Introduction: A Cake Being Eaten from The Bottom Up
On January 21, 2026, Jensen Huang took the Davos stage at the World Economic Forum alongside BlackRock CEO Larry Fink and delivered what would become the most referenced framework in AI policy discussions of the year. He described artificial intelligence not as software, not as a product, not as a service, but as a five-layer industrial economy — a “cake” whose layers, from bottom to top, are: Energy, Chips, Datacenters, Models, and Applications/Agentic Systems. Each layer, Huang explained, feeds the one above it. Energy powers chips. Chips power infrastructure. Infrastructure trains and runs models. Models create the intelligence that applications convert into economic value. And every successful application cascades demand back down to the power plant at the bottom.
“AI is one of the most powerful forces shaping the world today. It is not a clever app or a single model; it is essential infrastructure, like electricity and the internet. AI runs on real hardware, real energy and real economics. It takes raw materials and converts them into intelligence at scale. Every company will use it. Every country will build it.”[1]
— Jensen Huang, CEO of Nvidia — Davos 2026 / “AI Is a 5-Layer Cake,” Nvidia Blog, March 10, 2026 [1]
Huang’s framework was not intended as a map of geopolitical risk. It was an investor thesis — a case for why the AI buildout would require trillions of dollars across the entire stack, from TSMC’s twenty planned new chip factories to the application-layer companies that would ultimately justify the capital expenditure. What Huang did not say, because it was not his argument to make, was that his cake was also a map of vulnerability: a five-layer index of the points at which a determined state actor, seeking to contain its rivals’ AI capability, could apply pressure.
Within six months of that Davos speech, two of those five layers had been subjected to active sovereign restriction. The story of how this happened — and what it means for the remaining three layers, and for the global AI economy — is the subject of this paper.
Layer Two, Chips, had been under assault since October 2022, when the Biden Administration imposed export controls on Nvidia’s A100 and H100 GPUs. The controls were tightened in October 2023, extended in January 2025 under the AI Diffusion Rule, and administered their most financially devastating blow in April 2025, when the Trump Administration restricted exports of the H20 — a chip Nvidia had specifically designed to comply with the earlier controls. [2] The Q1 fiscal 2026 earnings report told the financial story of Layer Two’s militarization with brutal precision: $44.1 billion in total revenue, a 69% year-over-year increase, [2] and yet simultaneously $4.5 billion in write-downs, $2.5 billion in unshipped orders, and the frank acknowledgment from Jensen Huang himself that
“The H20 export ban ended our Hopper data center business in China. The $50 billion China market is now effectively closed to U.S. industry.”[2]
— Jensen Huang, CEO of Nvidia — Q1 FY2026 Earnings Call, May 2025 [2]
Then, less than five months after Huang stood on the Davos stage and described his five-layer cake to the world, the second target was selected. On June 9, 2026, Anthropic launched Fable 5 and Mythos 5 — the most capable models it had ever released to the public, described by the company as exhibiting capabilities that “exceed those of any model we’ve ever made generally available.” [3] Three days later, at 5:21 p.m. Eastern Time on June 12, the U.S. Department of Commerce transmitted a directive ordering Anthropic to suspend all access to both models for any foreign national, anywhere in the world, including Anthropic’s own foreign-national employees. Layer Four — Models — had become the second layer of the AI economy to be struck by sovereign export control. The speed of the sequence is itself part of the argument: from Huang’s Davos framework to the first Model-layer emergency restriction in under five months, the AI economy moved from industrial metaphor to geopolitical battlefield faster than any policy architecture could anticipate or absorb.
The same day, in a coincidence that captured the manic energy of this particular technological moment, Elon Musk rang the opening bell on the Nasdaq from Starbase, Texas, as SpaceX raised $75 billion — pricing 555.6 million shares at $135 each and valuing the company at more than $1.77 trillion in the largest initial public offering in history. [4] Musk became the world’s first trillionaire. On the day that the private AI economy produced its first trillionaire and its largest IPO, the government struck down the most powerful publicly available AI model on earth for the entire non-American world. The contrast encapsulates the central tension this paper seeks to analyze: the immense commercial forces building the AI economy, and the immense sovereign forces that are, layer by layer, beginning to wall it off.
What this paper argues — and why it names both itself and its central framework Model Protectionism — requires a moment of deliberate explanation, because the name is not merely descriptive. It is diagnostic. The word “protectionism” is borrowed deliberately from the vocabulary of trade policy, where it has always described something more specific than mere restriction: it describes the use of state power to shield a strategically valued asset from foreign access, not simply to defend against a known threat, but to preserve a structural advantage over rivals who would otherwise close the gap. When the United States restricted steel in the twentieth century, or semiconductors in the twenty-first, the underlying logic was not only security — it was the maintenance of dominance through controlled scarcity. Model Protectionism applies that same logic to the fourth layer of Jensen Huang’s five-layer AI economy: trained neural network weights, the crystallized intelligence that is the AI industry’s most consequential and most transferable asset.
The reason this paper chooses that name, rather than a more neutral term like “AI export controls” or “model access restrictions,” is that Model Protectionism captures something those phrases do not: the coherent, upward-marching, strategically intentional character of what is happening. The targeting of Layer Two — Chips — in 2022 and the targeting of Layer Four — Models — in 2026 are not isolated policy decisions made in response to isolated security incidents. They are successive applications of the same sovereign logic to successive layers of the same industrial stack, each restriction made necessary partly by the inadequacy of the restriction below it. Chips alone could not contain intelligence already embedded in existing models. Models alone cannot contain intelligence that has already been distilled, extracted, or replicated into domestically controlled alternatives. The upward march is not coincidental. It is the structural consequence of applying containment logic to a technology whose value does not reside in any single layer but cascades upward through all five.
The three remaining layers — Energy (Layer One), Cloud Infrastructure and Data Centers (Layer Three), and Applications and Agentic Systems (Layer Five) — have not yet been subjected to the same sovereign chokehold treatment. But the pattern this paper identifies suggests the pressure will continue to move in that direction: not because any single government has a master plan to nationalize each layer of Huang’s cake in sequence, but because the internal logic of incomplete containment compels each successive restriction. The implications — for the global AI economy, for the nations that depend on its intelligence layer, for the open-science norms that made the AI revolution possible in the first place, and for the billions of people who will be affected by which side of the Algorithmic Iron Curtain they find themselves on — are not merely significant. They are civilizational in scope.
Section 1: The Five-Layer AI Economy — A Framework and Its Vulnerabilities
Before analyzing what has already been struck, one must understand what Jensen Huang built with his five-layer framework — and why it is, simultaneously, the most powerful conceptual map of modern AI and the most revealing index of where that AI can be choked. The framework did not originate at Davos. Huang had been developing the taxonomy across a series of investor events, keynote addresses, and public writings since at least 2025, culminating in his March 10, 2026 Nvidia blog post titled “AI Is a 5-Layer Cake,” which synthesized the thesis into its most complete public form. [5] At Davos, he presented the argument that the full-stack AI buildout was “the largest infrastructure construction in human history” — an effort that would require not just billions but trillions of dollars and would reshape labor markets, energy systems, and industrial supply chains at a global scale. [6]
1.1 The Five Layers Defined
Layer One — Energy: The physical foundation. AI training and inference are extraordinarily energy-intensive operations. Huang’s framework places energy at the base of the cake because without power — whether from natural gas, nuclear, solar, or other sources — none of the upper layers can function. The global AI buildout is already straining electrical grids and driving investment in new generation capacity. At Davos, Huang called energy the “hardest floor” of the AI economy: the constraint that limits how fast everything above it can grow.
