Are Chinese Models Safe?
Most conversations I have these days about Chinese AI models circle back to the same worry, and it comes from people you'd expect to be hard to rattle: R&D teams and people who train their own machine-learning models for a living. The concern usually comes from one of their non-technical stakeholders, but it has nothing to do with accuracy or latency. It's the fear that using an open language model from China might somehow be handing something over: data, control, a foothold.
The economic case for those models is strong enough that they want to use them, and the fear is strong enough that they are stuck.
I understand the instinct. I also think most of the fear is aimed at the wrong thing, and it's worth discussing in detail, because there are some nuances.
What are you actually afraid of?
The first fear is that your data ends up in China. If you call DeepSeek's own hosted API, that's a fair worry. You're sending your context and prompts to a service, and where they go after that is out of your hands. But an open model is, near enough, a file you download - weights plus the inference code wrapped around them. You can run DeepSeek or Qwen or Kimi inside your own Azure, AWS or Google account, or on your own servers with no internet connection at all, and nothing will go back to the Chinese company that made it. AWS will sell you DeepSeek on Bedrock, and depending on which model and which region, you can keep the traffic in-region. The data-to-China problem is therefore a deployment choice rather than a fact about the model, and a different deployment configuration makes it disappear.
The second fear is the interesting one: that the model itself is compromised, that there's a hidden trigger, a Manchurian-candidate word, that flips it into doing something malicious. I used to wave this away, and I was too quick about it. Anthropic published a study called "Sleeper Agents" (Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training \ Anthropic) showing you can train a model to behave normally until it sees a specific trigger, then write sabotaged code, and that the backdoor survives the usual safety training. So, it isn't science fiction. But look at what it actually takes. Someone has to deliberately build it, plant it, and for the model to leak anything or take instructions from outside, it needs a way out. A model you host yourself, with no path to the internet, can't call anyone. The realistic version of this threat is narrow, and it's a reason to evaluate the models you run, but not a reason to treat every open weight model as a bomb.
The fear you should have: bias
Here's the fear people should have and mostly don't: bias. This part is real and it's measured. DeepSeek will deflect on Tiananmen Square, frame Taiwan in Beijing's terms, and steer around words like "democracy" and "human rights." Taiwan's own National Security Bureau found exactly this in the content these models generate (China's AI models pose risks, NSB says - Taipei Times), and independent studies have reproduced it. The model has opinions, and they aren't neutral. It isn't only politics. CrowdStrike found DeepSeek-R1's rate of severely vulnerable code jumped nearly 50% when the prompt mentioned Tibet - a word with no bearing on the coding task. So the question is whether user-supplied strings can put a sensitive term in front of the model, and what the destination is of the output. A ticket router qualifies. A PDF field extractor probably doesn't. Safety here therefore isn't the property of the model, but the property of the model for a use case. Ask what the model is doing, not where it was born.
Once you've threat-modeled it that way, the reason those data scientists wanted these models in the first place comes back into view. They're a serious deal.
The obvious place to start is price. You pay no license fee, because you're running downloaded weights instead of renting a service, and nobody can reprice it on you later, because you're the one holding it. Or DeepSeek will run V4 Pro for you at $0.66 per million input tokens and $1.98 output off-peak, double that during two daily peak windows that land inside the European working day. The equivalent for Claude Opus 5 is $5 and $25 - seven to thirteen times cheaper off-peak, roughly four to six at peak. On high-volume work, that can be the difference between a viable project and a non-viable one.
Then privacy, which is a bit of a head scratcher. The models people fear on privacy grounds are the ones that, given the right deployment configuration, give you the most control over your data. You hold the weights, so you decide where they run: your cloud account, your own hardware, an air-gapped box in a regulated environment. OpenAI's smaller open models aside, Anthropic and OpenAI will not put their frontier weights on a machine in your data center. For a bank or a hospital, that difference is sometimes what forces the whole decision.
And most work doesn't need the smartest model on the market. In one case, we moved a client's workloads off the top Anthropic model onto a cheaper one that gave similar output on their tasks, and their bill dropped by about half. Open weights give you far more room to run that exercise, because you can put a small model on the routine work and keep a frontier model only for the cases that earn it.
So the question in the title is missing the mark. "Are Chinese models safe" has no single answer, because safety isn't a property a model carries around with it. A more useful question is whether a specific model is safe for a specific job, run in a specific way. For a lot of jobs the honest answer is yes, and at a fraction of what you're paying for the heavyweight models on the benchmark podium. Left unexamined, the fear itself does more damage to your budget than the model could ever do.
.png)