The "Chinese Models" Category Doesn't Exist. Stop Buying What Doesn't Exist.

Every week another operator asks me whether they should be using Chinese AI models. It's the wrong question. The phrase "Chinese models" bundles DeepSeek, Kimi, Qwen, GLM, and MiniMax into one decision when they don't share a price, a deployment path, a hardware burden, or a best use. What they share is a country. That's it.

I've watched this pattern for thirty years. A new category shows up, gets a nickname, the nickname collapses real differences, and operators make bad calls because they treated a bucket as a product. It happened with "the cloud" in 2010. It happened with "blockchain" in 2017. It's happening now with "Chinese AI."

If you run a real operation and want to know whether these models belong in your stack, break the bucket apart before you touch a single API key.

What Actually Sits Inside the Bucket?

Look at what shipped recently. Kimi K3 from Moonshot: 2.8 trillion parameters, one million token context window, $15 per million output tokens, marketed as open weight even though the weights weren't downloadable at recording time. DeepSeek V4 Pro: 1.6 trillion parameters, $0.87 per million output tokens. GLM 5.2 from Z.ai: MIT licensed, strong on long-horizon coding, but the BF16 checkpoint is roughly 1.5 terabytes. MiniMax M3: around 427 billion total parameters, 23 billion active per token, custom license requiring attribution, prior written authorization above $20M annual revenue, and prohibiting military use.

Five products. Five different economic profiles. Five different legal profiles. Five different hardware profiles. And "open" alone splits into four questions. Can I call it via API? Can I download the weights? Does the license permit my use? Can my hardware run it at the required context length and speed?

An operator who answers "yes to Chinese models" without running that breakdown hasn't made a decision. They've announced a preference.

Where Do These Models Actually Belong in a Stack?

Here's the shape I use when I test them.

For high-volume, price-sensitive API work like extraction, classification, first-pass research, and test generation, DeepSeek belongs in the test set. At $0.87 per million output tokens, the economics of document processing pipelines change. This is reviewable work. A machine can afford to check and recheck. Where I'd be careful is anywhere a single ambiguous answer drives an unrecoverable action.

For local work on personal hardware, smaller Qwen models and DeepSeek's R1-distilled models are the honest options. These are not the same artifact as DeepSeek R1 at 671B parameters or V4 Pro at 1.6T. Different systems. Different capability. Conflate them and you'll be disappointed by the local student and confused about why.

For long-horizon coding, research, and agent work, test GLM, Kimi, Qwen, and MiniMax against the best American frontier models using the same tools and the same acceptance standards. GLM 5.2 is particularly strong on coding. Strength in one domain doesn't make a model a universal replacement. A model can write an excellent patch and still fail a repository-level task by using the wrong tool, missing a test, or timing out.

For sensitive work, decide where data may go before choosing the model. A Chinese model running on your own server has a very different risk profile from the same model accessed via a first-party Chinese chat service. Same weights. Different exposure.

Why Is a 1.6 Trillion Parameter Model Cheap?

Mixture of experts. That's the whole story. DeepSeek V4 Pro has 1.6T total parameters. MiniMax M3 has around 427B total with only 23B active per token. The router doesn't use the whole network for every token.

Active parameters set compute per token. Total parameters set storage, memory, networking, and serving burden. That's why the same model can be cheap via improved API and impractical to run on a laptop.

Operators who read "23 billion active" and think "I can run this on a workstation" have missed how MoE works. Active count isn't a hardware estimate. Checkpoint size, precision, context requirements, serving topology, all of it matters. This complexity is precisely the advantage of the frontier US API providers. They absorb it. You don't.

What Is the Right Metric?

Cost per token is the wrong metric. Cost per accepted result is the right one.

The US government CAISI evaluation in May called DeepSeek V4 Pro the most capable Chinese model tested and estimated it was roughly eight months behind the leading US frontier. The gap was smaller on individual tasks, which tells you the model is spiky. Reinforcement-learned in specific areas. Strong where it was trained hard. Weaker elsewhere.

Here's the number that matters more. CAISI found DeepSeek ranged from 53% cheaper to 41% more expensive per correctly solved task across seven benchmarks. Cheaper tokens don't always yield cheaper solutions. If the model produces longer reasoning traces, makes unnecessary tool calls, fails late, or needs human cleanup, the token savings evaporate. A premium model can end up cheaper if it succeeds in one pass.

This is the operating reality most AI buying decisions miss. You're not buying tokens. You're buying finished work. Measure the finished work.

What About the Distillation Story?