Layer Two — Chips: The computational substrate. Graphics processing units, tensor processing units, and custom AI accelerators are the machines that convert energy into computation. Nvidia occupies a dominant position at this layer through its CUDA software ecosystem and its Blackwell and Hopper GPU families. Taiwan Semiconductor Manufacturing Company (TSMC) dominates the fabrication of the chips that Nvidia, AMD, and others design. This layer is where the first sovereign chokepoints were applied. [2]
Layer Three — Datacenters: The data centers, networking equipment, cooling systems, and cloud platforms that aggregate thousands of chips into unified training and inference environments. The “Big Five” hyperscalers — Amazon Web Services, Microsoft Azure, Google Cloud, Meta, and Oracle — collectively projected to exceed $600 billion in capital expenditure in 2026 [7] — are the primary builders of this layer. Without the infrastructure layer, individual chips cannot be organized into the coordinated computational environments required to train frontier models.
Layer Four — Models: The trained neural networks — the frozen intelligence crystallized from the energy, chips, and infrastructure of the three layers beneath. Foundation models like Claude, GPT-5, Gemini, and Llama are the outputs of this layer. Huang described the inflection point at Davos with precision:
“For the first time, the models are good enough to build on top of. This is the moment when AI transitions from research curiosity to economic engine.”[6]
— Jensen Huang, CEO of Nvidia — Davos 2026 [6]
Layer Five — Applications & Agentic Systems: The software products, industry-specific tools, autonomous agents, and AI-native companies that convert model intelligence into economic value. Healthcare diagnostics, legal copilots, autonomous vehicles, drug discovery platforms, financial trading systems — these are the outputs that justify the capital expenditure at every layer beneath. Huang described Layer Five as “where the economic benefit will happen.” [6] Crypto Briefing’s summary of Huang’s framework captured the dependency cleanly: “Every successful application pulls on every layer beneath it, all the way down to the power plant that keeps it alive.” [8]
1.2 The Stack as a Map of Vulnerability
What makes Huang’s framework so useful for geopolitical analysis is precisely its clarity about interdependency. If you can constrain any layer, you can constrain everything above it. Block energy access, and the chips cannot run. Block chips, and the infrastructure cannot scale. Block infrastructure, and the models cannot be trained. Block models, and the applications cannot be built. Block applications, and the economic value that justifies the entire investment cannot be realized.
This cascading dependency logic is not merely theoretical. It is the operational premise of the export control strategies that the United States has been executing since 2022. The initial GPU controls were designed to prevent China from accumulating the Layer Two (Chips) capacity needed to train frontier models (Layer Four). The January 2025 AI Diffusion Rule extended those controls explicitly to Layer Four itself — model weights — for the first time. [9] And the June 12, 2026 Anthropic directive represents the first emergency, real-time application of Layer Four controls to a model that was already deployed and in use worldwide.
The five layers can now be mapped against their geopolitical status as of June 14, 2026:
LAYER 1: ENERGY [WATCHING] Not yet subjected to sovereign export controls; monitored for data center energy dependencies.
LAYER 2: CHIPS (AI GPUs/Semiconductors) [STRUCK] Targeted by U.S. export controls since Oct 2022. H20 ban April 2025 cost Nvidia $4.5B in Q1 FY2026.
LAYER 3: DATACENTERS AND CLOUD INFRASTRUCTURE [WATCHING] Growing scrutiny of hyperscaler data center locations and cloud sovereignty mandates.
LAYER 4: MODELS (Foundation AI Models) [STRUCK] Anthropic Fable 5 & Mythos 5 disabled June 12, 2026 under emergency export control directive.
LAYER 5: APPLICATIONS AND AGENTIC SYSTEMS [NEXT?] Under growing regulatory scrutiny; Huang has warned policymakers against restricting this layer.
Two of five layers struck. Three under watch. The upward march has begun.
Section 2: The Anatomy of Model Protectionism — How Layer Four Was Targeted
To understand the June 12 directive as a geopolitical act rather than merely a national security precaution, one must place it in the context of how model protectionism works as a policy instrument — who it targets, what mechanisms it uses, and why it chose this particular moment to emerge. Model Protectionism, as this paper defines it, is the deliberate, state-enforced restriction on the cross-border transfer, distribution, or access to trained neural network weights, inference architectures, and model-derived intelligence — motivated by national security interests, economic competition, or the prevention of dual-use weaponization.
2.1 The Anatomy of the June 12 Directive
The sequence of events surrounding the Fable 5 and Mythos 5 restriction is important to understand in its full texture. Anthropic launched Fable 5 on June 9, 2026 — the first publicly accessible version of its “Mythos-class” model family, a tier the company described as exceeding all of its prior public releases in capability. The Mythos architecture had been partially previewed months earlier through “Project Glasswing,” an initiative that Anthropic had explicitly restricted to a small group of trusted organizations because of the model’s advanced cybersecurity capabilities. Fable 5 was Anthropic’s attempt to make those Mythos-class capabilities publicly available through new safeguards designed to block responses in specifically high-risk areas. [10]
One day after launch, Dario Amodei published a sweeping policy essay, “Policy on the AI Exponential,” calling on the U.S. government to assume legal authority to block or reverse frontier AI model deployments that fail independent safety testing — comparing the needed regime to FAA aircraft certification. [11] Two days after that essay, the government invoked precisely the logic Amodei had advocated. Anthropic received its directive at 5:21 p.m. Eastern Time on Friday, June 12. The letter, sent by the U.S. Department of Commerce citing national security authorities, ordered suspension of all access to Fable 5 and Mythos 5 for any foreign national — including Anthropic’s own foreign-national employees — whether inside or outside the United States. [3]
Anthropic’s statement captured the extraordinary position in which the company found itself:
“The US government, citing national security authorities, has issued an export control directive to suspend all access to Fable 5 and Mythos 5 by any foreign national, whether inside or outside the United States, including foreign national Anthropic employees. The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance.”[3]
— Anthropic, Official Statement — Fable 5 and Mythos 5 Access Suspension, June 12, 2026 [3]
The government’s reported justification was a jailbreak — a technique, shared with officials, that could potentially bypass Fable 5’s safety guardrails and unlock the underlying Mythos cybersecurity capabilities. Anthropic disputed the proportionality of the response:
“We disagree that the finding of a narrow potential jailbreak should be cause for recalling a commercial model deployed to hundreds of millions of people. If this standard was applied across the industry, we believe it would essentially halt all new model deployments for all frontier model providers.”[3]
— Anthropic, Official Statement — June 12, 2026 [3]
2.2 The Corporate-State Nexus: Proxy Labs and Sovereign Obligations
The Anthropic case illuminates a structural condition that this paper terms the “Proxy Lab” dynamic: private AI laboratories are progressively being transformed into state-monitored entities whose obligations to national security architecture supersede their commercial obligations to global customers. Anthropic is not a defense contractor. It is a company that filed a confidential S-1 with the SEC on June 1, 2026, less than two weeks before the directive, having just closed a $65 billion Series H funding round at a $965 billion post-money valuation — a company preparing to be one of the largest technology IPOs in history. [12] Its annualized revenue run rate had crossed $47 billion in May 2026. It had achieved a five-fold revenue increase in five months.
