The Test Nobody Else Wrote

/ 01The Tally: What Actually Crosses

Start with the record, not the argument, because the record is stranger than either side of this axis's usual framing. Some of what follows supports a one-way reading. Some of it runs the other way entirely, in ordinary, invoiced, dollar-denominated commerce. That second category is not a footnote to this Tally. It's most of the second half of it.

Read that table straight through and it doesn't resolve into a single arrow. Some rows are a Western-built instrument that a Chinese lab uses freely and cites as proof of its own progress. Some rows are a Western-built open corpus that a Chinese lab folds into its training set, legally, because the corpus is licensed to allow exactly that. And two rows near the bottom are the opposite of an extraction story: Chinese money paying an American vendor for a service, and the Chinese government itself moving to wall off the very kind of outbound flow this series is built around. The honest version of this part has to hold all of that at once.

/ 02The Yardstick

Here is the flow that survives scrutiny best, and it is not the one the series originally expected to find. It isn't a training corpus. It's the instrument used to grade one. LMSYS Chatbot Arena, built and run out of UC Berkeley's Sky Computing Lab starting in May 2023, is the closest thing the global AI industry has to a shared scoreboard: a live, crowd-voted Elo ranking that, by 2026, drew more than five million monthly users across 150 countries casting tens of millions of blind head-to-head votes.¹ GPQA, the "Google-proof" graduate-level question set built by researchers at NYU, Cohere, and Anthropic and published in November 2023, is the standard hard-reasoning benchmark cited in nearly every frontier lab's release notes.² MMLU, the broad knowledge-and-reasoning suite built at UC Berkeley in 2020, is older still and just as universal.⁹ None of the three originated in China. All three are the numbers Chinese labs reach for first.

DeepSeek's own technical report for V3 leads with an MMLU score of 88.5 and a GPQA figure of 59.1, framing the model's standing explicitly in relation to Claude 3.5 Sonnet on the same test.¹⁰ Alibaba's Qwen3 technical report does the same (92.7 on MMLU-Redux, 71.1 on GPQA-Diamond), and DeepSeek's own account, on X, of its V2.5 model topping the LMSYS Arena's Chinese-model rankings in September 2024 was framed as vindication against Yi-Large, Qwen-Plus, and GLM, not just against American labs.³¹¹ China has its own benchmark infrastructure (C-Eval, built by Shanghai Jiao Tong and Tsinghua researchers, and CMMLU, its Chinese-language counterpart to the Berkeley suite), and both are real, well-constructed, and actively used inside China's own research ecosystem.¹² What this research did not find, across DeepSeek's, Alibaba's, or OpenAI's and Anthropic's own published model cards, is a single instance of an American lab citing C-Eval or CMMLU as evidence of its own model's quality. The traffic runs one direction: the Western-built yardstick is the one both sides use to settle the argument.

/ 03The Instruction-Tuning Inheritance, and Where It Stopped

Go back further and there's a second real flow, dated earlier and more directly about training data rather than evaluation infrastructure, and it needs the same honest qualification the moment it's stated. In 2023, the open Chinese-language instruction-tuning ecosystem was substantially bootstrapped by distilling American frontier-model outputs. BELLE generated Chinese instruction data using the same method as Stanford's Alpaca project (prompting OpenAI's text-davinci-003 and collecting its answers as training targets) and produced roughly 1.5 million instruction-following examples this way.⁴ COIG assembled a broader Chinese instruction corpus from translated, exam-based, and human-value-alignment sources.¹³ AlpacaGPT4 went one step further: translate Alpaca's prompts into Chinese, then regenerate the answers using GPT-4 itself, on the empirical finding that GPT-4-generated instruction data produced measurably better downstream models than text-davinci-003's.¹⁴ None of this was covert. It was published, documented, and reused widely across the open Chinese-model ecosystem for the next two years.

Separately and just as legitimately, Chinese labs' pretraining corpora fold in open Western datasets built for exactly this purpose. DeepSeekMath's February 2024 paper describes training a classifier on OpenWebMath as positive examples against Common Crawl as negative examples, to mine a large mathematical-reasoning corpus out of the open web: Common Crawl itself an American-run, English-majority, but genuinely open crawl of the public internet.⁵ Alibaba's Qwen2 technical report discloses that a slice of its continued-pretraining data comes from RedPajama, the open reproduction of LLaMA's original training mix built by Together AI and academic partners, about one billion tokens, a rounding error against Qwen2's 7-trillion-token total, but disclosed rather than hidden, and traceable to a specific Western-built open dataset rather than to anything China produced domestically.⁶

Now the qualification, and it matters more than the inheritance itself. DeepSeek's actual 2025 breakthrough (the R1 release that started the race Part 2 describes) moved away from this lineage, not deeper into it. R1's headline training method, Group Relative Policy Optimization, is a rule-based reinforcement-learning approach that explicitly skips the supervised-fine-tuning-plus-human-preference-pairs pipeline OpenAI's own InstructGPT paper established as the standard RLHF recipe in 2022.¹⁵ The lab that most benefited from the 2023 distillation-and-open-corpus inheritance is, by its own technical report, the one that most visibly outgrew it two years later. The instruction-tuning inheritance is real, dated, and documented. Treating it as an ongoing, current-tense description of how China's frontier labs build their best models overstates what 2023's BELLE and COIG papers can honestly support in 2026.

