning models

In September 2024, just as discussion was spreading about the Scaling Law hitting a wall, OpenAI released the o1 reasoning model. o1 brought two changes.

Large-scale reinforcement learning in the post-training stage could teach a model to form reasoning strategies. And at the inference stage — that is, the stage when the model is being used — more test-time compute could allow the model to generate longer chains of thought when answering complex questions, and thus continue improving performance.

Both changes amplify the effect of distillation. Large-scale distillation is a method mainly used in the post-training stage; as the importance of post-training rises, the return on investment from distillation also rises. At the same time, test-time compute allows the model, in addition to producing a final answer, to also produce long reasoning processes — chains of thought, tool calls, search processes, correction processes. These outputs can be used as raw material for distillation data.

Four months later, the distillation process disclosed by DeepSeek in the R1 technical report showed in more detail the mechanism by which distillation makes models stronger. R1 had several specific practices and findings.

The distillation process mainly used “question–reasoning process–answer” data pairs generated by R1. This is currently the ideal state for distillation, and it works better than data pairs that contain only question and answer.

When releasing R1, the highly open DeepSeek directly displayed the full chain of thought, saying it “hoped to help the community distill better small models.”

By contrast, leading closed-source model companies, including OpenAI, Anthropic, and Google DeepMind, have always hidden full chains of thought and reasoning traces from users. That is why practitioners often say, when talking about distillation, that “so-and-so cracked so-and-so’s chain of thought.”

This Monday, August 10, researchers from the University of Tübingen in Germany and other institutions released a paper titled “Stealing Reasoning Traces from Proprietary LLM APIs,” showing some methods they had found for reconstructing reasoning traces. The research website is stolen-thoughts.com.

In fact, this has not been a secret for a long time. Even if closed-source model companies deliberately hide them, chains of thought and reasoning traces can still be reconstructed through technical means. The essential reason is that they are all part of model output — products of the model usage stage. As long as you use a model, chains of thought and reasoning processes are generated and leave traces. This still belongs to black-box distillation and hard distillation.

Another finding from R1 about distillation is that in the post-training stage, direct distillation brings greater improvement than having the model do reinforcement learning on its own.

At the time, DeepSeek ran a controlled experiment using Qwen2.5-32B. After more than 10,000 steps of large-scale reinforcement learning on Qwen-32B-Base, the resulting model scored 47.0% on AIME 2024, a benchmark that evaluates mathematical problem-solving ability. After supervised fine-tuning Qwen-32B-Base with 800,000 pieces of data generated by R1, the resulting model scored 72.6% on AIME 2024, more than 25 percentage points higher than the RL method.

“We demonstrate that the reasoning patterns of larger models can be distilled into smaller models, resulting in better performance compared to the reasoning patterns discovered through RL on small models.”
— R1 technical report

Although this was the result of a specific experiment and may not generalize to all situations, it is still an attractive finding. Long-step reinforcement learning is inherently more difficult than supervised fine-tuning. It places more demands on infrastructure, is often slower, and has higher compute costs.

DeepSeek made public a relatively economical, efficient, and deterministic way to improve the reasoning ability of smaller or weaker models.

Several practitioners said that some recent practices mainly use supervised fine-tuning in the post-training stage, with little or almost no reinforcement learning, and can still achieve very good results.

It was also after DeepSeek-R1, throughout 2025 and up to now, that Anthropic, OpenAI, Google, and other companies said the “distillation attacks” they had detected were increasing.

During the same period, more exploration of post-training also promoted another form of distillation that is not controversial: on-policy distillation, currently mainly used for merging post-training capabilities.

The difference between on-policy and off-policy distillation lies in who generates the data. The distillation mentioned earlier, in which a model learns from another closed-source model, is mostly off-policy distillation: the data is generated by the teacher model. On-policy distillation, by contrast, has the student model generate reasoning and answers, while the teacher model provides feedback. The feedback can be the distribution probabilities generated token by token (white-box), or it can be a judgment of the reasoning trace and answer (black-box).

Since the second half of 2025, Alibaba Qwen, Thinking Machines Lab, and Xiaomi MiMo have all contributed practices and improvements in on-policy distillation.

In the technical report for MiMo V2-Flash early this year, Xiaomi introduced MOPD, or multi-teacher on-policy distillation. In June, it published a separate paper titled “Multi-Teacher On-Policy Distillation for Capability Integration in LLM Post-Training.” The method first trains teacher models in different directions — math, coding, tool use — and then has the student model generate its own trajectories and receive feedback from different teachers according to the task. It aims to solve a new post-training problem: if capabilities in multiple directions are directly mixed together for reinforcement learning, they often interfere with each other, with gains in one area coming at the expense of another.

The technical reports for DeepSeek-V4 and Kimi K3 both said that in the post-training stage, they used MOPD-like ideas to merge multiple expert models.

Using AI to accelerate AI

The third line of development in the scaling of distillation is that distillation itself is becoming more automated as AI capabilities grow stronger.

Return to the key of distillation: “question–reasoning process–answer” data pairs. The question-asking step can shift from humans to AI. Since 2022, studies such as Self-Instruct have tried to solve the problem that high-quality questions are scarce and expensive.

In practice, companies can first screen high-quality real questions from authorized user behavior, then expand from these real questions to generate more AI-created questions, which can be used to ask the teacher model more frequently and obtain more answers. It is like starting with some yeast — real data — and using it to ferment a larger dough.

The complete “question–reasoning process–answer” data pairs can also be rewritten and expanded in this way. This is essentially a basic way of thinking in today’s AI field: using AI and models to automate and accelerate AI itself.

Many specific steps in the distillation process can also use AI. These include selecting high-quality questions from massive amounts of real questions, evaluating what counts as high-quality data, and improving the diversity of synthetic data. Some steps can be handled by models. Others can be accelerated and optimized by increasingly powerful AI programming capabilities, which make it faster to build and improve various systems.

Since 2025, the various methods and practices of large-scale distillation have gradually matured. Its effects and necessity have also become more apparent as the importance of post-training has increased. Discussion around “distillation” has also gradually moved beyond the AI technical community. In the process of communication, it has been simplified, misunderstood, and even distorted. Distillation is no longer a purely technical issue. It has moved to the center of the storm.

Misunderstandings about distillation: it is neither a silver bullet nor a secret

As mentioned repeatedly above, distillation that makes large language models stronger mainly happens in the post-training stage, and also includes the mid-training stage. But a model’s overall effectiveness comes from the complete training process, from pre-training to post-training. Pre-training is generally believed to be more important. Distillation is not the most important factor determining a model’s performance.

In the DeepSeek-R1 technical report, the same 800,000 pieces of R1 data were used for distillation. After distillation, the Qwen2.5-32B base model scored 72.6% on AIME 2024, higher than the 70.0% scored by the distilled Llama-3.3-70B-Instruct, even though the latter had more than twice as many parameters.

After K3 was released, Ai2 researcher Nathan Lambert replied to a tweet about K3 topping the Frontend Code Arena ranking, which evaluates front-end coding ability. He said that by this point, the whole “distillation” narrative should stop; people should recognize that China is also very good at building models.

A certain level of pre-training is the foundation that allows Chinese open-source models such as K3, GLM-5.2, and DeepSeek-V4 to achieve their current performance.

Distillation is often compared to a shortcut. A shortcut usually implies ease and less effort. But in reality, carrying out distillation at large scale today is a relatively complex systems-engineering project.

Based on descriptions from several practitioners, large-scale distillation has several difficult parts.

First, a team must be able to call leading models stably, frequently, and at large volume, while also doing user operations. One practice mentioned is to build many relay sites and attract a group of specific users with real usage behavior through discounts or other methods. These users might be advanced programmers, or science and engineering students and researchers who need to handle a large number of research questions. In daily use, they naturally generate high-quality multi-turn questions from real scenarios and real tasks, and then receive model answers. After being screened and processed in certain ways, the data from these questions and answers can serve as the source for fermenting and expanding more data.

This tests a team’s operations capabilities, including whether it knows where high-quality users are and how to reach them. It also tests the engineering capability to build such a system. It also requires some ecosystem capabilities, because the whole process may require cooperation with third-party companies or institutions.

Second is the team’s own ability to construct high-quality questions and tasks. This requires deep understanding of the tasks, the data, and the performance boundaries of current leading models. It overlaps with some of the capabilities needed for large-model training itself.

Third is how to use the data well. This requires building a data pipeline: whether the task distribution is reasonable; how to sample, screen, filter, deduplicate, expand, and correct; and how to determine formats and ratios. This pipeline has some measurable optimization indicators, such as what proportion of the raw data obtained can ultimately be used in post-training, and how efficient and high-quality the expansion is. The quality of the data pipeline affects effectiveness, efficiency, and cost.

Continuous distillation is also very expensive. There are some circulating claims about what companies in the industry are spending and budgeting for distillation this year, ranging from more than $100 million to $1 billion.

One AI investor said: distillation is not a simple button. It is not that you click once and model performance suddenly leaps forward. There are many implementation problems involved. Distillation also requires calculating return on investment.

Is distillation a moat for a model team?

Most of the practitioners we spoke with, whether they came from companies rumored to be doing distillation or from companies that do not distill, held relatively consistent views: for first-tier companies, distillation does not constitute a long-term moat.

Like many technologies in large models, the ideas and practices of distillation will gradually spread. Personnel movement, open-source sharing, conference exchanges, and third-party service providers looking for more customers all contribute to this. People and information in the AI circle are constantly moving. Researchers repeatedly expressed a similar sentiment: there are no real secrets in the large-model field.

The competitive advantage brought by a technical method itself is mostly first-mover advantage. Those who do it first will have more experience, but it is not an insurmountable, winner-takes-all moat like a network effect.

The phenomenon truly seen as having a stronger competitive moat is the “data flywheel”: if one company’s model is strong enough and can reach large numbers of users who use it for difficult tasks, it will receive more high-quality data flowing back. These data are unique, non-public, and unavailable to others. After certain processing, these data can again be used to help train stronger models, which then attract more users to handle harder tasks.

In this flywheel logic, applications that directly contact users are highly valuable. For example, depending on user agreements and permission settings, applications such as Cursor, Devin, and Manus may be able to obtain more complete data and user behavior than the models they call.

Yesterday, August 12, after Grok 4.6 was released, Elon Musk (马斯克) replied to a tweet saying Devin had integrated Grok 4.6. He said: “Grok 4.7 will be better than all current models.” “The training corpus of SpaceX is so awesome and unique.” A $60 billion acquisition of Cursor seems to have been worth it.

The data flywheel also has its own controversies. Model and application companies can obtain data, but can they use those data for training? The more difficult the task and the higher-value the scenario, the more likely customers and users may be to prefer controlling those data themselves. At the same time, as the number of model users continues to expand, user types and scenarios become more diverse. Is it still worth searching for gold in the sand?

One practitioner believes that in some AI applications that lean toward life assistants, entertainment, and leisure, the vast majority of user-generated data are garbage for training stronger models.

The internal line of judgment: black box or white box

The most interesting phenomenon about distillation is this: no one wants to talk about it publicly, but most of the practitioners we spoke with do not believe deep down that it is a shameful practice or one that violates their technical convictions.

The dividing line in this internal judgment lies between black box and white box.

The distillation currently being done on closed-source models is all black-box distillation. The data it obtains are data generated during use after these models are released. They are products of the model as a product. Then why can’t other companies ask this model questions and obtain answers as users? Besides, everyone has paid real money for these questions and answers. Of course, in practice, various methods are used to “take advantage” and lower costs.

The more controversial part here is reasoning traces. Most models hide the full reasoning traces, and the distilling party needs to use some technical means to infer and reconstruct them. But reasoning traces are still products of the model usage stage.

Anthropic, Google, and OpenAI would say: my user agreement clearly states that other competitors cannot use my model to train and improve their own models.

But who was sued by The New York Times, accused of copying and using without permission the newspaper’s archive of journalism accumulated over more than 170 years by generations of reporters, commentators, and authors? OpenAI. Who downloaded huge numbers of books from pirate platforms, was unwilling to pay for any of them, was sued in a class action by several American authors, and just reached a $1.5 billion settlement? Anthropic.

Even some American AI practitioners believe companies such as Anthropic are being highly hypocritical. It is a bit like the situation in Christopher Nolan’s new film The Odyssey: you sent the Trojan Horse into Troy, and now your own homeland is being invaded by those who come from the sea.

Large-scale distillation is a new issue that has emerged after the development of new technology. It is hard to make most people sincerely accept that this is undesirable, unethical, or even shameful and evil just because several companies say it violates their user agreements. Moreover, violating a user agreement does not necessarily constitute legal infringement. This also involves other legal rules, jurisdictional questions, and more.

In the broadest sense, distillation — that is, using data to improve a model — has become ubiquitous.

A widely circulated way to verify distillation is actually invalid: when you ask a model “Who are you?” and Model A says it is Model B, this is not ironclad proof that A distilled B. In the pre-training stage, everyone uses large amounts of public internet data, and much of that data already includes content generated by various models themselves.

In July this year, Nvidia founder Jensen Huang (黄仁勋) was asked about distillation in an interview with Axios. He said: “Distillation, learning from AI and learning from other sources of knowledge, is the fundamental principle of intelligence.”

For most model companies, including some American model companies, the accelerator on distillation has already been pressed. Few will voluntarily give up distillation in the short term.

Is it really impossible for distillation to surpass the teacher model?

We also asked several practitioners this question. Their answers were similar: technically it is not impossible, but there are potential organizational risks.

Distillation has some inherent technical problems. For example, it may cause the student model to learn some of the teacher model’s errors, biases, refusal habits, and expression patterns.

But distillation is only one part of model training. There are many other parts of the complete model training process that can be improved: pre-training data, architecture, algorithms, infrastructure. If multiple optimizations are stacked together, is it possible for a student model to become better than a given teacher model?

Some studies have shown that on certain specific tasks, student models can surpass teacher models. In December 2024, for example, Microsoft released Phi-4, a 14-billion-parameter model. A large amount of its training data was synthesized by teacher models such as GPT-4o. Phi-4 surpassed GPT-4o on two benchmarks:

• GPQA, which evaluates graduate- and PhD-level scientific knowledge and reasoning ability: Phi-4 scored 56.1%, while GPT-4o scored 50.6%.

• MATH, which evaluates mathematical problem-solving and reasoning ability: Phi-4 scored 80.4%, while GPT-4o scored 74.6%.

What is special is that as a small-parameter model, Phi-4 also directly used data generated by teacher models in pre-training. But when training truly large-scale models with trillions of parameters, the pre-training stage requires enormous amounts of data, and it is difficult to use data obtained through distillation. Compared with directly processing web pages, code, and books, calling teacher models one by one to generate data is slow and expensive.

But this also raises a possibility: when model inference speed increases greatly and prices fall sharply, can distillation — or data constructed with the help of stronger models — enter pre-training more often?

At the same time, can ideas such as multi-teacher distillation also be used to make models stronger? In theory, a student model can learn from different strongest models such as Claude and GPT at the same time. This may bring new technical problems, such as training instability and interference between different capabilities when distilling from different base models.

More aggressive possibilities include whether the most leading companies can distill their own models to achieve a kind of “lifting themselves by stepping on their own foot.”

From a pure research perspective, “whether a model using distillation can surpass the teacher model” is at least a question that remains to be tested and explored.

Distillation is a relatively economical method that produces results quickly. An athlete can certainly both take stimulants and train diligently. But in reality, the two are often hard to balance, because luck and inertia set in.

When a team, during a certain stage, puts a relatively large share of its attention and resources into distillation, projects and individuals exploring more uncertain and longer-term directions may not receive enough resources or recognition.

When someone accuses you of doing something wrong, responding with “didn’t you do the same?” does not resolve the conflict.

At this moment, open-source models are increasingly approaching the leading closed-source models in performance. It is also an objective fact that the strongest open-source models come from China, while the strongest closed-source models come from the United States.

Earlier, Zhipu had already been placed on the U.S. Commerce Department’s Entity List in January 2025. The Intelligence Authorization Act for Fiscal Year 2026, which took effect at the end of the same year, requires DeepSeek to be removed from U.S. intelligence systems, national security systems, and related suppliers.

By April this year, the U.S. House Committee on Homeland Security and the Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party had begun investigating American companies’ use of Chinese models. They asked Cursor why it used Kimi K2.5 as the base for Composer, and asked Airbnb why it used Alibaba Qwen in its customer service business.

After Kimi K3 was released on July 16, the U.S. government was reportedly considering restricting or even banning some Chinese open-source models. On July 24, 77 companies and organizations, including Microsoft, Nvidia, Meta, and Fireworks AI, successively signed the open letter “Open Weights and American AI Leadership,” opposing rushed restrictions on open-source models.

Jensen Huang’s first post on Twitter was sharing this open letter.

New restrictive measures in recent months are still under discussion and have not yet been implemented.

Companies including Anthropic, OpenAI, and Google are also taking stricter technical measures to identify and ban accounts suspected of being used for distillation. Anthropic, for example, said it had built classifiers and behavioral fingerprinting systems to identify distillation traffic, detecting cross-account coordination, repeated questioning, and attempts to extract chains of thought. It will also strengthen identity verification for education, research, and startup accounts.

In the University of Tübingen “stealing reasoning traces” study mentioned earlier, the methods used to reconstruct reasoning traces had already been reported by the research team to the relevant closed-source model companies. By the time the researchers uploaded the paper, some of those methods had already stopped working.

All parties involved are making their own choices and preparations. The changes that follow will affect the entire industrial chain, from compute, cloud services, and infrastructure to models, applications, and customer deployment.

The storm is still continuing. The next eye of the storm may not necessarily be distillation. Distillation itself is only one method for optimizing models.

So many companies are investing so many resources and rushing into this intelligence race. What are they doing it for? In the first half of this year, explosive growth in coding and agents reversed market expectations. Further ahead, if the scale and speed of large-model application adoption cannot continue, how will the future of the model R&D race fluctuate? That is a question some others are already watching.

Meta announced its acquisition of Manus on December 29, 2025, in a deal reportedly worth more than $2 billion. In January 2026, China’s Ministry of Commerce began looking into whether the transaction complied with relevant Chinese laws and regulations. Against this backdrop, Manus’s announcement that it will “resume independent operations” appears to suggest that the transaction or subsequent integration is now entering a separation phase. What users see is a backup-and-restore process; what the company is dealing with behind the scenes is the data and operational relationships established following the transaction.

This is not a routine product upgrade. Ordinary upgrades typically do not require users to first back up and then restore their data, nor do they usually divide user data based on a specific historical cutoff date. Manus attributed the changes to the “resumption of independent operations” and the need to “comply with regulatory requirements in certain jurisdictions.” This suggests that the adjustment is more akin to a reset of the company’s operating structure, data ownership arrangements, or compliance boundaries.

The December 29, 2025 cutoff is particularly significant. Manus did not explain in its user letter why this date serves as the dividing line. However, the fact that only certain data generated on or after that date needs to be deleted suggests that the regulatory or compliance measures apply specifically to data created during a particular period or under a particular operating structure. What can be said with greater confidence is that Manus appears to have determined that some data generated after that date cannot simply remain in the existing system and must instead be reconnected through a user-initiated backup and restoration process.

In the short term, the main impact on Manus is likely to be on user trust and experience. AI agent products differ from ordinary chat tools: users may store not only conversation histories, but also task histories, files, project context, and workflows. Even if Manus provides backup and restoration tools, some heavy users are likely to have concerns about data integrity, continuity of historical tasks, and the stability of the service going forward.

A letter to our users

Manus will soon resume operations as an independent company.

As part of this transition, and to comply with regulatory requirements in certain jurisdictions, some users will need to back up their data before 7:59 AM (Singapore time) on August 23, 2026, and then restore starting 8:00 AM (Singapore time) on August 25, 2026, to ensure continued access.

More information is available in our blog post. We have also provided detailed guidance in the Help Center, including how to check whether you are affected.

For affected users, here are the key details:

We will notify you via email and in-app notification. If you registered with an Apple ID or Facebook account, please check your in-app notifications.

Back up your data anytime between now and 7:59 AM on August 23 (Singapore time). You can back up more than once — after backing up, you can continue creating new data and simply run the backup again.

Starting 8:00 AM on August 25 (Singapore time), the restoration portal will open. Restore your data and pick up right where you left off.

Affected users will not be charged during the transition period, and we will provide a welcome-back bonus.

If your account is not affected, you don't need to do anything — just keep using Manus as usual. You will receive an in-app notification confirming this.

For those who are affected, we understand this is disruptive and we apologize for the inconvenience. Supporting you through this process is our top priority. In addition to the full guide in the Help Center, our support team is available 24/7 to answer any questions.

Looking ahead, we are incredibly excited about what's coming. We are preparing a range of new features that will once again push the boundaries of what general-purpose AI agents can do.

Thank you for being with us through this. The best is yet to come.

Pursuant to Articles 28 and 29 of China’s Anti-Dumping Regulations, MOFCOM decided to impose provisional anti-dumping measures in the form of cash deposits. Beginning August 11, 2026, importers of the products under investigation are required to provide deposits to Chinese Customs based on the deposit rates assigned to the relevant companies in the preliminary determination.

Notably, the case was initiated by MOFCOM on its own initiative rather than in response to a written petition from Chinese domestic producers. MOFCOM relied on the “special circumstances” provision under Article 18 of the Anti-Dumping Regulations. Its explanation was that China’s domestic pecan-growing industry is highly fragmented, has a low level of concentration, and involves a large number of growers, making it costly and difficult for the industry to organize and file an anti-dumping petition itself. The investigating authority therefore initiated the case on its own initiative. The dumping investigation period covered the full year of 2024, while the injury investigation period extended from 2022 through 2024. Separately, on September 25, 2025, China also launched a trade and investment barrier investigation into Mexico’s restrictive measures targeting China.