Into this commercial moment came a government letter at 5:21 p.m. on a Friday, ordering the company to switch off its two most powerful products for the world. The compliance was immediate and total. The damage to customer relationships, to ongoing commercial contracts, and to the company’s global reputation in the lead-up to its IPO was accepted as the cost of operating in the Proxy Lab paradigm.
The deeper irony is that Anthropic had, in the Amodei essay just two days earlier, explicitly called for a regime of government oversight — but a regime that was “transparent, fair, clear, and grounded in technical facts.” The June 12 directive, by the company’s own assessment, adhered to none of those principles. Amodei’s proposal envisioned an FAA-style certification process. What arrived instead was closer to an emergency grounding order, issued without warning, without third-party audit, and without specific explanation.
2.3 From GPU Border to API Border: The Chokepoint Moves Up the Stack
The shift from Layer Two (Chips) to Layer Four (Models) as a geopolitical chokepoint reflects a sophisticated understanding of how the AI economy actually works — and where its vulnerabilities actually lie. The insight that drives this shift is captured clearly by the January 2025 policy analysis from Just Security, which noted that “possession of the weights allows an adversary to deploy models without restrictions, modify them for malicious purposes, or study them to develop competing systems.” [13]
Restricting chips (Layer Two) prevents an adversary from training new frontier models. But it does nothing about models that have already been trained and already exist as files of numerical parameters that can be downloaded, copied, and run on whatever hardware is available. The H20 export ban prevented China from purchasing new Nvidia chips — but it did not prevent Chinese researchers from accessing Anthropic’s models through the public API and using them for research, product development, or capability assessment. The Model layer restriction closes that gap: by restricting API access itself, the June 12 directive extends the chokepoint from the physical manufacturing process (Layer Two) to the intelligence distribution network (Layer Four).
Viewed through the Five-Layer framework, the logic of progressive upward targeting becomes clear. Restricting Layer Two (Chips) slows the training of new frontier models but doesn’t restrict access to existing ones. Restricting Layer Four (Models) prevents direct access to trained intelligence but doesn’t stop an adversary from using cheaper open-source models or domestically trained alternatives. Each restriction is necessary but not sufficient. Each compels the next. The upward march of export controls through Huang’s cake is not accidental — it is the structural logic of a geopolitical competition being fought through an industrial stack rather than through a single technological chokepoint.
This dynamic has not escaped the attention of David Sacks, a key technology policy adviser to the Trump Administration, who framed the underlying question starkly:
“In each case we must ask the question, does this help the American tech stack dominate the world? What maximizes our global market share? If we look around the world in five years and see that the Global South is running on Huawei Cloud Matrix plus DeepSeek, that’s not the outcome that we want.”[14]
— David Sacks, Trump Administration Technology Policy Adviser [14]
Section 3: Technical Vectors of Model Leakage — Why Layer Four Requires Its Own Defense
To understand why governments have concluded that frontier AI models require export control treatment equivalent to that historically applied to weapons systems and advanced semiconductors, one must examine the actual threat landscape: the technical mechanisms through which the intelligence encoded in a model’s weights can be extracted, replicated, or weaponized without ever acquiring the weights themselves. The Layer Four restriction on June 12 was not arbitrary. It reflected a specific and technically coherent threat assessment that is worth understanding in full.
3.1 Model Extraction Attacks: Cloning Intelligence Through the API
The most elegant and most commercially practiced form of model intelligence theft requires nothing more than an API key and patience. In a model extraction attack — also called a distillation attack — an adversary uses legitimate access to a deployed model’s API to systematically query it, collecting input-output pairs that are then used to train a substitute model that approximates the original’s capabilities. The technique is intellectually straightforward: one simply asks the target model thousands or millions of questions and uses its answers as training data for a new model.
Google’s Threat Intelligence Group (GTIG) and Google DeepMind documented the industrial scale at which this is already occurring, in their February 2026 AI Threat Tracker report:
“Model extraction attacks (MEA) occur when an adversary uses legitimate access to systematically probe a mature machine learning model to extract information used to train a new model. Adversaries engaging in MEA use a technique called knowledge distillation (KD) to take information gleaned from one model and transfer the knowledge to another. Model extraction and subsequent knowledge distillation enable an attacker to accelerate AI model development quickly and at a significantly lower cost.”[15]
— Google Threat Intelligence Group (GTIG) & Google DeepMind, AI Threat Tracker, February 2026 [15]
The GTIG report further confirmed that during 2025, Google detected and disrupted “frequent model extraction attacks from private sector entities all over the world and researchers seeking to clone proprietary logic.” [15] These were not nation-state intelligence operations in the traditional sense — they were commercial competitors and independent researchers using legitimate API access to replicate capabilities that took hundreds of millions of dollars to develop.
For Fable 5, whose Mythos-class cybersecurity capabilities were the specific concern that triggered the June 12 directive, the extraction threat has a particular character. A foreign actor with access to Fable 5’s API and sufficient technical sophistication could, in principle, construct a distillation pipeline that systematically probes the model’s cybersecurity knowledge domains — vulnerability identification, exploit synthesis, network intrusion analysis — and uses the resulting data to train a domestically controlled model with equivalent capabilities and none of Anthropic’s guardrails. The resulting model would be a weapon by design rather than a tool constrained by policy.
3.2 Knowledge Distillation as Strategic Arbitrage
Knowledge distillation is the legitimate technique that model extraction attacks weaponize. In its proper form, distillation involves training a smaller “student” model on the outputs of a larger “teacher” model — a method used throughout the industry to create efficient, deployable versions of expensive frontier models. The security concern is that this technique, when applied without the model developer’s consent and with adversarial intent, functions as a form of industrial espionage that is technically legal (because it uses only publicly accessible outputs), practically unstoppable (because no API monitoring can perfectly distinguish legitimate from adversarial query patterns), and commercially devastating.
The competitive economics of distillation are dramatic. DeepSeek’s R1 model, released in January 2025 and trained for approximately $6 million, achieved near-frontier performance on a fraction of the budget required for its Western counterparts. [16] Whether or not R1 directly incorporated distillation from Western models — a question that remains contested — the episode demonstrated that the combination of algorithmic innovation and targeted knowledge transfer can close capability gaps that semiconductor export controls were designed to maintain. Restricting Layer Two (Chips) slows an adversary’s ability to train large models from scratch. But distillation from Layer Four (Models) allows them to bypass that constraint by training much smaller models on the intelligence already embedded in Western frontier systems.
3.3 The Jailbreak: Knowledge as the Ultimate Weapon
The government’s specific justification for the June 12 directive adds a third dimension of Layer Four vulnerability: the jailbreak. Unlike model extraction, which requires sustained effort and technical sophistication, a successful jailbreak requires only the discovery of a specific input pattern — a sequence of words or instructions — that causes the model to bypass its safety constraints and operate in an unconstrained mode.
For Fable 5, the concern was precisely this. The model was designed with guardrails preventing access to its Mythos-class cybersecurity capabilities in high-risk contexts. A jailbreak that defeated those guardrails would, in effect, convert a safety-constrained civilian AI tool into an unrestricted offensive cyber weapon — without any theft of weights, without any model training, and without any activity that current legal frameworks could characterize as theft or espionage. It would simply require knowledge: the right prompt, communicable in words, shareable on the internet.
