You cannot embargo a download

Indian firms have been quietly reconfiguring their software to run on Chinese AI. Nikkei Asia reports that across the country companies are migrating their workloads to models from DeepSeek, Alibaba and Moonshot AI in order to keep costs down. On the Microsoft platform in southern India a DeepSeek model will cost a very small fraction of what the equivalent American model would charge for the same amount of text. The usual reason given is that the Chinese models are cheap and the American models are expensive and so the cost conscious start-ups go with the cheap option.

While that it true, what matters more is capability rather than origin. If you take a number of models of comparable ability and compare their prices the advantage of being Chinese or of being open source vanishes almost completely. A cheap Chinese model is cheap because it’s a step below the frontier, not because it’s Chinese. At the same level of capability several American models cost pretty much the same. A developer cited by Rest of World put it very nicely when he said you don’t need God to write your email. For the vast majority of business use cases the frontier is more than you need so it’s a perfectly sensible decision to go for a slightly weaker model in order to save on the tier rather than some kind of clever arbitrage on China.

This isn’t an Indian thing. American developers are doing exactly the same. Rest of World described a coding session which costs around $10 on one of the major US models and less than $0.50 on DeepSeek and goes on to note that US lawmakers are now looking into the US companies that are building on Chinese open models. It’s all down to the maths.

If price isn’t the differentiator, then what is? It’s that the weights of an open model can be downloaded, run on your own machines and modified without anyone’s permission. All technology denial efforts need to target this, but that is precisely difficult to achieve.

For three years Washington has been building a rather sophisticated system to slow China’s access to advanced AI. It’s all about restricting the most capable chips, the equipment used to make the chips and the cloud services that allow you to rent the chips. The logic is taken straight from arms control, if one looks closely at it. You deny the other side the inputs and you deny it the capability (or at least you delay it). On the hardware front, the controls do have some effect. To train a model at the frontier you still need huge quantities of the scarce chips and the data shows that the cost of a frontier training run is continuing to rise, roughly doubling every year. Denial to a considerable extent increases the cost.

The problem is that a capability will not stay confined in the lab that first developed it. Within months you will see a similar version as open weights that anyone can download. The gap between the best closed model and the best open model has shrunk from well over a year down to a few months and it’s closed fastest in the Chinese labs. When an open version is weeks behind the frontier, an export control designed to keep that capability locked away for years is simply not going to work.

The two sides of the cost story make this point even more stark. The cost of building the frontier is increasing, while the cost of using a given level of capability is dropping by a factor of nearly 10 every year (that’s the trend that the Stanford AI Index and a number of independent benchmarkers have tracked). The controls are all on the expensive side (the side of building the frontier) and they have absolutely no effect on the cheap side (the side of the spread of what’s already been built).

The Fable 5 episode in June was very clear in demonstrating the asymmetry. The US government at one point had a US company turn off a service that was in use globally and then very quickly reversed that position a few weeks later. A closed model has this problem - there is an off switch that a government can use. A set of weights that are already out there on the internet have no such off switch.

That’s why treating AI as an arms control issue is fundamentally wrong. Arms control makes sense when you’re dealing with a physical object that is difficult to copy. A missile is that sort of object. Export controls can certainly put a dent in the frontier and slow down the pace at which a competitor gets there. They cannot prevent a capability from spreading as open weights make exclusivity a non-starter in terms of diffusion (it spreads in a matter of days, not years). The entire Washington debate about whether the controls have worked or failed is a bit of a misdirection. The more important and useful question is what the controls can and can’t do. The Council on Foreign Relations has already said that the software side of the regime is effectively unenforceable.

For India a few practical points need to be looked at.

The open-weight frontier (a lot of it Chinese) is the baseline against which we have to plan. Indian firms are already building on it and that diffusion will continue regardless of what New Delhi decides. India is also part of this world via the open models that are emerging under the IndiaAI Mission, not just a consumer of it.

Further, India’s access to capable AI is far more dependent on the diffusion of such capability than on its position in any given country’s export control framework. As Washington whimsically plays the cycle of abandoning and reworking its diffusion controls, access will increasingly get negotiated country by country. It would be a very foolish thing to base any national strategy on the assumption that a partner’s controls will in any case be effective in keeping a competitor at bay. The evidence suggests quite the opposite.

The China issue is important but not in the way the price argument would have one believe. The issue with a Chinese model isn’t its cost. The issue is where the model runs. A prompt sent to a service hosted in China could be subject to Chinese law which could in turn require the company to hand over the data. The same weights, downloaded and run on Indian servers, would have no such exposure. The important thing from governance point of view is therefore the point of use (where the model is run) rather than the point of access (where you access it) which is where the exposure lies.

Chip controls aren’t pointless. They still make it more expensive and more time consuming to set the frontier and being first in that has value. The hope behind the controls was however much greater than that. The promise was to deny China a capability and a capability that anyone can just download is not something that can be denied. India’s own game from the IndiaAI Mission right through to its negotiations on chips will be far more grounded once they start from that premise rather than from the fantasy that the chip war will do more than it can.