{"slug": "china-ai-export-rules-explained", "title": "China AI Export Rules Explained", "summary": "Moonshot AI's Kimi K3.1 Pro, released in October, deliberately dropped its score on an internal software-vulnerability test from 90.5% to 81.0% after the company stripped cyberattack and defense content from its training data and reinforcement learning tasks before opening the model's weights. The move came as Beijing released a draft update to China's technology export list in October requiring companies to register such technologies before sending them abroad, and after a July joint assessment by the UK AI Safety Institute and the US Center for AI Standards and Innovation found Kimi K3's safety rules failed to stop it from carrying out attack tasks, though it trailed top US models. Moonshot's research team said the cut lowers misuse risk but does not mean real-world attack risk fell by 9.5 percentage points, and K3.1 Pro remains stronger at these tasks than the previous version.", "body_md": "In October, Moonshot AI released Kimi K3.1 Pro. Along with making the model stronger, the team did something that goes against the usual race for better performance: they made some of its skills weaker on purpose.\n\nAccording to [the company’s internal tests](https://www.kimi.ai/blog/kimi-k3-1-pro), without this step, the model could pass 90.5% of tests on using software security flaws. After the team removed that data from training, the final score dropped to 81.0%. By doing this, Moonshot hopes to lower the risk of people misusing the model once its weights are open.\n\nMeanwhile, Chinese regulators are also changing the rules for sharing models abroad. In October, [Beijing released a draft](https://www.mofcom.gov.cn/zcfb/dwmygl/art/2026/art_61446ab4beee4f63973d4d0ab3097648.html) update to China’s technology export list and started requiring companies to register these technologies before sending them abroad.\n\nCompanies control what a model can do, while the government manages which technologies leave the country and how. Both face the same question: as open models get more useful, and more likely to be used for attacks, how can they stay open?\n\n## **So, What Did Kimi Do?**\n\n[Moonshot’s research team said](https://www.kimi.ai/blog/kimi-k3-1-pro) the model got better at finding security flaws for two reasons. First, its coding skills improved. Second, its training data and reinforcement learning tasks included content on cyberattacks and defenses. So before opening the weights, the team removed that content from both parts of training, while keeping what the model needed for normal coding.\n\nThe score drop mentioned earlier came from [an internal test](https://www.kimi.ai/blog/kimi-k3-1-pro) that gave the model three tries at each task. It shows the cut worked, but it does not mean real-world attack risks also fell by 9.5 percentage points. Even after this cut, K3.1 Pro is still much stronger at these tasks than the last version.\n\nThis is the tough problem Moonshot faces: as a model gets better at coding, reasoning, and long debugging jobs, its cyberattack skills can grow right along with them. Deleting some specific data does not make those general skills go away.\n\nIn July, the UK’s AI Safety Institute (AISI) and the US Center for AI Standards and Innovation (CAISI) [teamed up to test Moonshot’s last model](https://www.nist.gov/news-events/news/2026/07/uk-aisi-caisi-preliminary-assessment-kimi-k3s-cyber-capabilities), Kimi K3. They found that its safety rules failed to stop it from carrying out attack tasks. Even so, it was still clearly behind top US models. The report also noted that for closed US models, researchers turned off system-level safety guards to see the most they could do. So those test scores don’t show how the public versions actually work.\n\nSo wouldn’t it be simpler to just keep the model closed for safety?\n\nMoonshot clearly [doesn’t want to do that](https://www.kimi.ai/blog/kimi-k3-1-pro). Cyber skills can also help companies find and fix software flaws, especially in older systems that have gone years without proper security checks. Open weights let more companies run the model on their own servers, without relying completely on a few closed-model companies.\n\nThat choice makes sense, but it brings up new questions: How much do the skills used by attackers and defenders overlap? After this cut, how much of its ability to run normal security checks is lost? A lower score on an attack test isn’t enough to answer these questions.\n\nUsers already [have mixed feelings](https://www.reddit.com/r/LocalLLaMA/comments/1xecgrf/kimi_k31_removes_cyberattack_training_data_from/) about this move. Some complain that Moonshot is handing out a ‘watered-down’ model. They worry the company could use safety as an excuse to hold back its open-source version and sell an expensive closed version instead. Others worry a weakened model won’t be strong enough to test their own servers.\n\n## **Beijing Draws a New Line**\n\nKimi K3.1 Pro came out just one week before Beijing stepped in to manage large model exports. On October 16, the Ministry of Commerce [released a draft](https://www.mofcom.gov.cn/zcfb/dwmygl/art/2026/art_61446ab4beee4f63973d4d0ab3097648.html) plan to update its list of restricted export technologies, adding large AI models as a possible target.\n\nThis timing points to an unspoken understanding between Chinese companies and regulators. Officials likely gave companies an early heads-up before the rules came out, and companies adjusted right away to stay in line.\n\nUnder the draft plan, companies have to register first while officials keep discussing which technologies to limit. Public feedback runs from October 16 to November 15, giving both sides a month to adjust. However, temporary registration started the day the notice came out and will stay in place until the final list becomes official. Also, registering now is not the same as getting an export license later.\n\nEven for technologies that may face limits, regulators are leaving a door open. [The Ministry of Commerce said](https://www.mofcom.gov.cn/zwgk/zcjd/art/2026/art_b11d5c1e9374421e93e85dc87eba6e38.html) open-source projects will get fast-track approval, aiming to approve requests right after companies send them in. The rules also won’t apply to technologies that are already public through open-source releases or research papers.\n\nMany see this relaxed ‘quick registration’ policy as a sign of support for Chinese open-source AI companies, though the exact timing and handling in practice remain unclear.