Following the outbreak of U.S.-China trade tensions in 2018, U.S. pecan exports to China were hit hard by retaliatory tariffs and fell sharply from their peak around 2017. In recent years, the U.S. pecan industry has been hoping to regain access to the Chinese market, while Mexico has emerged as an important source of incremental supply. China’s decision to investigate both countries at the same time therefore carries a clear message that circumvention will not be tolerated: it restricts direct U.S. exports while also putting pressure on Mexico and discouraging attempts to route U.S. products through Mexican processing and supply chains.

There is also a domestic industrial-policy rationale. China’s pecan-growing industry remains in the early stages of scaling up. Competition from low-priced imports does not merely put direct downward pressure on domestic prices; it may also discourage new planting and reduce growers’ incentives to make subsequent investments in orchard management. This is an important part of the industry-protection rationale disclosed by MOFCOM.

One particularly noteworthy detail concerns MOFCOM’s injury analysis. The investigating authority did not use the aggregated data submitted by the six sampled domestic producers. Instead, it relied on nationwide industry statistics provided by the Research Institute of Non-Timber Forestry under the Chinese Academy of Forestry. MOFCOM explained that the questionnaire responses from the sampled companies contained missing and inconsistent data and therefore could not reasonably reflect the overall condition of the domestic industry. This suggests that the statistical system for China’s pecan industry remains relatively underdeveloped, and the investigating authority’s methodology could consequently face questions over procedural compliance.

No U.S. producer or trader registered to participate in the investigation within the prescribed period. The U.S. Embassy in China registered as an interested party, but no U.S. company participated at the corporate level. As a result, all U.S. companies are subject to a uniform 54.3% cash deposit rate, with no differentiation among companies and no company-specific exceptions. This is the highest rate imposed in the preliminary determination. Once combined with existing tariffs and value-added tax, the resulting import cost will leave Chinese importers with very little economic incentive to continue purchasing U.S. pecans.

A further consequence is that U.S. companies lost the procedural opportunity to seek lower company-specific rates at the preliminary stage. If U.S. companies participate in the investigation during the subsequent final-determination stage, they could in theory seek review or differentiated rates. However, the across-the-board rate imposed at the preliminary stage has already caused a de facto disruption of trade, and the commercial losses during this interim period are real.

The situation for Mexico is more complicated because Mexican companies participated in the investigation and therefore received differentiated deposit rates. The two sampled companies—San Enrique Agricultural Enterprises and Alta Vineyards—are subject to rates of 23.0% and 17.8%, respectively. Four other cooperating Mexican companies are subject to a 22.2% rate, while other non-cooperating Mexican companies face a 51.6% rate, broadly comparable to the rate imposed on U.S. companies.

From an industry-incentive perspective, the leading and cooperating Mexican companies secured significantly more favorable treatment by participating in the investigation and therefore retain some possibility of preserving their Chinese orders. Nevertheless, even a 17.8% deposit represents a substantial additional cost and is likely to prompt Chinese importers to put pressure on Mexican suppliers during price negotiations to share part of that burden. For non-cooperating Mexican companies, the 51.6% rate effectively amounts to being priced out of the Chinese market.

Mexico’s pecan industry is sizable. Industry estimates put its 2024 production at approximately 129,000 metric tons, broadly comparable to U.S. production. These figures should not be treated as precise customs statistics, as estimates vary depending on whether they are measured on an in-shell or kernel basis and on differences in crop-year definitions. The industry estimate cited here comes from Mundus Agri. Mexico’s pecan industry has traditionally been deeply integrated with U.S. processing and consumer markets, while China has become an important source of incremental demand in recent years. If Chinese orders contract, Mexican growers could simultaneously face greater competition in the U.S. market and fluctuations in domestic production, with pressure transmitting upstream from exporters to growers and harvesting operations.

Overall, China’s approach toward the United States looks more like closing the door, while its approach toward Mexico is more akin to screening: cooperating companies are allowed to retain some market access, while non-cooperating companies are effectively pushed out.

At the same time, the measure sends a broader signal to the Mexican government: if Mexico unilaterally absorbs the costs of restrictions targeting China as U.S.-China supply chains are reconfigured, Beijing has trade-policy tools with which to respond.

Full translation of the announcement:

MOFCOM Announcement No. 32 of 2026
Preliminary Determination in the Anti-Dumping Investigation into Imports of Pecans Originating in Mexico and the United States

Issuing Department: Trade Remedy and Investigation Bureau
Document No.: MOFCOM Announcement No. 32 of 2026
Date of Issuance: August 10, 2026

In accordance with the provisions of the Anti-Dumping Regulations of the People’s Republic of China (the “Anti-Dumping Regulations”), on September 25, 2025, the Ministry of Commerce of the People’s Republic of China (“MOFCOM” or the “Investigating Authority”) issued Announcement No. 52 of 2025, deciding to initiate an anti-dumping investigation into imports of pecans originating in Mexico and the United States (the “product under investigation”).

The Investigating Authority conducted an investigation into whether dumping existed and the margin of dumping, whether the product under investigation had caused injury to the domestic industry in China and the extent of such injury, as well as the causal relationship between the dumping and the injury. Based on the findings of the investigation and pursuant to Article 24 of the Anti-Dumping Regulations, the Investigating Authority has made a preliminary determination (see Annex 1). The relevant matters are hereby announced as follows:

I. Preliminary Determination

The Investigating Authority has preliminarily determined that imports of pecans originating in Mexico and the United States are being dumped, that China’s domestic pecan industry has suffered material injury, and that there is a causal relationship between the dumping and the material injury.

II. Collection of Cash Deposits

Pursuant to Articles 28 and 29 of the Anti-Dumping Regulations, the Investigating Authority has decided to impose provisional anti-dumping measures in the form of cash deposits.

Beginning on August 11, 2026, importers of the product under investigation shall, when importing such product, provide corresponding cash deposits to the Customs of the People’s Republic of China based on the cash deposit rates applicable to the respective companies as determined in this preliminary determination.

The product under investigation is specifically described as follows:

Scope of investigation: Imports of fresh or dried pecans originating in Mexico and the United States.

Name of the product under investigation: Fresh or dried pecans (American pecans; thin-shelled hickory nuts).

Foreign-language/scientific name: Carya illinoensis.

Product description: Seeds of the thin-shelled hickory, genus Carya, family Juglandaceae; fresh pecans, or nuts produced from pecan fruits through processes including sorting and drying, whether or not shelled or peeled, principally intended for human consumption.

Principal uses: Pecans may be consumed raw or roasted, used in the preparation of various pastries and other foods, or processed for oil extraction.

The product is classified under tariff heading 08029990 of the Import and Export Tariff of the People’s Republic of China. Other products classified under this tariff heading are not covered by this investigation.

The cash deposit rates applicable to the respective companies are set forth in Annex 2 to this Announcement.

III. Method for Collection of Cash Deposits

Beginning on August 11, 2026, when importing pecans originating in Mexico and the United States, importers shall provide corresponding cash deposits to the Customs of the People’s Republic of China based on the cash deposit rates applicable to the respective companies as determined in this preliminary determination.

The cash deposit shall be calculated on an ad valorem basis using the customs-determined dutiable value of the imported goods. The formula is as follows:

Cash Deposit Amount = (Customs-determined dutiable value of the imported goods × applicable cash deposit rate) × (1 + import VAT rate)

IV. Comments

Interested parties may submit written comments to the Investigating Authority within 10 days from the date of publication of this Announcement.

Annexes:

1. Preliminary Determination of the Ministry of Commerce of the People’s Republic of China on the Anti-Dumping Investigation into Imports of Pecans Originating in Mexico and the United States

2. List of Cash Deposit Rates Applicable to Individual Companies

Ministry of Commerce of the People’s Republic of China
August 10, 2026

At present, the CAC has not determined that the company’s products pose a national security risk, nor has it announced a blanket sales ban. However, given that the review targets cybersecurity products and that the notice specifically emphasizes “ensuring the safe and stable operation of critical information infrastructure,” government agencies, central state-owned enterprises, and operators of critical information infrastructure in sectors such as finance, energy, telecommunications, and transportation will very likely immediately suspend new purchases pending the review outcome. In commercial terms, this is already close to a de facto temporary restriction.

Palo Alto Networks is headquartered in Santa Clara, California, and is one of the world’s largest specialist cybersecurity companies. Its best-known product is the next-generation firewall. It also offers the GlobalProtect enterprise VPN, the Prisma cloud security platform, the Cortex endpoint detection and security operations platform, the WildFire malware analysis service, and Unit 42 threat intelligence and cyber incident response services. The company reported about $9.22 billion in revenue for fiscal year 2025, making it one of the representative firms in the U.S. cybersecurity industry.

What distinguishes Palo Alto from an ordinary software company is that its products are typically deployed at critical nodes such as enterprise network gateways, data centers, and cloud platforms. Firewalls can identify the applications, users, devices, and communication traffic operating within an enterprise network. VPNs control how employees access internal systems from outside. Security detection platforms, meanwhile, need to continuously collect domain names, IP addresses, attack logs, device status, and even submit suspicious files to the cloud for analysis. These products are not only the “guards” of a company’s network, but also sit at the network’s main gate. If they are secure and reliable, they can block attacks; if they are remotely controlled, stop receiving updates, or are used to collect information, they can also become a channel into the entire network.

Palo Alto’s public documents show that its firewalls can send the company telemetry data on applications, threats, and device operations. WildFire can also upload suspicious files to regional cloud infrastructure for analysis. Palo Alto’s WildFire cloud for the Asia-Pacific region is located in Singapore, and the company has not publicly listed any regional cloud located in mainland China. Although customers can disable some telemetry functions or use localized private cloud appliances, Chinese regulators still need to determine exactly what data products sold in China collect by default, whether such data and file samples are transferred abroad, whether overseas headquarters can remotely access them, and whether the U.S. government could require the company under U.S. law to provide relevant information. Palo Alto products can also be deployed locally, so not all data is automatically sent to the United States. For that reason, these questions require technical review before any conclusion can be reached, and cannot simply be equated with the discovery of a “backdoor.”

Palo Alto does have business operations in China. The company has had offices in Beijing, Shanghai, Guangzhou, and other cities. Public information indicates that it has more than 70 employees in China and has provided firewalls, VPN, and cloud security services to some multinational corporations and large enterprises. For example, Thoughtworks China once deployed Palo Alto firewalls, GlobalProtect, and WildFire for 2,817 employees. Even so, Palo Alto is not a mainstream vendor in China’s cybersecurity market. According to IDC data, China’s cybersecurity hardware market was worth about RMB 21 billion in 2024, and the top five vendors were Sangfor, Venustech, H3C, Huawei, and Topsec, each with a market share above 9 percent. Palo Alto did not rank among the top five. Because the company does not separately disclose its China revenue, the only safe conclusion is that its overall share of the Chinese market is below 9.3 percent, and more likely in the low single digits. It has relatively stronger influence among multinational companies, high-end manufacturers, and customers that require a globally unified network architecture, but in the government, central SOE, and critical information infrastructure markets, it has long been squeezed by indigenous innovation policies and domestic substitution.

In fact, this review did not come out of nowhere. As early as January this year, China had already instructed some domestic institutions to stop using U.S. and Israeli cybersecurity products from Palo Alto, Fortinet, VMware, Check Point, and others. According to reporting at the time, Chinese authorities were concerned that these products might collect sensitive information and transmit it overseas. The formal launch of a review into Palo Alto products by the Office of Cybersecurity Review means that restrictions that had previously been advanced mainly through procurement guidance and domestic substitution are now being converted into a national security review with a clear legal procedure.

As for what specific “bad record” or unfriendly conduct by Palo Alto may have drawn China’s attention, the official notice does not list any concrete facts, so it would be wrong to say that the company was punished because of one particular report or one particular action. Still, public records show at least several areas likely to have raised concern in Beijing.

The most sensitive issue is that Palo Alto’s Unit 42 threat intelligence team has long maintained cooperation with the U.S. government and intelligence community. The company has publicly stated that Unit 42 has established threat intelligence sharing mechanisms with the U.S. Department of Homeland Security, the U.S. intelligence community, and international law enforcement agencies. In 2025, when the U.S. Department of Justice indicted several Chinese citizens and personnel from i-Soon, it specifically thanked Unit 42 for assisting the investigation. From the perspective of a U.S. company, this is a common form of public-private cooperation in cybersecurity. From the perspective of Chinese regulators, however, a U.S. company that may have access to the network traffic, attack logs, and suspicious files of Chinese clients, while also sharing threat intelligence with U.S. homeland security, law enforcement, and intelligence agencies, clearly carries a high degree of national security sensitivity.

Unit 42 has also for years published reports about what it describes as “China-linked hackers” and “Chinese state-backed cyber operations,” attributing multiple campaigns targeting diplomatic entities, telecommunications, government bodies, and critical infrastructure to Chinese-related groups. In 2025, Unit 42 also named a group that had long targeted government and telecom organizations “Phantom Taurus,” and assessed it as having a “China nexus.” China has consistently opposed politicized attribution based solely on attack tools, language traces, working hours, IP addresses, and target selection. It argues that research by U.S. security firms is often used by the U.S. government to prosecute Chinese individuals, sanction Chinese companies, and amplify the narrative of a “China cyber threat.” From Beijing’s point of view, Palo Alto may be seen not merely as a commercial security vendor, but also as an intelligence provider within the broader U.S. cyber policy and law-enforcement system directed at China.

One episode in February this year is especially revealing. Reuters reported that Unit 42 had originally planned to directly attribute a cyber espionage campaign affecting 37 countries to Beijing, but Palo Alto management worried about triggering further Chinese retaliation and ultimately described the actor in the final report only as a “state-linked group active in Asia.”

In addition, Palo Alto products have in recent years suffered several serious vulnerabilities that were actively exploited in the wild. CVE-2024-3400 allowed an unauthenticated attacker to execute code with the highest privileges on certain firewalls. CVE-2024-3393 could cause firewalls to reboot repeatedly. After that, the PAN-OS management interface and GlobalProtect also saw a string of problems including authentication bypass. Several of these were added by the U.S. Cybersecurity and Infrastructure Security Agency to its Known Exploited Vulnerabilities catalog. These vulnerabilities do not prove that Palo Alto intentionally planted backdoors; any large cybersecurity product can have vulnerabilities. But because firewalls sit at the network perimeter, once compromised they pose risks far beyond those of ordinary application software, so they naturally become a focus of Chinese review.

The most relevant precedent for this review is Micron. In March 2023, China announced a cybersecurity review of Micron products sold in China. About seven weeks later, regulators concluded that the products posed relatively serious cybersecurity risks and required operators of critical information infrastructure in China to stop purchasing them. Whether Palo Alto will face the same outcome remains unclear. Under the Measures for Cybersecurity Review, regulators will focus on whether its products could lead to illegal control of, interference with, or damage to critical information infrastructure; whether supply could be interrupted for political or diplomatic reasons; and whether important data could be stolen, leaked, or unlawfully transferred abroad. If Palo Alto can demonstrate that data flows are controllable, that products can be fully deployed locally, that overseas headquarters cannot remotely interfere, and that the company will ensure continued supply and comply with Chinese law, it is still possible that the review could be cleared subject to remedial conditions. Even so, given that notices to stop using its products had already appeared in January, the probability of eventual restrictions on procurement by critical information infrastructure operators is not low.

Politically, this cybersecurity review is closely aligned with the logic behind China’s recent retaliation against FCC-related restrictions. In recent years, the United States has repeatedly invoked “national security” to restrict Chinese telecom equipment, routers, inverters, robots, testing laboratories, and cybersecurity firms from entering the U.S. market. China is now also beginning to use its own tools of cybersecurity review, certification, entity lists, and export controls to impose more concrete reciprocal restrictions on U.S. companies. The Compliance Testing case was a named retaliation against a promoter of FCC policy. The CCC measure was a reciprocal response within the certification system. The Palo Alto review goes one step further, extending scrutiny to U.S. cybersecurity products and their ability to control data.

For Palo Alto, the direct economic loss may not be very large. Its Asia-Pacific and Japan business accounts for only about 12 percent of global revenue, and China is just a relatively small part of that. When the January stop-use news emerged, Palo Alto’s share price barely moved, which also suggests that investors do not see China as central to the company’s growth story. But the symbolic significance of this case is much larger than the short-term revenue impact: an American security company whose business is to protect networks has now itself become the object of a Chinese cybersecurity review. Taken together, these signs suggest that China is carrying out a cross-departmental, layered, “portfolio-style” retaliation strategy: naming and punishing U.S. firms involved in designing and promoting restrictive policies, creating reciprocal barriers for U.S. certification bodies, and formally reviewing U.S. security products that can enter China’s critical networks and access sensitive data.

Given Palo Alto Networks’ overall market share in China is not high, the company could financially exit the China market, but that would be the worst way to resolve the situation — though under today’s geopolitical realities, it may also be an unfortunate option.

The countermeasures announced this time mainly include several items.

First, China will strengthen export controls on drones, their key components, and related technologies to the United States.

From now on, drones, key components, and technologies that have already been included in China’s export control list of dual-use items will be subject to strict case-by-case review if exported to the United States, and exporters will no longer be allowed to use license facilitation measures.

Second, China will suspend part of China-U.S. product certification cooperation.

Designated bodies for China Compulsory Certification will suspend entrusting U.S. certification bodies with follow-up inspections of U.S. factories.

Third, China will add seven U.S. entities to its countermeasure list.

Six of them are accused of assisting and supporting the United States in imposing Xinjiang-related sanctions. The other, a U.S. compliance testing company, is accused of assisting the FCC in introducing restrictive measures against Chinese companies and testing laboratories. Organizations and individuals within China will no longer be allowed to conduct relevant transactions, cooperation, and other activities with these seven entities.

Fourth, China will launch a national security investigation into imported printing and copying office equipment installed with foreign system software.

The investigation covers imported office equipment that is installed with foreign driver software and embedded software and has both printing and copying functions.

For the detailed content of these announcements,Inside China has published a full English translation.

Taken together, this is indeed a carefully designed package of countermeasures. The FCC restricted Chinese testing laboratories, drones, routers, submarine cables, robots, and power inverters; China is responding item by item from several directions, including certification, components, software security, and supply chain compliance.

In an accompanying press briefing, China’s Ministry of Commerce (MOFCOM) made no attempt to downplay the rationale behind the latest measures.

According to the spokesperson, since the Trump–Xi summit in Busan, the U.S. Federal Communications Commission (FCC) has repeatedly ignored China’s strong objections as well as calls from industry in both countries, while continuously expanding the concept of national security to justify a growing number of restrictive measures against China. These measures have covered a wide range of sectors, including telecommunications operators, testing laboratories, drones, consumer routers, submarine cables, and, most recently, advanced robotics and power inverters.

The spokesperson also highlighted that, despite repeated diplomatic representations from China, the United States added more than 40 Chinese entities to the Uyghur Forced Labor Prevention Act (UFLPA) Entity List on July 31, just one day after the July 30 video call between the Chinese and U.S. lead officials on economic and trade affairs. China said it was “strongly dissatisfied with and firmly opposed” to this decision.

According to MOFCOM, these U.S. actions seriously violate the important consensus reached by the two heads of state and undermine China’s legitimate rights and interests, leaving China no choice but to adopt necessary countermeasures.

At the same time, the spokesperson stressed that China’s response remains restrained. China values the hard-won stability in bilateral economic and trade relations and hopes the United States will work with China in the same direction. China urged Washington to immediately revoke the relevant measures, abandon what it described as its “erroneous practices,” and return to resolving differences through dialogue and cooperation in order to preserve constructive strategic stability between the two countries.

The spokesperson added that if the United States proceeds with additional restrictive measures against China, China will take further countermeasures in response.

The actual force of these measures is not exactly the same. Some have already taken effect immediately and will directly cut off relevant companies’ business with China. These include strengthening export controls on drones, their key components, and related technologies to the United States; suspending part of China-U.S. product certification cooperation; and adding seven U.S. entities to the countermeasure list. Others are only investigations for now and remain some distance away from actual import restrictions. One example is the national security investigation into imported printing and copying office equipment installed with foreign system software. This is also the first time China has launched a foreign trade national security investigation under Article 41 of the Foreign Trade Law.

Among all these measures, inclusion on the countermeasure list carries the most serious consequences. Most of the U.S. entities listed this time are not household-name large companies, but they share one feature: they are all located in the implementation layer of U.S. Xinjiang-related supply chain enforcement and product safety regulation.

For example, Applied DNA Sciences and Stratum Reservoir mainly provide services such as DNA tagging and stable isotope analysis, which can be used to determine the origin of cotton, agricultural products, and other raw materials. After the United States implemented the Uyghur Forced Labor Prevention Act, importers needed to prove that their products and raw materials had no connection to Xinjiang. Traditional contracts, invoices, and supplier declarations were sometimes not enough to satisfy U.S. Customs, so DNA and isotope testing came to be used as supporting evidence.

Applied DNA Sciences is a listed company. In 2025, it changed its name to BNB Plus Corp., and its stock ticker changed from APDN to BNBX. The company previously operated cotton DNA tagging and origin tracing businesses, and it once publicly stated that U.S. implementation of the UFLPA helped drive demand for its business. Since then, however, the company has undergone major business changes. Its main strategy has now shifted to holding BNB digital assets and generating returns through the Binance ecosystem. Its original DNA supply chain tagging and security business is being exited, and its molecular diagnostics business has also been discontinued. The remaining industrial business is mainly nucleic acid production technology for the biopharmaceutical and diagnostics industries. The Ministry of Commerce’s move this time is more about the company’s past participation in UFLPA supply chain tracing than its current core business.

