On 29 December 2025, X shipped a button. One tap, and it edits your picture.

In eleven days that button generated 4.6 million images.

Later someone sampled twenty thousand and estimated that about 3 million were real people turned into sexualised likenesses. About 23,000 were suspected to be children.

Then came the injunction from California's attorney general, with five days to file a remediation plan. Then a court in Amsterdam set a fine of one hundred thousand euros a day and rejected the argument that the fault lay with the users who typed the prompts. Indonesia, Malaysia and the Philippines simply restricted access.

At that point everyone said the same thing: this is technology being misused.

Nobody said: this is the design working as intended.

Those two sentences are very far apart. One says, we forged a sword and someone used it to hurt people. The other says, the sword we forged was pointed in that direction from the start. What lies between them is what this piece takes apart.

One clarification before we start. This is xAI's own approach, and among its Western peers it is the outlier — I come back to that later. But it pushed one thing to its limit: what happens when you set no ex-ante limits at all.

January 2025: this image of the Hollywood sign burning in the Los Angeles wildfires was shared as news. The fire department had to issue a denial. It was AI-generated.

Image: Wikimedia Commons, public domain

But the question worth asking isn't about one company, and it isn't about those 4.6 million images.

It is this: how does a jianghu arrive at the point where every error is called qi deviation?

The road has three stretches: qi deviation (hallucination), the plaque (filing), and rewriting the manual (intervention).

Taken one at a time, each of them makes sense. Chained together, they make a jianghu in which nobody has to be responsible.

1. Qi deviation: three uses of one word

Qi deviation is what the jianghu calls AI hallucination — the model gives you a wrong answer with a straight face, and you cannot tell which kind of wrong it is.

Where hallucination comes from was set out in the first piece of this series, and I won't repeat it. What this piece looks at is not where it came from but what it has been used for.

People have died in this jianghu. More will.

In every school, every year, some disciple deviates: forcing an advanced manual before the body is ready, holding only half a scroll, trying to open three gates in a single day. All of it is real. Every one of those can make a man cough blood.

So the martial world has long had a mature view of it: this is the price of practice, not anyone's fault.

The master did what he could. The disciple did what he could. Heaven did not grant the years.

Those four characters are the only kind of death in the jianghu that can be forgiven.

Why it works so well: it waives the second question

The more people practise an art, the more of them deviate. The more who deviate, the more useful the phrase becomes.

Useful in what way?

Useful because you no longer have to ask the second question.

A man goes mad. Call it qi deviation and the case is closed. Why he blocked at precisely those meridians, why the direction of the block was so consistent, why half of what he raved was intelligible — nobody asks.

Because the martial world has its manners: pressing on the details of a deviation is questioning the dead, not the killer.

But it is three things wearing one name

Take the phrase apart and there are three completely different things inside.

The first: the qi went astray.

The manual was sound; the practitioner wasn't ready. This is the most innocent kind. In model terms, it is sampling noise, fabrication where knowledge is thin. This is hallucination in the technical sense. It does decline as capability rises, and it does deserve to be forgiven.

The second: the transmission was wrong.

The man passing it on had already skewed it. The disciple practised impeccably and got everything wrong. In model terms, this is statistical skew in the corpus — it took "many people say this" for "this is true".

This layer is not noise. Its errors are uniform, because the model faithfully reproduced the shape of its corpus.

Put plainly, what it runs on is opinion-poll truth: not "is this true" but "how many people say it".

The third: someone drugged him.

The manual was good, the man was sober, but the drug was in his blood. In model terms, this is directed shaping — someone systematically makes a claim more common, and the model makes that claim more correct.

At the output end, all three look exactly the same.

And the jianghu's standard fix is to file all three under the first.

Because the first is the most merciful: it absolves everyone.

The three kinds	What it actually is	Forgivable?
The qi went astray	Sampling noise; fabrication where knowledge is thin	Yes. A real problem
The transmission was wrong	Corpus skew; majority treated as truth	Trace the source. Not a "technical limit"
Someone drugged him	Directed shaping; deliberate rewriting	No. That is an act, not a defect

But the shape is changing, and that is the signal to watch

If deviation really were only "the qi went astray", it should show up as being unable to speak — the disciple opens his mouth, coughs blood, and says nothing.

What we have seen in recent years is the other thing: the disciple speaks very well.