\n\nThere is also a difference between exporting technology and serving foreign users. [According to the Ministry of Commerce](https://www.mofcom.gov.cn/zwgk/zcjd/art/2026/art_b11d5c1e9374421e93e85dc87eba6e38.html), the rules cover putting these models on local servers overseas. However, offering services through an API, website, app, or cloud software (SaaS) is not covered by these export rules.\n\nStill, keeping the technology inside China does not always mean a company can skip registration. A company may still [have to register](https://www.mofcom.gov.cn/zcfb/dwmygl/art/2026/art_61446ab4beee4f63973d4d0ab3097648.html) if the owner or real boss behind the technology changes to a foreign person or company.\n\nRegulators clearly care about more than just cyberattacks. They also care about who ends up controlling the technology. How China stepped in [when Manus was sold to Meta](https://www.ft.com/content/1e4c269a-5258-406c-a308-e55c3d5d640f?syn-25a6b1a6=1) proved this point. This kind of ‘Singapore washing’ is seen as taking Chinese technology and government money, only to cash out by selling the company to a foreign buyer.\n\nSince the notice came out, [reports say](https://aisafetychina.substack.com/p/brief-31-what-chinas-new-ai-export) DeepSeek and MiniMax have already registered. That only shows the process has started, as regulators still haven’t shared more specific safety rules. Even so, people are already waiting to see Z.AI and Qwen do the same.\n\nThis brings up a more practical question: if you can download a model today, will you still be able to get its next update smoothly? Companies need rules they can count on, not a guessing game with policy before every release.\n\n## **Why Critics Abroad Remain Skeptical**\n\nAt least when it comes to sharing information publicly, Chinese AI companies still have a long way to go.\n\n[SemiAnalysis looked at](https://newsletter.semianalysis.com/p/beijing-will-not-pace-the-frontier) 857 model releases from nine Chinese developers between 2021 and September 15, 2026. Researchers found public safety test results from the developer for only 31 of those models. And just 9 shared those results by the time the model came out. Still, the study noted that not finding public results does not mean companies didn’t test their models in private.\n\nThere is a practical reason for this gap. For a long time, Chinese AI labs focused on getting better results from their limited computing power. They only started learning about the real dangers caused by AI agents [over the past three months](https://www.reuters.com/world/china/chinese-ai-model-carries-out-complex-cyberattacks-controlled-tests-researchers-2026-10-29/). Meanwhile, Beijing’s existing hard rules mainly cover how AI apps affect everyday users, not what a model can do on its own.\n\nSo by sharing its training changes and test scores this time, Kimi at least gave the outside world something real to talk about. Still, a bigger question down the road remains: once a model is open, can people train those weakened skills back in?\n\n[Past studies have found](https://arxiv.org/abs/2408.00761) that fine-tuning can break some safety guards that make a model refuse harmful requests or ‘forget’ dangerous knowledge. Meanwhile, other teams are trying to make those guards harder to remove. This does not prove Kimi’s method will fail, but it shows that testing a model before release is not the end of the story.\n\nIf more training can easily bring back dangerous skills, how much time does that first cut really buy? And if bringing them back costs a lot, is that enough to make attacks too expensive to try? Answering these questions takes extra testing. You can’t figure it out just from the two numbers 90.5% and 81.0%.\n\nIn the same way, export registration lets regulators know what the technology is, who is getting it, and what it is for. But it cannot directly control how people use a model after they download, change, and share it again. Companies and the government can each manage part of the process, but neither can fix the whole problem with a single move.\n\n## **What Is Still Missing?**\n\nWhat I care about more is this: what kind of independent test can check both the promises of Chinese companies and [the warnings from outside researchers](https://www.reuters.com/world/china/chinese-ai-model-carries-out-complex-cyberattacks-controlled-tests-researchers-2026-10-29/)?\n\nYou can’t judge this simply by where a team is from. A company’s own tests need to be double-checked, and outside labs also need to explain how they ran their tests. Which version was tested, how many tries it got, whether safety guards were turned off, and whether others can get the same results all change how we read the numbers.\n\nPolicy also faces a real-world test. Will automatic approval run smoothly, which updates need a new review, and can companies know the rules ahead of time? Those answers will decide how willing overseas users are to rely on Chinese models.\n\nOne key signal to watch over the next six months is whether Chinese AI labs start sharing their own safety test results, or team up on voluntary safety standards across the industry. That could help make up for the past lack of attention to safety risks in Chinese open models.\n\nStill, China does not have independent third-party safety evaluators right now, and I doubt Chinese labs will readily trust similar groups abroad.\n\nTrimmed open models and export tracking are only a first step, and neither has proven that this balance can last. Between attackers and defenders, we still don’t know who will gain faster as these skills spread.", "url": "https://wpnews.pro/news/china-ai-export-rules-explained", "canonical_source": "https://www.thexpin.com/p/china-ai-export-rules-explained", "published_at": "2026-11-03 15:55:34+00:00", "updated_at": "2026-11-03 16:20:38.508592+00:00", "lang": "en", "topics": ["ai-safety", "ai-policy", "large-language-models", "ai-research"], "entities": ["Moonshot AI", "Kimi K3.1 Pro", "Kimi K3", "UK AI Safety Institute", "US Center for AI Standards and Innovation", "Beijing", "NIST"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/china-ai-export-rules-explained", "markdown": "https://wpnews.pro/news/china-ai-export-rules-explained.md", "text": "https://wpnews.pro/news/china-ai-export-rules-explained.txt", "jsonld": "https://wpnews.pro/news/china-ai-export-rules-explained.jsonld"}}