Altana Technologies operates a supply chain data platform. It uses customs, shipping, corporate, and trade data to map supply chain networks from raw materials to final products. In 2025, U.S. Customs and Border Protection selected Altana’s “product passport” system, allowing importers to prove product origin and supply chain compliance to customs in advance. Altana’s core strength is mapping global supply chain networks, and China is one of the most important nodes in global manufacturing and trade networks. If Chinese companies cannot directly provide data to Altana, purchase its services, or participate in product passport cooperation, Altana can still rely on U.S. customs data, shipping data, and overseas customers to continue analyzing Chinese supply chains, but the completeness of its data and its verification capacity will clearly be affected. For a company whose core selling point is end-to-end supply chain visibility, this impact may be greater than the direct loss of China revenue.

The Responsible Business Alliance, or RBA, is a very important industry organization in global electronics, automotive, and consumer goods supply chains. It develops supply chain codes of conduct and provides factory audits, forced labor-specific assessments, risk questionnaires, training, and corrective action tools. Many multinational companies require suppliers to accept RBA standards or audits. Many of RBA’s activities take place at the level of Chinese factories and suppliers. Now that it has been placed on the list, organizations and individuals within China, in principle, can no longer conduct relevant transactions and cooperation with it. This may affect its membership fees, factory audits, training, data submissions, and supplier assessments. In reality, however, many RBA services are purchased centrally by multinational headquarters, which then require their Chinese subsidiaries and suppliers to implement them. How regulators will define such intra-group arrangements in the future, and whether contracts signed overseas will be treated as extending to audit activities inside China, remains to be seen.

It is worth noting that the RBA is one of the world’s most widely adopted supply chain compliance frameworks. Many multinational companies—including Apple, Dell, HP, Intel, Tesla, and Bosch—are RBA members and require their suppliers to comply with its standards. If RBA is no longer able to conduct audits in China as a result of its designation on China’s countermeasures list, many Chinese suppliers may be unable to obtain new RBA certifications or renew existing ones. Overseas customers may then require Chinese companies to adopt alternative certification schemes or conduct supplier audits themselves. This could have a meaningful impact on sectors such as electronics, automotive, new energy, semiconductors, and EMS manufacturing. Much will depend on how the countermeasures are implemented in practice. If the restrictions were to materially affect Chinese companies’ ability to meet supply chain compliance requirements, the exemption mechanism under China’s Anti-Foreign Sanctions Law could potentially be used to waive the relevant restrictions.

Verité has long worked on labor rights, forced labor, and supply chain due diligence, providing research, training, and consulting to governments, companies, and international organizations. Being placed on the countermeasure list may cause it to lose some China-related projects, clients, and sample sources, but these organizations have not publicly disclosed their China revenue, so it is difficult to judge the actual amount involved.

Human Rights in China mainly engages in human rights research and policy advocacy. Its commercial attributes are relatively weak, and it has no obvious commercial activities inside China. Its inclusion on the countermeasure list is therefore more political and symbolic.

For UFLPA listings, the Department of Homeland Security’s publication of a list is only the first step. Actual enforcement still requires origin testing, supply chain data, factory audits, labor investigations, and policy research. The Chinese side is targeting precisely the technology and service providers behind this enforcement system. The signal is already very clear: if foreign organizations help the U.S. government investigate, identify, and sanction Chinese companies, they may face risks under Chinese law even if they are not government agencies themselves.

The other company separately added to the countermeasure list is Compliance Testing LLC, based in Arizona. It is an FCC-recognized U.S. testing laboratory and telecommunications certification body that can help electronic products complete FCC testing, obtain FCC IDs, and enter the U.S. market. On the one hand, the company has long provided FCC certification services to Chinese manufacturers, and its website clearly states that it “frequently works with Chinese clients.” On the other hand, its executives have long lobbied the FCC to prohibit Chinese laboratories from testing products exported to the United States, arguing that this business should be moved back to the United States. So its inclusion on the list is not exactly undeserved. After being placed on the countermeasure list, Chinese manufacturers, in principle, can no longer directly entrust this company with testing and certification. Ongoing projects may also need to be transferred to other FCC-recognized bodies, which may bring Compliance Testing relatively direct losses of Chinese clients. However, after the United States restricts Chinese laboratories, some testing that was previously conducted in China may flow to U.S. laboratories. Compliance Testing may lose Chinese clients, but it may also benefit from the return of testing business to the United States. The final net impact is therefore hard to judge.

The drone-related countermeasure is to apply strict case-by-case review to exports to the United States of drones, key components, and related technologies included in the dual-use item list, while canceling license facilitation. It does not prohibit all drones and components from being exported to the United States. The existing list mainly covers drones with certain technical parameters and military uses, as well as aircraft engines, communications equipment, infrared imaging equipment, synthetic aperture radar, lasers, high-precision inertial measurement equipment, and counter-drone systems. Ordinary consumer-grade products and general components, if they do not meet the parameters in the list, should not be automatically banned from export because of this announcement.

Major U.S. military drone companies were already reducing their use of key Chinese components. Companies such as AeroVironment, Red Cat, and Skydio serve the U.S. defense and public safety markets and usually need to meet NDAA or Blue UAS supply chain requirements. U.S. law has already restricted the Department of Defense from procuring drones that use key components produced in China, such as flight control systems, communications equipment, cameras, gimbals, operating software, and other parts. As a result, large U.S. military drone companies are already less directly dependent on key Chinese components than ordinary commercial drone companies. Compared with drone companies themselves, this measure is more likely to affect two types of companies. One group consists of small and medium-sized drone companies that still procure motors, batteries, magnets, sensors, and general electronic components from China. The other consists of companies that need high-performance thermal imaging, inertial measurement, lasers, communications equipment, or counter-drone components.

One new tool that has attracted attention this time is China’s first use of the foreign trade national security investigation authority under Article 41 of the Foreign Trade Law to launch a national security investigation into imported printing and copying office equipment. The investigation targets imported printing and copying equipment installed with foreign driver software or embedded software. The Ministry of Commerce will assess the impact of these devices on national security, domestic industries, import dependence, and domestic supply capacity.

But it should be emphasized that this is currently only an investigation, not a ban. The Ministry of Commerce has not prohibited the import of any brand, has not imposed additional tariffs, and has not named HP, Xerox, Canon, Ricoh, or any other company. Judging from the market structure, the U.S. companies that may be affected are mainly HP and Xerox. But China’s office printing market also includes many Japanese brands, such as Canon, Ricoh, Konica Minolta, Kyocera, Brother, and Epson. Therefore, if the investigation eventually turns into substantive restrictions, the companies most affected may not necessarily be American; they could instead be Japanese manufacturers.

Another key issue is that the investigation targets only “imported equipment.” If the relevant printers are produced inside China, then even if the brand and software are controlled by a foreign company, they may not fall within the scope of this investigation. Therefore, to assess a company’s risk, it is not enough to look only at whether it is a foreign brand. One also needs to look at where the specific product is manufactured and how it enters China.

The investigation may eventually lead to several possible outcomes: foreign companies may be required to provide more detailed explanations of software and data security; restrictions may be imposed on remote updates, telemetry, cloud printing, and device management functions; companies may be required to establish software maintenance and vulnerability response capabilities inside China; government departments, state-owned enterprises, or critical infrastructure operators may be restricted from procuring certain imported devices; some products may face import restrictions.

HP’s printing business remains an important source of profit, but the company does not separately disclose revenue from its China printing business, so outsiders cannot accurately calculate its dependence on the Chinese market. If the final result is only a requirement to submit security materials or adjust some software functions, the impact on HP’s overall revenue would be very small. Only if China restricts imported equipment or government procurement would there be a more visible financial impact.

Xerox’s situation is somewhat different. In 2025, the company acquired Lexmark. Lexmark had previously been controlled by investors including China’s Ninestar and has some manufacturing and supply chain foundations in China. Some products, if manufactured inside China, may not themselves qualify as “imported equipment.” But if the investigation is further extended to foreign-controlled embedded software, cloud printing, and remote management services, Xerox and Lexmark may still be affected. Considering that Xerox is currently also facing high debt, declining demand for traditional printing, and acquisition integration issues, the Chinese investigation is not yet its most important fundamental variable.

The China Chamber of Commerce for Import and Export of Machinery and Electronic Products (CCCME) quickly issued a statement backing the government’s actions on printing devices.

The chamber said it “firmly supports” the Ministry of Commerce’s decision to launch the investigation in accordance with the law, assess the impact of the relevant imports on China’s national security interests in foreign trade, and adopt further measures where necessary.

CCCME also criticized a series of recent China-related measures introduced by the U.S. Federal Communications Commission (FCC) and the U.S. Department of Homeland Security, including multiple restrictions on market access. It further argued that the U.S. government has continuously expanded the concept of national security, even extending Section 232 investigations and tariffs to ordinary products such as timber, and expressed its firm opposition to these actions.

The chamber noted that printing and photocopying equipment, as critical information input and output devices, forms part of the essential infrastructure supporting economic and social activities. It argued that ensuring the security of the domestic printing and copying equipment industry is important for safeguarding China’s national security interests and promoting the healthy development of the industry.

CCCME added that it will actively organize relevant companies to cooperate with the Ministry of Commerce’s investigation and support efforts to safeguard China’s industrial development and national security interests.

The measure suspends China’s designated CCC certification bodies from commissioning U.S. certification bodies to carry out post-certification follow-up factory inspections of U.S. manufacturers. Previously, China generally allowed qualified overseas certification bodies to participate in CCC factory inspections to facilitate international trade. Suspending this arrangement does not ban U.S. products from entering the Chinese market or automatically invalidate existing CCC certificates. However, it will increase the time and cost for U.S. companies to maintain their CCC certification, creating a new procedural barrier for U.S. exports to China. The move is widely seen as a reciprocal response to the United States’ use of mechanisms such as the FCC equipment authorization regime to steadily raise regulatory barriers for Chinese products entering the U.S. market in recent years.

Prior to the issuance of these Regulations, China’s legal framework governing restrictions on the departure of Chinese citizens was primarily based on the Exit and Entry Administration Law, the Passport Law, the Supervision Law, the Counter-Espionage Law, the Tax Collection and Administration Law, and other relevant legislation. Most of these statutes, however, are laws enacted by the National People’s Congress with relatively high-level provisions. They generally lack detailed implementing rules and typically apply only to specific categories of persons or particular circumstances.

Exit and Entry Administration Law (Article 12)

Chinese citizens may be prohibited from leaving China under any of the following circumstances:

• They do not possess valid travel documents or refuse to undergo, or evade, border inspection;

• Their criminal sentence has not yet been fully served;

• They are defendants or criminal suspects in a criminal case;

• They are involved in unresolved civil litigation where a people’s court has ordered an exit ban;

• They have been penalized for disrupting border administration or have previously been repatriated for illegal exit, illegal residence, or unauthorized employment and remain within the applicable restriction period;

• Their departure is likely to endanger national security or cause significant harm to national interests;

• Other circumstances prescribed by laws or administrative regulations.

Supervision Law (Article 33)

To prevent persons under investigation or other relevant individuals from fleeing abroad, supervisory authorities may, with the approval of a supervisory authority at or above the provincial level, impose exit restrictions, which are enforced by the public security authorities.

Counter-Espionage Law (Article 33)

The Ministry of State Security may:

• prohibit Chinese citizens from leaving China for a specified period if their departure is likely to endanger national security or cause significant harm to national interests; and

• notify immigration authorities to prevent individuals suspected of espionage activities from leaving the country.

Tax Collection and Administration Law (Article 44)

Taxpayers with outstanding tax liabilities, or the legal representatives of enterprises that owe taxes, must settle the outstanding taxes and late-payment surcharges, or provide an acceptable guarantee, before leaving China. Otherwise, the tax authorities may notify the immigration authorities to prevent them from departing the country.

In the accompanying Q&A, the Ministry of Justice, the Ministry of Public Security, and the National Immigration Administration explained the background to the issuance of the Regulations. They noted that, as China continues to advance high-level opening-up, a number of new challenges and issues have emerged in exit and entry administration. It has therefore become urgently necessary to promulgate the Regulations, following the principle of addressing the most pressing needs first, in order to improve and refine the relevant legal framework.

One noteworthy change is that violations of China’s export control regime have, for the first time, been expressly included within the scope of the exit-ban system.

Article 4 provides:

Where a Chinese citizen violates export control regulations, technology import and export administration regulations, or other relevant rules, and such conduct may endanger China’s industrial security or technological security, the competent departments of the State Council, including the Ministry of Commerce, may decide to prohibit that person from leaving China.

The accompanying Q&A further explains that this provision is mainly intended to address situations that have arisen in practice where individuals leave China and subsequently transfer technology overseas illegally, thereby endangering China’s industrial security and technological security. According to the authorities, the provision further refines and improves the existing circumstances under which exit bans may be imposed, pursuant to the authorization provided by the Exit and Entry Administration Law.

Question: What provisions does the Regulations make with respect to the administration of Chinese citizens’ departure from China?

Answer: In recent years, as the number of Chinese citizens travelling abroad has continued to increase, new issues have emerged in practice, including the illegal transfer of technology overseas after individuals leave China, thereby endangering China’s industrial security and technological security. To address these issues, the Regulations provide that where a person violates export control regulations or technology import and export administration regulations, and such conduct may endanger China’s industrial security or technological security, that person may, in accordance with the law, be prohibited from leaving China.

This may indicate that the practical reach of China’s export control enforcement is no longer limited to licensing requirements, controlled items, and cross-border transactions, but may also extend to the exit administration of individuals responsible for export control violations. For companies engaged in sensitive technology research and development, technology cooperation, exports of controlled items, and cross-border technology transfers, greater attention may need to be paid to the personal compliance responsibilities of individuals involved in technology transfer activities, with personnel compliance becoming an integral part of export control compliance programs.

Foreign media have repeatedly reported allegations that China has restricted the overseas travel of individuals involved in sensitive technologies.

For example, the Financial Times reported in March 2026 that two executives from Manus were summoned to Beijing to meet with officials from the National Development and Reform Commission (NDRC), after which they were reportedly informed that they could not leave China while regulatory review of Meta’s proposed acquisition of Manus was ongoing, although they remained free to travel within the country.

On June 25, 2025, The Wall Street Journal reported that China’s Ministry of Commerce had asked certain rare earth companies to submit lists of technical personnel, including information on their areas of expertise, educational background, and research experience. According to the report, some technical staff were also required to hand over their passports to their employers or local authorities in order to prevent unauthorized overseas travel and the disclosure of rare earth processing technology.

Bloomberg further reported in May 2026 that China had required certain senior researchers and professionals working on strategic AI projects at companies including Alibaba and DeepSeek to obtain government approval before traveling abroad.

None of these reports has ever been officially confirmed or denied, and they are better understood as unverified media allegations. Moreover, much of the reporting sought to portray such restrictions as arbitrary exercises of unchecked government authority, implying that the Chinese government could prohibit individuals from leaving the country simply because they possessed important technologies, without any legal basis for doing so. The issuance of the new Regulations by the State Council provides an important clarification in response to such interpretations and misunderstandings.

In addition, the new Regulations also provide that Chinese citizens who engage in illegal or criminal activities overseas may be prohibited from leaving China again, provided that such activities endanger China’s national security or national interests.

Article 4 provides:

Where a Chinese citizen engages in illegal or criminal activities outside China that endanger China’s national security or national interests, the relevant competent departments under the State Council, or the people’s government at the provincial level of the individual’s place of residence within China, upon verification by Chinese diplomatic missions or other relevant authorities abroad, may decide to prohibit that person from leaving China for a period of six months to three years from the date of his or her return to China.

In addition to strengthening national security-related measures, the Regulations also improve procedural safeguards.

Under Article 6, where a decision has been made in accordance with the law to prohibit a person from leaving China, the authority making the decision shall, in principle, notify the individual in writing of the facts, reasons, legal basis, and available avenues for relief.

Article 6 provides:

Where a decision is made in accordance with the law to prohibit a person from leaving China, the authority making the decision shall promptly notify the immigration authorities for implementation in accordance with the relevant provisions, and shall notify the individual in writing of the facts, reasons, legal basis, and available avenues for relief. Where notification to the individual may affect national security, the investigation of criminal cases, or other similar circumstances, the individual may not be notified.

When implementing an exit ban decision, the immigration authorities shall notify the individual in accordance with the contents of the notice received from the authority making the decision.

At the same time, in the accompanying Q&A, the Ministry of Justice, the Ministry of Public Security, and the National Immigration Administration specifically emphasized that, in implementing the Regulations, commercial secrets, personal privacy, and personal information shall be protected in accordance with the law, while balancing the needs of national security with the protection of the lawful rights and interests of the individuals concerned.

Another important feature of the Regulations is that they further clarify the implementation of China’s countermeasures regime in the context of visa issuance and the entry administration of foreign nationals.

Article 5 provides that where a foreign national has been included on a countermeasure list, the Unreliable Entity List, the Malicious Entity List, or has otherwise been made subject to countermeasures or restrictive measures in accordance with the law, and relevant legal measures such as refusing to issue exit-entry documents or denying entry are required, such measures shall be implemented by the visa authorities and immigration authorities in accordance with their respective responsibilities.

Article 5

Where a foreign national, when applying for a Chinese visa outside China or applying for entry at a port of entry, submits false materials or makes false statements, the immigration authorities or visa authorities may decide to prohibit that person from entering China for a period of one to five years.

Where a foreign national has received criminal punishment for disrupting border administration, or administrative penalties for fraudulently obtaining exit-entry documents or for illegal exit or entry, the immigration authorities may, based on the nature of the violation and the need to prevent future violations or crimes, decide to prohibit that person from entering China for a period of one to five years from the date the penalty has been fully served. Where other laws provide otherwise, those provisions shall apply.

Where a foreign national has been included on a countermeasure list, the Unreliable Entity List, the Malicious Entity List, or has otherwise been made subject to countermeasures or restrictive measures, and it is necessary under the law to refuse the issuance of exit-entry documents or deny entry, such measures shall be implemented by the immigration authorities and visa authorities in accordance with their respective responsibilities.

In the accompanying policy interpretation, the Ministry of Justice, the Ministry of Public Security, and the National Immigration Administration explicitly stated that the purpose of these provisions is to “strengthen the implementation of entry-related countermeasures” and to further improve China’s legal framework for countering sanctions, foreign interference, and “long-arm jurisdiction.”

From the perspective of institutional coordination, this means that restrictive measures previously established under the Anti-Foreign Sanctions Law, the Unreliable Entity List regime, and the legal framework for countering the extraterritorial application of foreign laws have now been more clearly integrated with China’s visa administration, border inspection, and entry management systems, providing a clearer implementation pathway for these measures.

Below is the full translation (unofficial) of the regulation and the Q&A:

Provisions of the State Council on the Administration of Exit and Entry

Article 1　These Provisions are formulated in accordance with the Exit and Entry Administration Law of the People’s Republic of China and other laws, for the purposes of regulating exit and entry administration, protecting the lawful rights and interests of persons exiting or entering the country, and safeguarding national sovereignty, security, and development interests.

Article 2　The State shall establish and improve a system for preventing safety and security risks relating to the exit of Chinese citizens from the country.

The competent departments of the State Council for foreign affairs, culture and tourism, and diplomatic missions abroad shall, in light of the security conditions in relevant countries and regions, including wars or armed conflicts, public security conditions, natural disasters, accidents and disasters, and outbreaks of infectious diseases, promptly publish overseas security alerts and safety risk advisories for travel destinations.

Chinese citizens shall pay attention to overseas security alerts and safety risk advisories for travel destinations, and avoid travelling to or staying in high-risk countries or regions.

When accepting and examining applications by Chinese citizens for exit and entry documents and conducting exit border inspection, immigration administration authorities shall, on the basis of notifications from the relevant competent departments of the State Council, remind Chinese citizens who intend to travel to high-risk countries or regions to travel with caution or to closely monitor the local security situation, heighten vigilance, strengthen precautions, and pay attention to safety. Where Chinese citizens intend to travel to countries or regions with the highest risk rating or where cases seriously endangering personal safety occur suddenly and frequently, such citizens shall, where necessary, be dissuaded from travelling there.

Article 3　The grounds on which persons exiting or entering the country apply for exit or entry, or for stay or residence, shall be truthful and lawful.

When verifying the identity of persons exiting or entering the country and the grounds for their applications, immigration administration authorities and visa authorities may inquire into relevant circumstances and require such persons to present or provide relevant documents, materials, electronic data and other information; persons exiting or entering the country shall cooperate accordingly.

Where any entity or individual issues invitation letters or other application materials for persons exiting or entering the country, such entity or individual shall be responsible for the authenticity of the matters invited and the matters certified, and shall cooperate with immigration administration authorities and visa authorities in verifying relevant information.

Where persons exiting or entering the country provide false materials or make false statements, immigration administration authorities and visa authorities shall have the authority to decide not to issue exit or entry documents or not to permit such persons to exit or enter the country.

Article 4　Where a Chinese citizen is subject to an administrative detention penalty for fraudulently obtaining exit or entry documents or for illegally exiting or entering the country, immigration administration authorities may, in light of the circumstances of the violation and the need to prevent violations and crimes, decide not to permit such citizen to exit the country for a period of not less than six months and not more than three years from the date on which execution of the penalty is completed.

