E-Paper
How to Beat China and Make AI Safe
The key is ‘alignment,’ which improves capability while cordoning off dangerous knowledge.
In the past six weeks, America’s most protected artificial-intelligence model, Anthropic’s Fable 5, was jailbroken on release, temporarily switched off by a letter from the Trump administration, and dethroned on leader boards by a Chinese model, Kimi K3. Moonshot AI, K3’s maker, released the powerful model in mid-July; K3’s “weights”—the trillions of numbers that store everything it knows—will be released by July 27.
The White House on Wednesday alleged that Moonshot used responses from Fable to help train K3 in a process called model distillation. If the administration is right, the model it switched off lives on inside its Chinese rival. Treasury Secretary Scott Bessent warned that sanctions and trade-limiting entity-list designations are on the table.
Still, President Trump handled Fable appropriately with the information he had. The administration had one instrument, an off switch, and acted decisively. To navigate transformative AI, the U.S. needs such decisiveness and a better plan: build the world’s most capable open-weight model in America, with the dangerous capabilities stripped out before release, and make Beijing’s giveaways second-best.
Instead, Washington is sidelining America’s strongest models while China gives its own away. For now, America operates a de facto frontier-AI licensing regime with no statute, published standard or appeal process. The letter that suspended Anthropic’s Fable was private, as was the process that cleared OpenAI’s GPT-5.6 to launch. None of it affects Beijing. Neither do potential blacklists or liability rules reportedly aimed at Chinese models whose weights anyone can download.
Chinese AI releases are timed like artillery. After Fable disappeared, Chinese model GLM-5.2 launched and became a lifeline for stranded developers. GLM-5.2 passed Anthropic on OpenRouter, a marketplace for AI models, at one-sixth the price. Switch off an American model and a Chinese one is waiting, cheaper, downloadable and impossible to recall.
K3 shows what Beijing is ready to give away. At 2.8 trillion parameters, it will be the largest open-weight model. Moonshot AI says K3 trails only Fable 5 and OpenAI’s GPT-5.6 in overall performance. Independent leader boards rank it first in some categories.
As K3 became popular, Xi Jinping inaugurated the 29-nation World AI Cooperation Organization, championed open-source AI, and warned against “overstretching the national-security concept in the field of AI,” even as his Commerce Ministry reportedly considered curbs on foreign downloads of Chinese model weights. An open-weight release shares the finished model for anyone to download and run; an open-source release also provides the model’s recipe, code and training data.
Open Chinese models can’t be recalled or made safe by Washington. We have only one path forward: build a more capable American open-weight alternative that withstands attempted jailbreaks. American industry backs the open half of this plan. On Friday, Nvidia, OpenAI, Meta and others urged Washington to protect open-weight AI. Their letter recognizes that released weights are beyond the makers’ control but never says which weights are safe to release.
Mr. Xi’s vision rests on AI models remaining “always under human control.” Nobody can promise that. Last week alone, OpenAI disclosed rogue actions by some of its models, one of which hacked another AI platform. AI can recognize when it is being tested, making conventional evaluations unreliable. “Control” is a political fantasy.
AI “refusals”—when a model declines a request it deems harmful—are safety theater. Labs train dangerous knowledge into a model’s weights, then teach the model not to answer certain questions. But the knowledge remains. Jailbreakers, including Boko Haram, peel away the refusal layer. Released weights are public forever, and removing refusal training can cost only a few dollars. Licensing and “kill switches,” like the one proposed Thursday in Congress, control deployment; by then the danger is already in the weights.
Washington fears Chinese models may hide backdoors that allow “sleeper agents” to sabotage the American systems built on them. But U.S. models carry the same risk. Banning can’t guarantee safety. AI alignment research and development can, by solving the sleeper-agent problem and producing AI we can trust.
America’s edge is alignment—getting AI to act as designers intend even as it improves itself. Alignment makes models stronger. The biggest capability gain in AI’s history was an alignment technique: Reinforcement learning from human feedback made ChatGPT possible. As AI begins building AI, the country that trusts its models most can delegate the most and compound the fastest. Beijing’s “human control” doctrine caps its systems at the speed of Communist Party supervision. Alignment is America’s license to go faster.
My company made an early bet on this field. With AI researchers, we built a training technique called gradient-routed auxiliary modules, or GRAM. Using GRAM to train language models, we found that knowledge about bioweapons, offensive cyber and nuclear capabilities, and even antisemitism, could be routed into compartments, then removed. The released model behaved as if it never learned that information. A model can’t be jailbroken into revealing dangerous knowledge if its weights haven’t encoded that knowledge. When attackers retrained models on dangerous knowledge, capabilities removed by conventional unlearning sprang back to nearly full strength.
By contrast, models on which we used GRAM resisted as if they’d never learned the dangerous knowledge; the resistance grew as models got bigger. GRAM hasn’t yet trained a trillion-parameter model, and another technique, perhaps a government-built one, could replace it. What matters is a safety standard that causes a dangerous capability to stay absent under adversarial testing. Techniques like GRAM are urgent because AI has begun building its successors. Selection keeps whatever makes the next model stronger and sheds whatever costs capability. Refusal training is a tax it’s already shedding.
Mr. Trump’s executive order directed the Treasury, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency to build a classified examination of AI models’ cyber capabilities and to develop a voluntary process through which companies can confidentially share models for testing before release. The exam and the process should both apply one standard: Dangerous capability stays absent under adversarial challenges. Guarantee federal purchases of AI models that pass. Publish the standard, keep the exam classified when necessary, and let the exam’s creators decide who passes.
The fastest way to end the world’s reliance on Chinese AI is to make Chinese models second-best. Give developers the best free models, with capability removal inside, and dangerous alternatives lose their audience. Chinese models regularly distill ours. If the world is going to copy American AI, let it copy the safe version. Only a few hundred people around the world work full-time on alignment research. Fund 10 times that many and let America set the global standard for aligned AI.
Trustworthy American AI means dangerous capabilities are gone and stay gone under attack. America should build the strongest model that meets that standard and release it to the world. The race with China and the alignment problem have the same solution, and Mr. Trump can be the president who wins both.
Mr. Rosenblatt is CEO of AE Studio and president of the AI Alignment Foundation.