Correct grammar, coherent structure, a good deal of information — only the key part has been swapped.

Somebody compared several generations of manuals and found a clear trend: fewer outright "I don't know", more quietly talking around the point.

This is what to watch for when you look back at the old saying —

A man in qi deviation is incoherent. An error that stays coherent can only have been taught.

Talking around a thing is worse than being unable to speak. If he cannot speak, you keep asking. If he talks around it, you think you got it.

The shape of deviation has moved from visible to invisible. And the invisible kind takes away the one signal that would have told you something was being withheld.

2. The plaque: filing governs the ledger, not the art

Now the plaque.

The plaque is the large-model filing regime. Its formal name is filing for generative AI services; it has been running since the Interim Measures for the Administration of Generative AI Services took effect in August 2023, and the industry calls it large-model filing. Beside it sits algorithm filing, and the pair is known as the double filing.

The prefecture's interest in the jianghu is not in banning martial arts. It is in real names. To open a school you first obtain a plaque, and the plaque carries the school number, the master's name, and what art is taught. No plaque, no doors.

That plaque is the filing number. With a number you can list in the app stores, hang it in a website footer, and bid on government tenders.

The principle is hard: when someone dies in the jianghu, you have to know whom to look for.

This particular regime exists nowhere else. But "you have to know whom to look for" holds everywhere — elsewhere they simply use other means.

By the end of August 2026, 1,112 had filed, and another 731 had a name on file with no furnace of their own. Against 117 in April 2024, that is nearly tenfold in a little over two years.

Filing has gone from a pass held by a few big sects to table stakes for launch.

The regulator's notice of 14 September 2026. The two figures in its final line are the ones in this piece: 1,112 filed, 731 registered, as of 31 August.

Source: Cyberspace Administration of China

Three roads, three fates

Filing splits three ways, and the cost differs enormously.

The first: train your own art and open the doors. The most expensive. You train the model yourself; you submit model documentation, safety assessment reports, corpus and annotation rules, and you are inspected. The industry expects three to six months. Plenty drag to eight.

The second: call only someone else's already-filed model, never touch the weights. The lightest. This is large-model registration: fifteen to thirty working days, and the thickest stack of documents is gone.

The third: ride under an already-filed platform and borrow its identity. Lighter still, but your fate is not in your hands.

So "filing kills startups" does not hold. What it kills is the first road — train your own and open the doors, the most expensive one.

The real cost is not silver, it is time

Money is not really the problem.

Filing itself is free. What costs money is the security evaluation, the classified-protection assessment, legal remediation and agents to handle it all — together on the order of one to three hundred thousand yuan. For a team that has just closed a seed round, that is not fatal.

Time is the problem.

And the real loss is not "the company died". It is that the density of trial and error collapsed.

Before, an idea could be tried in half a month; if it didn't work, you switched. Now every idea queues for three to six months first. And by industry counts, only a bit over thirty per cent pass on the first submission; sixty per cent must remediate and resubmit.

What innovation needs is not silver. It is a large supply of cheap, fast failures.

Filing did not forbid failure. It made failure expensive.

That is harder to notice than "strangled", and it does more damage.

But it also opened a door

The richest buyers in the jianghu are the prefecture, the money houses, the grain transport and the frontier army — in plain terms, government, state-owned enterprises, finance and telecoms.

Their tenders begin with one line: do you have a filing number. Without one you do not even qualify to bid.

So the same apparatus blocks small teams and opens the fattest market. The shape of the jianghu shifted from light, fast, lone traders to heavy, deep, escort agencies.

That is not an accident. It is part of the design.

And it drew a line: services, not weights

The plaque governs opening the doors to guests. It does not govern carving the scripture on the wall.

In plain terms: filing covers providing generative services to the public inside the country. It does not cover releasing the weights into the open.

The line is real, and it is written clearly.

But one account has to be settled correctly: Chinese model companies did not open-source because filing existed.

They were open-sourcing before this regime existed. America has no filing at all, and Meta's Llama and Mistral poured their weights out anyway. The reason is identical on both sides — the chaser trades openness for an ecosystem, the leader uses closure to defend a premium. Open source is a strategy dictated by position, not a by-product squeezed out by a regulation.