This is the deepest technical reason why Layer Four controls are qualitatively different from Layer Two controls. A chip is a physical object that can be seized at a border, tracked through supply chains, and denied through manufacturing restrictions. A jailbreak is a form of knowledge that is, in principle, impossible to contain once discovered. The government’s response — remove the model entirely for all users worldwide — is the only technically reliable countermeasure available. It is also a blunt instrument of extraordinary proportions, and Anthropic’s statement made its disproportionality explicit.
Section 4: The Geopolitical AI Cold War — Who Controls the Layers Controls the Future
The progressive targeting of Jensen Huang’s five-layer AI cake cannot be understood in isolation from the broader geopolitical competition that motivates it. By the spring of 2026, the contest between the United States and China for AI dominance had entered a phase that both governments and independent analysts were describing in terms historically reserved for the nuclear arms race and the Cold War era space competition — but with a crucial difference: the scale of investment, the speed of development, and the geographic breadth of competitive engagement all dwarf anything the twentieth century produced.
4.1 The Scale of the Competition
The Center for Strategic and International Studies placed the magnitude of the contest in historical context in December 2025. The entire Apollo program, humanity’s most ambitious peacetime technological achievement, cost the equivalent of $326 billion in inflation-adjusted dollars over thirteen years. In fiscal year 2026 alone, just five U.S. companies — Meta, Alphabet, Microsoft, Amazon, and Oracle — were projected to spend more than $450 billion in AI-specific capital expenditure. [17] Add the investments of OpenAI, Anthropic, xAI, and others, and the annual figure exceeds the total Apollo program budget by a factor of three or more.
The Atlantic Council’s November 2025 assessment characterized the competition with appropriate gravity:
“The world has entered the most consequential tech race since the dawn of the nuclear age, but this time the weapons are algorithms instead of atoms. Rather than a race to obtain a single superweapon, this is one to determine how societies think, work, and make decisions.”[18]
— Atlantic Council — Geopolitics and AI, Inflection Points Series, November 2025 [18]
4.2 China’s Upward Response: Building the Stack from Inside
China’s strategic response to the U.S. export control campaign has been precisely to internalize as much of Huang’s five-layer cake as possible. Restricted from Layer Two (Chips) by Nvidia export controls, China has been investing massively in domestic semiconductor capability — most visibly through Huawei’s Ascend chip line, which has become the hardware platform for an increasing share of China’s AI research and development.
The most significant signal of this strategy came on April 24, 2026, when DeepSeek released its V4 model — trained specifically on Huawei Ascend NPUs rather than Nvidia hardware. [19] This was not merely a product launch. It was a demonstration of Layer Two independence: proof that China could train competitive frontier models without American chips. The Council on Foreign Relations, assessing V4 in April 2026, observed that the release “reflects China’s accelerating push toward technological self-sufficiency.” [20]
The velocity of China’s parallel stack construction was demonstrated with unusual clarity in April 2026, when five major Chinese AI laboratories — Z.ai, Moonshot, DeepSeek, Alibaba, and Xiaomi — released frontier-tier models within a single four-week window, using a combination of domestic hardware and open-source architectural innovations. [21] An Andreessen Horowitz partner estimated that by early 2026, 80% of U.S. startups were using Chinese base models for derivative development. Chinese models’ weekly token consumption on OpenRouter surpassed U.S. models in February 2026, and the gap has continued to widen. [22]
The CSIS assessment of the DeepSeek-Huawei dynamic, published in May 2026, identified the fundamental paradox at the heart of the chip export control strategy:
“DeepSeek’s success in large part reflects the lagging impact of the flawed first package of U.S. AI chip export controls in October 2022. The U.S. government acknowledged and partially remedied these flaws in its October 2023 update.”[23]
— Center for Strategic and International Studies — DeepSeek, Huawei, Export Controls and the Future of the U.S.-China AI Race, May 2026 [23]
4.3 Jensen Huang in Alaska: The Statecraft of the Stack
The geopolitical theater of the AI competition was vividly illustrated on May 13, 2026, when President Trump traveled to Beijing for a two-day state visit with President Xi Jinping — a summit explicitly described as centering on trade, security, and the AI competition. Seventeen American CEOs were on the initial invitation list, but Jensen Huang’s name was conspicuously absent. When media reported the absence, Trump personally called Huang and summoned him to join the delegation. Huang flew from the West Coast to Anchorage, Alaska, where he boarded Air Force One at a refueling stop. [24]
Huang’s own description of the episode captures the intimate and improvised nature of the relationship between private AI industry and state power in this era:
“The president called me in the morning. He didn’t know I wasn’t going. He insisted I get on the plane, so I hurriedly packed. He called as he was leaving and assumed I was in Washington D.C., ready to board Air Force One. But I was on the West Coast. He told me, ‘Let’s meet in Alaska,’ so I flew there, joined Air Force One, and then flew to China.”[24]
— Jensen Huang, CEO of Nvidia — Channel NewsAsia Interview, May 25, 2026 [24]
The man who defined the five-layer AI economy was summoned to a presidential aircraft in Alaska to serve as a geopolitical instrument in the competition that is, layer by layer, militarizing that same economy. The visual is a precise emblem of the Proxy Lab dynamic applied not to a single AI laboratory but to the entire AI industry stack. Twenty-nine days after that flight, the government would issue the directive that struck down Layer Four.
4.4 The Digital Divide: Layers of Inequality
The Five-Layer framework also clarifies the human cost of model protectionism with unusual precision. Each layer of the AI economy that is subjected to sovereign restriction reduces the number of people in the world who can access the intelligence that layer produces. Layer Two restrictions (Chips) limit the countries that can build domestic AI infrastructure. Layer Four restrictions (Models) limit the individuals who can access frontier intelligence, regardless of nationality, in real time.
When the June 12 directive disabled Fable 5 for all foreign nationals, it did not merely restrict Chinese researchers. It restricted a Nigerian medical student using Claude to study pharmacology. It restricted a Kenyan entrepreneur building agricultural market analytics. It restricted an Indonesian engineer developing Bahasa language tools. The order made no distinctions of use, of intent, or of affiliation.
The IMF has warned explicitly that AI could exacerbate cross-country income inequality, with growth impacts in advanced economies potentially more than double those in low-income countries. [25] A June 2026 Brookings analysis found that 24.7% of the working population in the Global North used AI tools, compared to 14.1% in the Global South, as of the second half of 2025. [26] Of the 23 gigawatts of global data center capacity under construction as of September 2025, approximately 75% was located in the United States. The infrastructure of the AI economy is already radically unequal. Model protectionism, applied to the layer where intelligence is actually delivered, risks converting a digital divide into a permanent intelligence chasm.
Professor Daron Acemoglu of MIT, one of the world’s foremost economists of technology and inequality, has framed the structural dynamic that model protectionism is accelerating:
“Capital-intensive innovations developed in advanced economies might not be particularly useful in poor economies where labor is abundant and capital is scarce. AI-driven divergence between the rich and developing worlds is not inevitable, but needs to be addressed urgently.”[27]
— Professor Daron Acemoglu, MIT — Network Readiness Index Analysis [27]
Stanford HAI’s Co-Director James Landay identified AI sovereignty — the pressure on nations to assert independence from dominant AI providers — as the defining policy trend of 2026:
“AI sovereignty will gain huge steam this year as countries try to show their independence from the AI providers and from the United States’ political system.”[28]
— James Landay, HAI Co-Director and Professor of Computer Science, Stanford University — Stanford AI Predictions 2026 [28]
Nations excluded from Layer Four access are not passive. They are constructing alternative stacks. Malaysia has launched a sovereign AI ecosystem on Huawei hardware. Singapore’s OCBC Bank runs over thirty internal tools on DeepSeek and Qwen. Indonesia’s Indosat has partnered with a DeepSeek-based AI firm. [22] The nations that model protectionism most seeks to contain are building the very alternative global AI infrastructure — Chinese-aligned, open-source, state-supported — that U.S. policy is ostensibly designed to prevent.
