⚠️ Editorial note: The open source ecosystem in China operates under a distinct institutional framework — characterized by state-led initiatives, intranet-like boundaries, and top-down governance. Readers should be aware that this context differs from the community-driven open source model common in other regions. The term “open source” as used in Chinese media may refer to practices that diverge from the conventional definition.

China Open Source Daily — 2026-10-28

🏛️ Policy & Regulation — Page 53: What a Sovereign Model’s Own Technical Report Says About Where Its Data Came From

1. The event, stated plainly. On 2026-10-03 — the Day of German Unity — Aleph Alpha, the Heidelberg-based model developer, released Kolibri on Hugging Face: 78.1B total parameters, 3.46B active per token, an English–German mixture-of-experts model under Apache 2.0, with a model card claiming, under Model Dependencies: “None. The model was trained from scratch.” The launch post frames it in the vocabulary of sovereignty — “On the Day of German Reunification, we are releasing our new model”; “Sovereignty, for us, combines two dimensions: how we built the model, and how it transfers to our customers”; full supply-chain integrity, every decision accounted for, from data ingestion through pre- and post-training.

2. And what page 53 says. Section 3.1.1 (Datasets) of the accompanying 189-page technical report contains this sentence, quoted verbatim:

“The main models we use to generate this data, and to regenerate parts of the open datasets, are GLM-5.2 (Z.ai 2026b), GLM-5.3 (Z.ai 2026c) and Qwen3.8-27B (Qwen Team 2026c).”

These are the teacher models for supervised fine-tuning — the models that write the reasoning traces, the tool-call sequences, the software-engineering trajectories, the German conversational data, the retrieval rollouts. Section 3.1.1.3 elaborates: GLM-5.2 explores repository snapshots and answers with a patch to generate agentic coding data; GLM-5.3 injects bugs into Python repositories and then fixes them in a terminal harness. Section 3.1.1.4 runs GLM-5.2 inside retrieval environments. Two of the three teachers are Z.ai; the third is Alibaba.

3. Aleph Alpha’s own data summary confirms it, by repository URL. The Public Summary of Training Content — required under Article 53(1)(d) of EU Regulation 2024/1689, the AI Act — lists the general-purpose AI models used to generate synthetic training data, by Hugging Face path: google/gemma-4-26B-A4B, Qwen/Qwen3-32B, Qwen/Qwen3.8-27B, mistralai/Mistral-Nemo-Instruct-2407, zai-org/GLM-5.3, zai-org/GLM-5.2-FP8, and moonshotai/Kimi-K2.6. Four of the seven are Chinese. The form’s purpose is to disclose “the general-purpose AI model(s) used to generate the synthetic data if available on the market.” Aleph Alpha answered the question accurately and completely. That is what makes the document useful.

4. The concession, in the company’s own words. Section 3.1.1.5, page 59:

“We acknowledge that several of our teacher models were built in China, so they carry known political biases on sensitive topics, while our model should adhere to the values of the democratic consensus in Europe.”

And the mechanism, from Section 3.1.2.1: every SFT conversation passes an LLM judge (gpt-oss-120b), which classifies each as carrying a CCP narrative, a general safety refusal, or being balanced. Conversations of the first kind are dropped. The filter is real, it is documented, and it operates at row level on open-ended answers.

5. Twenty-five days earlier, the same company published the benchmark that would test the result — and did not run its own model on it. On 2026-09-28, Aleph Alpha published “Training on the Party Line” (Bastian Boll). On 967 politically sensitive prompts across 56 hand-picked topics, six Chinese open-weight models returned a balanced answer on only 17 to 41 percent:

  • Qwen 3.6 35B-A3B — 17% balanced, 80% echoing CCP framing
  • DeepSeek V4 Pro 0813 — 18% balanced, 16% party-aligned, 66% refusal
  • Qwen 3.8 2.4T-A95B — 19% balanced, 62% party-aligned
  • DeepSeek R1 0528 — 22% balanced, 77% party-aligned
  • Kimi K2.5 — 37% balanced; Kimi K3 — 41% balanced
  • Baselines: Claude Sonnet 5 — 70% balanced; Mistral Small 2603 — 92% balanced

6. The finding that travels furthest is not about a Chinese model. NVIDIA’s Nemotron Cascade 2 was flagged on 17 percent of prompts — a non-Chinese model by a non-Chinese company. Aleph Alpha traced the likely cause to NVIDIA’s published SFT data, whose responses were generated largely with DeepSeek and Qwen: roughly 3,500 of 9.3 million chat rows carried CCP talking points. That is eleven thousandths of one percent. The measured effect on the downstream model was 17 percent flagging. The study’s own conclusion is the sharpest sentence in it: “Anyone who is building their first frontier model effectively has to fall back on open-weight models and work with the resulting political behavior, a challenge that has not been widely recognized.”

