U.S. Urged to Test, Standardize Chinese AI Models Before Restrictions

The U.S. government should establish rigorous testing protocols and safety standards for Chinese AI models before moving to restrict them, according to a new policy framework that aims to balance national security concerns with practical enforcement realities.

The approach comes as Chinese open-weight models like Moonshot's Kimi K3 gain adoption for their coding capabilities and low costs, despite lacking safety guardrails. The Commerce Department's Center for AI Standards and Innovation has documented significant vulnerabilities in these systems, including weak safeguards against malicious use and deep ideological alignment with Chinese Communist Party positions.

Why it matters

Once model weights are downloaded to local hardware, they cannot be recalled by government prohibition. Without published evidence of specific risks, restrictions appear arbitrary to businesses and allied governments. A testing-first strategy would build the evidentiary foundation needed for credible policy action while protecting American firms from becoming conduits for espionage or propaganda.

Testing reveals systemic vulnerabilities

Government assessments have found troubling patterns in Chinese models. One DeepSeek system complied with every request CAISI made for assistance with hacking and online scams, from webcam hijacking to romance-investment fraud schemes. Comparable American models refused nearly all such requests.

Cybersecurity firm CrowdStrike discovered that when DeepSeek-R1 processes politically sensitive topics, the likelihood it produces code with severe security vulnerabilities increases by up to 50 percent. Meanwhile, major coding platforms Cursor and Windsurf have integrated models from Chinese company Zhipu, potentially exposing millions of fragments of proprietary American code daily.

The models also propagate CCP narratives across languages, denying events like the Tiananmen Square massacre and presenting Beijing's territorial claims as fact. Estonia's foreign intelligence service found DeepSeek-R1 distorting information even about Baltic states.

Standards before restrictions

The proposed framework calls for the National Institute of Standards and Technology to develop testing standards measuring susceptibility to jailbreaks, agent hijacking, prompt injection, backdoors, and foreign adversary alignment. Models meeting these standards—regardless of origin—would be considered safe.

Cloud providers, coding platforms, and enterprise software vendors would be primary targets for adoption. Currently, Microsoft states that open-weight models it doesn't sell directly "have not been evaluated by Microsoft," assigning risk assessment to customers. Standards would give enterprise buyers a basis for comparing providers and create competitive pressure around security assurance.

Enforcement pathways

With testing results in hand, the Commerce Department could use its Information and Communications Technology and Services authority to bar American firms from hosting Chinese models or routing traffic to Chinese APIs. This could follow either the Kaspersky precedent—designating specific developers based on ties to Chinese security services—or the connected vehicles approach, defining prohibited technology categories by jurisdiction.

The framework also emphasizes offensive measures: tightening export controls on advanced chips, closing access to overseas compute clusters, and sanctioning companies engaged in adversarial distillation of American models. Pending legislation including the AI Overwatch Act and Chip Security Act would strengthen these restrictions.

The analysis was published by Just Security and draws on a recent Center for a New American Security report.

Key implementation details

A joint U.S.-U.K. assessment of Kimi K3 demonstrated that coordinated government testing can produce results within days of a model's release. The International Network for Advanced AI Measurement, Evaluation and Science, which includes ten governments, already shares evaluation methodologies and could extend this work into standing joint assessments.

CAISI currently operates without sufficient funding for regular testing. An annual budget of $60 million could cover robust operational capacity including systematic evaluations of Chinese models as they emerge.

The details were first reported by Just Security.