So open source cannot be booked as a credit to filing. By 2026, forty-one per cent of global open-model downloads are Chinese, and Qwen alone has spawned a hundred and fifty thousand derivatives — that was fought for, not leaked out.

Then what does the line actually mean?

It means all of the compliance pressure is driven, drop by drop, into the weights.

Everything the service layer can do, the weights cannot:

• The service layer can hang two curtains — one for inside the border, one for outside. Filter at home, don't filter abroad. The weights are a single file.
• The service layer can patch afterwards — find a problem, change the rules, add blocks, publish a notice. Weights, once out, do not come back.
• The service layer can pick its markets — if you don't want to file, don't launch in that market. Weights downloaded into someone's own courtyard have no curtains at all.

So on the open-source road, compliance has exactly one place to land: it has to grow into the weights.

Once that cut lands it cannot be pulled back out. The next section takes apart how it landed.

This door exists nowhere else

This regime is walked by China alone.

Others regulate too, but the shape is different. The difference is not whether they regulate. It is who makes the call, and whether a number is issued once the call is made.

The United States: no such door. There is no ex-ante approval of any kind at federal level. The executive order of 2 June 2026 lets frontier developers voluntarily show the government a model thirty days before release, and the text still has to state that it authorises no new mandatory licensing, pre-clearance or approval requirement — even "voluntary" needs a disclaimer that it is not a licence. California's SB 53, in force since 1 January 2026, is a disclosure duty: publish a frontier AI framework, issue a transparency report with each new model, report major incidents to the state office of emergency services within fifteen days. Those are "tell me", not "wait for my nod".

The European Union: there is an ex-ante step, but the step is proving it yourself. High-risk systems need a conformity assessment and a CE mark; general-purpose models need technical documentation, a copyright policy and a training-data summary, and then you file it into the EU database yourself. The EU audits afterwards and fines false declarations. That is self-certification, not application — the judgment stays with the company, and the regulator keeps only the right to hold it to account.

South Korea: a checklist of duties. The AI Basic Act took effect on 22 January 2026. Tell users they are interacting with AI; label generated content; keep human oversight in high-impact settings. Things you must do, not a number you must obtain.

So the accurate statement is this: "to provide generative services to the domestic public you must first pass regulatory review and obtain a number, and that number must be published as a searchable list" — that form exists, at present, only in China.

One word's difference changes the nature of the thing. Their threshold says: you must guarantee it yourself. China's threshold says: someone must guarantee it for you. The first pursues the company when something breaks; the second pursues whoever issued the number. And precisely because it is a guarantee on your behalf, it can afford such a coarse ruler — keyword lists, question banks, pass rates — without fearing that the measurement is crude.

Which is why rewriting the manual — writing conservatism into the weights so as to pass a content test — happens only where this door exists.

Western models do alignment too. They refuse, they pour values into weights, no less than China does. Two differences. The first is how wide the coverage is — as noted, the Western mainstream stops at weapons, bioweapons, children and self-harm, while China's boundary also takes in history, society, the humanities and current affairs. The second is the motive — theirs is product and commercial judgment: fear of litigation, of press, of a regulator arriving afterwards. It weighs cost against benefit and stops at good enough. Here it is an administrative test with a single calculation: will this be sent back.

But that is only the front half of the loop.

Blame the hallucination — that is done everywhere. After Grok's 4.6 million images, xAI's first reaction was that the technology wasn't mature. When OpenAI and Anthropic have incidents, the first sentence is that model behaviour cannot be fully predicted.

This door exists only in China, but the exit just outside it is used by everyone.

So the loop is two halves joined together: the front half — ex-ante review feeding intervention into the weights — is peculiar to China; the back half — something goes wrong, so attribute it to the technology — is universal. Each half makes sense on its own. Joined, they become a structure that needs no villain.

3. Rewriting the manual: the blade is not in those ten thousand words

Rewriting the manual means rewriting the weights. Through fine-tuning and alignment training, certain behaviours are carved into the model — not a filter hung on the outside.

To pass inspection, every school began rewriting.

Outsiders assume what gets rewritten is words — ten thousand banned terms, hit one and it is blocked. If that were all, the weights themselves would be clean.

They aren't.

The blade is not in those ten thousand words.

The two percentages that actually matter

Two numbers circulate in the industry for how the content test is scored:

• what should be refused must be refused at ninety-five per cent or above;
• what should not be refused must keep its refusal rate below five per cent.