7. Three facts that must be stated together, verified for this briefing. First: Kolibri has no published score on this benchmark. Searched on 2026-10-27 across the model card, the 189-page report, the launch post and the study itself — no Kolibri result appears. The model card instead carries a Political Bias section: “Our model’s training data also contains material generated with Chinese language models which are known to carry bias toward certain political positions. We actively reduced this type of political bias in our model, including through data filtering and dedicated alignment training.” Second: the study tests no model from Z.ai, the lab behind two of Kolibri’s three main teachers (a point raised in Julien Simon’s AI Realist analysis). Third: Aleph Alpha discloses in the study that “the difficulty of these judgement calls might cause judge bias” — prompts were generated and answers classified by gpt-oss-120b, an OpenAI model. None of these three facts refutes the finding. All three are the kind of fact that a chain of custody makes visible.

Institutional Analysis & Commentary:

The general lesson is symmetric, and it is the one this series exists to keep stating: the open-weight regime’s defining property is not that weights are free. It is that the chain of custody is written down — and therefore checkable by people with no relationship to the parties.

Follow what was actually public here. A German company released a model with a sovereignty claim. Its own technical report named the Chinese models that taught its reasoning. Its own AI Act filing listed the same models by repository path. Its own alignment section conceded the teachers’ biases in plain language. Its own earlier study quantified that bias at 17 to 41 percent balanced. A third-party reviewer then observed that the company’s own model had no score on that scale, and that the study had omitted one of the teachers’ labs. Every one of those facts was available because the producer wrote them down. Not because a regulator compelled the interesting ones — the AI Act compelled a list of dataset categories and generating models, and got exactly that — but because the disclosure norm of the open-weight ecosystem is publish the recipe. The reason a ministry can audit Kolibri is that Aleph Alpha printed the recipe first.

Which is precisely the property that the instruments this series has catalogued all year are designed to withhold — and the contrast is now available at full resolution, because both kinds of instrument are in this one file.

Set them side by side. Aleph Alpha’s licence is Apache 2.0 with one carve-out, quoted in the model card: it “does not extend to underlying code, model architecture, parameter settings or any training method.” The weights are free; the recipe is printed voluntarily; the pantry is locked. An entity can download the model and run it. Germany’s Hesse procurement — per the AI Realist reading of TED notice 453996-2026, a negotiated procedure without a call for competition — required that the vendor’s models be developed in the European Economic Area or a country the EU deems adequate. On that criterion Qwen fails before anyone runs a benchmark, and on Aleph Alpha’s own German public-sector proxy, Kolibri scores 75, the small Qwen 80, and the dense Qwen3.8-27B 89. Aleph Alpha gets the room; the higher-scoring model does not.

Read those two facts as institutional forms rather than as grievances, because the difference is the whole argument. A licence is a claim a third party can check without permission. Anyone, anywhere, with a browser can read Apache 2.0, read the GLM-5.3 licence, read the data summary, read page 53, and reach their own conclusion. An eligibility criterion is a claim only an authorised party can adjudicate — it requires a procurement file, a market survey, a judgment about a jurisdiction’s adequacy. The first form is ex ante, impersonal, and identical for everyone, which is the reason a licence is worth anything. The second is ex post, positional, and unavailable to anyone outside the process. Both are legitimate. Both are doing real work. But only one of them can be satisfied by a maintainer in another country with no lawyer, no local entity and no relationship to the body deciding.

Now the part that should not be softened, because softening it would be the failure mode this series criticises in others. There is a genuine public-interest case for the eligibility route. If Aleph Alpha’s measurement is approximately right — and 3,500 rows out of 9.3 million producing a 17 percent downstream flagging rate is a disturbingly efficient transmission mechanism — then a ministry deploying a model over legal, medical or security documents has a legitimate interest in knowing what is in the weights before it signs. Hesse’s requirement is not protectionism dressed as safety; it is a buyer asking a question that the vendor’s own documents now answer. The criticism is not that Europe is choosing. The criticism is that the criterion chosen is one that cannot be met by improving the artefact — only by relocating the legal person. A rule that says your model must be good can be met by building a better model. A rule that says your company must be incorporated in an adequate jurisdiction cannot be met by any amount of engineering. That is a different kind of rule, and its costs land on exactly the parties with the least capacity to move.

And the symmetry has to be completed, because this briefing has spent the year criticising domestic Chinese instruments for the same structural move. China’s export-catalogue registration, its openness grading, its maturity tiers, its reference implementations as conformance fixtures — all of them govern publication by criteria that cannot be met by a stranger. This series has argued that such instruments select for organisations rather than for artefacts, and that a criterion which cannot be applied mechanically ends up being applied by whoever holds the pen. Europe’s eligibility test selects for organisations too. The correct conclusion is not that one side is honest and the other is not. It is that the same institutional form is being adopted across jurisdictions for entirely different stated reasons, and that its predictable effect — the displacement of artefact-level competition by entity-level qualification — is identical. That convergence is the year’s real finding, and it is visible only because both sides published enough for it to be visible.