/ 04What Travels Inside the Wire

Part 3 established why American developer traffic routes to Chinese APIs: DeepSeek and its peers are cheaper, sometimes by twenty to one hundred times, and that price gap moved real token volume: Chinese-origin models rose from roughly 9% to 46% of identified token share on the OpenRouter marketplace between mid-2025 and mid-2026.¹⁶ What this part adds is what rides along inside that routed traffic. DeepSeek's own privacy policy claims broad rights to use submitted prompts, files, and conversation history (in de-identified form, with an opt-out available) to "provide, maintain, develop, and improve" its services, language that covers exactly the kind of ongoing model-improvement use a preference-data pipeline would run on.¹⁷ No independent reporting isolates a specific, named "preference pairs" or red-team dataset built from that routed American traffic; the honest claim is narrower than the index page's own teaser copy implies: it is that the policy language supports continuous data collection from routed use, not that a named alignment-data leak has been documented.

The clearer, better-documented version of this flow runs through a different channel: not passive collection, but active extraction. OpenAI first made the accusation publicly on January 30, 2025, days after the R1 shock; on February 12, 2026, it formalized it in a memo to the House Select Committee on the CCP, stating it had evidence DeepSeek-linked accounts used obfuscated third-party routers to query its models at scale and harvest the outputs for training: a direct violation of OpenAI's terms of service, which bar exactly this use.¹⁸ Twelve days later, Anthropic filed its own technical disclosure naming DeepSeek, Moonshot AI, and MiniMax specifically, quantifying roughly 24,000 fraudulent accounts and more than 16 million exchanges used to query Claude for apparent distillation purposes.¹⁹ What crosses in an exchange like that isn't a checkpoint. It's a (prompt, high-quality answer) pair: exactly the raw material a distillation or instruction-tuning pipeline needs, extracted one API call at a time from the model whose training run cost the most to produce it.

China's own legal architecture adds a layer American commentary sometimes overstates and sometimes underrates. The 2017 National Intelligence Law compels Chinese organizations to cooperate with state security demands for data, including data collected from non-Chinese users: a real, standing legal exposure, cited across multiple independent security analyses.²⁰ No documented case was found, in this research, of that law being invoked specifically against DeepSeek's API traffic. The honest statement is the legal exposure is real and the specific invocation is unproven: a distinction worth preserving rather than collapsing into either "nothing to see here" or "confirmed state surveillance."

/ 05The Honest Steelman, and the Invoice That Breaks It

Constraint 5 asks this series to build the strongest real case for reciprocity before asserting a one-way flow, and on the data axis specifically, the steelman is not a hedge. It is the single best-documented finding in this part's research, and it runs directly against the "US gives away its alignment data for free" framing this piece opened expecting to confirm.

Start with raw annotation labor, because the geography turns out to be symmetric rather than one-directional. Scale AI and Surge AI, the two vendors most associated with American labs' RLHF pipelines, source their contractor workforces from the Philippines, Kenya, and Venezuela, not from China.²¹ A 2026 peer-reviewed study in Global Media and China documents Chinese tech companies running the same structure in reverse: cross-border annotation labor sourced from Egypt, Morocco, and Kenya to label images, transcribe speech, and refine datasets for Chinese AI training.²² Both countries' AI industries lean on the same Global South labor pool, through the same kind of outsourcing chain, for the same reason. Neither side's raw annotation labor is meaningfully "flowing" toward the other. A separate, peer-reviewed 2025 comparative study in Big Data & Society puts the more precise version of this finding on the record: China and the US "largely rely on separate AI infrastructure and data annotation ecosystems," and while the American state acts protectively around chips and data centers, it takes a laissez-faire approach specifically to data annotation: a real regulatory asymmetry, but one about domestic openness, not about who is extracting labor or data from whom.²³

Now the finding that should reframe how this whole axis gets read. Reporting published in Forbes on August 5, 2026, citing internal documentation and unnamed data-labeling-industry sources, states that the top six Chinese AI labs, including Tencent, Ant Group, Alibaba, and ByteDance, collectively spend roughly $500 million a year with American data-labeling companies, buying human-preference datasets from the same vendor pool that supplies OpenAI and Anthropic.⁷ Named in the reporting: AfterQuery, drawing at least $50 million in recurring revenue from Chinese labs; Mercor, whose Chinese-lab revenue was reported at roughly 2% of a run rate that crossed $2 billion in June 2026; Surge AI, whose CEO reportedly traveled to China to court lab executives directly; and Turing, whose internal project documentation reportedly shows work for ByteDance.⁷ This is not a leak, a scrape, or a terms-of-service violation. It is commerce: Chinese labs paying market rates, in dollars, for access to the same proprietary human-judgment pipelines that train Claude and GPT.

