# Nathan Lambert's Harvard lecture says Chinese open models lead but the US has far more compute

> Original title: Nathan Lambert 哈佛讲座：开源模型现状全景，中国开源全面领先，但美国有 10 倍以上的算力优势；蒸馏不是关键问题

- Source: meng shao
- Published: 2026-10-22T02:17:11.000Z
- Bad Influence: https://badinfluence.news/items/yfk86bzvvk1uczza7ir47x329
- Original: https://x.com/shao__meng/status/2113092271503818988

## Summary

Nathan Lambert, in a guest lecture at Harvard's CS 2881R, says open models trail closed frontier models by about 3 to 5 months. He argues Chinese open models lead on performance, downloads, and paper citations, while US compute is more than 10 times larger. He says distillation is not the key issue, and that banning open models would harm economic activity without stopping bad actors.

## Why it matters

The lecture gives a structured view of open model licensing, competitiveness, distillation, and compute gaps, with figures to compare against other assessments of the field.

## Post

Nathan Lambert 哈佛讲座：开源模型现状全景，中国开源全面领先，但美国有 10 倍以上的算力优势；蒸馏不是关键问题

@natolambert 在哈佛大学 CS 2881R「AI 安全」的客座讲座，他认为：开源模型落后闭源前沿大约 3 到 5 个月，差距还在缩小。性能、下载量、论文引用这三方面，中国开源模型全面领先，美国开源模型又比中国落后 3 到 4 个月。核心判断有三点：把"蒸馏"当成核心问题是高估了；美国真正持久的优势是算力；禁止开源只会损害经济活动，挡不住坏人。
https://natolambert.com/slides/2026/harvard/lecture.html

什么是开源模型，许可证是关键
· 开源是一个光谱：从只开放权重（Llama、Qwen、DeepSeek、Kimi、GLM），到连数据和代码都开放的完全开源（OLMo、Pythia、SmolLM、Marin），Nemotron 处在中间。
· 宽松许可证：MIT（DeepSeek、GLM-5.2、MiMo），Apache 2.0（Qwen、gpt-oss、Gemma 4）。
· 自定义许可证带附加条件，并不算开源：营收门槛（Kimi K3、Muse Spark Open、MiniMax M3 的年营收门槛是 2000 万美元，GLM-5.3 超过 100 亿美元要做安全审查）、品牌露出要求、使用限制。这些条款大多还没有在法庭上检验过。

为什么要开源
支持开源的力量来自几个方向：资本（把互补品变成廉价商品）、科研和教育、防止权力集中、自由。按 Bill Gurley 的说法，开源也是"第二名的自然选择"，用来抢市场和分发渠道、获得软实力。中国实验室集体走向开源，是为了在西方 AI 圈获得存在感；DeepSeek R1 之后，小米、美团、蚂蚁等也纷纷入场。企业用开源模型来"拥有自己的模型"，例如 Harvey 在 Kimi K3 上做法律方向的后训练，全部通过率接近翻倍，成本基本不变。

竞争力
· 2026 年，1T 参数以下就算"小模型"了。新近的强模型：小米 MiMo-V2.6-Pro（总参数 1T、激活 42B，Artificial Analysis 指数 46）、DeepSeek V4.1 Flash（763B，45）、MiniMax M3.1 Flash（42，第三方测评低于官方宣传）。
· 关于"刷榜"：中国模型确实更看重公开榜单，长尾能力也不如美国模型全面。但他花了半年时间，也没找到能证明头部开源模型（Kimi、GLM、DeepSeek）有明显缺陷的分析。
· 开源模型依然锚定着性价比的最优区间，不过闭源厂商现在也开始在这个区间竞争。

蒸馏之争（全篇最有观点的部分）
· 训练分三个阶段：预训练、中期训练和 SFT、强化学习。蒸馏主要发生在 SFT 阶段，而现在强化学习消耗的算力已经超过预训练。
· 现在说的"蒸馏"其实是对抗性蒸馏：想办法从 API 里套取被隐藏的推理过程。中国不少实验室有专门的团队做这件事。
· 他认为不值得把它当成焦点：公开研究并没有显示用推理过程做 SFT 能带来巨大提升；没有好的政策手段可以只针对中国而不伤害全球开源生态；中国实验室本身就很强，"快速跟进"本来就比开拓前沿省算力。小米公开直播了 MiMo-V2.6 的强化学习训练（约 150 万次 rollout，花费 347 万美元），就是不只依赖蒸馏的证据。
· 真正持久的优势是算力：美国前五家实验室的总算力平均是中国前五家的 16 倍；到 2026 年底，Anthropic 和 OpenAI 各有 5 GW 以上的算力，而中国头部实验室最多只有 100 到 200 MW。

使用情况
开源模型的推理量快速增长，本地模型下载在加速；Hugging Face 日均独立用户约 60 万。性能相近时，美国模型的采用量是中国模型的 2 到 5 倍，说明市场对美国开源模型有需求。他扫描了 37 万篇 arXiv 论文，Qwen 被提到的次数已经接近 OpenAI 的 GPT。总结是：性能、下载、科研三方面中国都领先，推理和后训练市场也主要是中国模型。

风险与治理
· AI 驱动的网络攻击已经真实发生，而目前公开的案例主要是闭源模型（Claude Code、Codex）被滥用。
· 想禁止开源模型，在现实中做不到（美国不可能建起有效的"防火墙"），而且十多家实验室都能在前沿一年左右的水平上训练模型，结果只会抑制经济活动。不少关于开源风险的说法被夸大了（比如虚假信息），但深度伪造这类风险确实被加速了。
· 建议：发布方按每个模型评估它带来的"额外风险"，并由国家统一风险标准，而不是让各家公司自己判断。开源模型对网络防御非常关键，因为公司的受信任访问项目没法覆盖整个经济。