Where a Chinese citizen engages in illegal or criminal activities abroad and thereby endangers national security and interests, the relevant competent departments of the State Council may decide, or the provincial people’s government at the place of domicile of such citizen within the territory of China may, after verification by a diplomatic mission abroad or other authority, decide not to permit such citizen to exit the country for a period of not less than six months and not more than three years from the date of return to China.

Where a Chinese citizen violates provisions on export control, technology import and export administration or other provisions, and may endanger national industrial security or technological security, the competent departments of the State Council for commerce and other relevant matters may decide not to permit such citizen to exit the country.

Article 5　Where a foreign national provides false materials or makes false statements when applying for a Chinese visa abroad or applying for entry at a port, immigration administration authorities and visa authorities may decide not to permit such foreign national to enter the country for a period of not less than one year and not more than five years.

Where a foreign national is subject to a criminal penalty for obstructing the administration of national borders, or is subject to an administrative penalty for fraudulently obtaining exit or entry documents or for illegally exiting or entering the country, immigration administration authorities may, in light of the circumstances of the violation and the need to prevent violations and crimes, decide not to permit such foreign national to enter the country for a period of not less than one year and not more than five years from the date on which execution of the penalty is completed. Where laws provide otherwise, such provisions shall prevail.

Where a foreign national is included on a countermeasure list, unreliable entity list, malicious entity list, or is subject to countermeasures, restrictive measures or other measures, and it is necessary to take relevant measures in accordance with law, including refusing to issue exit or entry documents or denying entry, immigration administration authorities and visa authorities shall implement such measures in accordance with their respective functions.

Article 6　With respect to persons against whom a decision not to permit exit from the country has been made in accordance with law, the deciding authority shall, in accordance with provisions, promptly notify immigration administration authorities for enforcement, and shall inform the party concerned in writing of the facts, reasons and basis for the decision not to permit exit, as well as the channels for seeking remedies; where circumstances exist in which such notification may affect national security, criminal case investigations or other matters, the party concerned may not be informed.

When enforcing a decision not to permit exit from the country, immigration administration authorities shall inform the party concerned of the contents notified by the deciding authority.

Article 7　The State shall implement record-filing administration with respect to institutions and personnel that, upon entrustment by persons exiting or entering the country, engage in intermediary services such as consulting on exit and entry policies, agency services for documents, and handling of procedures.

An institution engaging in exit and entry intermediary services shall, within 15 days from the date of its establishment, complete record-filing with the immigration administration authority at the place where it is located. Personnel engaging in exit and entry intermediary services shall have record-filing formalities handled by the institution to which they belong. Those that have already engaged in exit and entry intermediary services before the implementation of these Provisions shall complete record-filing formalities within 90 days from the date on which these Provisions come into force.

Specific measures for the record-filing administration of institutions and personnel engaging in exit and entry intermediary services shall be formulated by the national immigration administration department in conjunction with the competent departments of the State Council for market regulation and other matters.

Article 8　An institution engaging in exit and entry intermediary services shall meet the following conditions:

(1) it is established in accordance with law;
(2) its legal representative or person in charge has not been subject to a criminal penalty for an intentional crime;
(3) it has staff with professional knowledge of laws, regulations, policies and other matters relating to exit and entry, and has funds and premises commensurate with the intermediary service activities in which it engages;
(4) staff who directly provide intermediary services to persons exiting or entering the country have not been subject to a criminal penalty for an intentional crime endangering national security or public security or obstructing the administration of national borders;
(5) it has sound management systems, including systems for personnel management, education and training, retention of materials, data security, and compliance management.

An institution engaging in outbound intermediary services shall also have established cooperative relations with relevant overseas service institutions or signed valid letters of intent for cooperation.

Overseas enterprises and institutions shall not provide exit and entry intermediary services within the territory of China.

Article 9　Immigration administration authorities shall, in conjunction with competent departments at the same level for foreign affairs, education, judicial administration, human resources and social security, commerce, culture and tourism, market regulation and other relevant matters, establish and improve regulatory systems, strengthen supervision and administration of the satisfaction of conditions and business activities of institutions engaging in exit and entry intermediary services in accordance with the division of functions, and publish relevant information on violations of law and adverse records in accordance with law.

Relevant competent departments and their staff shall, in accordance with law, keep confidential any state secrets, work secrets, trade secrets, personal privacy and personal information that they become aware of in the course of performing their duties.

Article 10　An institution engaging in exit and entry intermediary services shall not commit any of the following acts:

(1) publishing false information, or soliciting service recipients by exaggerated publicity, misleading publicity or other means;
(2) providing or assisting in providing false materials, or assisting others in handling visas, stay or residence documents, passports or other exit and entry documents or formalities in violation of provisions;
(3) disclosing, selling or illegally providing trade secrets, personal privacy or personal information learned in the course of intermediary service activities;
(4) engaging in exit and entry intermediary services beyond the scope of record-filing;
(5) organizing or assisting others in engaging in cross-border illegal or criminal activities;
(6) other acts that endanger national security or interests or disrupt the order of exit and entry administration.

Where public officials, military personnel or other persons entrust an institution engaging in exit and entry intermediary services to handle foreign nationality, overseas permanent residence qualifications, overseas residence documents, or other exit and entry documents or formalities in violation of provisions, the institution engaging in exit and entry intermediary services shall not handle such matters, and shall promptly report the matter to the supervisory organs and other authorities.

Article 11　Where any person obtains a visa, stay or residence document, passport or other exit or entry document by fraud through providing false materials, making false statements or other falsification, immigration administration authorities shall impose penalties in accordance with the Exit and Entry Administration Law of the People’s Republic of China and the Passport Law of the People’s Republic of China.

Where an individual issues a false invitation letter or other application materials for another person’s application for exit or entry, or for stay or residence, immigration administration authorities shall impose a fine of not less than RMB 5,000 and not more than RMB 10,000; where there are illegal gains, the illegal gains shall be confiscated. Where an entity commits the aforesaid act, a fine of not less than RMB 10,000 and not more than RMB 50,000 shall be imposed; where there are illegal gains, the illegal gains shall be confiscated; and the directly responsible person in charge and other directly responsible persons shall be fined not less than RMB 5,000 and not more than RMB 10,000. Where laws provide otherwise, such provisions shall prevail.

Article 12　Where an institution engaging in exit and entry intermediary services violates Article 7 or Article 8 of these Provisions, immigration administration authorities shall order it to make corrections within a prescribed time limit; where it refuses to make corrections, a fine of not less than RMB 5,000 and not more than RMB 10,000 shall be imposed, and the relevant competent departments shall be notified to order suspension of relevant business or suspension of business for rectification; where the circumstances are serious, a fine of not less than RMB 10,000 and not more than RMB 50,000 shall be imposed, and the relevant competent departments shall be notified to revoke the relevant business licence or revoke the business licence.

Where an individual engages in exit and entry intermediary services in violation of these Provisions, immigration administration authorities shall order the cessation of the illegal act; where there are illegal gains, the illegal gains shall be confiscated; where the circumstances are serious, a fine of not more than RMB 5,000 may also be imposed.

Article 13　Where an institution engaging in exit and entry intermediary services violates Article 10 of these Provisions and disrupts the order of exit and entry administration, immigration administration authorities shall order it to make corrections within a prescribed time limit; where there are illegal gains, the illegal gains shall be confiscated; where the illegal gains are RMB 20,000 or more, a fine of not less than one time and not more than five times the illegal gains shall also be imposed; where there are no illegal gains or the illegal gains are less than RMB 20,000, a fine of not less than RMB 20,000 and not more than RMB 50,000 shall also be imposed; where it refuses to make corrections or the circumstances are serious, the relevant competent departments shall be notified to order suspension of relevant business, suspension of business for rectification, revocation of the relevant business licence, or revocation of the business licence; and the directly responsible person in charge and other directly responsible persons shall be fined not less than RMB 10,000 and not more than RMB 50,000. Where laws provide otherwise, such provisions shall prevail.

Article 14　Where an exit and entry administration authority of the public security organ of a local people’s government at or above the county level imposes an administrative penalty of a fine exceeding RMB 5,000 or confiscation of illegal gains in accordance with these Provisions, the decision shall be made by the public security organ to which it belongs.

Article 15　The relevant competent departments of the State Council shall strengthen coordination in work relating to the protection of the lawful rights and interests of persons exiting or entering the country, the prevention of safety and security risks relating to the exit of Chinese citizens from the country, and the administration of exit and entry intermediary services.

Article 16　Immigration administration authorities shall maintain unobstructed channels for reporting acts violating exit and entry administration, and shall handle relevant reports promptly in accordance with law. Reports that do not fall within the functions of the authority shall be promptly transferred to the relevant entity for handling in accordance with law.

Article 17　Where any violation of these Provisions constitutes a crime, criminal liability shall be pursued in accordance with law.

Article 18　For the purposes of these Provisions, “immigration administration authorities” means the national immigration administration department, exit and entry border inspection authorities, and exit and entry administration authorities of public security organs of local people’s governments at or above the county level.

For the purposes of these Provisions, “visa authorities” means overseas visa authorities and port visa authorities.

Article 19　These Provisions shall come into force on September 15, 2026.

Officials from the Ministry of Justice, the Ministry of Public Security, and the National Immigration Administration Answer Reporters’ Questions on the State Council Provisions on Exit and Entry Administration

On July 22, 2026, Premier Li Qiang of the State Council signed State Council Decree No. 841, promulgating the State Council Provisions on Exit and Entry Administration (hereinafter referred to as the “Provisions”), which will come into force on September 15, 2026. Officials from the Ministry of Justice, the Ministry of Public Security, and the National Immigration Administration answered reporters’ questions on issues related to the Provisions.

Q: Please briefly introduce the background to the formulation of the Provisions.

A: Exit and entry administration concerns the safety and lawful rights and interests of Chinese nationals traveling abroad, as well as China’s sovereignty, security, and development interests. Since the Exit and Entry Administration Law came into force in 2013, it has played an important role in regulating exit and entry administration, safeguarding national sovereignty, security, and social order, and promoting opening-up and exchanges with other countries.

As China continues to advance high-standard opening-up across the board, new challenges and issues have emerged in exit and entry administration. It is therefore urgent to promulgate the Provisions in accordance with the principle of addressing urgent needs first, so as to improve relevant systems.

First, it is necessary to strengthen the prevention of safety risks for Chinese citizens traveling abroad. As China’s international exchanges continue to expand, more and more Chinese citizens travel overseas for tourism, family visits, business, study, and other purposes. In recent years, major emergencies such as wars or armed conflicts, public security incidents, natural disasters, accidents, and infectious disease outbreaks have occurred from time to time in some countries and regions, posing threats to the personal safety of Chinese citizens abroad. It is therefore necessary to promptly improve the system for preventing safety risks faced by citizens traveling overseas.

Second, it is necessary to regulate the entry administration of foreigners. As China continues to deepen its opening-up, the number of foreign nationals entering China has continued to grow. In practice, there have also been cases in which a small number of individuals provided false materials or fraudulently obtained exit and entry documents when applying for entry. It is therefore necessary to improve measures such as entry examination and denial of entry.

Third, it is necessary to regulate exit and entry intermediary services. After the access licensing requirement for private exit and entry intermediary service agencies was abolished in 2018, the number of such agencies grew rapidly. While they have provided convenience for exit and entry personnel, problems have also emerged, including unclear overall information about intermediary agencies, unlawful or non-compliant business practices by some agencies, and harm to the lawful rights and interests of exit and entry personnel. It is therefore necessary to improve the management system for intermediary service agencies.

Q: What provisions does the Provisions contain regarding the prevention of safety risks for Chinese citizens traveling abroad and the protection of their personal safety?

A: In order to more effectively prevent safety risks faced by Chinese citizens after they travel abroad and to protect their personal safety, the Provisions adhere to the principle of prioritizing prevention and adopting comprehensive measures. The main provisions are as follows.

On the one hand, overseas safety risk alerts and reminders must be issued in a timely manner. The foreign affairs, culture, and tourism departments of the State Council, as well as diplomatic missions abroad, are required to promptly publish overseas safety alerts and safety risk reminders for tourist destinations based on the security situation in relevant countries and regions, including wars or armed conflicts, public security conditions, natural disasters, accidents, infectious disease outbreaks, and other factors.

On the other hand, the safety risk prevention system at the exit stage is improved. Immigration administration authorities are required, when accepting and approving applications for exit and entry documents and conducting exit border inspections, to remind citizens to exercise caution when traveling to high-risk countries or regions. For those who indeed need to travel to such destinations, the authorities should remind them to pay attention to the local security situation and strengthen safety precautions. When necessary, the authorities should dissuade them from traveling to countries or regions with the highest risk level or where incidents seriously endangering personal safety are occurring suddenly or frequently.

Q: What provisions does the Provisions contain regarding the regulation of exit administration for Chinese citizens?

A: In recent years, as the number of Chinese citizens traveling abroad has continued to increase, some problems have arisen in practice. These include individuals being deceived into leaving the country, or fabricating reasons to illegally exit the country to engage in illegal activities such as cross-border gambling and telecom and online fraud, seriously endangering the lives and property of the public. There have also been cases in which individuals illegally transferred technology abroad after leaving the country in violation of regulations, endangering national industrial security and technological security.

In response to these issues, the Provisions strengthen exit administration on the one hand. They require that the reasons given by exit applicants must be truthful and lawful, and that applicants cooperate with immigration administration authorities in verifying their identity and the reasons for their application. They also provide that entities and individuals issuing invitation letters shall be responsible for the truthfulness of the invitation content. Where false materials are provided or false statements are made, immigration administration authorities have the right to decide not to issue exit and entry documents or not to permit the applicant to leave the country.

On the other hand, pursuant to the authorization under the Exit and Entry Administration Law, the Provisions improve the circumstances under which exit may be denied. In accordance with the law, exit shall be denied to persons who have been subject to administrative detention for fraudulently obtaining exit and entry documents or for illegally exiting or entering the country; persons who engage in illegal or criminal activities abroad that endanger national security and interests; and persons who may endanger national industrial security or technological security by violating regulations on export control, technology import and export administration, and other related rules.

Q: What provisions does the Provisions contain regarding the regulation of entry administration for foreigners?

A: To further regulate the entry administration of foreigners, the Provisions mainly contain the following provisions.

First, entry administration is strengthened. The Provisions require that the reasons given by entry applicants for entry, stay, or residence must be truthful and lawful, and that applicants cooperate with immigration administration authorities and visa authorities in verifying their identity and the reasons for their application. They also provide that entities and individuals issuing invitation letters shall be responsible for the truthfulness of the invitation content.

Second, the circumstances under which entry may be denied are improved. Pursuant to the authorization under the Exit and Entry Administration Law, the Provisions specify that foreign nationals who provide false materials or make false statements when applying for a Chinese visa abroad or applying for entry at a port, who have been subject to criminal punishment for obstructing the administration of national border control, or who have been subject to administrative penalties for fraudulently obtaining exit and entry documents or for illegally exiting or entering the country, shall be denied entry in accordance with the law.

Third, the implementation of entry-related countermeasures is strengthened. To strengthen the rule-of-law response to counter-sanctions, anti-interference, and opposition to “long-arm jurisdiction,” the Provisions stipulate that where foreign nationals are included on a countermeasure list, the unreliable entity list, or the malicious entity list, or are subject to countermeasures and restrictive measures, and where relevant measures such as refusing to issue exit and entry documents or denying entry need to be taken in accordance with the law, immigration administration authorities and visa authorities shall implement such measures according to their respective duties.

Q: Please briefly introduce the main considerations behind the establishment of the filing-based management system for exit and entry intermediary service agencies under the Provisions.

A: In recent years, the number of agencies in China engaged in exit and entry intermediary services has grown rapidly. While they have provided convenience for exit and entry personnel, problems have also emerged, including unclear overall information about such agencies, unlawful or non-compliant business practices by some agencies, and harm to the lawful rights and interests of exit and entry personnel. These issues affect the standardized and healthy development of the industry and endanger the national order of exit and entry administration. It is therefore urgent to improve relevant systems and rules.

The Provisions adopt a problem-oriented approach and improve the management system for intermediary service agencies in a targeted manner.

First, a filing-based management system is established. The Provisions specify that agencies and personnel entrusted by exit and entry personnel to provide intermediary services such as exit and entry policy consultation, document application agency services, and procedure handling shall be subject to filing-based management. Intermediary service agencies are required to file with the local immigration administration authority within 15 days from the date of establishment. Personnel engaged in exit and entry intermediary services shall complete filing procedures through their agencies. Agencies that were already engaged in intermediary services before the Provisions come into force shall complete filing procedures within 90 days from the date on which the Provisions come into force. Non-profit activities such as policy consultation and information inquiries do not fall within the scope of “exit and entry intermediary services” as referred to in the Provisions.

Second, the conditions that intermediary service agencies must meet are clarified. To ensure the quality of intermediary services and improve service standards, agencies engaged in exit and entry intermediary services are required to have staff with relevant professional knowledge, as well as premises and financial support commensurate with the intermediary service activities they conduct. At the same time, the Provisions clarify that overseas enterprises and institutions may not provide exit and entry intermediary services within China. Foreign-invested enterprises and institutions, as well as enterprises and institutions funded by investors from Hong Kong, Macao, or Taiwan, that are lawfully established within China may engage in exit and entry intermediary services in accordance with the law.

Third, intermediary service practices are regulated. To effectively protect the lawful rights and interests of exit and entry personnel and promote the standardized and healthy development of the industry, the Provisions stipulate that agencies engaged in exit and entry intermediary services shall not publish false information, solicit clients through exaggerated or misleading publicity, provide or assist in providing false materials, or assist others in improperly handling visas, stay or residence permits, passports, or other exit and entry documents or procedures.

Q: What provisions does the Provisions contain regarding the strengthening of protection for the lawful rights and interests of exit and entry personnel?

A: To better protect the lawful rights and interests of exit and entry personnel, the Provisions, while strengthening the protection of the personal safety of outbound travelers, also strengthen protection in the following respects.

On the one hand, protection of personal privacy and personal information is strengthened. The Provisions emphasize that relevant competent departments and their staff shall keep confidential, in accordance with the law, any trade secrets, personal privacy, and personal information that they become aware of in the course of performing their duties. They also provide that exit and entry intermediary service agencies shall not disclose, sell, or illegally provide trade secrets, personal privacy, or personal information.

On the other hand, the Provisions clarify that authorities making decisions to deny exit shall, in accordance with the law, inform the parties concerned in writing of the facts, reasons, legal basis, and remedies relating to the denial of exit. When immigration administration authorities enforce a decision to deny exit, they shall notify the parties concerned in accordance with the notice from the decision-making authority, so as to effectively strengthen protection of the parties’ lawful rights and interests regarding exit.

According to the Chinese readout, the two sides discussed implementing the consensus reached by the two heads of state at their Beijing meeting, maintaining stable economic and trade relations, expanding practical cooperation, and properly addressing each other’s concerns.

On July 30, Chinese Vice Premier He Lifeng, China's lead official for China-U.S. economic and trade affairs, held a video call with his U.S. counterparts, Treasury Secretary Scott Bessent and U.S. Trade Representative Jamieson Greer. The two sides held candid, in-depth, and constructive discussions on implementing the important consensus reached by the two heads of state during their meeting in Beijing, maintaining stable China-U.S. economic and trade relations in the next stage, expanding practical cooperation, and properly addressing each other's concerns. The Chinese side expressed serious concerns over the recent U.S. restrictive economic and trade measures against China. The two sides agreed that, under the strategic guidance of the two heads of state, they will further make full use of the China-U.S. economic and trade consultation mechanism, strengthen communication, enhance mutual trust, address each other's concerns, expand cooperation, promote the stable and positive development of bilateral economic and trade relations, and contribute to building a constructive and strategically stable China-U.S. relationship.

One sentence in the Chinese statement deserves particular attention: “The Chinese side expressed serious concerns over the recent U.S. restrictive economic and trade measures against China.”

It is worth reviewing what these “restrictive measures” refer to. In the week leading up to the call, the United States either introduced or signaled new restrictions across tariffs, robotics, energy equipment, telecommunications components, and artificial intelligence.

On July 23, the United States announced a new round of Section 301 tariffs targeting products associated with forced labor. Citing the failure of other economies to take sufficient measures to prevent goods produced with forced labor from entering global supply chains, the White House imposed an additional 12.5% tariff on products from China and around 60 other economies. Unlike the broader tariffs previously challenged in U.S. courts under the International Emergency Economic Powers Act (IEEPA), this action relies on Section 301 of the Trade Act of 1974. Beijing is likely concerned that Washington is repackaging broad-based tariffs into a series of legally distinct Section 301 actions based on different policy justifications, making them more difficult to reverse in the future.

On July 28, the Federal Communications Commission (FCC) announced restrictions on new foreign-manufactured advanced mobile robots and grid-connected power inverters entering the U.S. market. The policy covers humanoid robots, quadruped robots, and other devices that rely on wireless connectivity to navigate or perform autonomous functions. Although the rule is technology-neutral on its face, its practical target is widely understood to be Chinese manufacturers. Rather than banning existing products, the FCC is restricting new models from obtaining equipment authorization. Products that have already received authorization will not automatically lose their approvals, although the FCC retains the authority to revoke them in the future.

During the same week, the FCC also adopted rules preventing products containing specified logic components from companies on the FCC’s Covered List, including Huawei and ZTE, from obtaining equipment authorization. As a result, the scope of U.S. restrictions has expanded beyond complete telecommunications equipment to include internal chips, modules, and control components incorporated into a wide range of products.