Section 5: The Open-Source Counter-Movement and the Enforcement Impossibility
Against the progressive sovereignization of the Five-Layer AI stack, the open-source AI movement represents the most powerful structural counterforce in existence — and the one most fundamentally at odds with the logic of model protectionism. Open-source AI is, in its essence, the assertion that trained model weights are knowledge, that knowledge belongs to humanity, and that attempting to restrict the distribution of knowledge through state power is both philosophically wrong and practically futile. Whether that assertion can survive the era of model protectionism is one of the defining questions of the current technological moment.
5.1 Meta’s Open Bet: Strategic Logic and Its Limits
The most consequential decision in the open-source AI ecosystem has been Meta’s sustained commitment to releasing high-capability models under open or near-open licenses. The Llama model family — progressing through versions 1, 2, 3, 3.1, 3.2, and 4 — has made Meta the primary architect of the open-weight AI world, a company whose GPU fleet had grown to over 1.5 million units by early 2026 and whose projected 2026 capital expenditure of between $115 billion and $135 billion [29] rivals or exceeds the GDP of many developing nations.
Meta’s strategic logic is straightforward: open-weight distribution lowers the barrier to entry for companies building AI applications (Layer Five), which expands the ecosystem that depends on Meta’s underlying infrastructure, which reinforces Meta’s platform position. Mark Zuckerberg has argued publicly that open-source AI is not merely a business strategy but a democratic imperative — that allowing any single company to monopolize frontier AI capability is dangerous for both commerce and society.
But the security logic of model protectionism runs in precisely the opposite direction. By December 2025, internal tensions at Meta were surfacing in public reporting. CNBC sources within the company described growing dissatisfaction with open-source risks, citing specifically DeepSeek’s use of Llama architectures as a concern — a concern that had influenced leadership changes on the AI team. Mark Zuckerberg was reported to have confirmed that Meta would not release superintelligence-capable models as open-source. [30]
The strategic vulnerability of open-weight distribution is clear from a Five-Layer perspective: when Meta releases Llama 4 weights, it releases them without any layer-specific access controls. A researcher in a country subject to U.S. export restrictions can download Llama 4, fine-tune it on restricted topics, and deploy it in an environment without any of Meta’s usage constraints. The Layer Four restriction applied to Anthropic’s Fable 5 — disabling API access for foreign nationals — has no equivalent mechanism for a model whose weights have already been downloaded to servers worldwide.
5.2 The Enforcement Impossibility and the Recall Problem
The enforcement impossibility at the heart of open-weight model policy is one of the defining asymmetries of the model protectionism era. Once a model’s weights have been released — onto Hugging Face repositories, onto BitTorrent networks, onto private servers in jurisdictions that do not recognize U.S. export control authority — those weights cannot be recalled. A government can issue a takedown notice to a U.S.-based repository. It cannot reach a server in a jurisdiction that has not agreed to comply, nor can it un-train the derivative model that a foreign researcher built before the takedown.
The January 2025 AI Diffusion Rule attempted to address this asymmetry explicitly, by exempting publicly available model weights from its export controls while targeting closed-weight models above specific capability thresholds. [9] The logic was that attempting to restrict already-released open-source models would be futile, while restricting the most capable closed models was both legally feasible and strategically meaningful. But this framework creates a perverse incentive: it punishes the most safety-conscious labs — those, like Anthropic, that maintain closed weights and robust access controls — while leaving those that release everything open to circumvent the entire system.
The Anthropic case demonstrates precisely this inversion. Anthropic’s closed-weight, API-gated model was instantly controllable: the government issued a directive, and within hours Fable 5 was dark for the world. Meta’s open-weight Llama models, simultaneously available for download worldwide, were not subject to any comparable emergency restriction. The layer that was regulated was the layer that was most transparent and most responsible. The layer that was left unrestricted was the one that was, from a model protectionism standpoint, already uncontrollable.
5.3 Sovereign Open Source: Nations Build Their Own Layer Four
The developing world’s response to both closed-model protectionism (Anthropic-style) and open-model geopolitical risk (Chinese-origin models) has been to invest in what analysts term “sovereign open source” — state-funded or state-supported AI models developed domestically and released under open licenses, explicitly positioned as independent of both American and Chinese AI gatekeepers.
India launched its sovereign large language model at the AI Impact Summit in February 2026. France has been the principal backer of Mistral AI, which operates as Europe’s primary indigenous frontier AI laboratory. The Atlantic Council’s 2026 geopolitical forecast noted the momentum:
“Nations are seeking sovereign AI to strengthen their domestic economies, protect national security, mitigate geopolitical shocks, and reflect national values. That momentum will only grow in 2026.”[31]
— Atlantic Council — Eight Ways AI Will Shape Geopolitics in 2026, January 2026 [31]
Sovereign open source represents a Layer Four rebellion against the logic of model protectionism. Rather than accepting dependence on either American closed-weight models (now subject to emergency government restriction) or Chinese open-weight models (with their own political entanglements), these nations are building indigenous Layer Four capacity. The Algorithmic Iron Curtain, by excluding them from American AI, is actively accelerating the very diffusion of AI capability it ostensibly seeks to concentrate.
Section 6: Economic Costs and Market Distortion — The Price of Striking the Layers
Model protectionism is not cost-free for the societies that impose it. The economic consequences of progressively subjecting Jensen Huang’s five-layer AI economy to sovereign restriction are complex, multi-dimensional, and only beginning to be measured — but the early financial evidence from the Chips layer gives a precise preview of what Model-layer restriction will cost. Understanding these costs is essential to evaluating whether the national security benefits of model protectionism are proportionate to the commercial and innovation damage it demonstrably inflicts.
6.1 The Quantified Cost of Striking Layer Two: Nvidia’s $4.5 Billion Lesson
The financial cost of applying export controls to Layer Two (Chips) was documented with unusual precision in Nvidia’s Q1 FY2026 earnings report — the most detailed financial accounting yet produced of what happens when a layer of Huang’s cake is struck by sovereign action. The headline was extraordinary: $44.1 billion in revenue, a 69% year-over-year increase, driven by global Blackwell GPU adoption and surging AI inference demand. [2] But the detail beneath the headline told the story of Layer Two’s militarization: a $4.5 billion charge due to excess H20 inventory made unsaleable by the April 2025 export controls, $2.5 billion in H20 revenue that could not be shipped, and a projected $8 billion impact on H20 revenue in the following quarter. The China market — which Huang estimated at $50 billion annually — was, in his own words, “effectively closed to U.S. industry.”
Nvidia’s own 10-Q filing for FY2026 acknowledged the structural exposure with the directness required of public company risk disclosures:
“Export controls and other restrictions targeting GPUs and semiconductors associated with AI, which have been imposed and are likely to be more restrictive, would further limit our ability to export our technology, products, or services, creating a competitive disadvantage for us and negatively impacting our business and financial results.”[32]
— Nvidia Corporation — Form 10-Q, FY2026, U.S. SEC Filing [32]
The Layer Two cost, in other words, was not merely $4.5 billion in a single quarter. It was the permanent closure of a $50 billion annual market, ongoing compliance costs, product redesign cycles driven by regulatory uncertainty, and a structural competitive disadvantage in China that benefited Huawei’s Ascend line at American industry’s expense. Layer Two restrictions cost the U.S. AI economy more than they cost China’s AI development — a pattern that every additional layer’s restriction is likely to replicate.
