Nathan Lambert's Harvard lecture: a survey of the open-model landscape. China leads open source across the board, but the US has more than 10x the compute advantage; distillation is not the key issue
Guest lecture by @natolambert at Harvard CS 2881R "AI Safety." His view: open models trail the closed frontier by roughly 3 to 5 months, and the gap is still shrinking. On performance, downloads, and paper citations, Chinese open models lead across the board, while US open models trail Chinese ones by 3 to 4 months. He makes three core arguments: treating "distillation" as the core problem overstates its importance; the US's lasting advantage is compute; and banning open source would only harm economic activity without stopping bad actors.
https://natolambert.com/slides/2026/harvard/lecture.html
What open-source models are, and why licenses are key
· Openness is a spectrum: from open-weights only (Llama, Qwen, DeepSeek, Kimi, GLM), to fully open, which also releases data and code (OLMo, Pythia, SmolLM, Marin). Nemotron sits in between.
· Permissive licenses: MIT (DeepSeek, GLM-5.2, MiMo), Apache 2.0 (Qwen, gpt-oss, Gemma 4).
· Custom licenses with added conditions don't count as open source: revenue thresholds (Kimi K3, Muse Spark Open, and MiniMax M3 have an annual revenue threshold of $20 million; GLM-5.3 requires a safety review above $10 billion), brand attribution requirements, and use restrictions. Most of these terms have not yet been tested in court.
Why open source
The case for open source draws on several forces: capital (turning complements into cheap commodities), research and education, preventing concentration of power, and freedom. In Bill Gurley's framing, open source is also the "natural choice of the second place," used to win market share and distribution channels and to gain soft power. Chinese labs have collectively moved toward open source to gain visibility in Western AI circles; after DeepSeek R1, companies like Xiaomi, Meituan, and Ant also entered. Enterprises use open models to "own their own model": for example, Harvey did legal-domain post-training on Kimi K3, nearly doubling its pass rates at roughly the same cost.
Competitiveness
· In 2026, anything under 1T parameters counts as a "small model." Recent strong models: Xiaomi MiMo-V2.6-Pro (1T total parameters, 42B active, Artificial Analysis index 46), DeepSeek V4.1 Flash (763B, 45), MiniMax M3.1 Flash (42, below its official marketing claims in third-party evaluations).
· On "benchmark gaming": Chinese models do place more weight on public leaderboards, and their long-tail capabilities are less comprehensive than US models'. But after spending six months looking, he found no analysis demonstrating clear deficiencies in the leading open models (Kimi, GLM, DeepSeek).
· Open models still anchor the price-performance sweet spot, though closed vendors are now competing in that range too.
The distillation debate (the most opinionated part of the lecture)
· Training has three stages: pretraining, mid-training and SFT, and reinforcement learning. Distillation mainly happens in the SFT stage, and RL now consumes more compute than pretraining.
· What people call "distillation" today is really adversarial distillation: finding ways to extract hidden reasoning processes through APIs. Many Chinese labs have dedicated teams doing this.
· He argues it isn't worth making the focus: public research doesn't show that SFT on reasoning traces yields huge gains; there is no good policy tool that targets China alone without harming the global open ecosystem; and Chinese labs are already strong, and "fast following" is inherently less compute-intensive than pushing the frontier. Xiaomi's public livestream of MiMo-V2.6's RL training (about 1.5 million rollouts, costing $3.47 million) is evidence that they don't rely on distillation alone.
· The lasting advantage is compute: the combined compute of the top five US labs averages 16 times that of the top five Chinese labs. By the end of 2026, Anthropic and OpenAI will each have more than 5 GW of compute, while the top Chinese labs have at most 100 to 200 MW.
Usage
Inference volume for open models is growing rapidly, and local model downloads are accelerating; Hugging Face sees about 600,000 unique daily users. At similar performance levels, US models are adopted 2 to 5 times more than Chinese models, suggesting market demand for US open models. He scanned 370,000 arXiv papers, and Qwen is now mentioned nearly as often as OpenAI's GPT. The summary: China leads on performance, downloads, and research, and Chinese models also dominate the inference and post-training markets.
Risks and governance
· AI-driven cyberattacks have already happened, and the publicly documented cases mostly involve closed models (Claude Code, Codex) being misused.
· Banning open models is infeasible in practice (the US could never build an effective "firewall"), and more than a dozen labs can train models at roughly the one-year-behind frontier, so a ban would only suppress economic activity. Many claims about open-source risks are exaggerated (such as disinformation), but risks like deepfakes have indeed been accelerated.
· Recommendation: developers should assess the "marginal risk" of each model, with a national standard for risk rather than leaving each company to judge for itself. Open models are critical for cyber defense, because companies' trusted-access programs cannot cover the entire economy.