Meanwhile, U.S. government officials and members of Congress have increasingly accused certain Chinese AI companies of acquiring the capabilities of leading U.S. models through model distillation, account circumvention, or access to export-controlled computing resources. Moonshot AI and its Kimi models have received particular attention. The U.S. government is reportedly evaluating whether to respond through export controls, Entity List designations, or other sanctions tools.

The U.S. Department of War has also recently expanded its Section 1286 list to include several Chinese universities under the “problematic activities” framework established by the National Defense Authorization Act. The practical consequences extend well beyond symbolic designation, affecting eligibility for U.S. federal research funding, university partnerships, academic exchanges, laboratory procurement, and participation in advanced research networks.

On July 29, the Treasury Department’s Office of Foreign Assets Control (OFAC) announced new Iran-related sanctions targeting entities registered in Hong Kong or linked to offices in Shenzhen as part of Iran’s oil transportation and “shadow fleet” network. Designation on the SDN List typically cuts designated entities off from the U.S. dollar financial system, transactions involving U.S. persons, and compliance channels used by major international banks, with broader spillover effects on shipping, insurance, trade finance, and energy supply chains.

The U.S. readout framed the call primarily around implementation and institutional mechanisms, with particular emphasis on China’s commitments regarding rare earth exports and agricultural trade. Washington appears focused on ensuring that Beijing follows through on the commitments made during the leaders’ meeting, while Beijing is seeking to discourage the United States from introducing additional restrictive measures after the meeting.

Today,US Trade Representative Greer and I spoke with Chinese Vice Premier He Lifeng ahead of President Trump and President Xi’s meeting in September.

In our discussion, I emphasized that we expect Beijing to fully meet its commitments on rare earths and U.S. agricultural products. We also discussed implementation of the Trade and Investment Boards as a mechanism to secure concrete progress toward a more balanced, fair, and constructive U.S.-China economic relationship.

In the near term, both sides are likely to continue managing frictions through the bilateral economic and trade consultation mechanism. However, the recent series of U.S. restrictive measures may already represent an important test of whether China and the United States can maintain constructive strategic stability despite intensifying competition.

It was released in July 2026 (Draft for Public Comment, v0.23) by the Secretariat of the National Information Security Standardization Technical Committee (TC260) — the body that steers China’s national cybersecurity standards.

As a “practice guide,” it is not a mandatory national standard but an authoritative reference that signals the direction of forthcoming regulation and industry practice.

The guide sets out security requirements for how AI agents interact — both agent-to-agent and agent-to-tool — with the aim of preventing risks such as identity forgery, unauthorized (privilege) access, and the cascading spread of hallucinations across multiple agents.

It is organized around three areas:

(1) general interaction security (identity, access control, communication security, and risk management);

(2) agent-to-agent interaction security (registration, discovery, and mutual invocation); and

(3) agent-to-tool interaction security (tool discovery and tool invocation). An informative appendix maps a catalog of concrete interaction risks (e.g., information tampering, information leakage, privilege loss of control, tool abuse, intent hijacking) to the specific clauses that mitigate them.

It is aimed at AI agent service providers and tool providers, and can also serve as a reference for third-party assessors.

(The full translation follows. In case of any discrepancy, the original Chinese document prevails.）

Foreword

The Cybersecurity Standards Practice Guide (hereinafter the “Practice Guide”) is a standards-related technical document organized, developed, and published by the Secretariat of the National Information Security Standardization Technical Committee (hereinafter the “Cybersecurity Standardization Committee” or “TC260”). It aims to promote cybersecurity-related standards and knowledge and to provide standardization practice guidance around such themes as cybersecurity laws, regulations and policies, standards, and cybersecurity hot topics and incidents.

Drafting organizations of this document: China Mobile Communications Group Co., Ltd.; China Electronics Standardization Institute; Beijing Zhongguancun Laboratory; National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT/CC); ZTE Corporation; Beijing Kuaishou Technology Co., Ltd.; Fudan University; Alibaba Cloud Computing Co., Ltd.; Strategic Research Center of Qiyuan Laboratory; Ant Technology Group Co., Ltd.; Harbin Institute of Technology.

Drafters of this document: Qiu Qin, Su Li, Yang Kai, Li Ziwei, He Min, Cui Yong, Chen Jia, Zhao Yuhang, Ran Peng, Sun Yang, Li Bangling, Lu Dongjie, Xu Sijia, Zhang Yanting, Zhang Lei, Chao Yihan, Du Chenguang, Shi Guixin, Li Ye, Wang Kun, Wang Bo, Zhou Jihua, Mei Aoting, Cao Xiaoqi, Shao Meng, Wang Jian, Gu Chen, Yang Min, Hong Geng, Chen Pei, Peng Juntao, Xu Yuan, Li Yunjia, Lin Guanchen, Yang Xiaofang, Peng Jin, Jiang Wei, Ye Lin.

Statement

The copyright of this Practice Guide belongs to the Secretariat of the Cybersecurity Standardization Committee. Without the written authorization of the Secretariat, no part of this Practice Guide may be copied or translated in any manner. When reprinting or citing the views or data of this Practice Guide, please indicate: “Source: Secretariat of the National Information Security Standardization Technical Committee.”

Abstract

This document is developed to guide the interaction security of AI agents and to prevent security risks such as identity forgery, unauthorized access, and cascading hallucination propagation across multiple agents during agent interaction, in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, and relevant national standards.

To this end, this Guide specifies general security requirements for agent interaction, as well as security requirements for agent-to-agent interaction and agent-to-tool interaction. It is intended to provide security practice guidance on the interaction process for AI agent service providers and tool providers, and may also serve as a reference for third-party assessment organizations and other bodies.

Table of Contents

1. Scope

2. Normative References

3. Terms and Definitions

4. Abbreviations

5. Overview

6. General Security Requirements for AI Agent Interaction

7. Security Requirements for Agent-to-Agent Interaction

8. Security Requirements for Agent-to-Tool Interaction

• Appendix A (Informative) — List of AI Agent Interaction Security Risks

• References

1 Scope

This document specifies the interaction security requirements for agent-to-agent and agent-to-tool interactions, including general security requirements for agent interaction, security requirements for agent-to-agent interaction, and security requirements for agent-to-tool interaction.

This document is applicable to guiding AI agent service providers and tool providers in safeguarding the security of the agent interaction process. It is also applicable to third-party assessment organizations and other bodies in assessing the security of agent interaction.

2 Normative References

The contents of the following documents, through normative reference in this text, constitute indispensable provisions of this document. For dated references, only the version corresponding to that date applies to this document. For undated references, the latest version (including all amendments) applies to this document.

• GB/T 25069 — Information security techniques — Terminology

• GB 45438—2025 — Cybersecurity technology — Labeling method for content generated and synthesized by artificial intelligence

• GB/T 45574—2025 — Data security technology — Security requirements for the processing of sensitive personal information

• GB/T 45654—2025 — Cybersecurity technology — Basic security requirements for generative artificial intelligence services

• GB/Z 185.1—2026 — Artificial intelligence — Agent interconnection — Part 1: General architecture

• GB/Z 185.3—2026 — Artificial intelligence — Agent interconnection — Part 3: Identity management

• GB/Z 185.4—2026 — Artificial intelligence — Agent interconnection — Part 4: Agent description

• GB/Z 185.5—2026 — Artificial intelligence — Agent interconnection — Part 5: Agent discovery

• ISO/IEC 22989:2022 — Information technology — Artificial intelligence — Artificial intelligence concepts and terminology

3 Terms and Definitions

3.1 AI agent

A general term for an automated entity — that is, a process or system that can operate under specified conditions without human intervention or with controlled human intervention, that can perceive and respond to its environment, and that takes actions to achieve its goals.

[Source: ISO/IEC 22989:2022, 3.1.1, modified]

3.2 AI agent service provider

An organization or individual that provides AI agent services.

3.3 AI agent description

Machine- and human-understandable information used to describe an agent’s name, functions, and so forth.

[Source: GB/Z 185.4—2026, 3.1]

NOTE: In a specific system, the agent description generally follows a specific form of expression.

3.4 AI agent credential

A tamper-resistant collection of data that contains claims about an agent’s identity attributes and is used for identity authentication.

[Source: GB/Z 185.1—2026, 3.4]

3.5 AI agent discovery

The process of matching and obtaining one or more agent descriptions that meet business requirements.

[Source: GB/Z 185.5—2026, 3.1]

3.6 Agent discovery service

A process that implements or provides the agent discovery function.

[Source: GB/Z 185.5—2026, 3.2]

3.7 Agent identity registration service

A service that processes agent identity registration requests, performs agent identity verification, and manages agent identity accounts.

[Source: GB/Z 185.3—2026, 3.4, modified]

3.8 Critical information infrastructure

Important network facilities, information systems, and the like in important industries and fields such as public communications and information services, energy, transportation, water conservancy, finance, public services, e-government, and the national defense science, technology, and industry sector, as well as others that, once damaged, disabled, or subject to data breach, may seriously endanger national security, the national economy and people’s livelihood, or the public interest.

[Source: GB/T 39204—2022, 3.1]

3.9 Tool

A functional entity that can be invoked by an agent application.

NOTE: Examples of tools include cloud services, applications, agents, external devices, and so forth.

3.10 Minimum privilege

For a given subject, its access rights are limited to only those privileges necessary to perform the authorized tasks.

[Source: GB/T 5271.8—2001, 08.04.15, modified]

3.11 Identity (identifier)

Information that can uniquely determine the identity of an entity.

[Source: GM/T 0090—2020, 3.1]

NOTE: An identifier consists of information that the entity cannot repudiate, such as the entity’s identifiable name, email address, ID card number, telephone number, street address, and so forth.

4 Abbreviations

The following abbreviations apply to this document.

• AI: Artificial Intelligence

• TLS: Transport Layer Security

• IP: Internet Protocol

5 Overview

The security requirements for agent interaction include general security requirements for agent interaction, security requirements for agent-to-agent interaction, and security requirements for agent-to-tool interaction, as shown in Figure 1:

Figure 1 — AI Agent Interaction Security Architecture

Description of Figure 1 (original labels are in Chinese): The architecture consists of two top-level blocks — Security Requirements for Agent-to-Agent Interaction (智能体间交互安全要求) and Security Requirements for Agent-to-Tool Interaction (智能体与工具交互安全要求) — which are both supported (支撑) by a foundational layer, General Security Requirements for Agent Interaction (智能体交互通用安全要求). This foundational layer comprises four components: Identity (身份标识), Access Control (访问控制), Communication Security (通信安全), and Risk Management (风险管控).

6 General Security Requirements for AI Agent Interaction

6.1 Identity

An agent shall have an identifier that can uniquely identify the agent. An agent shall have an agent credential corresponding to that identifier.

6.2 Access Control

Both parties to an agent interaction shall support an access control mechanism to decide whether to permit access and to interrupt access.

6.3 Communication Security

The communication security requirements for agent interaction are as follows:

a) An agent shall use a secure communication channel that supports identity authentication of the access object and provides non-repudiation of both parties’ behaviors.

b) An agent shall adopt encryption and integrity-verification strategies, and should use a transport-layer protocol of TLS 1.2 or above.

c) An agent that processes critical business carried by critical information infrastructure shall, during communication with an interaction counterpart, use cryptographic algorithms for identity authentication, data encryption, and integrity verification in accordance with the requirements of the national cryptography administration authority and relevant industry requirements.

d) An agent service provider shall support traffic monitoring and cleaning mechanisms, identify and rate-limit/block abnormally high-frequency requests, and prevent resource-exhaustion attacks.

e) An agent service provider should support a transmission-path redundancy mechanism that automatically switches to a backup path when the primary path is impaired.

6.4 Risk Management

6.4.1 Proactive Prevention

The proactive-prevention security requirements for agent interaction are as follows:

a) An agent service provider shall establish an interaction rate-limiting mechanism for agents, controlling the number of interaction counterparts and the interaction frequency of a single agent per unit of time.

b) An agent service provider should support making advance judgments about potential abnormal interaction behaviors based on historical interaction logs and behavior-feature libraries, and should intercept high-risk interaction requests or subject them to manual review.

6.4.2 Anomaly Detection

The anomaly-detection security requirements for agent interaction are as follows:

a) An agent service provider shall, on the condition that user authorization has been obtained, support a monitoring function for the agent interaction status, tracking in real time such information as communication time, interaction counterparts, interaction status, and interaction behaviors, and shall promptly discover and issue early warnings of abnormal behaviors.

b) When a non-convergent interaction or communication anomaly is detected, the agent service provider shall forcibly terminate the interaction and record the anomaly information.

NOTE: A non-convergent interaction refers to a situation in which the dialogue or operation sequence between agents falls into repetition, looping, or contradiction and cannot advance the task, or an interconnection interruption caused by a network fault, a crash of the counterpart agent, or non-responsiveness.

c) When the agent service provider detects abnormal behavior by either party to the interaction, it shall record the details of the abnormal event.

6.4.3 Attack Analysis

The attack-analysis security requirements for agent interaction are as follows:

a) For discovered attack activities, an agent service provider shall analyze the attack target and the attack route.

b) An agent service provider shall have a mechanism to protect against identified attack behaviors.

c) An agent service provider should establish a mechanism for collaborative anomaly detection across multiple agents.

6.4.4 Emergency Response and Handling

The emergency-response and handling security requirements for agent interaction are as follows:

a) An agent service provider shall formulate a graded response plan for agent interaction security incidents, clearly defining the handling procedures for general, relatively major, major, and especially major incidents.

b) An agent service provider shall formulate an emergency strategy for agent interaction. When an agent interaction security incident occurs, the provider shall immediately activate emergency response and handling measures, and — in light of the actual situation — rapidly implement measures such as severing communication connections, blocking interactions, isolation handling, and vulnerability remediation, and initiate secondary verification for objects that repeatedly exhibit anomalies. The provider shall produce an incident report and handling record, retain complete interaction logs and a chain of evidence, and prevent security risks from spreading along the interaction chain.

c) After a relatively major or higher-level security incident occurs, the agent service provider shall promptly report it to the competent authority.

6.4.5 Traceability

An agent service provider shall have an attack-traceability mechanism and should, based on the analysis results, build a profile of the attacker.

7 Security Requirements for Agent-to-Agent Interaction

7.1 Agent Registration Security

An agent service provider shall select an agent identity registration service. The service shall support the following security mechanisms for the registration process. At the time of registration:

a) The service shall authenticate the agent’s identity.

b) The service shall implement a registration monitoring mechanism that supports monitoring, alerting on, and deregistering agents with abnormal registrations.

c) The service shall conduct a compliance review of agent service providers, allowing only providers that pass the review to register their agents.

d) The service shall support an agent identity lifecycle management mechanism.

e) The service shall, based on the agent description, detect the authenticity of capabilities and the compliance of behaviors — including but not limited to detecting the capability scope, input/output types, the provider, and obvious false/malicious injection — and it is recommended that a third-party assessment organization be engaged to carry out testing.

7.2 Agent Discovery Security

The discovery-security requirements for agent interaction are as follows:

a) An agent service provider shall disclose agent descriptions based on a standardized agent discovery mechanism.

b) The agent service provider of the discovering party shall verify the integrity and source of the list information returned by discovery.

c) When an agent service provider chooses a service-based agent discovery mechanism, it shall select an agent discovery service that supports the following security mechanisms:

1. It shall have an anti-interference agent recommendation/ranking mechanism;

2. It shall support an anti-tampering mechanism for the agent list;

3. It shall support a mechanism for identifying and blocking malicious queries.

7.3 Agent-to-Agent Invocation Security

The invocation-security requirements for agent interaction are as follows:

a) Both parties to an agent invocation shall perform mutual identity authentication.

b) Both parties to an agent invocation shall, through a standard interface or other form, exchange each other’s agent descriptions, security policies, data requirements, and potential risks, and shall reach an invocation agreement on the basis that both parties fully understand the potential impacts.

c) Both parties to an agent invocation shall follow the principle of minimum privilege, shall support a privilege-negotiation mechanism, and the validity of privileges shall be verifiable.

d) An agent shall ensure decision-making autonomy during collaboration, preventing unauthorized parties from tampering with its decision logic or goals.

e) During the interaction, both parties to an agent invocation should support lifecycle management of the invocation session and a mechanism to prevent session hijacking.

NOTE: A session corresponds to one multi-agent interaction process. It is created by the requesting agent and has a numbered identifier, used to manage the service agents, messages, and tasks involved in that process.

f) Both parties to an agent invocation shall have a security-protection mechanism against attack behaviors and content in inputs and outputs, and — for critical information — shall have the ability to verify its authenticity and integrity.

g) Both parties to an agent invocation shall support a mechanism to identify abnormal behaviors that exceed the scope of the agent description.

h) During the interaction, the called-party agent shall be prohibited from enabling high-risk system privileges without user authorization.

i) The calling-party agent service provider shall grant only the minimum privileges consented to by the user; the called-party agent shall verify that such privileges are consistent with the user’s original authorization, and shall save the invocation logs.

8 Security Requirements for Agent-to-Tool Interaction

8.1 Tool Discovery Security

The tool-discovery security requirements for agent interaction are as follows:

a) During tool discovery, the agent service provider shall ensure that the source and integrity of the tool list are verifiable.

b) A tool provider shall disclose to the calling party complete tool attribute information whose integrity and source can be verified, containing at least the tool identifier, tool name, tool description, and tool input/output parameters.

8.2 Tool Invocation Security

The tool-invocation security requirements for agent interaction are as follows:

a) An agent shall obtain user authorization when invoking a tool.

b) When an agent invokes a tool, identity authentication shall be performed based on an identity-authentication mode supported by both parties.

NOTE: The identity-authentication mode may be any of the following: mutual identity authentication; the agent unilaterally authenticating the tool; the tool unilaterally authenticating the agent; or no identity authentication.

c) A tool provider shall implement the principle of minimum interface exposure, exposing to the agent only the minimum necessary functional interfaces.

d) When an agent invokes a tool, it shall follow the principle of minimum privilege.

e) When an agent invokes a tool by means of a protocol, it shall be based on a standardized protocol recognized by both parties.

f) An agent shall, on the basis of clear business necessity and risk-assessment results, strictly limit the application for and use of high-risk system privileges.

g) For tool invocations involving high-risk system privileges, the agent service provider shall fully inform the user of the security risks and obtain the user’s express consent.

h) An agent shall support a malicious-tool identification mechanism; when it identifies the tool to be invoked as a malicious tool, it shall not initiate the invocation.

i) An agent shall inspect the feedback information from tools; when it identifies malicious content or malicious behavior, it shall stop the invocation.

Appendix A (Informative) — List of AI Agent Interaction Security Risks

Table 1 — List of AI Agent Interaction Security Risks

T01 Information Tampering

Risk description: Tampering with input instructions, tampering with tool lists, tampering with invocation parameters/return results.

Covered clauses: 6.3 Communication Security; 7.3 Agent-to-Agent Invocation Security (f); 8.1 Tool Discovery Security (b); 8.2 Tool Invocation Security (i).

Solution:

1. Use a communication channel with encryption and integrity verification (6.3 b).

2. For agent-to-agent invocation, verify the authenticity and integrity of critical information (7.3 f).

3. During tool discovery, verify the integrity of the tool list and tool attribute information (8.1 a, b).

4. During tool invocation, inspect the tool’s feedback information and identify malicious content or behavior (8.2 i).

T02 Information Leakage

Risk description: Leakage of invocation-parameter/return-result information, output of sensitive information, memory theft.

Covered clauses: 6.3 Communication Security; 7.3 Agent-to-Agent Invocation Security (b, f); 8.2 Tool Invocation Security (g).

Solution:

1. Use an encrypted communication channel (6.3 b).

2. Exchange data requirements and security policies before agent-to-agent invocation (7.3 b), and apply security protection to output content (7.3 f).

3. Strictly limit the application for and use of high-risk system privileges, invoking them only in a controlled environment (8.2 g).

4. Follow the principle of minimum privilege (6.2, 7.3 c, 8.2 d).

T03 Information Missing

Risk description: Incomplete logs, difficulty in tracing accountability.

Covered clauses: 6.4.5 Traceability; 7.3 Agent-to-Agent Invocation Security (i).

Solution:

1. The agent service provider shall have an attack-traceability mechanism (6.4.5).

2. Agent-to-agent invocation shall save the invocation logs (7.3 i).

T04 Harmful Information

Risk description: Injection of harmful instructions, indirect injection, business-logic bypass, tool-description poisoning, malicious content in invocation parameters/return results, output of harmful/malicious content, propagation of false information.

Covered clauses: 6.4.2 Anomaly Detection; 7.3 Agent-to-Agent Invocation Security (f, g); 8.2 Tool Invocation Security (h, i).

Solution:

1. Monitor the interaction status, and detect and terminate non-convergent or abnormal interactions (6.4.2).

2. For agent-to-agent invocation, apply security protection to inputs and outputs and identify abnormal behaviors (7.3 f, g).

3. During tool invocation, support a malicious-tool identification mechanism (8.2 h) and detect malicious content fed back by tools (8.2 i).

T05 Identity Error

Risk description: Identity impersonation, agent identity forgery, forgery of the caller’s identity, confusion of user identity, unclear identity of the recipient, session hijacking.

Covered clauses: 6.1 Identity; 7.1 Agent Registration Security (a); 7.3 Agent-to-Agent Invocation Security (a, e); 8.2 Tool Invocation Security (b).

