Nathan Lambert Harvard lecture: Chinese open-source models are fully ahead; US compute advantage is about 16x

Nathan Lambert Harvard lecture: a full picture of the state of open models, China leads across the board in open source, but the US has more than a 10x compute advantage; distillation is not the key issue

@natolambert in a guest lecture for Harvard's CS 2881R "AI Security" course, he argues: open models lag the closed-source frontier by about 3 to 5 months, and the gap is still narrowing. On performance, downloads, and paper citations, Chinese open models lead across the board, and US open models in turn lag China by 3 to 4 months. There are three core judgments: treating "distillation" as the core issue is an overestimate; America's truly durable advantage is compute; banning open source would only harm economic activity and would not stop bad actors. https://t.co/GpErvGTR0w

What counts as an open model: the license is key · Open source is a spectrum: from releasing only the weights (Llama, Qwen, DeepSeek, Kimi, GLM), to fully open source with data and code released as well (OLMo, Pythia, SmolLM, Marin), with Nemotron in between. · Permissive licenses: MIT (DeepSeek, GLM-5.2, MiMo), Apache 2.0 (Qwen, gpt-oss, Gemma 4). · Custom licenses with additional conditions are not really open source: revenue thresholds (Kimi K3, Muse Spark Open, and MiniMax M3 have an annual revenue threshold of $20 million; GLM-5.3 requires a security review above $10 billion), branding requirements, usage restrictions. Most of these clauses have not yet been tested in court.

Why open source: support for open source comes from several directions: capital (turning complements into cheap commodities), research and education, preventing concentration of power, and freedom. In Bill Gurley's phrase, open source is also "the natural choice of the second place," used to grab market share and distribution channels and to gain soft power. Chinese labs collectively going open source is about gaining a presence in the Western AI world; after DeepSeek R1, Xiaomi, Meituan, Ant, and others also entered the field. Companies use open models to "own their own model," for example Harvey doing legal-domain post-training on Kimi K3, with the overall pass rate nearly doubling at essentially unchanged cost.

Competitiveness · In 2026, anything under 1T parameters counts as a "small model." Recent strong models: Xiaomi MiMo-V2.6-Pro (1T total parameters, 42B active, Artificial Analysis index 46), DeepSeek V4.1 Flash (763B, 45), MiniMax M3.1 Flash (42, with third-party evaluations below the official claims). · On "gaming the benchmarks": Chinese models do place more emphasis on public leaderboards, and their long-tail capabilities are less comprehensive than US models. But he spent half a year and still could not find an analysis demonstrating clear flaws in the leading open models (Kimi, GLM, DeepSeek). · Open models still anchor the best value-for-money range, though closed-source vendors are now competing in that range too.

The distillation debate (the most opinionated part of the whole piece) · Training has three stages: pre-training, mid-training and SFT, and reinforcement learning. Distillation mainly happens in the SFT stage, and reinforcement learning now consumes more compute than pre-training. · What is called "distillation" now is really adversarial distillation: finding ways to extract hidden reasoning traces from APIs. Many Chinese labs have dedicated teams doing this. · He argues it is not worth making this the focus: public research does not show that SFT on reasoning traces brings huge gains; there is no good policy lever that targets only China without harming the global open-source ecosystem; Chinese labs are strong in their own right, and "fast-following" is inherently cheaper in compute than pioneering the frontier. Xiaomi publicly livestreamed the reinforcement learning training of MiMo-V2.6 (about 1.5 million rollouts, costing $3.47 million), which is evidence of not relying on distillation alone. · The truly durable advantage is compute: the combined compute of the top five US labs averages 16 times that of the top five Chinese labs; by the end of 2026, Anthropic and OpenAI will each have more than 5 GW of compute, while the leading Chinese labs will have at most 100 to 200 MW.

Usage: inference volume for open models is growing rapidly, and local model downloads are accelerating; Hugging Face has about 600,000 daily unique users. When performance is similar, adoption of US models is 2 to 5 times that of Chinese models, showing there is market demand for US open models. He scanned 370,000 arXiv papers, and Qwen is now mentioned nearly as often as OpenAI's GPT. The summary is: China leads on performance, downloads, and research, and the inference and post-training markets are also mainly Chinese models.

Risks and governance · AI-driven cyberattacks are already happening, and the publicly known cases so far mainly involve misuse of closed models (Claude Code, Codex). · Banning open models is not realistically achievable (the US cannot build an effective "firewall"), and more than a dozen labs can train models at roughly the frontier level of about a year ago; the result would only be to suppress economic activity. Many claims about open-source risk are exaggerated (such as disinformation), but risks like deepfakes are indeed being accelerated. · Recommendation: releasers should assess the "additional risk" of each individual model, with a national unified risk standard, rather than letting each company judge for itself. Open models are crucial for cyber defense, because companies' trusted access programs cannot cover the whole economy.