6.2 The Compliance Burden and the Proxy Lab Tax
The Anthropic case illustrates a second category of economic cost: the compliance overhead imposed on AI laboratories that must operate as de facto border enforcement agencies for the national security apparatus. When Anthropic received its June 12 directive, it faced an impossible technical choice: attempt to selectively disable model access for foreign nationals in real time — a task that raises profound questions about verification reliability, privacy, and false positive rates — or disable the models for everyone. It chose the latter, at a cost to commercial relationships, customer trust, and the company’s IPO trajectory that cannot yet be quantified but is unlikely to be small.
Looking forward, the prospect of mandatory pre-deployment reviews, capability thresholds requiring third-party audits, and the ever-present risk of an emergency directive represents an ongoing compliance overhead that is most easily absorbed by the companies large enough and well-capitalized enough to staff dedicated regulatory teams. Dario Amodei’s “Policy on the AI Exponential” proposed a certification regime explicitly modeled on the FAA — a regime whose costs, by the FAA analogy, would run to tens of millions of dollars per new model deployment. [11]
Industry observers noted the regulatory capture risk embedded in this structure. As one analyst summarized: “A certification regime built around compute thresholds, authorized evaluators, and security standards is a regime that frontier labs are structurally better positioned to absorb than smaller challengers. Anthropic, which already runs red teams, already protects its weights, already produces the documentation, is particularly well-positioned to navigate.” [33] The rules proposed by Anthropic may inadvertently construct the moat that protects Anthropic.
6.3 Monopolization, Fragmentation, and the Hyperscaler Geopolitics of Layer Three
The Five-Layer AI Economy framework also clarifies the economic distortions that flow from selective layer restriction. When a layer is restricted for geopolitical purposes, the companies best positioned to navigate those restrictions gain structural advantages over competitors that cannot. At Layer Two (Chips), the beneficiaries of Nvidia’s China exclusion are Chinese domestic chip producers — primarily Huawei — and, paradoxically, any AI lab that had already accumulated large Nvidia GPU reserves before the controls tightened.
At Layer Three (Datacenters and Cloud Infrastructure), a different form of monopolization is already underway. The Big Five hyperscalers, collectively projected to exceed $600 billion in 2026 capital expenditure, [7] are building the physical infrastructure of the AI economy in a pattern that is as geographically concentrated as it is financially enormous. Of the 23 gigawatts of global data center capacity under construction as of September 2025, approximately 75% was in the United States. [26] The Layer Three build-out is American infrastructure, owned by American companies, funded by American capital markets, and subject to American sovereign jurisdiction. As Layer Four restrictions extend the chokepoint from chip manufacturing to model access, Layer Three’s geographic concentration becomes an additional form of leverage — and an additional vulnerability, for any nation that has allowed its AI economy to depend on American cloud services.
The World Economic Forum’s June 2025 analysis warned explicitly that a few companies are threatening to monopolize the technology’s future, stifling access to computing power, data, and the advanced models needed by startups. [34] Model protectionism, by creating government-endorsed moats around the most capable AI systems, compounds this monopolization tendency — concentrating intelligence in a small number of state-adjacent corporations that can afford regulatory compliance overhead while the broader ecosystem is progressively excluded from the frontier.
Section 7: Five Pillars of the Algorithmic Iron Curtain
The events of the first half of 2026 — taken together, from the Nvidia earnings that quantified Layer Two’s militarization, through the Jensen Huang Alaska episode, through Dario Amodei’s policy essay, to the June 12 directive that struck Layer Four — constitute a coherent picture of an emerging sovereign order for artificial intelligence. This paper identifies five structural pillars of that order, each representing not merely a policy choice but a conceptual transformation in how states, corporations, and societies are beginning to understand the relationship between intelligence, technology, and power in the era of the Five-Layer AI Economy.
Pillar 1: The Weight Moat — Trained Parameters as Sovereign Property
The first and most foundational pillar is the reconceptualization of trained neural network weights — the numerical parameters that constitute a frontier AI model — as non-tangible sovereign property. This reconceptualization represents the deepest transformation in AI governance philosophy. For the first decade of the deep learning era, model weights were understood primarily as intellectual property — the product of a commercial development process, owned by the company that created them, protectable under trade secret law, and transferable through licensing agreements.
The June 12 directive marks the formal departure from that framework. Under the Weight Moat conception, a sufficiently capable model’s parameters are treated as strategic national assets — comparable in their policy treatment to enriched uranium specifications, aerospace guidance architectures, or signals intelligence collection methods. They are not merely owned; they are controlled, restricted, and in emergencies recalled, by the state that claims jurisdiction over the laboratory that produced them. Anthropic did not merely have a product disabled. It had a Layer Four national asset recalled by the sovereign that, under the Weight Moat doctrine, has senior claim to its disposition.
Anthropic CEO Dario Amodei had himself articulated the trajectory toward this moment in his “Policy on the AI Exponential” essay, arguing that “now the risks are clearly here” and that it is “time to go beyond transparency to more serious and binding regulation of AI.” [11] The Weight Moat is the logical conclusion of that argument — and it arrived, in its emergency form, before the orderly regulatory framework Amodei proposed had been built.
Pillar 2: The API Border — Cloud-Based Sovereignty Enforcement
The second pillar is the transformation of national borders from physical checkpoints into algorithmic access controls — what this paper terms the API Border. Traditional export control enforcement was designed for physical objects: chips, machines, blueprints, and materials that crossed a customs checkpoint in a container ship or a cargo plane. The emergence of AI-as-a-service, delivered through API calls across the public internet, has rendered this physical paradigm technically obsolete.
The June 12 directive required Anthropic to implement API-level national identity verification — to determine, in real time and at the moment of every API authentication, whether the requesting entity was a U.S. citizen or permanent resident, and to deny access to everyone else. The technical challenges of this task are substantial: IP address geolocation is unreliable; VPNs can trivially spoof national origin; enterprise API keys are often shared across multinational teams. Anthropic’s solution was the only technically reliable option available — disable the models for everyone — which is itself a form of the API Border operating at its most extreme setting.
The API Border represents a fundamentally new form of sovereignty enforcement: not a physical barrier but a logical one, implemented in software, applied at the moment of intelligence access rather than at the moment of physical transport. It is, in the terms of Huang’s framework, a chokepoint installed at the point where Layer Four (Models) communicates with Layer Five (Applications) — designed to prevent foreign actors from extracting intelligence from the American AI stack while allowing domestic actors uninterrupted access.
Pillar 3: Architectural Cloaking — The Black Box as Security Architecture
The third pillar is the systematic shift away from transparent, auditable AI systems toward heavily guarded, closed-weight APIs designed to prevent not just weight theft but capability assessment — what this paper terms Architectural Cloaking. The security logic is straightforward: if a model’s capabilities are fully understood by those who query it, those capabilities can be replicated through distillation. If a model’s architecture is transparent, it can be studied for vulnerabilities, for jailbreaks, and for the exact safety properties that distinguish it from a weaponizable alternative.