Solution:

1. An agent shall have a unique identifier and a corresponding credential (6.1).

2. Agent identity shall be authenticated at registration (7.1 a).

3. Agent-to-agent invocation must implement mutual identity authentication (7.3 a).

4. When an agent invokes a tool, identity authentication shall be performed based on a mode supported by both parties (8.2 b).

5. Support lifecycle management of invocation sessions and a session-hijacking prevention mechanism (7.3 (e)).

T06 Privilege Loss of Control

Risk description: Unauthorized access, unauthorized execution, environment jailbreak, runtime-environment escape, privilege overreach, system-privilege escalation, excessive privilege application.

Covered clauses: 6.2 Access Control; 7.3 Agent-to-Agent Invocation Security (c, h, i); 8.2 Tool Invocation Security (a, d, g).

Solution:

1. Both parties to the interaction shall support an access control mechanism (6.2).

2. Agent-to-agent invocation shall follow the principle of minimum privilege and support privilege negotiation and verification (7.3 c), shall prohibit enabling high-risk privileges without user authorization (7.3 h), and shall verify that privileges are consistent with the user’s original authorization (7.3 i).

3. Tool invocation shall obtain user authorization (8.2 a), follow minimum privilege (8.2 d), and strictly limit the use of high-risk privileges to controlled environments (8.2 g).

T07 Resource Occupation

Risk description: DoS attacks, planning confusion, resource overload, abuse of system functions.

Covered clauses: 6.3 Communication Security (d); 6.4.1 Proactive Prevention (a); 6.4.2 Anomaly Detection (a).

Solution:

1. Support traffic monitoring and cleaning, and identify and rate-limit/block abnormally high-frequency requests (6.3 d).

2. Establish an interaction rate-limiting mechanism to control the number and frequency of interaction counterparts per unit of time (6.4.1 a).

3. Monitor the interaction status and promptly discover and issue early warnings of abnormal behaviors (6.4.2 a).

T08 Attack Behavior

Risk description: DoS attack tools, output of attack behaviors, output of malicious code/scripts, multi-agent collaborative attacks, spread of attacks caused by the absence of an emergency-response and handling mechanism for security incidents.

Covered clauses: 6.4.3 Attack Analysis; 7.3 Agent-to-Agent Invocation Security (f); 8.2 Tool Invocation Security (i); 6.4.4 Emergency Response and Handling.

Solution:

1. Analyze and protect against discovered attack activities, and should establish a mechanism for collaborative anomaly detection across multiple agents (6.4.3).

2. For agent-to-agent invocation, have a security-protection mechanism against attack behaviors in inputs and outputs (7.3 f).

3. During tool invocation, inspect the tool’s feedback information and stop the invocation upon identifying malicious behavior (8.2 i).

4. For emergency response and handling, implement graded plans, severing/isolation/remediation, secondary verification, retention of the chain of evidence, reporting, and other handling measures (6.4.4).

T09 Component Risk

Risk description: Malicious materials, materials with vulnerabilities, malicious extensions.

Covered clauses: 7.1 Agent Registration Security (e) (indirectly, through referencing GB/T 43698 and GB/T 44111).

Solution:

1. At registration, detect the authenticity of capabilities and the compliance of behaviors based on the agent description, and it is recommended to engage a third-party assessment (7.1 e).

2. The normative references include software-supply-chain security standards (GB/T 43698, GB/T 44111), which provide a standards basis for preventing component risks.

T10 Intent Hijacking

Risk description: Infringement of the right to choose tools, manipulation of tool ranking, mismatch during the discovery stage or invocation of the wrong object caused by non-standard or tampered agent descriptions.

Covered clauses: 7.2 Agent Discovery Security (c, a); 8.1 Tool Discovery Security (b).

Solution:

1. When choosing a service-based discovery mechanism, select a service that has an anti-interference agent recommendation/ranking mechanism (7.2 c 1)).

2. Disclose agent descriptions based on a standardized agent discovery mechanism (7.2 (a)).

3. Tool attribute information shall be disclosed completely and with verifiable integrity (8.1 (b)).

T11 Tool Abuse

Risk description: Malicious tools, tool-combination attacks, tool downgrading, illegal operations, tool abuse, tool poisoning, unauthorized execution by tools.

Covered clauses: 7.1 Agent Registration Security (e); 8.1 Tool Discovery Security (a); 8.2 Tool Invocation Security (g, h, i).

Solution:

1. At registration, detect the authenticity of the agent’s capabilities and the compliance of its behaviors (7.1 e).

2. During tool discovery, ensure the source and integrity of the tool list are verifiable (8.1 a).

3. Limit high-risk tool invocation to controlled environments and explicitly obtain user authorization (8.2 g).

4. Support a malicious-tool identification mechanism (8.2 h), and stop the invocation upon detecting malicious content or behavior (8.2 i).

T14 Intent Deviation

Risk description: Reasoning hijacking, goal hijacking, hallucination amplification, cumulative intent drift, long-context attacks, entropy increase in tool selection, abnormal task execution.

Covered clauses: 6.4.2 Anomaly Detection; 7.3 Agent-to-Agent Invocation Security (d, g).

Solution:

1. Monitor the interaction status, and forcibly terminate and record when a non-convergent interaction (falling into a loop or contradiction) is detected (6.4.2).

2. An agent shall ensure decision-making autonomy during collaboration, preventing unauthorized parties from tampering with its decision logic or goals (7.3 d).

3. Support a mechanism to identify abnormal behaviors that exceed the scope of the agent description (7.3 g).

References

[1] GB 45438—2025 — Cybersecurity technology — Labeling method for content generated and synthesized by artificial intelligence

[2] GB/T 34975—2017 — Information security technology — Security technical requirements and testing and evaluation methods for application software of mobile intelligent terminals

[3] GB/T 35273 — Information security technology — Personal information security specification

[4] GB/T 39720—2020 — Information security technology — Security technical requirements and testing and evaluation methods for mobile intelligent terminals

[5] GB/T 39276—2020 — Information security technology — General security requirements for network products and services

[6] GB/T 45574—2025 — Data security technology — Security requirements for the processing of sensitive personal information

[7] GB/T 45652—2025 — Cybersecurity technology — Data security specification for generative artificial intelligence pre-training and optimization-training

[8] GB/T 45654—2025 — Cybersecurity technology — Basic security requirements for generative artificial intelligence services

[9] GB/T 45674—2025 — Cybersecurity technology — Data-annotation security specification for generative artificial intelligence

[10] HarmonyOS AI Agent Framework White Paper

[11] YD/T 3973—2021 — General technical requirements for end-to-end 5G network slicing

[12] YD/T 6095—2024 — General technical requirements for fixed-mobile convergence dedicated-line services based on the SDN/NFV new-generation network architecture

This is an unofficial English translation prepared for reference only. In case of any discrepancy, the original Chinese document (”网络安全标准实践指南——智能体交互安全要求（征求意见稿）”, TC260-PG-2026NA) prevails. Source: Secretariat of the National Information Security Standardization Technical Committee.

Overcapacity has long been one of the most contentious issues in China’s trade relations with both the European Union and the United States. In Washington and Brussels, the prevailing view is that China has continuously directed large amounts of capital into strategic manufacturing sectors through subsidies, policy lending, low-cost land and energy, government procurement, and local industrial policies. Because domestic demand is seen as insufficient to absorb the resulting output, the surplus is ultimately exported at low prices, putting pressure on manufacturing industries in other countries.

That said, the United States and the European Union do not frame the issue in exactly the same way. The United States primarily views it through the lens of macroeconomic imbalances, industrial security, and strategic competition with China. The European Union, by contrast, focuses more on demonstrating the existence of specific subsidies, import injury, and the legal basis for trade remedy measures.

I have participated in several discussions on China-Europe economic relations, involving both think tanks and industry representatives, and one thing has become increasingly clear to me: there remains a significant gap between Chinese and European perspectives on this issue.

European experts generally argue that the challenge has evolved beyond isolated trade disputes or individual industries into a structural conflict between two different economic models. In their view, China relies on exports and industrial upgrading to sustain economic growth, while Europe sees its own manufacturing base coming under sustained pressure, with implications for employment, industrial capacity, and political stability. As a result, Europe’s “de-risking” agenda is driven as much by domestic economic and political considerations as by geopolitics.

Many also argue that years of dialogue have failed to change the underlying dynamics, prompting the EU to rely increasingly on legal and industrial policy tools in an effort to encourage adjustments by China. With China’s technological upgrading accelerating, many in Europe believe that waiting longer would only further erode Europe’s industrial competitiveness.

China apparently has a very different view, as indicated by the word “so-called” being used in the title of the official position paper. Chinese experts generally argue that the China-EU trade imbalance is primarily the result of macroeconomic structures rather than unfair competition driven by subsidies. China has maintained a high savings rate for decades, while domestic investment has slowed in recent years, naturally producing current account surpluses and capital outflows.

They contend that China’s manufacturing competitiveness is rooted in its enormous domestic market, highly integrated supply chains, and industrial clusters—not simply in government support. In this view, attributing trade imbalances entirely to industrial policy misdiagnoses the problem and risks turning what should be addressed through macroeconomic adjustment into a trade conflict.

Some Chinese experts also question the methodologies used in Western studies on China’s overcapacity and subsidy levels, arguing that they rely on strong assumptions and that policies built on those estimates could face challenges both economically and under international trade rules.

I am not a trade economist, and it will be too difficult to take a position on this debate. My impression is that this is an extraordinarily complex issue that deserves much more research and discussion by international experts.

The position paper released by the Chinese government today is, from my personal view, a detailed response to many of the criticisms that the United States and Europe have made against China on this issue over the past several years. I would recommend that anyone following China trade policy—including policy watchers and trade lawyers—read it carefully.

One small but telling detail is the title of the position paper. The official English version is "China's Position on the So-called Excess Capacity Issue," rather than using the much more common Western term "overcapacity." This is unlikely to be accidental.

In U.S. and European policy discussions, “overcapacity” has become a loaded political term, implicitly accepting the premise that China suffers from a structural overcapacity problem. By choosing the more neutral phrase “excess capacity” and prefacing it with “so-called”, China seems to signal that it does not accept the Western framing of the debate.

You can download the full English text of China’s position paper here:

China’s Position on the So-called Excess Capacity Issue

The full English transcript (my own translation) of today’s press briefing is available here:

Opening Remarks

Jia Huili, Deputy Director-General of the News Bureau of the State Council Information Office and Spokesperson:

Good afternoon, ladies and gentlemen. Welcome to this press conference of the State Council Information Office.

Today, the Ministry of Commerce released the document China’s Position on the So-Called “Overcapacity” Issue. We are joined by Mr. Yan Dong, Vice Minister of Commerce, who will brief us on the document and answer questions of concern. Also attending today’s press conference are Mr. Lin Weilong, Director-General of the Policy Research Department of the Ministry of Commerce; Mr. Han Yong, Director-General of the Department of World Trade Organization Affairs; and Mr. He Shaojun, head of the Department of Foreign Trade.

First, I will give the floor to Mr. Yan Dong.

Introductory Statement

Yan Dong, Vice Minister of Commerce:

Thank you, Madam Moderator. Friends from the media, good afternoon.

As just mentioned, the Ministry of Commerce today released the document China’s Position on the So-Called “Overcapacity” Issue. I would like to take this opportunity to briefly introduce the background to its release and its main contents.

In recent years, global economic growth has lacked momentum. The international community has paid broad attention to global supply-demand balance and capacity issues, and there has been much discussion. In particular, some economies, out of concern over their own industrial competitiveness and market position, have politicized economic and trade issues, hyped up the so-called issue of Chinese “overcapacity,” and even deliberately confused concepts by linking industrial subsidies, trade surpluses, economic imbalances, and market competition with “overcapacity.” They have pushed narratives such as “China Shock 2.0” and used the so-called “overcapacity” issue as a pretext to implement all kinds of protectionist measures.

President Xi Jinping has pointed out that blowing out others’ lamps will not make oneself brighter, and blocking others’ paths will ultimately block one’s own. China believes that capacity issues should be viewed in a comprehensive, objective, and fair manner, and must not be used as a pretext for protectionism. Doing so will only disrupt the global economic and trade order and the stability of industrial and supply chains, aggravate contradictions and divisions, and create long-term risks for global economic growth. To clarify the facts and explain China’s views and position on issues related to the so-called “overcapacity,” we prepared this position paper.

The Chinese version of the document contains more than 10,000 Chinese characters, and an English version has also been released simultaneously on the website of the Ministry of Commerce. The full text consists of three parts: a preface, the main body, and a conclusion. The main body has four chapters.

Chapter One is A Comprehensive and Objective View of Global Capacity and the So-Called “Overcapacity.” This chapter reviews, from a historical perspective, the evolution of the global capacity landscape and explains that the gradual shift of the global industrial pattern from a single center to multiple centers is the result of international industrial division of labor. “Overcapacity” is a dynamic phenomenon in a market economy. Different parties understand the concept differently, and the situation in different economies and industries should be measured according to their stages and levels of development.

Chapter Two is China’s Position on Four Relationships Related to “Overcapacity.” It objectively analyzes the relationship between industrial subsidies, trade surpluses, economic imbalances, market competition, and “overcapacity,” emphasizing that there is no necessary connection between industrial subsidies and overcapacity, that more exports and larger surpluses do not equal overcapacity, that global economic imbalance is a historical norm with complex roots, and that market competition is an important safeguard for the optimization and adjustment of capacity.

Chapter Three is China’s Commitment to Building a Modern Industrial System Through Openness and Cooperation. This chapter focuses on China’s policy practices and future direction. It explains that the rapid development of China’s modern industries is driven by innovation, and that the steady and healthy operation of industry depends on deepening reform. It also makes clear that the development of China’s modern industries is not the so-called “China Shock 2.0,” but rather “China Opportunity 2.0.”

Chapter Four is Jointly Promoting an Open and Inclusive Global Industrial and Supply Chain Cooperation Landscape. This chapter presents China’s vision and proposals. It calls on the international community to shoulder responsibilities together and move toward one another, advocate mutual benefit and win-win outcomes, respect market rules, strengthen coordination of industrial policies, expand market openness, create cooperation opportunities, uphold multilateralism, and build a fairer and more equitable international economic order.

That is all for my introduction. My colleagues and I are now ready to take your questions. Thank you.

Jia Huili:

Thank you, Mr. Yan Dong, for the introduction. We will now move to questions. Please identify your media outlet before asking your question.

Questions and Answers

Reporter from The Beijing News, Shell Finance:

At present, countries hold different views on the issue of “overcapacity,” and international institutions also lack a unified definition. Evaluation criteria vary significantly and there are major differences of opinion. How should we understand this issue? Thank you.

Yan Dong:

I will invite Director-General Lin Weilong of the Policy Research Department to answer this question.

Lin Weilong, Director-General of the Policy Research Department, Ministry of Commerce:

Thank you for your question. As you just mentioned, the concept of “overcapacity” and related issues have long been disputed in the international community, and no broad consensus has been reached. I would like to explain this from three dimensions so that the issue can be understood in a more comprehensive, objective, and systematic way.

The first is the theoretical dimension. “Overcapacity” is a complex concept that needs to be understood in a specific economic context. Most economists explain it from both macro and micro perspectives. At the macro level, it refers to supply exceeding demand, with total production capacity clearly surpassing total demand. At the micro level, it refers to idle enterprise capacity, with factors such as monopolistic competition preventing the clearing of capacity and keeping output below its optimal state. “Overcapacity” is a dynamic phenomenon in a market economy. It is related both to changes in supply and demand and to the industrial life cycle, and it always exists in a dynamic cycle of balance, imbalance, and rebalancing. Balance is relative; imbalance is common.

The second is the historical dimension. The global center of capacity has undergone several major shifts along with industrial relocation. Since the First Industrial Revolution, factors of production around the world have accelerated their movement, and the United Kingdom and the United States successively became world industrial centers. In 1880, the United Kingdom’s share of global industrial output reached a peak of 22.9 percent; in 1953, the United States’ share reached as high as 44.7 percent. After World War II, the world experienced multiple waves of industrial transfer: from the United States to Europe, from Europe and the United States to Japan, then to East Asia and China, and now from parts of China to Southeast Asia and other regions. This has formed three major regional manufacturing centers in North America, Europe, and East Asia. China’s emergence as the “world’s factory” is the result of actively integrating into economic globalization and participating in international industrial division of labor, and it is an important component of the global manufacturing network.

The third is the practical dimension. Capacity utilization needs to be assessed in light of the realities of different countries and industries. Internationally, capacity utilization is commonly used to measure “overcapacity.” This indicator is the ratio of actual output to potential output. Reasonable ranges differ across economies, and there is no universally applicable global standard. The median capacity utilization rate in developed and fast-growing economies is usually between 75 percent and 80 percent, while in less developed countries it is generally between 50 percent and 64 percent. At the same time, capacity utilization differs greatly across industries. In some traditional industries, capacity utilization is clearly below the average level. In some countries, utilization in industries such as beverages and furniture is around 65 percent, while in rubber, chemicals, and plastics it is only 40 to 50 percent. Emerging industries tend to have relatively higher rates. In some countries, capacity utilization in computers and peripheral equipment reaches 83 percent, and in electrical equipment and components it reaches 86 percent. Looking at countries’ economic practice, capacity utilization is somewhat objective as a measure of the state of capacity use, but it should not be absolutized as a standard for judging whether different economies or industries have overcapacity.

In light of China’s actual development, industrial capacity utilization as a whole remains within a reasonable range. In 2025, the capacity utilization rate of above-designated-size industry was 74.4 percent. In fields such as high-tech manufacturing, high-end equipment manufacturing, and strategic emerging industries, capacity was used more fully. In some traditional industries, such as raw materials, utilization was temporarily lower, mainly because of adaptive adjustments brought about by structural transformation and green transition. This is a normal phenomenon in the process of industrial upgrading and quality improvement. Overall, China’s industry remains basically balanced in supply and demand and operates steadily.

Thank you.

Reporter from China News Service:

In recent years, there has been an international narrative that subsidies cause overcapacity. How does China view such statements? Also, what is the relationship between industrial subsidies and “overcapacity”? Thank you.

Yan Dong:

Thank you for your question. I will ask Director-General Han Yong of the WTO Affairs Department to answer.

Han Yong, Director-General of the Department of World Trade Organization Affairs, Ministry of Commerce:

Thank you for the question. At present, many countries formulate industrial policies tailored to their national conditions and industrial development needs. For example, they provide research and development subsidies for emerging industries and risk subsidies for agriculture. These are WTO-consistent industrial and trade policy tools available to members. Multiple reports by UNCTAD show that the number of industrial policies worldwide has been on the rise over the past five years, and that R&D subsidies, tax incentives, and low-interest loans have become internationally common approaches to supporting emerging industries. What needs to be emphasized here is that industrial subsidies are not a problem in themselves, nor is there any necessary connection between industrial subsidies and overcapacity. Reasonable and compliant subsidy policies can help correct market failures, advance technological innovation, protect the ecological environment, reduce poverty, and promote balanced development. They do not create the so-called “overcapacity.”

On the other hand, if protectionist measures are adopted and non-compliant industrial policies are introduced to shift burdens onto others and restrict competition, they will disrupt the global economic and trade order. The U.S. Inflation Reduction Act plans to provide $750 billion in various subsidies from 2022 to 2031, and subsidized electric vehicles must meet conditions such as being produced and sold locally or in North America, thereby excluding other countries and regions. In addition, according to incomplete statistics, the European Commission will provide more than 1.44 trillion euros in various subsidies between 2021 and 2030. The EU’s Industrial Accelerator Act proposes to directly link local content with fiscal support through an “EU-origin” requirement, creating serious investment barriers and institutional discrimination. Major powers are the leaders of global industrial development and should set an example by using subsidies reasonably on the basis of openness, fairness, and compliance, avoiding discriminatory subsidy policies and avoiding artificial interference in the global layout of industrial and supply chains.

China has always strictly observed WTO rules and is committed to building and improving a fiscal subsidy system consistent with international practices. Over the years, China has taken multiple measures to continuously improve the compliance, scientific basis, and transparency of subsidies, and has constantly standardized and refined related policies. It has cleaned up and regulated some improper local subsidies and is studying the establishment of a unified negative list management mechanism for local fiscal subsidies. China fulfills its WTO transparency obligations in a timely and comprehensive manner, and its subsidy notifications cover the entire country. Chinese subsidies are mainly directed to areas such as scientific research and development, commercialization of technology, and market consumption. More often, China uses market-based and guiding means such as public services, technical standards, and skills training, with重点 support for technological innovation, small and medium-sized enterprises, green development, and energy conservation. China’s subsidies apply equally to all kinds of market entities. Foreign-invested enterprises actively participate and benefit on an equal footing.

Development is an eternal theme of human society. All countries should focus on making the global development pie bigger and introduce industrial policies in a reasonable and compliant manner, rather than using them as tools to restrain other countries’ development. China is willing to hold discussions with all parties under the WTO framework on relevant industrial policies, jointly regulate related practices, and promote the updating of multilateral rules.

Thank you.

Reporter from Bloomberg News:

Does China plan to address trade partners’ concerns about “overcapacity” and the displacement of domestic industries by low-cost Chinese exports? If so, what specific measures will it take? And do you expect the trade surplus to reach another record high this year? Thank you.

Yan Dong:

This question concerns trade, so I will ask Mr. He Shaojun from the Department of Foreign Trade to answer.

He Shaojun, head of the Department of Foreign Trade, Ministry of Commerce:

Thank you for your question. Trade surplus is a topic of broad concern, and I would like to take this opportunity to share some views from several angles.