## AI translation

Nathan Lambert's Harvard lecture: a survey of the open-model landscape. China leads open source across the board, but the US has more than 10x the compute advantage; distillation is not the key issue

Guest lecture by @natolambert at Harvard CS 2881R "AI Safety." His view: open models trail the closed frontier by roughly 3 to 5 months, and the gap is still shrinking. On performance, downloads, and paper citations, Chinese open models lead across the board, while US open models trail Chinese ones by 3 to 4 months. He makes three core arguments: treating "distillation" as the core problem overstates its importance; the US's lasting advantage is compute; and banning open source would only harm economic activity without stopping bad actors.
https://natolambert.com/slides/2026/harvard/lecture.html

What open-source models are, and why licenses are key
· Openness is a spectrum: from open-weights only (Llama, Qwen, DeepSeek, Kimi, GLM), to fully open, which also releases data and code (OLMo, Pythia, SmolLM, Marin). Nemotron sits in between.
· Permissive licenses: MIT (DeepSeek, GLM-5.2, MiMo), Apache 2.0 (Qwen, gpt-oss, Gemma 4).
· Custom licenses with added conditions don't count as open source: revenue thresholds (Kimi K3, Muse Spark Open, and MiniMax M3 have an annual revenue threshold of $20 million; GLM-5.3 requires a safety review above $10 billion), brand attribution requirements, and use restrictions. Most of these terms have not yet been tested in court.

Why open source
The case for open source draws on several forces: capital (turning complements into cheap commodities), research and education, preventing concentration of power, and freedom. In Bill Gurley's framing, open source is also the "natural choice of the second place," used to win market share and distribution channels and to gain soft power. Chinese labs have collectively moved toward open source to gain visibility in Western AI circles; after DeepSeek R1, companies like Xiaomi, Meituan, and Ant also entered. Enterprises use open models to "own their own model": for example, Harvey did legal-domain post-training on Kimi K3, nearly doubling its pass rates at roughly the same cost.

Competitiveness
· In 2026, anything under 1T parameters counts as a "small model." Recent strong models: Xiaomi MiMo-V2.6-Pro (1T total parameters, 42B active, Artificial Analysis index 46), DeepSeek V4.1 Flash (763B, 45), MiniMax M3.1 Flash (42, below its official marketing claims in third-party evaluations).
· On "benchmark gaming": Chinese models do place more weight on public leaderboards, and their long-tail capabilities are less comprehensive than US models'. But after spending six months looking, he found no analysis demonstrating clear deficiencies in the leading open models (Kimi, GLM, DeepSeek).
· Open models still anchor the price-performance sweet spot, though closed vendors are now competing in that range too.

The distillation debate (the most opinionated part of the lecture)
· Training has three stages: pretraining, mid-training and SFT, and reinforcement learning. Distillation mainly happens in the SFT stage, and RL now consumes more compute than pretraining.
· What people call "distillation" today is really adversarial distillation: finding ways to extract hidden reasoning processes through APIs. Many Chinese labs have dedicated teams doing this.
· He argues it isn't worth making the focus: public research doesn't show that SFT on reasoning traces yields huge gains; there is no good policy tool that targets China alone without harming the global open ecosystem; and Chinese labs are already strong, and "fast following" is inherently less compute-intensive than pushing the frontier. Xiaomi's public livestream of MiMo-V2.6's RL training (about 1.5 million rollouts, costing $3.47 million) is evidence that they don't rely on distillation alone.
· The lasting advantage is compute: the combined compute of the top five US labs averages 16 times that of the top five Chinese labs. By the end of 2026, Anthropic and OpenAI will each have more than 5 GW of compute, while the top Chinese labs have at most 100 to 200 MW.

Usage
Inference volume for open models is growing rapidly, and local model downloads are accelerating; Hugging Face sees about 600,000 unique daily users. At similar performance levels, US models are adopted 2 to 5 times more than Chinese models, suggesting market demand for US open models. He scanned 370,000 arXiv papers, and Qwen is now mentioned nearly as often as OpenAI's GPT. The summary: China leads on performance, downloads, and research, and Chinese models also dominate the inference and post-training markets.

Risks and governance
· AI-driven cyberattacks have already happened, and the publicly documented cases mostly involve closed models (Claude Code, Codex) being misused.
· Banning open models is infeasible in practice (the US could never build an effective "firewall"), and more than a dozen labs can train models at roughly the one-year-behind frontier, so a ban would only suppress economic activity. Many claims about open-source risks are exaggerated (such as disinformation), but risks like deepfakes have indeed been accelerated.
· Recommendation: developers should assess the "marginal risk" of each model, with a national standard for risk rather than leaving each company to judge for itself. Open models are critical for cyber defense, because companies' trusted-access programs cannot cover the entire economy.

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVM2NJMbkAAMCm9.jpg&mode=thumb&exp=1793404800&sig=84465fad93f83131)

## Quoted post @natolambert

> Finally got to put together a complete deck on the state of open models.
> What they are, licenses, how competitive they are, signs people are using them, distillation's impact, and how we balance the risks and benefits of openness!
> Will record a video lecture of these soon, and hopefully re-do them a few times a year.

https://x.com/natolambert/status/2112960942078107960