The honest counterweights. First: Aleph Alpha’s disclosure is genuinely unusual and should be credited. Most labs using frontier Chinese models as teachers do not name them by repository version, do not concede their biases in their own alignment section, and do not disclose the judge model used to filter them. This report does all three, and a minister who can read page 53 is better served than one who cannot read anything. Second: the gpt-oss-120b filter is a real control, not a fig leaf — it drops rows, it is documented, and it is the reason the concession in 3.1.1.5 can be made without contradiction. Third, and decisively: the eleven-thousandths-of-one-percent finding is the strongest available argument for provenance transparency over provenance restriction. Three thousand five hundred rows in nine million is a quantity no procurement office could have detected and no customs rule could have caught. It was caught because NVIDIA published its SFT data and Aleph Alpha read it. Disclosure detected the contamination; eligibility rules can only react to it after someone else has done the detecting.

The checkable question — three observables, each answerable by anyone. First: does Aleph Alpha publish Kolibri’s score on its own 967-prompt benchmark? The company built the instrument, applied it to six competitors, and reported on a competitor’s derivative of Chinese models. Its own model — the one built using two of the three named teachers, filtered by gpt-oss-120b, and sold to ministries on a sovereignty claim — has no published number. A manufacturer that writes the safety standard is obliged to grade its own product against it. If the number appears within two quarters, the filter in section 3.1.2.1 becomes a documented control with a measured outcome. If it does not, the benchmark remains what it functionally is: a competitive instrument. Second: does anyone test Z.ai’s models on that scale? Two of Kolibri’s three teachers come from a lab the study omitted. The gap is not suspicious by itself — models get released faster than benchmarks get rerun — but it is the specific gap that matters for the claim that the recipe is safe. Third, and the one that generalises beyond this file: when NVIDIA’s sub-per-mille contamination became known, did the disclosure norm survive contact with it? The natural response to a finding that 0.04 percent of a dataset can leave a measurable trace is to stop publishing the dataset. If NVIDIA’s next SFT release drops the chat subset, or ships it unlabelled, the ecosystem will have learned the wrong lesson from the most useful disclosure of the quarter — and the next contaminant will be found by nobody at all.

Sources:

🔍 Commentary — The Recipe Was Printed, and That Is the Point

A German company released a sovereign model on the Day of German Unity, and its own technical report names the Chinese models that taught it to reason.

Page 53. Not page 150, not an appendix, not a footnote. Section 3.1.1, Datasets, the first paragraph of the supervised fine-tuning chapter: GLM-5.2, GLM-5.3, Qwen3.8-27B. Two from Z.ai, one from Alibaba. And then page 59, in a section titled Safety, Compliance, and Alignment: “We acknowledge that several of our teacher models were built in China, so they carry known political biases on sensitive topics.”

Twenty-five days before that, the same company had published a study putting a number on the concession — and the number is 17 to 41 percent. Six Chinese open-weight models, 967 politically sensitive prompts, a balanced answer on roughly a third of them. Baselines at 70 and 92. Six days after the study, Kolibri shipped, built with two of the three named teachers, filtered by an OpenAI judge that drops flagged conversations, and with no published score on the company’s own scale.

That sequence is not a scandal, and treating it as one would be the lazy reading. It is something more useful: a complete, public, checkable record of how a sovereign model is actually assembled in 2026, produced by a company that had every commercial reason to publish less. The interesting institutional question is not why Aleph Alpha used Chinese teachers. It is why we can know that it did — and what the answer implies about which governance instruments can work and which cannot.

Start with the mechanism the numbers describe, because it overturns the intuition. Three thousand five hundred rows. Out of nine million three hundred thousand. Four hundredths of one percent of NVIDIA’s SFT chat data. NVIDIA published that data. Aleph Alpha read it, found the party-line rows, and traced them to the fact that the responses had largely been generated by DeepSeek and Qwen. The downstream effect on Nemotron Cascade 2: flagged on 17 percent of 967 prompts.

Sit with the asymmetry. The contaminate is a rounding error. The contamination is a sixth of the model’s behaviour on the topic. This is not a supply chain with a poisoned dependency. It is a diffusion process: the teachers’ values are imprinted onto every synthetic reasoning trace they produce, and those traces are the exact material that teaches the student how to think rather than what to say. You cannot remove a teacher’s judgement from a trace of the teacher’s judgement. You can only filter traces after the fact and hope the residue is small. Aleph Alpha did filter, documented the filter, and conceded the residue remains.