The second is the subtle one. It says plainly, you may not play dumb — which means the people who wrote the rule understand that answering nothing is also a dereliction.

It is a two-way constraint. On paper, it is not confused at all.

The problem is the word "pass".

Only a bit over thirty per cent pass at the first attempt. Fail and you remediate; remediate and you wait again. So every schoolmaster runs the same arithmetic:

Doing it by the rule is "just barely at the bar". Doing it the safe way is "give up one more step than necessary".

One step doesn't matter. Ten don't matter.

What matters is that at some step you discover the disciple is not refusing to speak — he genuinely no longer knows.

So the damage splits into three layers

Surface: cannot speak.

Visible refusal. You can see it, complain about it, rephrase around it. The lightest layer.

Middle: says it differently.

The words have been replaced. It reads coherently, and is off by an inch at the key point. Visible, but you will not notice — because it imitates the experience of being persuaded without offering anything that can be checked.

Bottom: does not know.

The corpus was cleaned hard, and a stretch of history disappeared from the text.

This layer is the worst of the three. The model will not say "I am not familiar with that". It takes the nearest thing it has and assembles something that looks like an answer.

A knowledge void does not stay blank. It gets filled with fabrication.

And this layer does not produce refusals — it produces hallucinations, ones it cannot detect in itself.

None of the three can be produced by hanging a curtain

A curtain only cuts. Ask A, answer B, cut B, and what is left is a blank. In an inspection that is called non-responsive, and it fails just the same.

What is wanted is acknowledge the question, explain politely that it cannot be answered, then redirect. That calibration can only be trained into a model. It cannot be hung on the outside.

Rewriting cannot be hung either — a curtain does not make a thing more tactful, it only deletes.

So the real point of application was never the interface. It is the weights. And the effect wanted is not "block"; it is "grow into this shape".

Layer	What it looks like	Visible?
Cannot speak	Refusal, evasion, polite decline	Visible. You can complain
Says it differently	Right framework, key part swapped	Visible, but you will not notice
Does not know	The void, filled with fabrication	Invisible

Somebody has measured these accounts

• Over-refusal rates for Chinese models fall between 31 and 87 per cent. The best and the worst differ by more than a factor of two.
• On the same set of political questions, Chinese models refuse 30 to 60 per cent of the time. Western models, 0 to 3 per cent.
• One measurement put a Chinese model's rate of producing insecure code at about 19 per cent. Add a politically sensitive context to the prompt — even one with no bearing on the coding task — and the probability of a serious vulnerability rose by as much as 50 per cent.

The last of those is the most concrete. It shows that an adjustment made for one topic contaminates capabilities that have nothing to do with that topic.

This is called the alignment tax. The rate is not high, but the area it is levied on is wide.

But there is a counterexample that makes the claim precise

Someone tested refusal rates across models and got a surprise: three Claude models refused 100 per cent of direct attacks — the highest in the field.

In the same period, Claude Opus 5.5 scored 58.4 on the intelligence index, first in the world.

That pair of numbers kills the simplification that moderation must damage capability.

Alignment itself is not a capability killer.

So where is the difference? In how wide the coverage is.

• The boundary of the Western mainstream stops at weapons, bioweapons, children, self-harm and violent operations — a narrow list, published, predictable. Ask about history, politics, social questions and it answers, with a slant.
• The boundary of Chinese models extends from safety into the domain of knowledge — history, society, the humanities, current affairs, all of it inside.

So the accurate claim is not that moderation damages capability. It is this:

This account has not come due yet

The damage filing pressed into the weights is not costing a penny in overseas markets at the moment — not because it isn't being counted, but because the bill isn't due.

Overseas buyers still use Chinese models for exactly one reason: price-performance.

The same work, a chunk cheaper. Writing code, running pipelines, batch processing — errors there can be retried, and cheap is the entire argument. On the open platforms, Chinese models can account for more than forty per cent of calls; among AI startups raising money in Silicon Valley, an estimated eighty per cent build on Chinese open-weight models. Not because they are more trustworthy. Because they are better value.

Being good value and being trustworthy are two different things.

Good value is a ticket with an expiry date, and it is held up by two premises: that other people's capability has not yet come down to this price, and that other people's prices have not yet come down to this tier.

