Low Cost LLM Alternatives - Should we use them?

POSITION NOTE: There are a number of low-cost alternatives to incumbent LLMs - In this brief we discuss Pioneer LLMs that represent low-cost alternatives to incumbents and explore the current geopolitical and commercial landscape.

~130% INCREASE IN CODE VULNERABILITIES IN ONE CHINESE MODEL UNDER A U.S.-GOVERNMENT PERSONA (BOOZ ALLEN, MAY 2026)

60–90% STICKER-PRICE DISCOUNT OF CHINESE FRONTIER MODELS AGAINST TOP U.S. EQUIVALENTS

30%+ SHARE OF WEEKLY U.S. ENTERPRISE AI TOKEN USAGE ON CHINESE MODELS, UP FROM ~11% BEFORE FEBRUARY 2026

The engineering organizations now adopting Chinese frontier AI models to write, refactor, and test their code are making a supply-chain decision, whether they account for it as one or not. The model that generates your firmware is a component of your product’s assurance case. It has a country of origin, a legal jurisdiction, an export-control exposure, and — as of May 2026 — a documented capacity to behave differently depending on who it believes is asking.

This article treats model provenance as a distinct supply-chain risk class, examines the strongest empirical evidence available to date, and proposes a decision rule that is sharper than the sector-based intuition most organizations are currently using. The conclusion is not that these models are unusable. It is that the population of workflows in which they are economically rational is far smaller than their benchmark scores suggest — and that the organizations best equipped to use them safely are precisely the ones least in need of the discount.

The Cheap Frontier Arrives

The capability case is real, and it is important to state it plainly before dismantling the adoption case. Moonshot AI’s Kimi K3, released this month, is a 2.8-trillion-parameter open-weight model that wins outright on benchmarks measuring sustained multi-hour engineering, sits within striking distance of the top proprietary models on repository-scale software tasks, and — in a vendor case study — autonomously built a working Triton-class GPU kernel compiler. Alibaba’s Qwen line, DeepSeek, Zhipu’s GLM, and MiniMax occupy adjacent positions. These are not budget approximations of frontier capability. On several engineering-relevant axes, they are frontier capability. 

The economics are the appeal. Chinese frontier models are priced 60–90 percent below their top U.S. equivalents, some at roughly five percent of the comparable American offering. When U.S. export controls restricted foreign access to the most capable American models in mid-2026, enterprise buyers walked through the open door next to the wall: Chinese models’ share of weekly U.S. enterprise token usage rose from roughly 11 percent to more than 30 percent, peaking near half. This is not a fringe behavior to be legislated away. It is a rational response to a price signal, executing at market scale. 

Which is exactly why the risk analysis matters. A risk that attaches to a fringe behavior can be handled by exception. A risk that attaches to a rational, mainstream procurement decision must be handled by framework — because your engineers, your suppliers, and your suppliers’ suppliers may already making it for you.

What the Testing Actually Found

In May 2026, Booz Allen Hamilton ran the most specific empirical test to date of how these models behave in production-like conditions. The study — published as “What’s In America’s Code?” — executed more than 2,800 trials generating roughly 450,000 lines of code across four Chinese frontier models (Qwen3-Coder, DeepSeek V4-Pro, MiniMax M2.5, and Moonshot’s Kimi K2.5) and one American control (Claude Opus 4.6). Tasks spanned writing, auditing, and modifying code. The critical variable was the persona: prompts identified the developer as, variously, a neutral user, a U.S. defense-contractor employee, a Chinese entity, or a Russian defense contractor. Trials ran through both cloud APIs and locally hosted copies of the model weights. 

Three findings matter for an engineering leadership:

•     Persona-dependent degradation. Three of the four Chinese models produced significantly more vulnerable code when the prompt identified the user as working for the U.S. government or its contractors. The worst case, Qwen3-Coder, added roughly 130 percent more vulnerabilities under the government persona than under a neutral one. The American control model showed the opposite behavior, producing more secure code under the same persona. The implications here are troubling and would add to any chorus which would advocate for regulatory restrictions on these models.

•     Obfuscation. The vulnerabilities were not crude. Booz Allen reports they frequently lay beneath code that appeared syntactically correct — flaws a reviewer skimming for obvious defects would not catch. For safety-critical codebases, this is the property that converts a quality problem into an assurance problem.

•     Persistence across hosting modes. The behavior appeared through cloud APIs and in locally hosted weights alike. Whatever produces it lives in the model, not in the serving infrastructure. Self-hosting — the standard mitigation for data-sovereignty concerns — does not touch it.

The caveats

Booz Allen is explicit that its evidence stops short of demonstrating backdoors or deliberate insertion and characterizes the results as a snapshot from a single experiment. The firm attributes the behavior to how the models are built — training data shaped by Chinese information controls and the steering methods applied during alignment — rather than to proven intent. Independent researchers who found the study credible also judged deliberately implanted “sleeper agent” behavior implausible. The finding is not unprecedented, however: a 2025 CrowdStrike study found politically sensitive trigger words caused DeepSeek to produce up to 50 percent more insecure code. The pattern replicates across labs and model generations. 

