The Open-Weight Illusion

Transparency, Cheap Tokens, and a Plausible Vector for Strategic Leverage in Western Institutions

----------------------------------------------------------

China is not a liberal democracy with independent corporations. It is a state in which strategically
significant technology companies do not stand apart from state will, not legally, not institutionally,
not historically. It is a state that treats technological strength as a tool of global influence, a direct
competitor to the Western order, widening its reach across technology, the military, and the economy.
Against that background sits a question Western institutions prefer not to ask out loud. Why does
precisely this kind of state push open AI models, free or at dumping prices, onto world markets so
hard?
The comfortable answer is that independent researchers want to advance science and open up competition. It is an appealing story. It also assumes that Chinese AI companies enjoy the same indepen-
dence as a startup in Berlin or San Francisco. They do not.
Open weights joined to closed training data are not transparency. They are the look of it, and the
look is the way in. Cheap tokens do the rest. They move Western business and government onto these
models and build dependence before anything is ever switched on. I call this the Economic Deployment
Vector. Here price becomes a route to infrastructure capture, and reading it as an ordinary market tactic
misses what it actually does.
The underlying mechanism is not hypothetical, though its full reach has not been mapped. Peer reviewed work shows that a backdoor can be planted during training through a tiny number of documents, and that it survives later safety training. So far this has been shown for simple triggers. It has not been shown for the sophisticated, context-conditioned behaviour that a strategic payload would require. Whether the same economy of scale reaches that level of complexity is an open technical question. A state actor that trains the model from the inside, instead of injecting documents into a corpus it does not control, removes the access constraint completely. But access was never the open question here. Complexity is, and it remains untested in either direction. I offer this as an existence proof of feasibility. It is not a claim that anything has actually happened, and the recommendation that follows does not depend on settling it. 

A hidden behaviour can also sit where Western auditing does not look, inside the Chinese-weighted part of a bilingual model, in a region that English-only evaluation never reaches. I call this the Bilingual Blind Spot. A clean record across many versions does not settle the question in either direction. A strategy built on earning trust before striking would produce exactly that clean record, and so would the complete absence of any strategy. Model behaviour on its own cannot separate the two. What can be tracked instead is the external condition that would make striking rational: the depth of institutional dependence, and how close the geopolitical situation sits to the point where restraint stops paying.
Reliable detection may turn out to be impossible, or so costly that it eats the very saving that made
the model attractive. If that is so, the practical answer stops being better auditing. It becomes lower
dependence: build on your own models, or on those of a trusted state, and stay away from any model
whose institutions leave it no room to refuse. This conclusion falls hard on China, and it is still fair,
because it rests on how that state is built and not on where a given model happens to come from.
Two of the three technical links this argument needs are already established. The third, that the same
cheap method reaches sophisticated behaviour, has been neither proven nor refuted. Set against what
is already known, the absence of any institutional check on the state and the economics of deepening
dependence, that single open question is reason enough for precaution. None of it is evidence that an
attack is already underway.