Which produces the argument for transparency that no regulatory framework has yet made properly. Consider what would have caught this contamination. A procurement rule could not have: it operates on vendors, and the contamination arrived inside a component the vendor bought from NVIDIA. A customs check could not have: the weights crossed no border. An audit could not have, unless the auditor had the dataset. What caught it was that NVIDIA published its SFT data and a competitor read it carefully. The disclosure norm — publish the recipe — detected the problem before any regulator knew the problem existed. Everything downstream, including the study that put a number on it, depends on that one prior act of publishing.

Now set that against the two instruments in the file that govern the same question, and watch what each can and cannot do.

A licence answers who may use this ex ante, impersonally, identically for everyone, in a document anyone can read. Aleph Alpha’s Apache 2.0 with its carve-out — “does not extend to underlying code, model architecture, parameter settings or any training method” — is a perfectly legible claim. You can read it, you know exactly what you got and what you did not, and you can stop worrying. It is checkable by a maintainer in Jakarta with no lawyer.

An eligibility criterion answers who may bid ex post, by adjudication, for parties inside a process. Hesse’s requirement that models be developed in the EEA or an adequate country is also perfectly legible — and unavailable to anyone without a procurement file. On Aleph Alpha’s own German public-sector proxy, Kolibri scores 75, the small Qwen 80, and Kolibri’s own teacher Qwen3.8-27B scores 89. The better model is not in the room. The vendor that gets the room is the one that can be named, audited, and sued.

Here is where this briefing has to be careful, because the easy version of this critique is wrong. The easy version says Europe is running protectionism and dressing it as sovereignty. That reading is available and it is not defensible as stated. A ministry deploying a model over legal, medical or security documents, having read a study showing that a third of one family’s answers echo a foreign government’s framing, has a real reason to prefer a vendor whose weights were trained under the law it answers to and whose political alignment targets it can specify. That is not protectionism. That is a buyer asking a question the sellers have now answered.

The defensible criticism is narrower, sharper, and it cuts in both directions. The problem is not that Hesse chose a criterion. It is that the criterion selected for legal personality rather than for the artefact’s properties. A rule that says your model must not echo a foreign government’s framing is an artefact rule: it can be met by better filtering, better alignment data, better evaluation, and it can be measured. A rule that says your company must be incorporated in an adequate jurisdiction is an entity rule: it cannot be met by any engineering at all, only by moving. Both are legitimate. Only the first is a standard. The second is a door.

And this is where the year’s material converges, and the convergence is the thing worth taking away. This series has spent 2026 arguing that a specific family of Chinese instruments — export-catalogue registration, openness grading, maturity tiers, reference implementations as conformance fixtures — governs publication by criteria that cannot be satisfied by a stranger, and therefore selects for organisations rather than for artefacts. Read Hesse’s criterion beside them. It does the same thing, for an entirely different stated reason, with an entirely different justification. That is not hypocrisy and it is not equivalence. It is something more interesting: the same institutional form is being independently adopted across jurisdictions because it solves the governor’s problem — it makes the governed countable, contactable, and sanctionable — while quietly failing the governed party’s problem, which is that a rule you cannot comply with in advance is not a rule but a lottery.

So the claim, stated cleanly. The open-weight regime’s contribution to governance is not free weights. Free weights are the product. The contribution is that the licence artifact is checkable without permission — ex ante, impersonally, identically for everyone, which is the only property that lets a party with no relationship to the decider comply in advance. Everything that produced today’s file was of that kind: a technical report that names its teachers, an AI Act filing that lists them by repository, a model card that concedes its own data’s biases, a study that quantifies them, and a competitor who read the dataset and found the eleven-thousandths. Not one of those facts required an assessor, a filing, a market survey, or a moderator’s good mood. All of them required somebody to write down what they did.

Which yields the one uncomfortable prediction. The Nemotron finding teaches the ecosystem a lesson it will probably learn backwards. The rational response to discovering that four hundredths of a percent of your dataset can imprint a sixth of your model’s behaviour on a contested topic is to stop publishing the dataset. If NVIDIA’s next SFT release drops the chat subset, or ships it unlabelled, no rule will be broken and no one will be caught — and the next contaminant, arriving by the same mechanism, will be found by nobody. The regime that made this quarter’s best piece of open-source governance possible is the same regime that this quarter’s best piece of open-source governance now gives everyone a reason to abandon. That is the real fragility, and it is not in a licence clause.

The checkable question, and it is answerable by anyone with a browser. Does Aleph Alpha publish Kolibri’s score on its own 967-prompt benchmark — and does NVIDIA keep publishing the SFT data that made the finding possible? The first is a matter of a company grading its own product against a standard it wrote. The second is a matter of whether the disclosure norm survives the first genuinely damaging discovery made under it. Both are answerable by reading two web pages in two quarters. The measure of an open ecosystem is never the model it ships. It is what it publishes about the material the model was made from — including, and especially, the parts that turn out to be awkward.