THE HIDDEN SWITCH — Control the Pipeline Shape the Future

Washington and Beijing built opposite kill switches for AI. Neither control what it thinks it controls.

This reads as the derivative brief of the full-length working paper at: https://medium.com/@patrickgros/the-pipeline-is-the-switch-c0fddb01399f

At 5:21 p.m. on Friday, June 12, the Commerce Department ordered Anthropic to suspend its two most capable AI models for every foreign national on earth. Unable to filter users by nationality in real time, the company shut the models off for everyone, everywhere, within hours. For nineteen days, the most advanced commercial AI systems in the world were dark because one cabinet official signed a letter. Then, on June 30, another letter: the controls were lifted, and the models came back.

Depending on your politics, the episode was either an abuse of export-control authority or the first live proof that the U.S. government can actually switch off frontier AI. Both readings miss what the episode quietly demonstrated about the limits of that switch. During the nineteen days Washington held two American models offline, the Chinese open-weight ecosystem, the model families anyone can download, copy, and run on their own hardware, did not blink. No directive can reach a Qwen checkpoint sitting on a server in Jakarta, because there is no company to send the letter to. The most consequential fact about the June episode is not that the switch worked. It is the size of the world the switch cannot touch, and that world is growing faster than the one it can.

The AI control debate keeps framing this as open versus closed, or as an American-versus-Chinese capability race. It is neither. It is a contest among three incompatible control architectures, each strong exactly where the others are weak, and understanding the contest in those terms changes what the United States should do about it.

The World the Switch Cannot Touch Start with the scale. Sometime in the year ending August 2025, researchers at MIT and Hugging Face found that Chinese open-weight model families had edged past American ones in global download share for the first time, roughly 17 percent to just under 16. The gap has since widened: Alibaba’s Qwen family has overtaken Meta’s Llama in cumulative downloads, and Chinese base models now account for a large share of new fine-tuned derivatives uploaded to the platform. Singapore’s national AI program built its latest regional model on Qwen. Malaysia announced a sovereign AI ecosystem running on DeepSeek. The pricing is structural, not promotional: Chinese frontier-adjacent models run at a fraction of Western API rates, and for a budget-constrained government seeking what the trade press now calls AI sovereignty, open plus cheap is simply the rational procurement answer.

An honest reading requires the qualifier: downloads measure developer experimentation, not deployed inference, and enterprise production workloads in the West still run overwhelmingly on closed American APIs. Anyone treating the Hugging Face numbers as AI-economy market share is overreading them. But that is exactly why they matter. Downloads measure where the next generation of builders is forming its habits and defaults, and defaults are where standards come from. The right analogy is not revenue share; it is which textbook the students are learning from.

Nor is the capability story what it was even a year ago. This spring, an open-weight Chinese model beat a leading American frontier system on a demanding software-engineering benchmark for the first time, and a second Chinese flagship posted a comparable result against another Western system in the same quarter. On aggregate leaderboards the best Chinese models still trail the top Western proprietary systems by mid-single-digit margins, but the gap has compressed faster than nearly every forecast, and it has compressed under export-control conditions that were designed to prevent exactly this. The models being downloaded are no longer merely cheap. They are close.

Three Architectures, Not Two Camps Beijing’s architecture embeds the control in the model weights themselves. Chinese content regulation requires it, and because the leading labs give their models away, compliance is compiled in before release: benchmark research has found the political restrictions embedded at the weights level, equally present across languages, and persistent even when the model runs on local hardware with no connection to any Chinese server. A model downloaded in Lagos carries the regime with it. That is the architecture’s defining property: the control travels.

How deep it travels is the interesting question, because the embedded control is really a stack. The top layer, the model’s trained refusals, is nearly disposable: the research community established that refusal behavior is mediated by a single direction in the model’s activation space, and open-source tooling now strips it from downloaded models in minutes on consumer hardware. But the layer underneath is a different material. What a model was never shown, it cannot recall, and how trillions of training tokens framed the world is not a component that can be unbolted. Researchers who crawled the best-known politically decensored variant of DeepSeek’s R1 still found a residue of state-aligned refusals the fine-tuning never touched. The visible censorship strips easily, which is precisely why the durable censorship underneath it is routinely underestimated. And beneath both sits a third layer that cannot be audited from outside at all: the possibility of conditional behaviors, implanted deliberately or absorbed accidentally, dormant until triggered. Research on so-called sleeper agents has shown that deliberately inserted behaviors can survive the full battery of safety training, and comprehensive detection remains an open problem. Whether any given release contains such implants is unverifiable in either direction, and the unverifiability itself does the strategic work, because it is the property that security reviewers and underwriters cannot get past.

Skeptics will object that a control which strips in minutes is a weak control, and they would be right if the unit of control were the artifact. It is not. Chinese flagship models now iterate every eight to sixteen weeks, and adoption gravity, the enterprise hosting, the sovereign programs, the derivative ecosystem, sits on the official releases, not on community-stripped variants. The stripped copy of version N becomes irrelevant the day version N plus one ships carrying the current embeds, and version N plus one always ships. The control is brittle in the artifact and durable in the cadence, because it never lived in the artifact. It lives in the pipeline. Which also identifies Beijing’s actual kill switch: stop releasing, and the global ecosystem built on your models freezes on stale weights while your domestic frontier moves on.