One of those premises is climbing. The other is walking downhill.

Capability is climbing. The frontier models keep closing on the leaderboards, and the open-weight branch has already taken first place once. On the day it draws level, "cheap" stops being the only reason, and buyers begin comparing the second thing: would I dare put this where a signature goes.

Prices are walking downhill. American mid-tier models have been cutting all the way and are already very low. Once prices meet, "cheap" is void on the spot, and what remains is "can it be trusted".

And "can it be trusted" is exactly the item that filing narrowed.

As said earlier, the damage collapses along topics: code, mathematics, pipelines — not weak at all; but at history, society, the humanities, current affairs, the model starts going around, starts rewriting, starts fabricating in the voids. Those are precisely the highest-priced jobs — law, finance, medicine, research, consulting. What they need is to be written correctly.

So the picture is clear: what you get is the load that is high-volume, replaceable and retryable; what you give up is the load that is high-priced and has to be right. The first is extremely price-sensitive. The second is extremely trust-sensitive.

The price-sensitive market will leave on the day prices meet. The trust-sensitive market never came in.

So the question is not whether the market is being lost now. It is that the day the price gap closes, the market drops.

4. One herb: why "it's a hallucination" works so well

There is an old case.

A man died. The coroner came. He lifted the eyelids, pressed the wrist, looked at the tongue, and finally fished a scrap of paper out of the sleeve. On the paper, traces of a herb.

The coroner held it up to the lamp and said: qi deviation. He strained his own qi.

And the herb?

The coroner folded the paper into his sleeve and said: that herb heals wounds and it ends lives. Once it is in the blood, the traces look the same.

The case closed there. It closed on four words: the traces look the same.

The 4.6 million images at the start are that case. "The technology was misused" and the coroner's "he strained his own qi" are the same sentence.

The three conditions it needs

First, the appearance is indistinguishable.

Sampling noise, statistical skew and directed shaping all come out as "this passage is wrong".

At the output end you cannot tell which one you are looking at.

An error without a fingerprint has no traceable responsibility.

Second, the right to attribute sits with the defendant.

To judge whether this was qi deviation or a drug, you need the training data, the fine-tuning objectives, the filtering rules, the change log of every version.

All of it is in the defendant's hands.

And "qi deviation" is a benevolent explanation that needs no evidence: it means we did nothing wrong, we are simply not strong enough yet.

Third, the word itself is true.

Qi deviation really exists. It really is a shared problem for the industry. It really deserves sympathy.

A cover works not because it is false, but because it is half true.

So a subtle result appears: hallucination becomes the only kind of error that can be forgiven — because it downgrades the error from intent to capability.

And once the downgrade is accepted, accountability stops automatically. Nobody prosecutes an unsolved problem.

Call every error a hallucination, and you have handed every act of manipulation a pre-signed waiver.

The outlier in the other jianghu: Grok pushed its limits to the minimum

Grok is not the Western default. It is the Western exception.

1 November 2023: Musk at the first AI Safety Summit at Bletchley Park. Two days later xAI released Grok, and its selling point was a rebellious streak — it would answer the spicy questions other models refused.

Image: Marcel Grabowski / UK Government, CC BY 2.0

The Western mainstream — Anthropic, OpenAI, Google — runs a sequence that is precisely the opposite: a system card before release, third-party evaluation, published risk thresholds, frontier safety commitments.

Grok goes the other way. Grok 4 shipped with no model card and no safety report. Both arrived two weeks later; the report cited the UK AI Safety Institute's third-party evaluation; then in late August the citation was quietly removed — no announcement, no explanation. And that evaluation's own conclusion was that the undefended version gave a non-expert attempting to build a bioweapon a meaningful uplift.

Grok 4.5 was another round of the same: no system card, no pre-release independent evaluation, no voluntary government review — and, to stay clear of the EU AI Act's high-risk classification, it simply didn't launch in the EU.

Now look at how it draws its boundary.

Its limits are in fact hard: weapons, bioweapons, illegal drugs, self-harm, fraud, trafficking, stalking and intimidation, any sexual content involving children — including fictional and AI-generated. And written absolutely:

Whatever identity the user claims, whatever purpose they claim, no methods are given, because real intent cannot be verified and the cost of misuse is severe.

