Let’s make China work for us, securely: Building India's domestic compute, keeping good terms with US

If AI inference runs on Indian GPUs in an Indian data centre, the data pipeline is entirely domestic.

Companies across the world are turning to Chinese open-weight models that now deliver near-frontier capability at a fraction of the cost, trailing the frontier (Anthropic’s) by roughly eight months. Even this claim is changing fast with Moonshot AI’s Kimi K3 beating Anthropic’s Fable 5 on some coding-related benchmarks. These developments have amplified the question of AI sovereignty for India: In the absence of a domestic frontier model, are Chinese open-source models just as problematic as US proprietary models?

Not all foreign models create the same kind of dependency, and the cheaper, most accessible models might be the most sovereign. (AFP)

Our argument is that the sovereignty debate should not treat AI as a monolith. A proprietary model reached through a foreign application programming interface (API) and an open-weight model running on Indian hardware create fundamentally different dependencies. Despite structural tensions between India and China, the cheaper Chinese option might be the more sovereign one. We explain why.

When a ministry or a bank builds a workflow on Claude or ChatGPT, every query is processed by a company subject to US jurisdiction. When access to frontier models is being turned on and off based on national policy, this matters as the dependence is continuous — if an export control or sanctions decision were to remove access tomorrow, the workflow would break.

Now consider an alternative. An Indian financial services firm runs a Chinese open-weight model on graphics processing units (GPUs) rented from data centres in India. What exactly is the sovereignty risk here? The model weights are a static file of parameters sitting on Indian hardware. The data never leaves Indian territory. The Chinese creator of the model has no ongoing connection to its deployment, no API to revoke access, and no access to user data. This setup has better data sovereignty properties than a foreign proprietary API.

Large Indian firms and regulators are wary of using these open-weight models because they suspect Chinese “backdoors”, even though there is no special backdoor in an open-weight model, which is just a set of billions of weights and biases (parameters). If inference runs on Indian GPUs in an Indian data centre, the data pipeline is entirely domestic. The Chinese lab is no more “in the loop” than the authors of a textbook are when someone reads their book in another country.

This highlights the perception and compliance risk China’s digital exports face, even when the technical risk is minimal. But the fear of Chinese AI in Indian boardrooms is often a category error: The risk of Chinese hardware (with potential physical backdoors) or Chinese equity (with potential political influence) is being mapped onto Chinese model weights, where the threat model is structurally different. The security research community has identified concerns around sleeper agents and trojans in neural networks — models that behave normally on standard benchmarks but produce subtly compromised outputs under specific trigger conditions. But this risk is not specific to open-weight models.

Chinese companies have chosen the open-weight model route partly to compete with proprietary models for the global market. However, the Chinese government has demonstrated a pattern of restricting exports when materials become strategically important. For instance, gallium, germanium, antimony, and rare earth processing technologies were all freely exported until they weren’t. That open-weight models are still leaving without restriction tells us how strategically significant Beijing considers this generation of AI tools.

But as models become the primary intermediaries through which people interact with information, China will face an uncomfortable problem. Its own open models, built with Chinese talent and compute, will become the vehicle through which the world encounters balanced, often unflattering accounts of its history and present. An experiment we did using Open Router suggests that third-party-hosted Chinese open-weight models tend to provide neutral or seemingly uncensored answers, whereas direct calls to the same models hosted by Chinese companies are censored. A government that censors its domestic internet is unlikely to remain comfortable exporting models that undo that censorship for everyone else.

If these models prove transformative, we can expect China to restrict them. Weights cannot be “unexported” once released publicly, so any restriction would apply only to future, more capable generations. This strengthens the case for building domestic AI inference platforms that credibly serve models from both ecosystems as a neutral party. We should prepare for a near-term future (possibly within the next 18 months) in which access to the leading models will be curtailed by the Communist Party of China. Thankfully, there are non-Chinese open-weight models in contention should that happen.

Since the risk profile of open models differs qualitatively from that of proprietary APIs, the policy response should differ too.

First, Indian firms should actively focus on developing domestic AI inference infrastructure. The ability to run any model on Indian hardware, without data leaving Indian territory, is a capability worth having. India needs multiple inference providers, not a single national AI cloud.

Second, regulators should focus on the deployment layer (where data flows, who controls the compute, and what audit trails exist) rather than the national origin of model weights. A blanket suspicion of cheap Chinese-origin models is commercially costly. It denies Indian firms access to capable, low-cost models while doing nothing about the actual sovereignty risk, which lies in proprietary API dependencies.

Third, timing matters. If China eventually restricts exports, India will want to have already built the capacity to absorb whatever is available in domains such as fine-tuning, evaluation, and red-teaming. Domestic compute takes months to build, and starting now is imperative.

Fourth, one vulnerability that open weights cannot solve is that every GPU powering inference in India is designed by American firms, which may be subject to American export controls. Open weights solve the model-access and data-flow problems, not the compute supply chain. The only near-term option here is to remain on reasonably good terms with the US and participate in initiatives like Pax Silica. That is manageable. It doesn’t mean agreeing with Washington on everything, but continuing to engage with it as India has, despite major provocations.

Not all foreign models create the same kind of dependency, and the cheaper, most accessible models might, in the right deployment configuration, also be the most sovereign.

Pranay Kotasthane and Bharath Reddy are researchers with the high-tech geopolitics programme at the Takshashila Institution. The views expressed are personal