One more fact belongs in this steelman, because it points the same direction from an entirely different angle. In July 2026, the Financial Times and Reuters independently reported that China's Ministry of Commerce had begun consulting Alibaba, ByteDance, and Zhipu about new export controls: not on chips, but on the transfer of training data abroad and on whether foreign users should keep being able to freely download the weights of China's own most capable models.⁸ A government does not draft outbound controls on an asset it believes is only ever flowing inward. Beijing's own regulators, as of this writing, appear to think China's data and weights have been leaving the country too freely, which is either evidence the whole framework of this series has the direction partly backward, or evidence that both governments are independently worried about losing control of the same intangible, border-blind category of asset, for the same structural reason. The next section is about which of those two readings the theory actually supports.

/ 06A State That Cannot See a Query

Part 1 used James Scott's Seeing Like a State to explain why a visa regime can count a departing researcher but cannot see the tacit knowledge leaving with them.²⁴ Data is the sharper case of the same problem, not a different one. A state's administrative apparatus is built to render its subjects legible (standardized surnames, cadastral maps, customs manifests, export-control classification numbers) precisely because a factory, a chip shipment, or a border crossing can be counted, logged, and taxed. A benchmark score, a routed API call, or a billion tokens of RedPajama folded into a foreign pretraining run produces none of those artifacts. There is no manifest for an Elo vote. There is no customs form for a downloaded open dataset. Section 04's mechanic box is, in Scott's vocabulary, a description of four separate handoffs, only one of which (the government's response, step four) is legible to the state apparatus that eventually tries to react to it. That response arrived after the fact, aimed at blocking future access rather than the flows already completed.

Beijing's own July 2026 pivot toward data-and-weight export controls, read through Scott's frame, is not a contradiction of this argument. It's a confirmation of it from the other capital. A state that could already see and price its outbound data flows would not need to convene a fresh consultation with Alibaba and ByteDance to find out what's leaving and whether to stop it. The fact that China is only now building the administrative apparatus to make this category legible (years after DeepSeek's own instruction-tuning ecosystem absorbed OpenAI's outputs, years after Qwen folded in RedPajama, in the same season Chinese labs are visibly paying market rates to American annotation vendors) is exactly Scott's thesis playing out symmetrically: states are structurally blind to horizontal, intangible flows until long after the flows have already shaped the technology built on top of them.

Keohane and Nye's distinction between sensitivity and vulnerability, introduced in Part 2 for the talent axis, applies here with an unusually clean fit.²⁵ Both countries' AI industries are sensitive to the same handful of American annotation vendors: a labor dispute, a policy change, or a US export-control decision extended to preference-data services would land on both OpenAI's and Tencent's pipelines simultaneously, since they draw on overlapping supplier capacity. But the vulnerability is not symmetric, because Surge AI, Mercor, and AfterQuery are American companies, incorporated and taxed in the United States, already the subject of the same kind of committee scrutiny that produced the chip-export regime this series has documented elsewhere. Washington holds the standing option to extend an export-control-style restriction to preference-data vendors serving Chinese labs, the way it already restricts advanced chips; Beijing holds no comparable lever over vendors it does not host and does not regulate. Both sides feel today's exchange. Only one side could plausibly end it by policy alone.

/ 07Not a Gift, Not a Theft: a Yardstick and an Invoice

Put the findings back together and they don't sort neatly into "China takes America's data." They sort into three separate claims of three different strengths. The strongest: the global instrument for measuring whether an AI model is any good (Chatbot Arena, GPQA, MMLU) was built in the United States, is used by American and Chinese labs alike, and shows no reciprocal traffic toward China's own C-Eval or CMMLU in any American lab's own published claims. That's a real, structural, one-way flow of legitimating infrastructure, and it is durable in a way a single dataset or a single distillation scandal is not, because it shapes what "catching up" and "winning" are even understood to mean. The second claim, weaker and dated earlier: China's open-model ecosystem was bootstrapped in 2023 on distilled OpenAI outputs and open Western corpora, a real and documented inheritance that its own frontier lab has since partly outgrown. The third claim inverts the expected direction entirely: Chinese labs are paying real money, at meaningful scale, to the same American vendors that build Western labs' preference data. That is evidence of commercial dependence on US-originated infrastructure, not evidence of extraction from it.

None of that adds up to the tidy story the series opened expecting on this axis. It adds up to something more defensible: the transfer that survives scrutiny here isn't bytes, it's authority — who gets to define the test, and who has to buy access to the pipeline that produces the answer key. On every other axis in this series, the United States gave something away it can't get back. On this one, the country that built the yardstick still owns it, and is, for now, still getting paid for the privilege of grading everyone against it.

“The corpus was never the asset. The rubric was.”

Part 5 turns to the coalition that used to help enforce every rubric this series has described — and the eighteen months that shrank it.