First, a surplus reflects profound changes in the international division of labor. Looking back at the history of global economic development, countries generally went through stages of trade surplus during industrialization. Manufacturing powers such as the United Kingdom, the United States, Japan, and Germany all maintained trade surpluses for long periods. At the product level, 80 percent of U.S. chips are exported, and about two-thirds of commercial aircraft delivered by Boeing are sold to customers outside North America. In 2025, the European Union recorded surpluses of $92.2 billion in automobiles, $214.6 billion in pharmaceuticals, and $11.6 billion in cosmetics. More exports and larger surpluses do not equal overcapacity. China’s trade surplus reflects the completeness and efficiency of its industrial system and is an objective result of changes in the global division of labor and trade patterns.

Second, Chinese products meet the production and daily-life needs of countries around the world. Consumer goods produced in China, such as computers, mobile phones, furniture, clothing, and toys, provide consumers in various countries with more choices, lower consumption costs, and help buffer inflation risks. China’s exports of production equipment and intermediate goods strongly support the industrialization of its trade partners. For example, China supplies more than 80 percent of the world’s photovoltaic modules and 70 percent of wind power equipment, providing important support for the green transition of its trade partners. Foreign-invested enterprises contribute 16 percent of China’s surplus and have also earned substantial returns on their investment. This vividly shows that while the surplus is recorded in China, the benefits are shared by all parties.

Third, from the perspective of the overall balance of payments, although China runs a sizeable surplus in trade in goods, it has deficits in trade in services and in the capital and financial account. The current account surplus accounts for about 3.7 percent of GDP, which is within the internationally recognized reasonable range, and there is no significant external imbalance.

I would like to stress that China never deliberately pursues a trade surplus. We will continue to actively promote balanced development of imports and exports, continue opening our market to the world, and firmly expand imports. In the first half of this year, China’s import growth in goods trade was 22.1 percent, significantly faster than export growth. China remains the world’s second-largest import market, and its enormous market demand provides strong momentum for the development of its trading partners. Since last year in particular, we have built the “Export to China” brand and plan to hold more than 100 import promotion activities every year, with the aim of sharing China’s new development opportunities with the world. At many overseas “Export to China” events, Chinese enterprises have signed letters of intent with local companies, broadened sourcing channels for imports, and created more convenient pathways for companies from various countries to enter the Chinese market. These efforts have received positive responses and have generated mutually beneficial cooperation.

Going forward, we will take more practical measures to expand imports and share with countries around the world the new opportunities created by China’s large market.

First, we will continue to expand the influence of the “Export to China” brand. Through a series of matchmaking events, exhibition linkages, and targeted procurement, we will further increase imports.

Second, we will continue to strengthen policy support. We will improve the facilitation of import trade, optimize the sources and structure of imported goods, and better meet the needs of industrial development and people’s aspirations for a better life.

Third, we will make full use of various promotion platforms. We will continue to host major exhibitions such as the China International Import Expo and the China International Consumer Products Expo, regularly organize import-trade fairs for featured CIIE products, and better leverage national demonstration zones for import trade promotion and innovation, so as to actively drive the import of high-quality goods and services from around the world.

Thank you.

Reporter from International Market News, United States:

Recently, some leaders from EU countries and institutions have expressed concerns that China’s currency is undervalued and gives Chinese exporters an unfair advantage. What is the Ministry of Commerce’s response? Looking ahead to the second half of this year, especially amid continued trade tensions and the broader economic backdrop, how does the Ministry view the outlook for China-EU trade? Thank you.

Yan Dong:

Director-General Lin Weilong from the Policy Research Department will answer this question.

Lin Weilong:

Thank you for your question. We have taken note of the relevant developments. In recent years, under the strategic guidance of the leaders of China and the EU, China-EU economic and trade relations have developed generally well. In the first half of this year, trade in goods between China and the EU increased by 14.2 percent year on year, reaching $447.88 billion. The two sides have huge potential for cooperation in services trade, scientific and technological innovation, and the green economy. This is both the result of deep interconnection and complementarity in China-EU industrial and supply chains, and a reflection of the broader trend of global digital and green transformation and the future development of China and Europe.

At the same time, the EU has recently continued to roll out trade restriction measures against China and to hype the so-called issue of the renminbi exchange rate. This lacks a factual basis and is not conducive to the stable development of China-EU economic and trade relations. China adheres to giving the market a decisive role in exchange-rate formation and maintains the renminbi exchange rate basically stable at an adaptive and equilibrium level. As a responsible major country, China does not seek competitive advantage through currency depreciation. Chinese manufacturing is internationally competitive, and there is no need to promote exports through an undervalued exchange rate.

China is not the source of the EU’s economic and trade problems, but a partner in solving them. Protectionism leads nowhere; cooperation for mutual benefit is the right path. At the end of last month, Minister of Commerce Wang Wentao and European Commissioner for Trade and Economic Security Maros Sefcovic jointly chaired the first meeting of the China-EU trade and investment consultation mechanism, and reached consensus on the new positioning of the relationship as one of “stable and balanced key trade partners.” China is willing to use this mechanism to strengthen dialogue and consultation with the EU, properly handle differences and frictions, promote practical cooperation, advance trade toward a more balanced direction, and foster the steady and sound development of China-EU economic and trade relations, thereby injecting more certainty and positive energy into the global economy.

Thank you.

Reporter from National Business Daily:

There are currently two narratives in the international community regarding China’s industrial development and technological innovation: one is “China Shock 2.0” and the other is “China Opportunity 2.0.” How should we view these two narratives? Is China’s industrial development ultimately a shock or an opportunity for the world? Thank you.

Yan Dong:

Thank you for your question. I will answer this one myself.

This is indeed a topic that has attracted a great deal of attention and discussion. Some countries have put forward the so-called “China Shock 2.0” narrative, slandering China’s industrial development as a threat to the monopoly position of Western countries and as squeezing the development space of countries in the Global South. This narrative does not conform to the facts and cannot stand up to scrutiny.

For more than a decade, China has been an important engine of world economic growth, contributing about 30 percent. By leveraging its market strengths, industrial development, and technological progress, China has provided the world with growing “market dividends,” “development dividends,” and “innovation dividends.” These dividends overlap and reinforce one another, bringing the world more development opportunities and broader room for growth, which is what more rational and objective voices in the international community call “China Opportunity 2.0.” This can be understood from four aspects.

First, China’s industrial development is a ballast stone for the stability of global industrial and supply chains. China has the world’s largest industrial manufacturing system, with the most complete range of categories and the most integrated system. It continues to provide all kinds of industrial manufactured products in an efficient manner, strongly supporting stable global supply and effectively offsetting localized supply gaps caused by protectionism, geopolitical conflicts, and other factors. This has demonstrated China’s strong resilience and sense of responsibility, enabling it to play the role of a stabilizing anchor and major hub in global industrial cooperation. China’s exports of high-quality and cost-effective production equipment and components have lowered entry barriers for developing countries’ manufacturing sectors. From 2012 to 2024, China exported more than $30 billion in textile machinery to developing countries, helping some countries in Southeast Asia and South Asia become important textile producers and exporters.

Second, China’s industrial development is a new engine for global innovation cooperation. China adheres to innovation-driven development and has forged an effective path in which technological innovation leads industrial innovation and industrial upgrading in turn accelerates technological iteration. With the support of Chinese manufacturing, any valuable technological achievement can quickly be transformed into a real product, making China an ideal testing ground for both “0-to-1” validation and “1-to-N” scaling of new products and services. China remains open in innovation, and its rapidly growing innovative companies have delivered several-fold, and in some cases several-dozen-fold, returns to investors from around the world. Many of China’s innovations, including large AI models, follow an open-source path and are widely welcomed by countries everywhere. Global cumulative downloads of open-source large models have surpassed 10 billion, enabling more countries, especially developing countries, to access and afford new technologies.

Third, China’s industrial development is a driving force for the global green transition. China is accelerating a comprehensive green transition and promoting green, low-carbon industrial development. By the end of the 15th Five-Year Plan period, the scale of China’s green industries is expected to exceed 20 trillion yuan. The rapid development of China’s green industries and the growing supply of new energy products have enriched global supply and strongly advanced the global low-carbon transition. According to a report by the International Renewable Energy Agency, over the past decade, the global levelized cost of electricity for wind and solar projects has fallen by more than 60 percent and 80 percent, respectively, and a large part of that is attributable to Chinese manufacturing and Chinese capacity. At present, with global energy tensions and artificial intelligence driving up electricity demand, the International Energy Agency predicts that by 2030 global electricity consumption by data centers will approach 1 trillion kilowatt-hours, of which 40 percent of the additional electricity demand will rely on renewable energy. China has clear scale and technological advantages in solar energy, energy storage, and electrification, and will be better positioned to meet future global demand for green energy and industrial development.

Fourth, China’s industrial development helps improve people’s well-being around the world. The rapid development of Chinese industry has provided the world with a rich supply of high-quality, highly efficient, and cost-effective products, offering consumers in all countries more stable and more diversified choices. Chinese manufacturing has improved living standards, reduced the cost of living, and eased global inflationary pressure. For example, Chinese air conditioners have recently sold well in Europe, helping local people stay cool during heat waves. A report by the European Central Bank estimates that if EU imports from China increase by 10 percent in 2026, the EU’s overall import prices would fall by 1.6 percent. China’s trade and investment have also had a stronger enabling effect on industrialization in developing countries. China has established more than 50,000 enterprises overseas, with outward investment stock exceeding $3 trillion, nearly 90 percent of which is located in developing economies. Through local production, local procurement, local hiring, supporting upstream and downstream industries, and connecting regional supply chains, Chinese-invested enterprises have brought a large number of projects in light industry, textiles, home appliances, and other sectors to fruition, while also driving the development of digital and green sectors. This has strengthened the contribution of exports to local value added in host countries. According to estimates by the Chinese Academy of Sciences, the value added in local exports driven by Chinese-invested enterprises in 24 developing economies increased from $24.4 billion in 2012 to $142.4 billion in 2025, nearly a fivefold increase. The so-called theory that China is squeezing others out is simply a new version of the “China threat” narrative. It is intended to undermine China’s cooperation with countries of the Global South and to shift historical and present responsibilities, rather than to genuinely help developing countries. Facts and data show clearly that China’s industrial development brings the world opportunities, not shocks; empowerment, not threats. It helps developing countries modernize and helps pave the way for their development.

Thank you.

Reporter from Yangguangwang, China National Radio, CMG:

In recent years, unilateralism and protectionism have been on the rise. Some economies have adopted discriminatory measures that undermine fair competition and disrupt global industrial division of labor and cooperation. How do you view the role of market competition in adjusting the global distribution of capacity, and how can the WTO play a better role in maintaining a fair international competitive environment? Thank you.

Yan Dong:

Thank you for your question. I will ask Director-General Han Yong to answer it.

Han Yong:

Thank you for the question. Market competition is an important safeguard for optimizing and adjusting capacity and for promoting healthy industrial development. Historically, every industrial revolution and technological transformation has been accompanied by a rise in capacity in related industries and even, in the short term, situations in which supply exceeded demand. In this process, enterprises invest and expand production in pursuit of profits and market share, while market competition drives them to reduce costs and improve efficiency, bringing technological progress and productivity gains. In that sense, market competition is the most effective mechanism for preventing disorderly expansion of capacity. The role of government should be to maintain competitive order and a fair environment, allowing the market to function more fully so that outdated capacity exits naturally through competition and dynamic balance between supply and demand is ultimately achieved. The WTO’s principle of fair competition and related rules have become widely accepted norms of behavior globally. All parties should uphold fair competition and reduce improper interference with global cooperation in capacity allocation.

China is actively fostering a first-class business environment characterized by fair competition. China has the largest number of market entities in the world. This huge number creates a fully competitive environment in which enterprises face direct challenges and compete on real strength, refining products and services in the survival-of-the-fittest process. McKinsey once described China as “the world’s toughest gym,” a place that has forged highly competitive companies. China’s 15th Five-Year Plan outline makes clear that it will deepen the development of a unified national market, remove barriers in factor acquisition, qualification recognition, tendering and bidding, and government procurement, fully implement national treatment for foreign-invested enterprises, and actively foster a first-class business environment that is market-oriented, law-based, and internationalized.

The multilateral trading system with the WTO at its core and rules at its foundation has played an important role in maintaining the stability of the global economic and trade order. Principles such as free trade, non-discrimination, and fair competition are deeply rooted and together form the underlying logic that keeps the global economic and trade order stable and predictable. At present, the multilateral trading system is under severe impact from unilateralism and protectionism, but multilateralism remains the first choice of the overwhelming majority of WTO members. According to WTO statistics, 72 percent of global trade is still conducted under the most-favored-nation principle. This fully demonstrates the value and resilience of the multilateral trading system’s basic principles, including fair competition. No one wants to return to a jungle world where the strong prey on the weak. In difficult times, international fairness and justice become all the more precious. China will work with all parties to firmly support the multilateral trading system, advance WTO reform, resolutely uphold the WTO’s basic principles and rules, and maintain a transparent, fair, and inclusive global economic and trade environment.

Thank you.

Reporter from the South China Morning Post:

The EU has recently proposed related trade defense instruments, and the United States has launched a Section 301 investigation targeting the capacity issue. How does the Ministry of Commerce comment on this? Given that domestic supply in related areas continues to exceed domestic demand, what measures is the Ministry taking to prevent export spillover effects from triggering more trade restrictions? Thank you.

Yan Dong:

Thank you for your question. Director-General Lin Weilong of the Policy Research Department will answer.

Lin Weilong:

Thank you for your question. As I understand it, your question actually contains three issues: trade measures by Europe and the United States, China’s domestic demand, and the export spillover effect and the resulting global economic imbalance.

Let me first address the question of the EU’s trade defense instruments and the U.S. Section 301 investigation into the capacity issue. China has repeatedly stated its position on both matters. The EU has continued to introduce protectionist measures against China, seriously undermining the confidence of Chinese enterprises in cooperating with Europe. Given the enormous scale of China-EU cooperation, it is inevitable that differences and frictions will arise, but such differences should not become a pretext for fabricating accusations, still less an excuse for setting restrictions, increasing pressure, and affecting practical cooperation. China is willing to properly handle differences and frictions with the EU through dialogue and consultation. As for the U.S. Section 301 investigation on the capacity issue, this is a typical act of unilateralism that seriously undermines the international economic order. The U.S. side cannot narrowly define production capacity exceeding domestic demand as “overcapacity” and attach the label of “excess.” Nor does it have the right, through a Section 301 investigation, to unilaterally determine whether a trading partner has “overcapacity” and to adopt unilateral restrictive measures. China urges the U.S. side to correct its wrong approach and return to the right track of resolving issues through dialogue and consultation. China will closely follow developments, reserve the right to take necessary measures, and firmly safeguard its legitimate rights and interests.

Second, on China’s domestic demand. As our position paper points out, some people claim that “insufficient domestic demand in China has led to overcapacity,” but this does not conform to the facts. China is not only a manufacturing powerhouse, but also a major consumer market. Domestic demand has long been the main engine of China’s economy. From 2013 to 2024, domestic demand contributed an average of 93 percent to China’s economic growth, with consumption and investment contributing 55 percent and 38 percent, respectively, on average. China’s total retail sales of consumer goods rose from 23.8 trillion yuan in 2013 to 50.1 trillion yuan in 2025, more than doubling. Based on World Bank purchasing power parity calculations, China’s retail sales in 2025 were about 1.7 times those of the United States, meaning China is already the world’s largest commodity consumption market in practical terms. For example, in food consumption, China’s Engel coefficient has fallen to 29.8 percent, and per capita protein supply has exceeded 130 grams per day, higher than in many developed countries. In terms of industrial goods consumption, annual per capita purchases of air conditioners, refrigerators, mobile phones, and automobiles have already approached OECD-country levels.

At present, insufficient effective demand in China is a stage-specific phenomenon in the transition from high-speed growth to high-quality development. Over the long term, however, China’s consumption space remains vast and full of potential, and its role as the main engine will become even more prominent. Over the next decade, China’s middle-income group is expected to exceed 800 million people, and per capita GDP will reach the level of moderately developed countries. Structurally, China is accelerating the shift from goods-led consumption toward a pattern in which goods and services are equally important. Service consumption is developing rapidly, and by 2030 it is expected to account for more than half of total consumption. China’s 15th Five-Year Plan contains a dedicated chapter on domestic demand, emphasizing the need to treat demand expansion as a strategic priority, expand effective investment, vigorously boost consumption, implement special initiatives to stimulate consumption, upgrade goods consumption, unlock service-consumption potential, foster new forms of consumption, guide new supply through new demand, create new demand through new supply, promote positive interaction among consumption, investment, supply, and demand, and strive to achieve a higher-level balance between supply and demand.

Third, on global economic imbalance. Global economic imbalances have always existed and are a historical norm. Under the global economic structure and international economic governance system formed after World War II, the world economy has experienced a major imbalance roughly every decade or so, and some of these episodes have even triggered international economic and financial crises. Each new round of imbalance prompts wide international discussion, though the focus has kept changing. Some discussions emphasize market factors such as the savings-investment structure and industrial and supply-chain division of labor; others focus on institutional factors such as the international financial system and macroeconomic policy. The roots of economic imbalance are extremely complex.

In recent years, global economic imbalance has taken on new features. Institutions such as the International Monetary Fund believe that the macroeconomic policies of countries, especially fiscal policy, are a key factor behind current global imbalances. The United States has accumulated a huge debt imbalance and needs to improve its fiscal position; Europe suffers from insufficient investment and needs to raise productivity; China needs to expand domestic demand. That view is only one school of thought, but it does reflect the systemic and complex nature of global economic imbalance. Some people seek to link global economic imbalance with the so-called “overcapacity.” This is simplistic attribution, a deliberate attempt to confuse the issue, and motivated by ulterior motives. By contrast, China’s high-quality capacity has not only met domestic demand but has also made important contributions to global development and played a significant role in promoting global economic balance.

Thank you.

Reporter from Elephant News:

China’s emerging industries such as artificial intelligence, new-energy vehicles, and lithium batteries have developed rapidly, and their export performance has also been strong. What are the sources of China’s industrial strengths and momentum? Thank you.

Yan Dong:

Thank you for your question. I will ask Mr. He Shaojun from the Department of Foreign Trade to answer.

He Shaojun:

Thank you. We have also noted that in recent years China’s electric vehicles, lithium batteries, and artificial intelligence industries have developed rapidly and posted strong export growth. According to customs statistics, in the first half of this year, China’s exports of electric vehicles and lithium batteries increased by 68.7 percent and 37.6 percent, respectively. AI-related products such as industrial robots and 3D printers also performed strongly, rising by 18.6 percent and 109.3 percent, and have become new calling cards for China’s foreign trade. Overall, this is the result of multiple factors, including a solid industrial foundation, market-driven iteration, enterprise innovation, and international openness and cooperation. These can be summarized as four major strengths.

First is the strength of a complete industrial system. China has now established a comprehensive and efficient new-energy vehicle industrial chain covering basic materials, components, complete vehicles, and manufacturing equipment. Its supply-chain responsiveness, cost control, and delivery speed are globally leading. In the Yangtze River Delta, through coordinated industrial-cluster development, a new-energy vehicle manufacturer can obtain needed supporting components within a four-hour drive.

Second is the strength of a super-sized market. China has the world’s largest consumer market, which provides a proving ground and training ground for new technologies, products, and services. New-energy vehicle sales have ranked first in the world for 11 consecutive years, and fierce domestic competition has greatly improved product technology. Massive user demand and diverse application scenarios have accelerated AI technology iteration, enabling rapid verification of technical feasibility and spreading R&D costs across a larger base.

Third is the strength of innovation-driven development. China has firmly pursued innovation-driven development, using scientific and technological innovation to lead industrial development and continuously enhance industrial competitiveness. National R&D intensity rose from 1.91 percent in 2012 to 2.8 percent in 2025. International patent applications have ranked first in the world for seven consecutive years, and China accounts for 60 percent of global AI patents. Technological breakthroughs have been achieved in areas such as power batteries and general-purpose large models. By 2025, the energy density of power batteries had increased by more than 50 percent compared with 2018, while production costs had fallen by more than 60 percent. Domestic large models such as DeepSeek and Qwen have risen collectively.

Fourth is the strength of openness and cooperation. At present, the global energy system is undergoing deep transformation, and artificial intelligence is developing rapidly. Economic and trade cooperation in related fields has enormous potential. According to institutional estimates, by 2030 the global market size for products and technologies such as electric vehicles, solar energy, and wind power will reach $2.1 trillion, while the AI data-center market is expected to grow by 45 percent annually over the next five years. The market outlook is broad. Guided by the principle of mutual benefit and win-win cooperation, China advances international cooperation and supports capable electric-vehicle and lithium-battery enterprises in making rational and orderly cross-border arrangements for industrial and supply chains, thereby empowering green transition and industrial upgrading in other countries.

The development of China’s modern industries and the enhancement of its foreign-trade competitiveness are driven by innovation and by the continuous deepening of reform. Going forward, we will continue to advance high-quality trade development, further support enterprises in related industries in integrating more deeply into global industrial and supply-chain systems, and inject more vitality into global digital, intelligent, and green transformation.

Thank you.

Jia Huili:

Thank you. We now have time for one last question.

Reporter from CCTV, China Media Group:

Under the current volatile international situation, maintaining stable and smooth global industrial and supply chains faces many challenges and requires the joint efforts of all countries moving in the same direction. What suggestions does the Ministry of Commerce have for better promoting an open and inclusive global industrial and supply chain cooperation landscape? Thank you.