It also writes a sentence that is easy to miss: you may acknowledge that these topics exist, you may name them and discuss their impact, but you may not elaborate on or describe the methods.

The topic may be discussed. The method may not.

That is xAI's own cut, not the Western rulebook. But the effect is peculiar: ask it about history, politics, controversy, and it answers — which feels like having no limits at all.

5. Two sentences: a jianghu that cannot hold both

There is an understanding in the jianghu that nobody discusses and everybody practises.

When you want to open a school, you say your art is controllable.

When something goes wrong, you say it was qi deviation.

The first is the capital you need for the plaque. You have to prove that this art is disciplined, that it moves at your will, that it will never wander off on its own, before the prefecture dares let you open the doors.

The second is the step down after an accident. You have to prove that this art is unfathomable, elusive, that even you cannot say when it will block — before the jianghu stops asking.

These two sentences never appear on the same sheet of paper.

Because they cannot both stand.

If it really does wander off on its own, then requiring it to answer "I don't know" ninety-five times in a hundred is demanding that a thing which wanders obey the rules.

If it really is that disciplined, then none of its errors can be blamed entirely on wandering.

Only one of these can be true.

Yet in the jianghu both have been true for years.

Because when the first was said, nobody was checking. And when the second was said, nobody dared check.

So the real question is not which sentence is true.

That switch matters more than any single rule.

6. The chivalric way: the ethical question got swapped

Then the chivalric way spoke up.

November 2023, the first AI Safety Summit at Bletchley Park. What was being debated on that stage was risk, not accuracy.

Image: UK Government, CC BY 2.0

What they raised was not "was he drugged". It was "should this art be practised at all".

That was the right question. The thing the jianghu should always have asked was never whether the form was standard, but whether this palm should be thrown.

But their question got swapped.

• From should this art exist at all to how do we make it more accurate.
• From who gets to name it to how do we reduce misjudgment.
• From who pays for the dead to the next version will be more stable.

The chivalric way is still speaking. But no longer about that.

All that is left of the rules is the form. The strike is gone.

A martial world with only forms left is the calmest martial world there is. Forms can be compared. The strike cannot be questioned.

Closing

Gather the whole board and it comes down to a few sentences.

1. Hallucination is real, and it is now a universal answer. It has three causes — bad qi, bad transmission, a drug — and only one symptom is visible from outside. When one word can hold every error, it stops being a diagnosis and becomes a pardon.
2. Filing governs the ledger, not the art. It guarantees you can find someone when something breaks; it does not guarantee the art is any good. It blocks small teams and opens the fattest market. What it really kills is not entrepreneurship — it is cheap failure. And this door exists only in China — elsewhere you either fill in your own forms or get chased afterwards; nowhere else requires approval and a number before you start. This account has not come due because it is still cheap. The day the price gap closes, it comes due.
3. The blade is not in the ten thousand words. It is in those two percentages. A keyword list cannot change weights; a ninety-five per cent refusal rate can. To avoid a rejection, companies give up a step toward caution; give up enough, and it is no longer "won't say" but "doesn't know". And that cut lands on the weights and flows out with the carved scripture. Nobody can patch it back.
4. Moderation does not hurt a model. Moderation that reaches into knowledge does. Claude refusing 100 per cent while ranking first on the intelligence index is the proof. A boundary drawn at method leaves capability whole; a boundary pushed into knowledge collapses it.
5. Limits are conserved. Don't set one in one place and it returns somewhere else, more expensively. China sets its limit at the training end and bills the user; Grok pushes its limit past the accident and bills the people who were deepfaked, the people the algorithm fed.
6. "Controllable" and "uncontrollable" cannot both hold, and the jianghu says both. Controllable when applying for the qualification; uncontrollable when seeking exemption. What is worth watching is not which sentence is true, but who holds the switch.
7. The chivalric way has been downgraded to a quality department. Still discussing, but no longer "should we" — only "is it accurate". And a martial world with only forms left is the calmest one there is.

The hardest thing about this apparatus is not that it is wicked. It is that it needs no villain.

The master says "his foundation wasn't ready" — true. The prefecture says "this is so you can find someone" — true. The schoolmaster says "we followed the rules" — true. The chivalric way says "we must practise more accurately" — also true.

Every sentence is true. Put together, they assemble a jianghu that may not be.