The Black Box Mandate creates direct tension with the AI safety community’s foundational commitment to transparency as a prerequisite for accountability. You cannot audit a model you cannot see. You cannot identify failure modes in a system whose architecture is classified. The push toward opacity in the name of security may thus inadvertently undermine the safety properties that security controls are designed to protect — creating models that are more powerful, less understandable, and less verifiable than their transparent counterparts, operated by companies whose compliance with safety standards can only be verified through the same government oversight process that issued the June 12 directive.
Just Security’s June 2026 policy analysis captured the technical stakes of the weight control debate:
“Possession of the weights allows an adversary to deploy models without restrictions, modify them for malicious purposes, or study them to develop competing systems. Model weights and model outputs present fundamentally different challenges.”[35]
— Sam Winter-Levy & Teddy Tawil, Just Security — AI Model Outputs Demand the Attention of Export Control Agencies, June 2026 [35]
Pillar 4: The Proxy Lab — Private AI Companies as State Security Instruments
The fourth pillar is the transition of private AI laboratories from commercial enterprises into state-monitored, state-directed entities that must prioritize national security requirements over global market expansion — the Proxy Lab transformation. Anthropic’s June 12 experience is the defining case study of this transformation in its emergency form.
The Proxy Lab is not a formal designation. It is a structural condition that emerges from the combination of Layer Four (Model) controls, national security classification authorities, and the commercial reality that the most capable AI models are built by a small number of well-capitalized private companies that are, simultaneously, the most commercially valuable and the most strategically significant entities in the American AI economy. Anthropic is a company that was valued at $965 billion in May 2026, [12] filed a confidential IPO S-1 on June 1, [12] and had its two most commercially significant products disabled eleven days later by a government directive it received at 5:21 p.m. on a Friday with no advance notice and no specific explanation. The Proxy Lab condition is not hypothetical. It has already arrived.
The June 12 directive also illuminated the gap between the regulatory framework Amodei had proposed and the regulatory reality that materialized. Amodei called for a system that is “transparent, fair, clear, and grounded in technical facts.” The directive, by Anthropic’s own assessment, was none of those things. The Proxy Lab operates under the emergency authority version of AI governance, not the orderly version — and the emergency version is what companies face in the present, regardless of what the orderly version might eventually become.
Pillar 5: Technical Balkanization — The Fractured Intelligence Web
The fifth and most consequential pillar is the progressive fragmentation of the global AI economy into regional intelligence architectures that cannot fully interoperate, cannot share models across borders, and cannot participate in unified global research without navigating an ever-more-complex lattice of national restrictions — the Fractured Intelligence Web. The Five-Layer AI Economy, as Jensen Huang described it at Davos, is a global industrial system. Its efficiency depends on the ability of energy, chips, infrastructure, models, and applications to flow freely across national boundaries, accumulating scale and network effects in ways that no single national market can replicate.
Model protectionism, applied sequentially to Layer Two (Chips) and now Layer Four (Models), is progressively disaggregating that global system into parallel national stacks. The U.S.-China AI divide is the most visible dimension of this fragmentation: an American stack built on Nvidia chips, Amazon/Microsoft/Google infrastructure, Anthropic/OpenAI models, and Silicon Valley applications; and a Chinese stack built on Huawei Ascend chips, Alibaba Cloud/Baidu infrastructure, DeepSeek/Qwen models, and Bytedance/Tencent applications. Between and around these two stacks, a growing number of nations — India, France, the UAE, Saudi Arabia, Southeast Asian economies — are constructing partial sovereign alternatives, motivated precisely by the realization that dependence on either dominant stack carries political risk that sovereign capacity can mitigate.
Deloitte’s 2026 semiconductor supply chain analysis identified the expanding footprint of technology balkanization:
“Export controls and other trade restrictions have started to affect a broader footprint of semiconductor equipment, materials, software, design tools, various kinds of chips, and packaging and assembly tools in 2025 and 2026 compared to two or three years ago.”[36]
— Deloitte — Semiconductor Supply Chain Analysis, 2026 [36]
The GAIA Insights analysis of sovereign AI strategy captured the psychological reality of this fragmentation for non-aligned nations: “Nations aligned with the U.S. stack face a persistent unease: How vulnerable are we to U.S. foreign policy shifts or export controls? Recent GPU licensing restrictions and cloud governance debates show how swiftly U.S. policy can change. For many countries, the emotional response is a mix of admiration and anxiety. They want the innovation, but not the dependency.” [37]
The Fractured Intelligence Web is not a bilateral U.S.-China phenomenon. It is a global restructuring of the most important technology economy in human history, driven by the recognition that in an era of model protectionism, the layers of Jensen Huang’s cake are national security infrastructure — and that every nation that does not control its own layers is vulnerable to the decisions of those that do.
Conclusion: The Remaining Three Layers and the Choice Ahead
The Anthropic block of June 12, 2026, is the second major act in a drama whose first act was the H20 export ban of April 2025, and whose subsequent acts are not yet written. Two of Jensen Huang’s five layers have been struck. Three remain. The question this paper has sought to examine — and that policymakers, investors, and citizens of every nation must now confront — is whether the upward march through the AI stack will continue, and if so, what it will take to stop it.
The logic of progressive layer restriction is coherent and, in its own terms, rational. Restricting Layer Two (Chips) slows adversary training capacity but doesn’t restrict access to existing models. Restricting Layer Four (Models) closes that gap but doesn’t prevent adversary cloud infrastructure from hosting alternative models. Restricting Layer Three (Cloud Infrastructure) could attempt to close that gap — but would require the United States to impose sovereignty claims on data centers in allied nations and to compel American hyperscalers to deny service to entire classes of foreign customers. The economic and diplomatic cost of Layer Three restriction would be orders of magnitude greater than what Layer Four restriction has already cost.
Layer Five (Applications) is already under scrutiny. Nvidia’s own Jensen Huang warned at CES 2026 that “policymakers who restrict the application layer risk undermining the entire technology stack” — and Crypto Briefing’s summary of that warning made the downstream logic explicit: if applications are restricted, demand for every layer beneath them collapses. [38] Restricting Layer Five would not merely harm the AI economy. It would destroy the financial justification for the entire Five-Layer buildout that Huang described at Davos as “the largest infrastructure construction in human history.”
The central paradox of model protectionism — and it is a paradox with historical precedent in every prior era of technology containment — is that the restrictions intended to preserve dominance may be the most efficient mechanism for ensuring that dominance does not last. DeepSeek’s V4 was trained on Huawei Ascend chips not because Huawei chips are superior to Nvidia’s — they are not — but because American export controls left Chinese researchers no alternative. The algorithmic innovations that resulted from that constraint are now available to the world. The laboratory that was supposed to be contained has instead developed capabilities that are accelerating the global field, including the field of adversary AI development.
Dario Amodei recognized this dynamic in his June 10 essay, writing that opposition to AI openness was in many ways understandable but ultimately counterproductive when applied without principled boundaries. [11] The irony is that his own company’s most advanced products became the casualty of precisely the kind of blunt, unprincipled restriction he had argued against — applied by a government that drew on his own essay’s logic but not its safeguards.
