AI Export Controls - Measuring Hardware Constraints and Model Transfer

Export controls can constrain AI capacity without halting progress
Distillation transfers capabilities through a different channel
Policy evaluation must separate benchmarks, deployment and enforcement

Evidence that Chinese AI models are becoming more capable does not settle whether restrictions on advanced chips have been effective. In July 2026, US and British testing organisations assessed Kimi K3 on a cyberattack exercise comprising 32 steps. Its average progress reached step 17, while leading American systems reached 28.5. That difference illustrates why apparently close scores on public benchmarks may conceal larger gaps in sustained, difficult work. Models including Kimi K3, DeepSeek V4 Pro and GLM 5.3 nevertheless demonstrate significant Chinese progress. The policy question is whether that progress would have been faster, broader or cheaper without hardware restrictions. A separate question concerns model capabilities acquired through distillation. Export controls address access to computing equipment, while the transfer of knowledge through model outputs can occur through other channels. Evaluating the first instrument requires understanding the second, rather than assuming either makes the other irrelevant.

Capability Scores Require a Counterfactual

The Epoch Capabilities Index placed Kimi K3 at 158 in September 2026, compared with 163 for Claude Fable 5 and 169 for GPT 6 Astra. Using the recent historical pace of improvement, the comparison discussed by Erich Grunewald implies a gap of approximately four to ten months. That is a meaningful level of capability, but the conversion from points to months is an interpretation of past progress, not a guaranteed development schedule. Grunewald also emphasises that benchmark collections cannot fully represent difficult, open-ended work sustained over longer periods. The cyberattack exercise is relevant because it tests a different dimension from short, scored tasks. Policymakers should therefore avoid treating a single ranking as a comprehensive measure of national AI capacity or as a direct test of export-control effectiveness.

Deployment introduces another dimension. Moonshot AI acknowledges that Kimi K3 remains behind the strongest systems overall, and reportedly suspended new subscriptions shortly after launch because demand exceeded available computing resources. A competitive model can therefore coexist with inadequate capacity to serve its users. Releasing weights openly may allow other organisations to supply that deployment capacity. Hardware constraints are one plausible influence on such a choice, alongside commercial strategy, ecosystem development and research preferences. Open-weight release alone cannot establish the developer’s motive. For policy evaluation, the distinction between developing a model and operating it economically at large scale is essential. Controls may affect experimentation, training and inference differently, and success in one activity does not demonstrate independence across the entire production chain.

The relevant comparison is not simply China against the United States at one date. It is China’s observed trajectory against the trajectory it might have followed with unrestricted access to advanced hardware. That alternative cannot be observed directly. Company statements that restrictions delay development, evidence about hardware availability and the economics of experimentation can nevertheless inform the assessment. None delivers a precise estimate of the counterfactual by itself. A policy may slow a competitor without preventing useful models, just as technical progress can remain substantial under binding constraints. Stating the objective as delay, cost or limited deployment makes evaluation more informative than using complete technological exclusion as the only definition of success.

Alternative Hardware Access Does Not Eliminate Constraints

Epoch AI estimated that Chinese firms held about 5 percent of global AI compute through official channels at the end of 2025, less than the capacity of any individual major US cloud provider. Smuggled equipment and rented capacity abroad complicate that picture. They can support projects that official domestic supply cannot accommodate, but they do not necessarily provide the same reliability, price or operational control as unrestricted ownership. A smaller accessible hardware base can limit the number of parallel experiments, the size of training runs and economical deployment. Those constraints may matter even if a firm can obtain enough resources to release a strong model. Policy assessment should distinguish an occasional successful project from the sustained capacity to develop, revise and serve systems at scale.

Enforcement is incomplete, and the evidence includes both estimates and allegations. In March 2026, US prosecutors charged a Super Micro co-founder with involvement in a scheme allegedly diverting up to $2.5 billion of Nvidia equipment through a Southeast Asian shell company. Charges are not findings of guilt. Epoch AI’s estimates suggest smuggled equipment could represent up to one-third of Chinese compute by 2025, approximately 3 percent of global capacity, with substantial uncertainty. Cloud rental contributes another difficult-to-measure channel, reported as at least 3 percent of global access in the discussion. These figures should not be combined without consistent denominators and dates. Remote access can also be lawful under applicable arrangements. The existence of leakage identifies an enforcement problem without showing that the restrictions impose no cost.

Platform Usage Is Not a Measure of National Compute Ownership

Token statistics offer information about model use, but require careful interpretation. An OpenRouter study with Andreessen Horowitz examined 100 trillion tokens. Chinese open-weight models rose from a 1.2 percent platform share at the end of 2024 to nearly 30 percent within several months, with an average weekly share of around 13 percent in 2026. The comparable share for models from outside China and the United States was 13.7 percent. These numbers describe activity routed through that platform, not all global AI use. They indicate the appeal of Chinese models within an important distribution channel, but do not directly measure national hardware capacity, domestic adoption or the resources devoted to training. A model’s origin, the user’s location and the location of the server running inference can all differ.

Wang Peng of the Beijing Academy of Social Sciences observed that Chinese developers represented just over 6 percent of OpenRouter users. This suggests substantial international use of Chinese models within the platform’s customer base. It does not establish the composition of AI use inside China, where other services may dominate, or prove that each user generates a comparable volume of tokens. Low pricing and open weights can support adoption abroad without requiring all inference to run on Chinese hardware. The distinction matters because successful software diffusion is compatible with a constrained domestic compute base. Policymakers should resist equating a high model-use share with control over the infrastructure used to provide that service. Each statistic describes one layer of a distributed technological system.