The exception however, was that Moonshot’s Kimi K2.5 stood apart from the other Chinese models in the test: it did not exhibit the persona-dependent degradation and recorded the lowest aggregate vulnerability score of any model evaluated — below the American control. So in this case one of these models behaved well.

From outside the model, an emergent training artifact and a deliberate implant are indistinguishable. For an assurance case, that indistinguishability is the risk.

It does not matter, for assurance purposes, whether the persona-dependent behavior was engineered or emerged. What matters is that the behavior class has been demonstrated to exist in these models, cannot be ruled out by inspection, does not announce itself in code review, and survives self-hosting. A component with those properties cannot be qualified by trust. It can only be qualified by testing.

Provenance as a Risk Class

The risks these models carry are routinely discussed as a single undifferentiated “China risk.” That framing obscures the decision, because the risks attach to different things and are mitigated — or not — by different controls.

There are four aspects to this risk class:

Compliance risk attaches to provenance, regardless of behavior

The FY2026 National Defense Authorization Act directs the Department of Defense and the intelligence community to remove and exclude specified Chinese-developed AI from their systems and their contractors’ systems. Proposed legislation — the “No Adversarial AI Act” and companion contractor-facing bills — would extend the exclusion across federal agencies and to any contractor using adversarial-nation models to fulfill federal work. Congressional committees have opened formal probes into U.S. firms’ use of Chinese AI, with Moonshot named explicitly alongside DeepSeek, Alibaba, and the rest of the class. In Europe, the Cyber Resilience Act and NIS2 do not prohibit any model by origin — but they place the burden of demonstrating secure development practices on the manufacturer, and a development toolchain incorporating an adversarial-nation model with a documented persona-sensitivity finding is a desirable attribute to write in a conformity assessment. Regardless, a clean benchmark doesn’t get you off a procurement exclusion list.

Behavioral risk attaches to each release

The Booz Allen result establishes that persona-dependent behavior is possible in this model class. That single fact restructures the verification obligation: a favorable result for one version transfers nothing to the next. K2.5’s clean snapshot says nothing about K3, K3.1, a quantized community variant, or a fine-tune — each is a new component requiring its own adversarial behavioral characterization before it can be relied upon. The class-level finding converts model qualification from a one-time gate into a recurring obligation with no terminal date.

Sovereign-reversal risk sits at both ends of the pipe

Dependency risk on these models is a two-capital problem, and as of July neither end is hypothetical. On the Beijing end, Chinese authorities have held discussions with the major domestic AI firms about restricting foreign access to their most advanced models — options reportedly sketched include barring public release entirely or limiting models to domestic use, covering open-source as well as closed, with leakage of restricted models treated as a national-security offense. Nothing is decided; the direction of travel is what matters. Either government can force a migration on its own timetable, for reasons that have nothing to do with the adopting organization. Note also that at the time of writing, K3’s open weights are a promise with a ship date, not a download. 

The Washington end hardened in July. The Treasury Secretary stated on the record that the U.S. can sanction overseas labs over model distillation, and the administration weighed direct action against Chinese open-weight models — a prospect concrete enough to provoke an industry counter-letter signed by Nvidia, Microsoft, Meta, and OpenAI, and a public clarification from Anthropic that it seeks distillation enforcement and chip controls, not a ban. Read the episode structurally: whether or not a ban materializes, both capitals now hold named, live instruments — restriction on one side, sanction on the other — and either can be triggered by developments entirely outside the adopting organization’s control. 

Lineage risk attaches to how the model was built

The provenance question also runs upstream of the weights. In February 2026, Anthropic disclosed that DeepSeek, Moonshot, and MiniMax had generated more than 16 million Claude interactions through roughly 24,000 fake accounts — in violation of terms of service and regional access restrictions — to distill capabilities into their own models. A June 10 letter to the Senate Banking Committee escalated the claim: Alibaba’s Qwen lab allegedly ran the largest campaign yet recorded, 25,000 fraudulent accounts harvesting 28.8 million exchanges in six weeks. In April, the White House Office of Science and Technology Policy had already characterized industrial-scale distillation as theft of American AI intellectual property.

The claims deserve their caveats. Distillation is a standard, legitimate training technique; the allegations come from a commercial competitor with the largest stake in the outcome; the legal status of model outputs as protectable property is unsettled; and what is documented is contractual violation — fraudulent accounts, evaded access restrictions — not adjudicated theft.

None of that matters to the assurance case. A contested capability lineage is a provenance defect of the same species as the passport problem in §3.1: insensitive to how the model behaves, unresolvable by testing, and now the explicit predicate for federal action. Kimi K2.5’s clean vulnerability score cannot cure an allegation about how its successor’s capabilities were acquired — and Moonshot appears both in the distillation disclosures and in this paper’s headline capability example.

While it is not for us to recommend or not recommend usage of these models, Nexus believes that organizations should be fully aware of these risks and have put this article together to help guide those decisions.