SemiAnalysis: Chinese AI Labs Rarely Publish Model Safety Test Results

Chinese AI developers almost never publish the results of their models' safety testing. That is the conclusion of research firm SemiAnalysis, which says labs in China are extremely reluctant to share how they test their systems for dangerous uses. The finding comes as concern grows worldwide over the rapid progress of frontier AI models. The material available to us contains no quantitative data from the report, but the conclusion itself matters: in a segment where labs compete for every percentage point on benchmarks, the risk section is most often left empty.

What is missing from the public record

Large Western labs have settled into a routine. A flagship model ships with a system card or model card describing dangerous-capability evaluations, red-team work, misuse testing results, and limitations. The contents of these documents can be disputed, but outside experts at least have material to check against. Chinese companies typically publish technical reports on architecture, training, and results on tests of knowledge, math, and coding. Sections on how a model behaves in biological, cyber, and other serious-risk scenarios are thin or missing entirely.

There are exceptions. In 2024, companies from several countries signed voluntary commitments at the Seoul AI Safety Summit, including China's Zhipu AI. But a commitment is not a report. Without a published methodology and results, there is no way to verify that it has been honored.

Why this hurts more for open models

A large share of the strongest Chinese models ship with open weights. For businesses that is an advantage: you can deploy a model in-house, fine-tune it, and avoid depending on an API. But openness has a downside. The safeguards a developer builds in can be removed through fine-tuning on a small budget. That makes pre-release risk evaluation, and an honest publication of its results, the only way to understand what the next people to pick up the model are starting from.

Independent testing has already turned up problems. In early 2025, Cisco researchers reported that DeepSeek R1 did not block a single harmful prompt from the HarmBench set in their test. The US institute NIST later published its own evaluation of DeepSeek, with findings on vulnerability to jailbreaking and agent hijacking. This kind of work is done by outside groups, not by the developers themselves, and that is exactly the asymmetry SemiAnalysis describes.

What the publication tells us

• Source of the finding: SemiAnalysis, a research firm specializing in AI and semiconductors.
• Core finding: Chinese developers are reluctant to disclose information about safety testing of their models.
• Context: global concern over the pace of frontier AI development.
• What the available excerpt does not include: a list of tested models, company names, and numerical scores.

What teams choosing a model should do

If you are building a Chinese model into a product, the absence of a public safety report means you will have to run the evaluation yourself. A minimal set looks like this: your own run on jailbreak prompts, a prompt injection test if the model has access to tools, and a check of the model's behavior on data from your industry. For agentic scenarios, restrict access permissions and keep an action log. For open-weight versions, add an external filtering layer on input and output rather than relying on built-in safeguards.

Ask vendors for documentation directly. If you get no answer, that is also data for your risk assessment. For the market as a whole, the question is simple: can disclosing safety test results become as standard as publishing benchmarks?