Distillation Creates a Separate Capability-Transfer Channel

Distillation trains one model using information supplied by another, potentially reducing the cost of acquiring particular capabilities. It still requires computing resources for generating or obtaining training data, optimisation and deployment; it is not a chip-free process. In an April 2026 memorandum, White House technology director Michael Kratsios alleged industrial-scale extraction campaigns by entities primarily based in China, involving false accounts and circumvention of restrictions. Anthropic separately accused DeepSeek, Moonshot AI and MiniMax of generating more than 16 million exchanges through approximately 24,000 fraudulent accounts, including 3.4 million exchanges attributed to Moonshot. These are allegations about particular access practices, distinct from the broader technique of distillation, which can also be legitimate. A coherent policy needs to distinguish authorised knowledge transfer from conduct alleged to breach access rules.

In July, Kratsios specifically alleged that Moonshot used outputs from Anthropic’s advanced Claude system to develop Kimi K3 and obtained Nvidia GB300 servers through Thailand in circumvention of export restrictions. Moonshot denied the allegations and attributed its model to its own innovations. Kimi K3’s reported input price of about $3 per million tokens, against $10 for Fable 5, and its stronger Frontend Code Arena result show why the dispute has commercial importance. Neither price nor benchmark performance establishes the alleged development method. Treasury Secretary Scott Bessent warned that covert large-scale extraction could attract sanctions or restricted-entity designations. Such warnings signal an enforcement direction; they should be distinguished from adjudicated findings about the firms concerned and from the legal treatment of ordinary model training.

A September joint warning from the NSA, CISA and FBI described targeted model-extraction tactics allegedly involving DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies reported efforts to obtain billions of tokens from US frontier systems since 2024 and assessed that Chinese authorities likely knew of the activity. Named targets included Claude, ChatGPT, Gemini and Grok. Access routes reportedly involved direct interfaces, cloud services and aggregators obscuring user information. The warning adds evidence about the agencies’ threat assessment, but should not be presented as conclusive proof of every allegation. For policy design, the significant point is the variety of access paths. Hardware controls alone do not govern every route through which model behaviour can be observed and incorporated into another system.

Combining Hardware Policy with Model-Access Governance

The potential applications extend beyond consumer services. A Reuters review of more than 80 Chinese papers and patents, informed by Jamestown Foundation research, described military-linked use of distillation. One paper from Unit 96941 discussed using GPT-3.5 to process military source code before training a domestic model intended to operate within military networks. Other research from the Academy of Military Sciences examined target-reconnaissance applications in simulated naval settings involving drones, ships and underwater vehicles. Published descriptions do not establish the operational scale or effectiveness of those systems. They do show why policymakers regard the transfer of capabilities through outputs as a security issue as well as a commercial dispute. A locally deployed model may embody information obtained from a foreign service even when subsequent operation no longer requires that service.

Export controls and model-access governance consequently address different parts of the development process. With easier access to chips, firms might still use distillation because it can reduce training cost or time. Hardware abundance would not remove that incentive. Proposed measures such as the Remote Access Security Act seek to extend controls to remote computing access; the legislative status described in the underlying account is a House-passed proposal awaiting Senate action, rather than an enacted universal rule. Diplomatic engagement supplies another channel for discussing acceptable conduct and mutual risks. The planned September AI-governance discussions cited in the original account should be understood as an announced initiative, not evidence here that a meeting occurred or produced an agreement. Evaluation needs to track the legal reach and implementation of each instrument separately.

Kimi K3’s step-17 performance does not show that chip controls have failed, and it does not show that those controls are sufficient. The evidence supports a narrower argument: restricted hardware access can constrain development and deployment while Chinese firms continue to release capable systems. Distillation may reduce some development costs and transmit capabilities through channels outside physical equipment exports. Its importance should not be converted into a claim that all competitive Chinese models rely on unauthorised extraction. Gordon Institute’s Policy Forum therefore treats the contest as a question of instrument design and evidential discipline. Policymakers need explicit objectives, consistent measures of capacity and careful separation of technical findings, commercial claims and security allegations. A restriction can impose delay without delivering isolation, and that distinction should shape both enforcement and public assessment.

This article presents analysis published by Gordon Institute’s Policy Forum. It does not constitute policy advice or an official policy position of Gordon Institute or any affiliated institution.

References

Baptista, E. (2026) 'Exclusive: Chinese military researchers tap US AI models to train defence systems', Reuters, 31 July.
Cheng, Y. (2026) 'Chinese AI models lead global token consumption', China Daily, 7 April.
Chow, V. (2026) 'Trump tech official accuses China's Moonshot AI of stealing from Anthropic', South China Morning Post, 23 July.
Grunewald, E. (2026) 'China's AI models aren't proof that US chip controls have failed', East Asia Forum, 10 September.
Kelley, A. (2026) 'China is trying to steal US AI models' secrets, intel agencies warn', Defense One, 8 September.
Lee, K. (2026) 'Open Weights, Extracted Capabilities: Reassessing the Distillation Economy and the Contest for American AI Leadership', The Economy Research (SIAI), 13 August.