Washington’s emerging architecture, visible in outline through the June episode and the policy apparatus assembling around it, locates control in infrastructure instead: attestation in training silicon, cryptographic custody of weights, controls at hosted endpoints, enforcement where model outputs become consequential actions. Inside its perimeter, June proved it works: inference halted, custody maintained, deployment suspended and restored through a process, on a closed, hosted, jurisdiction-resident model. But run the same layers against a downloaded Chinese checkpoint and three of the four fail on contact. There is nothing to seal once weights are a public download; endpoint controls are bypassed by anyone with a rented cluster; action-layer gates bind volunteers. Only the silicon layer survives, governing the training of future models, and even that survival is now conditional: Chinese labs have trained frontier-class models entirely on domestic Huawei silicon, outside any attestation regime anchored in American and allied chips. That achievement deserves precision. It is existential proof that training outside the perimeter is possible, not yet evidence that it is economical at scale, and reports of training delays traced to domestic chip bottlenecks cut the other way. But a perimeter a determined rival can exit at any price is a perimeter, not a wall. The deeper lesson was taught in the encryption export fights of the 1990s: controls built for physical, traceable objects fail against copiable digital artifacts. Model weights are encryption, not centrifuges.

The third architecture is usually discussed as fiscal policy, which is the misreading. The proposals circulating through 2026 to entangle the federal government with frontier labs, through equity stakes, golden shares, and governance rights, are a control architecture: they place the switch in the capitalization table, on the theory that control of the corporation is control of the model. The theory has one genuine strength the others lack, reach upstream into decisions about what to train and release before any weights exist. Everything else fails the same tests: an equity position cannot halt inference on a distributed model, cannot invalidate weights it never held, cannot reach a foreign pipeline at all, and its control dilutes with every financing round.

Scoring the Three Against a Common Standard Claims about control deserve a common standard. A functional kill switch decomposes into four capabilities: halting inference, invalidating weights, preventing retraining, and revoking deployment. Scored honestly, including against the architecture Washington is building, the exercise produces twelve cells and one unmistakable pattern.

Read by row, the table forecloses an entire genre of policy argument, the genre that demands one architecture perform another’s cell. Calls to ban Chinese models demand that jurisdiction-bound infrastructure control reach copies it can never touch. Confidence that embedded censorship neuters Chinese models is a bet on the one layer of that stack that strips in minutes. Faith that government equity secures the frontier mistakes the boardroom for the runtime. And note the row where every architecture posts its best score, deployment revocation: each wins it only in its home terrain, and the two affirmative cells describe different powers, Beijing’s prospective, denying the next release, Washington’s contemporaneous, suspending what is already running. No achievable increment of effort makes any architecture sweep the board, and every cell any of them does win, it wins at the pipeline level, never the artifact level.

The Pipeline Principle That regularity deserves stating as a principle: in this domain, control of artifacts is unavailable, and control of pipelines is the only control there is. Beijing’s embeds renew per release. Washington’s attestation renews per chip generation, its custody per sealed release; the June episode was the suspension of an ongoing service, not the seizure of an object. Even equity control renews per financing round. Nothing holds still long enough to be controlled as a thing. Two corollaries follow. Blocking a pipeline is not controlling it; a blocked pipeline reroutes, and the rerouting has already happened once at the layer that matters most, when export controls on training silicon produced, within three years, frontier training on domestic Chinese chips. And pipelines are not blocked but out-competed, on quality, price, and trust. You do not control a pipeline by blocking it. You control it by fielding a better one, where better means the one thing the rival pipeline is structurally incapable of producing.

What the Rival Pipeline Cannot Make That thing is verifiable provenance. A March report for the U.S.-China Economic and Security Review Commission warned that dependency on Chinese base models with embedded characteristics is compounding, and a substantial population of Western enterprises already cannot use Chinese weights at all, because nothing about their training, custody, or evaluation can be independently verified, and the governing statutes ensure it: China’s data-security and state-secrets regime forecloses the independent third-party audit access that confidential certification requires. An auditor operating under state supervision is not independent in any sense a Western procurement officer or insurance underwriter can recognize.

The constructive program that follows from the analysis, developed in full in the underlying working paper, has three parts, sketched here because the architecture matters more than the mechanics. A provenance standard for models on the template that made the software bill of materials real after 2021: training-compute attestation receipts, weight custody chains, data lineage commitments, and evaluation attestations, verified through cryptographic commitment and independent audit rather than disclosure. Enforcement through markets rather than mandates, the way trust standards actually propagate: procurement conditioning on the FedRAMP pattern, supervisory guidance on the model-risk template banking already lives under, development-finance conditionality abroad, and insurance, where carriers already writing AI exclusions will eventually sell coverage back through carve-backs conditioned on demonstrable controls, exactly as they did with cyber. And a supply side, because standards succeed when paired with attractive products: a sustained American cadence of attested open-weight models, so that the sovereignty-seeking buyer choosing between open-plus-cheap and closed-plus-trustworthy is finally offered open, affordable, and verifiable at once. The aviation industry has run this play for decades: parts of unknown provenance are excluded from airframes not because certified parts are always better, but because unattributable failure is intolerable in that market. Finance, medicine, and government share the property, and they have just acquired a new kind of component.

None of this suppresses the Chinese pipeline, and the honest version of the program does not claim to. Standards contests rarely end in dominance; they end in competing ecosystems, and the realistic ambition is bifurcation with a favorable boundary, the high-value regulated markets inside, the boundary contested outward one sovereign procurement decision at a time. That is not checkmate. It is position.

Whose Pipeline Beijing’s switch does not live in any model, and Washington’s will not live in any chip. Both live in pipelines: recurring, institutional, renewable, and competing for the position of default foundation for everyone now building. The United States spent three years trying to control the artifact and watched the artifact multiply. Its actual advantage was never the ability to stop a rival from shipping. It is that American-aligned markets still decide what shipping is worth, and they have always paid a premium for the one property this rival pipeline cannot manufacture: the ability to prove what a thing is. The June episode showed the switch Washington built. The question that should organize the next three years is the one it cannot reach: whose pipeline the world builds on.