Distillation isn't the controversy. A powerful teacher model generates examples, answers, or reasoning traces. A student model trains on those outputs. OpenAI sells distillation as a product. Frontier labs use it internally. DeepSeek openly used R1-generated samples, 800,000 curated examples, to train smaller Qwen- and Llama-based student models. Ordinary, disclosed teacher-to-student training.

A distilled student isn't the full teacher compressed. It inherits reasoning patterns on seen examples but loses breadth, reliability, and safeguards. That's why "DeepSeek runs locally" is misleading marketing. The local student and the full frontier teacher are very different systems.

The controversy starts where authorization ends. Anthropic alleges DeepSeek, Moonshot, and MiniMax used approximately 24,000 fraudulent accounts to generate more than 16 million Claude exchanges while evading access restrictions. A later White House memo described industrial-scale extraction by China-based entities but didn't name labs or validate Anthropic's numbers. The White House recently named Kimi K3 specifically. These are allegations, not court findings.

The distinction operators need to hold in their head is between authorization and conduct. A lab can distill its own or a licensed teacher. Or it can train on API outputs against contractual terms via fake accounts. The technical method overlaps. The legal claims are different. Chinese entities are typically not authorized to distill American models.

The broader lesson is more useful than the specific allegations. Model outputs are information, not physical like chips. Capability can move quickly across the internet via synthetic data, fine-tuning, RL, and distillation. Capability gaps can close faster than hardware policy alone would suggest. That gives frontier providers strong incentive to tighten access, monitoring, and account controls, which is exactly what you're seeing.

Where Does Your Data Actually Go?

"Chinese model" doesn't automatically fix the data path. That framing gets the causality backwards. Deployment fixes the data path. The model runs somewhere.

DeepSeek's first-party privacy policy says personal data is processed and stored in China, and inputs may be used to improve its technology. Alibaba's Model Studio says customer data isn't used for model training and offers deployment scopes that can exclude mainland China. An American third-party host running Qwen weights operates under American jurisdiction. Same model family. Three different data realities.

A properly configured self-hosted model can keep prompts away from the original lab and remove provider-side runtime filters. It doesn't remove refusal behaviour or political bias learned in the weights. Fine-tuning may be needed. Moving weights to your server changes who sees the data. It doesn't automatically make the software supply chain trustworthy.

Self-hosting itself only makes sense when four conditions are all true. Weights are available and the license permits your use. Data sovereignty requirements are real enough to require on-premise. Workload justifies the infrastructure cost. You have a team that can operate the stack safely. Miss any one of those and self-hosting is a project you'll regret twelve months in.

What's the Actual Decision Framework?

Four steps. In order.

Name the job. Bounded volume? Local assistance? Sensitive internal work? Frontier judgment? Don't choose a model before defining acceptable failure modes. Most bad AI decisions I see start here, with an operator picking a model before naming the work.

Name the artifact and deployment. API? Downloadable weights? Promised future release? Which license applies? What does the full model actually require at realistic context length?

Measure cost per accepted result. Include input tokens, output tokens, reasoning, tool calls, retries, latency, infrastructure. Not the sticker price. The finished-work price.

Trace the data and the exit path. Which company receives the prompt? Where is it stored? Governing law? Retention and training terms? And critically, can you move the workflow and preserve prompts, tools, and evaluations if the provider changes?

You don't need a lab to run this. Take 20 real examples from your own operation, including the ugly edge cases you'd normally hide from a demo, run them through a Chinese model, and see what happens. That's the whole test.

What I've Actually Seen Work

The pattern that's working in the operations I watch closely isn't "switch to Chinese models." It's using them as specialists inside a swarm where a frontier American model orchestrates and cheaper models do the reviewable work. Qwen as a swarm agent participant. DeepSeek for high-volume extraction. GLM for coding subtasks. The American frontier model holds the judgment layer.

For bounded, repeatable, high-volume jobs, Chinese models can offer extraordinary value. For ambiguous work requiring intent inference, recovery from surprises, or high-stakes judgment, the strongest American frontier systems remain the baseline to beat. Leading American services often come with more mature tool integrations, enterprise controls, and operational evidence. Chinese offerings often counter with lower prices, more open-weight options, more deployment choice.

Country of origin is the beginning of due diligence. Not a substitute for it.

The operators who'll win the next two years are the ones who stop asking whether to use Chinese models and start asking which model, for which job, on which deployment path, at which cost per accepted result. That's a real question. The other one isn't.

If you're working through this in your own stack and finding a pattern I'm missing, tell me where I'm wrong. I read every reply. And if this is the kind of operator note you want more of, The Operator's AI Brief is where I publish them first.