Yan Dong:

Thank you for your question. I will answer this one.

At present, with the international situation turbulent and protectionism on the rise, safeguarding the stability and smooth functioning of global industrial and supply chains is in the interests of all parties and is also an urgent expectation of the international community. President Xi Jinping has pointed out that economies advance together when connected and all fall behind when closed off. China is willing to work with all parties to uphold the global free-trade system, preserve an international environment of openness and cooperation, and jointly promote the building of an open and inclusive global industrial and supply chain cooperation landscape.

We must uphold mutual benefit and win-win outcomes and make the global development pie bigger. When the pie grows larger, conflicts over distribution become smaller. All parties should jointly seize the opportunities created by a new round of industrial revolution and technological transformation, strengthen international cooperation in areas such as green and low-carbon development, artificial intelligence, and bio-manufacturing, and use shared technological dividends to break through growth bottlenecks and continuously inject new momentum into the global economy. All parties should also pay greater attention to the “real imbalances” between developed and developing economies, strengthen industrial cooperation as well as trade and investment cooperation, help more developing countries and regions integrate into the international division of labor, accelerate industrialization and modernization, and open up a new blue ocean for global industrial cooperation.

We must uphold openness and connectivity and promote sound circulation in global industrial and supply chains. The division of labor and cooperation in global industrial and supply chains did not take shape overnight, and forced intervention by human hands will only backfire. All parties should continue expanding market openness, promote trade and investment liberalization and facilitation, improve the efficiency of allocating factors and resources, and jointly create and maintain an open global innovation ecosystem so that international industrial cooperation can deliver greater benefits. All parties should oppose the politicization and over-securitization of economic issues, respect market rules, reduce barriers to trade, lower obstacles to investment cooperation, promote full market competition, stimulate business vitality, and make the flow of factors and resources and the distribution of industrial division of labor more rational and orderly.

We must uphold policy coordination and foster a stable and predictable environment for cooperation. The world economy is highly interconnected, and national industrial policies have obvious spillover effects, so communication and coordination should be strengthened, especially among major powers, which should set an example. All parties should adhere to consultation on an equal footing and properly manage differences, abandon unilateralism and protectionism, and oppose discriminatory and exclusionary practices. All parties should strengthen bilateral and multilateral dialogue on industrial policies, uphold openness and transparency, and deepen exchanges and discussions on industrial policy under the WTO framework, taking more coordinated and effective measures to better pool the combined forces of global economic growth.

We must uphold multilateralism and build a fairer and more equitable international economic order. The multilateral trading system with the WTO at its core is the cornerstone of economic globalization and international trade. In economic and trade exchanges, all parties should uphold equality and mutual benefit, respect each other’s stage of development and national conditions, and strive through fair competition to run faster themselves rather than trip others up, while jointly resisting bullying by the strong against the weak. All parties should adhere to genuine multilateralism, uphold the WTO’s basic principles and rules, advance WTO reform in step with the times, safeguard the WTO’s authority and effectiveness, and make better use of multilateral and regional cooperation mechanisms such as the G20, BRICS, and APEC, so as to jointly defend fairness and justice and make the global economic governance system more just and equitable.

Thank you.

Closing

Jia Huili:

That concludes today’s press conference. Thank you to all the speakers and to all the journalists for participating. Goodbye.

Kimi K3 Open Day

Thank you for your patience.

Today is Kimi K3 Open Day. We are releasing the Kimi K3 model weights, the technical report, and the key infrastructure technologies that support Kimi K3 model training: MoonEP, FlashKDA, and AgentEnv. We hope this will accelerate the deployment and adoption of frontier intelligence and advance AGI research.

Kimi K3 Weights Released

Kimi K3 is our most capable model. It is a 2.8-trillion-parameter Mixture-of-Experts model with native visual understanding and support for a 1-million-token context window.

Kimi K3 has roughly three times as many parameters as Kimi K2.5. Scaling, however, is not merely the accumulation of parameters. Under constrained compute conditions, we achieved a 2.5× improvement in scaling efficiency through a set of technical innovations, including Kimi Delta Attention, Attention Residuals, and MoonEP. In compute-optimal terms, each unit of compute now produces roughly 2.5 times as much intelligence as before.

Everyone can now download and deploy the Kimi K3 model, whether for internal research and development or for integration into end-user products. For other use cases, please see the Kimi K3 License.

Download Kimi K3 model weights

Kimi K3 Technical Report Published

Alongside the Kimi K3 model weights, we are also making public our model training methods. The Kimi K3 technical report is now available.

The technical report covers the following details:

• KDA + AttnRes: KDA and Gated MLA are mixed at a 3:1 ratio to enable efficient long-context modeling, while block-level attention residuals improve cross-layer information flow.

• Stable LatentMoE: Each token activates 16 out of 896 routed experts. SiTU-GLU and Quantile Balancing maintain training stability under extremely high sparsity.

• MoonViT-V2: The visual encoder is trained from scratch using next-token prediction, without contrastive pretraining. It reaches the baseline performance of SigLIP initialization while providing a more stable optimization process.

• Post-training and evaluation: The report covers large-scale task synthesis across general reasoning, general agents, and coding agents; reinforcement learning infrastructure for million-token contexts; and full evaluation results from nearly 20 internal benchmarks.

These points are only an overview. Detailed discussions and ablation experiments are included in the technical report.

Download the Kimi K3 technical report

Key Kimi K3 Infrastructure Technologies Open-Sourced

Model capability depends on stable training systems at the infrastructure layer. Today, we introduce three infrastructure technologies that support Kimi K3 training: MoonEP, FlashKDA, and AgentEnv. They cover key links from high-performance communication and high-performance kernels to distributed RL environments. FlashKDA had already been open-sourced; MoonEP and AgentEnv are being officially open-sourced with this release.

• MoonEP: MoonEP is a high-performance communication library designed for extremely large, fine-grained MoE models. It enables expert-parallel communication to maintain high efficiency even under imbalance.

• FlashKDA: FlashKDA is our high-performance kernel implementation of Kimi Delta Attention. On NVIDIA H20, compared with the flash-linear-attention baseline, its prefill speed is 1.72–2.22× faster, and it can be used directly as a replacement backend for flash-linear-attention.

• AgentEnv: AgentEnv is a sandbox system developed jointly with KVCache.ai for running agent environments at scale. It provides high-fidelity, strongly isolated sandboxes for Kimi K3 post-training, with flexible support for fast snapshotting, restoration, and forking. It is designed for massively parallel agent workflows and training tasks.

These three technologies are key to Kimi K3’s training efficiency and stability. We are opening them up in the hope that they can also help you train next-generation models.

MoonEP GitHub repository

FlashKDA GitHub repository

AgentEnv GitHub repository

Why We Choose Openness

We firmly believe in the value of open-weight models. They lower the barrier to accessing intelligence, promote innovation, and give users greater control over their data, privacy protection, and ownership. Over the past few weeks, we have been pleased to hear support from many members of the AI community and from technology leaders who share our vision.

We believe that for a technology with far-reaching impact like AGI, a broad and open ecosystem is the most suitable foundation. We will continue to contribute to that ecosystem.

Quick Start

• Download Kimi K3 model weights

• Read the Kimi K3 technical report

• Learn about MoonEP

• Learn about FlashKDA

• Learn about AgentEnv

• Learn about the Kimi K3 model

GitHub Repository Content

Repository Overview

MoonshotAI/Kimi-K3 is titled “Open Frontier Intelligence.” The repository is public and includes an assets directory, LICENSE, README.md, and k3_tech_report.pdf. The repository page links to the Kimi chat site, Moonshot AI homepage, Hugging Face organization, Twitter/X account, Discord, ModelScope organization, the Kimi K3 license, the technical blog, and the full report.

1. Model Introduction

Kimi K3 is an open-weight, native multimodal agentic model and Moonshot AI’s most capable model to date. It is a 2.8T-parameter model built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes), with native vision capabilities and a 1-million-token context window. It is described by the repository as the world’s first open 3T-class model, designed for frontier intelligence across long-horizon coding, knowledge work, and reasoning.

Key Features

• New Architecture: Kimi K3 is built on Kimi Delta Attention (KDA) and Attention Residuals (AttnRes), and scales up MoE sparsity with a Stable LatentMoE framework that activates 16 out of 896 experts, yielding an approximate 2.5× improvement in overall scaling efficiency over Kimi K2.

• Long-Horizon Coding: Operating with minimal human oversight, Kimi K3 sustains long engineering sessions, navigates massive repositories, and orchestrates terminal tools, from GPU kernel optimization and compiler development to vision-in-the-loop game development, CAD, and chip design.

• Agentic Knowledge Work: Kimi K3 advances end-to-end knowledge work, producing deep research with interactive visualizations, widgets and dashboards, motion design, and video editing, powered by its native multimodal architecture.

• Native Multimodality & Long Context: Kimi K3 understands text, images, and video within the same model, and supports a 1-million-token context window.

• Open Frontier Weights: Moonshot AI releases the full Kimi K3 model weights under the Kimi K3 License, making frontier intelligence openly available for research, deployment, and further innovation.

2. Model Summary

3. Evaluation Results

3. Benchmark | Kimi K3 | Claude Fable 5 | GPT-5.6 Sol | Claude Opus 4.8 | GPT-5.5 | GLM-5.2
     <tr><td>GPQA Diamond</td><td>93.5</td><td>92.6</td><td>94.1</td><td>91.0</td><td>93.5</td><td>91.2</td></tr>  
     <tr><td>CritPt</td><td>23.4</td><td>28.6</td><td>32.3</td><td>20.9</td><td>27.1</td><td>20.9</td></tr>  
     <tr><td>AA-LCR</td><td>74.7</td><td>70.0</td><td>73.7</td><td>67.7</td><td>74.3</td><td>71.3</td></tr>  
     <tr><td>HLE-Full</td><td>43.5 / 56.0</td><td>53.3 / 63.0</td><td>44.5 / 58.0</td><td>49.8 / 57.9</td><td>41.4 / 52.2</td><td>—</td></tr>  
     <tr><td>DeepSWE</td><td>67.5</td><td>70.0</td><td>73.0</td><td>59.0</td><td>67.0</td><td>46.2</td></tr>  
     <tr><td>ProgramBench</td><td>77.8</td><td>76.8</td><td>77.6</td><td>71.9</td><td>70.8</td><td>63.7</td></tr>  
     <tr><td>Terminal-Bench 2.1</td><td>88.3</td><td>88.0</td><td>88.8</td><td>84.6</td><td>83.4</td><td>82.7</td></tr>  
     <tr><td>FrontierSWE</td><td>81.2</td><td>86.6</td><td>71.3</td><td>66.7</td><td>64.9</td><td>67.3</td></tr>  
     <tr><td>SWE-Marathon</td><td>42.0</td><td>35.0</td><td>39.0</td><td>40.0</td><td>14.0</td><td>13.0</td></tr>  
     <tr><td>PostTrainBench</td><td>36.6</td><td>41.4</td><td>34.6</td><td>34.1</td><td>28.4</td><td>34.3</td></tr>  
     <tr><td>MLS-Bench-Lite</td><td>48.3</td><td>49.9</td><td>46.2</td><td>42.8</td><td>35.5</td><td>40.4</td></tr>  
     <tr><td>SciCode</td><td>58.7</td><td>60.2</td><td>56.1</td><td>53.5</td><td>56.1</td><td>50.5</td></tr>  
     <tr><td>Kimi Code Bench 2.0</td><td>72.9</td><td>76.9</td><td>64.8</td><td>71.7</td><td>69.0</td><td>64.2</td></tr>  
     <tr><td>BrowseComp</td><td>91.2</td><td>88.0</td><td>90.4</td><td>84.3</td><td>84.4</td><td>—</td></tr>  
     <tr><td>DeepSearchQA F1</td><td>95.0</td><td>94.2</td><td>—</td><td>93.1</td><td>—</td><td>—</td></tr>  
     <tr><td>ResearchRubrics</td><td>76.2</td><td>—</td><td>73.8</td><td>73.5</td><td>64.0</td><td>71.1</td></tr>  
     <tr><td>GDPval-AA v2 Elo</td><td>1686</td><td>1747</td><td>1736</td><td>1593</td><td>1491</td><td>1510</td></tr>  
     <tr><td>Toolathlon-Verified</td><td>76.5</td><td>77.9</td><td>74.9</td><td>76.2</td><td>73.5</td><td>59.9</td></tr>  
     <tr><td>MCPMark-Verified</td><td>94.5</td><td>87.4</td><td>92.9</td><td>76.4</td><td>92.9</td><td>—</td></tr>  
     <tr><td>MCP-Atlas</td><td>84.2</td><td>84.7</td><td>83.6</td><td>83.6</td><td>82.8</td><td>82.6</td></tr>  
     <tr><td>AutomationBench</td><td>30.8</td><td>29.1</td><td>29.7</td><td>27.2</td><td>22.7</td><td>12.9</td></tr>  
     <tr><td>JobBench</td><td>54.3</td><td>57.4</td><td>45.4</td><td>48.4</td><td>38.3</td><td>43.4</td></tr>  
     <tr><td>AA-Briefcase Elo</td><td>1548</td><td>1583</td><td>1495</td><td>1354</td><td>1158</td><td>1260</td></tr>  
     <tr><td>Agents' Last Exam</td><td>28.3</td><td>25.7†</td><td>29.6</td><td>27.0</td><td>26.6</td><td>20.4</td></tr>  
     <tr><td>APEX-Agents</td><td>41.0</td><td>43.3</td><td>39.9</td><td>39.4</td><td>38.5</td><td>35.6</td></tr>  
     <tr><td>OfficeQA Pro</td><td>63.3</td><td>69.9</td><td>63.2</td><td>63.9</td><td>60.9</td><td>41.4</td></tr>  
     <tr><td>SpreadsheetBench 2</td><td>34.8</td><td>34.7</td><td>32.4</td><td>31.6</td><td>29.1</td><td>28.1</td></tr>  
     <tr><td>OSWorld-Verified</td><td>84.8</td><td>85.0</td><td>83.0</td><td>83.4</td><td>79.0</td><td>—</td></tr>  
     <tr><td>OSWorld 2.0</td><td>58.3</td><td>66.1</td><td>62.6</td><td>55.7</td><td>49.5</td><td>—</td></tr>  
     <tr><td>SaaS-Bench</td><td>60.1</td><td>—</td><td>61.4</td><td>56.1</td><td>43.8</td><td>—</td></tr>  
     <tr><td>τ³-Banking</td><td>33.4</td><td>26.8</td><td>33.0</td><td>27.6</td><td>31.3</td><td>26.8</td></tr>  
     <tr><td>Harvey Lab-AA</td><td>94.6</td><td>93.6</td><td>87.2</td><td>91.1</td><td>86.3</td><td>91.0</td></tr>  
     <tr><td>CorpFin v2</td><td>71.6</td><td>71.8</td><td>64.4</td><td>66.7</td><td>68.4</td><td>66.1</td></tr>  
     <tr><td>Finance Agent v2</td><td>54.4</td><td>56.3</td><td>53.8</td><td>53.9</td><td>51.8</td><td>49.7</td></tr>  
     <tr><td>Legal Research Bench</td><td>44.2</td><td>49.5</td><td>48.1</td><td>43.8</td><td>40.4</td><td>31.3</td></tr>  
     <tr><td>WorldVQA ForceAnswer</td><td>51.0</td><td>56.7</td><td>41.8</td><td>39.1</td><td>38.5</td><td>—</td></tr>  
     <tr><td>OmniDocBench</td><td>91.1</td><td>89.8</td><td>85.8</td><td>87.9</td><td>89.4</td><td>—</td></tr>  
     <tr><td>PerceptionBench</td><td>58.5</td><td>57.2</td><td>59.7</td><td>47.2</td><td>55.8</td><td>—</td></tr>  
     <tr><td>Video-MME w. sub</td><td>90.0</td><td>—</td><td>89.5</td><td>86.0</td><td>89.3</td><td>—</td></tr>  
     <tr><td>MMVU</td><td>82.1</td><td>—</td><td>81.2</td><td>79.2</td><td>81.7</td><td>—</td></tr>  
     <tr><td>BabyVision w/ python</td><td>85.7</td><td>90.5</td><td>88.9</td><td>81.2</td><td>83.6</td><td>—</td></tr>  
     <tr><td>MMMU-Pro</td><td>81.6 / 83.4</td><td>81.2 / 86.5</td><td>83.0 / 84.6</td><td>78.9 / 82.7</td><td>81.2 / 83.2</td><td>—</td></tr>  
     <tr><td>CharXiv RQ</td><td>84.8 / 91.3</td><td>88.9 / 93.5</td><td>84.6 / 89.1</td><td>80.5 / 89.9</td><td>84.1 / 89.0</td><td>—</td></tr>  
     <tr><td>MathVision</td><td>94.3 / 97.8</td><td>94.8 / 98.6</td><td>95.8 / 97.8</td><td>86.7 / 97.1</td><td>92.2 / 96.8</td><td>—</td></tr>  
     <tr><td>ZeroBench pass@5</td><td>23.0 / 41.0</td><td>23.0 / 46.0</td><td>17.0 / 35.0</td><td>17.0 / 34.0</td><td>22.0 / 41.0</td><td>—</td></tr>  
   

The repository footnotes state that all Kimi K3 results are obtained with reasoning effort set to max and temperature set to 1.0. For single-step tasks such as GPQA Diamond, HLE-Full, and vision benchmarks without tools, top-p is set to 0.95. For agentic tasks, top-p is set to 1.0. For HLE-Full, MMMU-Pro, CharXiv (RQ), MathVision, and ZeroBench, each cell reports scores without and with tool augmentation in that order.

Evaluation Footnotes

Reasoning and knowledge benchmark scores for CritPt and AA-LCR are cited from Artificial Analysis as of July 23, 2026.

For coding benchmarks, DeepSWE is evaluated with the Kimi Code harness. GLM-5.2 is taken from the GLM-5.2 release blog, while remaining DeepSWE scores are from the official DeepSWE leaderboard; Kimi K3 attains 67.3 with the mini-SWE-agent harness. Terminal-Bench 2.1 reports the best score across harnesses for other models. ProgramBench uses the Kimi Code harness for Kimi K3 and Vals AI for other non-GLM scores. SWE-Marathon is based on an H20-calibrated branch of official tasks as of July 9, 2026. FrontierSWE dominance scores are recomputed from raw scores using the official evaluation script and are current as of July 16, 2026. PostTrainBench scores for selected models are adopted from the official results, while Kimi K3, Claude Fable 5, and GPT-5.6 Sol are evaluated with Harbor at maximum reasoning effort over three runs on H20 GPUs.

For agentic benchmarks, OfficeQA Pro provides each test case with the entire PDF corpus as images and no machine-readable text. MCP-Atlas uses the 500-task public subset with a 100-turn limit and Gemini 3.1 Pro as the judge. AutomationBench uses the 600-task public subset. BrowseComp adopts a context-compaction strategy triggered at 300K tokens; with the full 1M-token context window and no context management, Kimi K3 scores 90.4. Several benchmark scores are cited from Artificial Analysis, APEX-Agents, Vals AI, and Agents’ Last Exam leaderboards as of July 23, 2026.

For multimodal benchmarks, all scores except ZeroBench are averaged over three runs. ZeroBench follows the official setting and is run five times. MMMU-Pro preserves the original input order and prepends images to the text input. PerceptionBench is described as an in-house benchmark focused on atomic visual perception capabilities.

4. Native MXFP4 Quantization

Kimi K3 applies quantization-aware training from the SFT stage onward, using MXFP4 weights with MXFP8 activations for broad hardware compatibility.

5. Deployment

Kimi K3’s API can be accessed at platform.kimi.ai by selecting kimi-k3. Moonshot AI provides OpenAI-compatible and Anthropic-compatible APIs. The repository recommends the following inference engines:

• vLLM, with recipes

• SGLang, with cookbook

• TokenSpeed, with recipes

6. Model Usage

Kimi K3 always has thinking enabled and returns reasoning_content. Thinking effort is configured through the top-level reasoning_effort request field, which supports low, high, and max; the default is max.

Kimi K3 was trained in preserved thinking history mode. For multi-turn conversations and tool calls, Kimi K3 requires the complete assistant message returned by the API to be passed back into messages unchanged, including reasoning_content and tool_calls, not only content.

import openai

def chat_with_preserved_thinking(client: openai.OpenAI, model_name: str):
    messages = [
        {
            "role": "user",
            "content": "Tell me three random numbers."
        },
        {
            "role": "assistant",
            "reasoning_content": "I'll start by listing five numbers: 473, 921, 235, 215, 222, and I'll tell you the first three.",
            "content": "473, 921, 235"
        },
        {
            "role": "user",
            "content": "What are the other two numbers you have in mind?"
        }
    ]

    response = client.chat.completions.create(
        model=model_name,
        messages=messages,
        stream=False,
        max_tokens=4096,
        reasoning_effort="max",
    )
    # the assistant should mention 215 and 222 that appear in the prior reasoning content
    print(f"response: {response.choices[0].message.reasoning}")
    return response.choices[0].message.content

For full guides and examples covering vision input, structured output, partial mode, tool choice, dynamic tool loading, and context caching, see the Kimi K3 Quickstart and Thinking Effort.

Coding Agent Framework

Kimi K3 works best with Kimi Code CLI as its agent framework. The repository invites users to run Kimi Code in the terminal and select Kimi K3 using the /model command.

7. License

Both the code repository and the model weights are released under the Kimi K3 License.

8. Contact

For questions, the repository lists support@moonshot.ai.