The architecture of China-U.S. technology controls was built for things that arrive in shipping containers, not for software. That is becoming the most consequential fact in the bilateral technology relationship. U.S. President Donald Trump’s May 14 state visit to Beijing will offer an early test of whether either government has begun to reckon with this gap.
For three years, the policy debate has run on a hardware-centered logic that even its critics have largely accepted. Lithography systems, GPU servers, and packaging equipment can be licensed, denied, traced, and counted. The Bureau of Industry and Security maintains entity lists. U.S. allies like the Netherlands and Japan coordinate parallel restrictions. Customs officials in Singapore and Kuala Lumpur look for diverted shipments. The regime is imperfect, but it is a regime.
Frontier AI capability is increasingly diffusing through channels this regime does not address. Application programming interface queries, open-weight model releases, synthetic datasets, and published research now move capability across borders without anyone passing through customs. The technical name for one important version of this problem is model distillation. It belongs near the top of any serious conversation about where China-U.S. technology diplomacy is headed.
Distillation is neither new nor sinister. Geoffrey Hinton and his Google co-authors formalized it in 2015 as a way to compress the behavior of a large “teacher” model into a smaller, cheaper “student” trained on the teacher’s outputs. A decade later it is foundational to commercial AI deployment everywhere. Apple distills models for iPhones. OpenAI distills for its consumer tier. DeepSeek, Alibaba, and Meta release distilled versions of their own models to the open-source community.
What has changed is the availability of teachers. When the most capable AI systems in the world are accessible through a paid API to anyone with a credit card, the practical distance between watching a model’s outputs and absorbing a meaningful slice of its capabilities into a new model becomes a function of query volume, engineering skill, and patience. None of those inputs is restricted; they cannot be blocked at a border.
Recent months have given Washington a vocabulary to talk about this. In February, Anthropic published a technical disclosure describing what it characterized as large-scale extraction campaigns by three Chinese laboratories – DeepSeek, Moonshot AI, and MiniMax – through tens of thousands of fraudulent accounts. OpenAI made a parallel submission to the House Select Committee on the Chinese Communist Party. In April, the White House Office of Science and Technology Policy issued a memorandum accusing foreign entities “principally based in China” of running “industrial-scale campaigns” against U.S. frontier systems. Days later, the Wall Street Journal reported that Treasury Secretary Scott Bessent is preparing what would be the first formal China-U.S. AI dialogue under the Trump administration, with the topic potentially on the agenda for Beijing.
These developments are easy to read as an indictment, and that is roughly how much of the U.S. debate has framed them. The more useful reading is structural. Hardware export controls work because the controlled artifact is physical and expensive. A high-bandwidth memory stack costs millions of dollars and weighs measurably more than zero. Distillation operates outside those parameters. It rides routine traffic. It uses synthetic data shipped as ordinary files. It builds on open weights that, once published, cannot be withdrawn. The recipes themselves diffuse through arXiv within hours of release.
Beijing’s position is equally rational on its own terms. Chinese laboratories cut off from the most advanced U.S. chips have made compute frugality a competitive moat. DeepSeek’s Multi-Head Latent Attention, Moonshot’s MuonClip optimizer, and MiniMax’s Lightning Attention are genuine architectural contributions now adopted by Western open-source projects. The August 2025 State Council opinion on the “AI+ Action” treats diffusion across the economy, not raw model benchmarks, as the principal metric of national success. Stanford HAI’s 2026 AI Index puts the gap between the leading American and Chinese systems on Chatbot Arena at 2.7 percent, achieved on roughly 1/23 the private investment. China’s AI ecosystem has learned, by necessity and by design, to do more with less.
What can the two governments realistically negotiate about any of this? Less than the headlines about a “first AI dialogue” suggest, and that may be a feature rather than a bug. The most plausible deliverable from Beijing is a re-affirmation of the November 2024 Lima principle that humans, not AI systems, should retain control over decisions to use nuclear weapons. It costs both leaders nothing and gives both a usable communiqué line. The next most plausible is gestural language on intellectual-property protection, woven into the broader trade truce extended at Busan. Anything more ambitious – a verifiable distillation accord, a mutual API-access regime, or agreed standards on watermarking and model evaluations – runs immediately into the verification problem that has haunted every cyber-era confidence-building measure since the 2015 Obama-Xi accord on cyber-economic-espionage.
The more interesting story is happening away from the principals. The Frontier Model Forum’s reported information-sharing arrangement on extraction attacks, the technical cooperation between Concordia AI in Beijing and U.S. AI safety researchers, the Singapore Consensus on Global AI Safety Research Priorities co-signed by Chinese and Western scientists in April 2025, and the testing protocols emerging from the AI Safety Institute (AISI) Network all constitute the substantive scaffolding the leader-level meeting will, at best, gesture toward.
For Asia-Pacific governments now building their own AI policies, the relevant question is which of these scaffolds will set the standards their domestic firms have to meet. Japan, South Korea, Singapore, and Australia are active members of the AISI Network. India hosted the most recent global summit. Southeast Asian governments are recipients of Chinese open-weight models running on Huawei Ascend infrastructure. The contours of any future distillation regime will be set as much by what these countries adopt as by what Washington and Beijing agree.
The hardware-centric debate of the past three years was animated by a conviction that compute is destiny, that controlling the chips controls the AI. That conviction is not wrong, but it is incomplete in a way the events of 2025 and 2026 have made hard to ignore. Capability now propagates through software, and software is not what export-control architectures were built to govern. The Beijing summit is unlikely to produce more than acknowledgment of this. But acknowledgment, after three years of debate that has largely refused it, is itself a beginning.