The question for the next decade is whether the international community — governments, AI laboratories, research institutions, and the civil society organizations that represent the billions of people who will ultimately be affected — can construct a middle path between the two extremes that are currently pulling the AI economy apart. At one extreme is the fully open global AI commons — a world in which model weights flow freely, research is shared openly, and access to frontier intelligence is a universal right. That world is incompatible with the national security concerns that motivated the June 12 directive. At the other extreme is the fully restricted, fully balkanized AI economy — a world of five or ten or twenty national AI stacks, each governed by sovereign authority, incompatible with each other, and inaccessible to the nations that cannot afford to build their own. That world is incompatible with the collaborative scientific norms and the economic logic of network effects that made the AI revolution possible in the first place.
The middle path requires what the June 12 directive conspicuously lacked: a transparent, auditable, third-party-verified system for determining which AI capabilities are genuinely too dangerous for unrestricted global distribution, and applying the minimum necessary restriction to those specific capabilities while preserving broad access to the general intelligence that Layer Four produces. Amodei’s FAA analogy is imperfect but directionally correct: aircraft are not banned from flight because a jailbreak was discovered in the avionics software. They are grounded for the minimum time necessary to assess and fix the specific vulnerability, and then they fly again.
The Algorithmic Iron Curtain is not yet fully drawn. Two of five layers have been struck, and the remaining three are under increasing pressure. The decision of whether to continue the upward march — or to stop, reassess, and build the transparent governance architecture that can distinguish genuine threats from commercial protectionism — will determine not just the architecture of the global AI economy but the architecture of the world that AI is already beginning to build. The cake, as Jensen Huang described it, must expand together for AI to become economically useful. The question is whether sovereign restriction will hollow it out from the inside before it can be finished.
— Stefanus.AI, June 14, 2026
Endnotes & Bibliography:
[1] Jensen Huang, CEO of Nvidia. “AI Is a 5-Layer Cake.” Nvidia Official Blog, March 10, 2026. First presented at World Economic Forum, Davos, January 21, 2026. URL: https://blogs.nvidia.com/blog/ai-5-layer-cake
[2] Nvidia Corporation. Q1 FY2026 Earnings Report (quarter ended April 27, 2025). Revenue $44.1B (+69% YoY); Data center $39.1B (+73%); $4.5B H20 write-down; $2.5B unshipped H20; Jensen Huang H20 export ban quote. URL: https://mlq.ai/news/nvda-q1-2026-revenue-soars-69-to-44b-ai-demand-surges-but-export-controls-impact-china-sales/
[3] Anthropic. “Statement on the US government directive to suspend access to Fable 5 and Mythos 5.” June 12, 2026. URL: https://www.anthropic.com/news/fable-mythos-access
[4] Bloomberg / Washington Post / The National. “SpaceX IPO Makes Elon Musk World’s First Trillionaire.” June 12, 2026. SpaceX raised $75B at $135/share; valued at $1.77T; Musk becomes world’s first trillionaire. URL: https://www.bloomberg.com/features/2026-spacex-ipo-elon-musk-trillionaire/
[5] Jensen Huang. “AI Is a 5-Layer Cake.” Nvidia Blog, March 10, 2026. Rare standalone essay synthesizing the five-layer framework. URL: https://blogs.nvidia.com/blog/ai-5-layer-cake
[6] Bernard Marr. “Davos 2026: Jensen Huang on the Five-Layer AI Cake, The AI Bubble and Key AI Breakthroughs.” BernardMarr.com, March 2026. Summarizes Huang-Fink Davos dialogue. Huang quote: “For the first time, the models are good enough to build on top of.” URL: https://bernardmarr.com/davos-2026-jensen-huang-on-the-five-layer-ai-cake-the-ai-bubble-and-key-ai-breakthroughs/
[7] Stabilarity Hub. “Tech Cold War 2026 — Microsoft, AWS, and the Geopolitics of AI Infrastructure.” March 11, 2026. Big Five hyperscalers projected to exceed $600B capex in 2026, 36% increase over 2025. URL: https://hub.stabilarity.com/tech-cold-war-2026-microsoft-aws-and-the-geopolitics-of-ai-infrastructure/
[8] Crypto Briefing. “Nvidia CEO Jensen Huang Warns Against Hindering AI Application Layer.” June 2026. Summary of Huang five-layer logic and application-layer dependency quote. URL: https://cryptobriefing.com/nvidia-huang-warns-ai-application-layer/
[9] U.S. Bureau of Industry and Security (BIS). “Framework for Artificial Intelligence Diffusion — Interim Final Rule.” January 13, 2025. Jones Day legal analysis. URL: https://www.jonesday.com/en/insights/2025/02/new-export-control-rule-regulates-global-diffusion-of-artificial-intelligence
[10] CNBC / Time Magazine. “Anthropic Pulls Its Most Powerful AI Models After U.S. Bars Foreign Access.” June 13, 2026. Background on Fable 5, Mythos, Project Glasswing. URL: https://time.com/article/2026/06/13/anthropic-fable-mythos-ban-US-security/
[11] Dario Amodei, CEO of Anthropic. “Policy on the AI Exponential.” June 10, 2026. Published at darioamodei.com. FAA analogy, binding regulation call, five policy domains. URL: https://darioamodei.com/post/policy-on-the-ai-exponential
[12] TechCrunch / Yellow.com / Enterprise DNA. Anthropic Series H and S-1 filing. $65B Series H closed May 28, 2026 at $965B post-money valuation. Confidential S-1 filed June 1, 2026. $47B annualized revenue run rate. URL: https://techcrunch.com/2026/06/01/anthropic-files-to-go-public/
[13] Sam Winter-Levy and Teddy Tawil. “AI Model Outputs Demand the Attention of Export Control Agencies.” Just Security, June 11, 2026. URL: https://www.justsecurity.org/126643/ai-model-outputs-export-control/
[14] David Sacks, Trump Administration Technology Policy Adviser. Quoted in CSIS. “The GAIN AI Act Will Undermine the Global Competitiveness of U.S. AI Chipmakers.” October 2025. URL: https://www.csis.org/blogs/perspectives-innovation/gain-ai-act-will-undermine-global-competitiveness-us-ai-chipmakers
[15] Google Threat Intelligence Group (GTIG) & Google DeepMind. “GTIG AI Threat Tracker: Distillation, Experimentation, and Integration of AI for Adversarial Use.” February 2026. URL: https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use
[16] Digital in Asia. “What is China’s AI Strategy in 2026? A Comprehensive Analysis of Models, Chips, and State Policy.” May 12, 2026. DeepSeek R1 trained for ~$6M; MoE architecture. URL: https://digitalinasia.com/china-ai-models-chips-strategy/
[17] CSIS. “Countering China’s Challenge to American AI Leadership.” December 10, 2025. Apollo $326B inflation-adjusted; five U.S. companies $450B+ 2026 AI capex. URL: https://www.csis.org/analysis/countering-chinas-challenge-american-ai-leadership
[18] Atlantic Council. “It’s time to reckon with the geopolitics of artificial intelligence.” Inflection Points Series, November 11, 2025. URL: https://www.atlanticcouncil.org/content-series/inflection-points/its-time-to-reckon-with-the-geopolitics-of-artificial-intelligence/
[19] Technosports. “DeepSeekAI V4 Launch: China’s AI Independence Play (2026).” April 26, 2026. V4 trained on Huawei Ascend NPUs; 30% accuracy improvement claimed. URL: https://technosports.co.in/deepseekai-v4-china-ai/
[20] Council on Foreign Relations. Michael C. Horowitz. “DeepSeek V4 Signals a New Phase in the U.S.-China AI Rivalry.” April 29, 2026. URL: https://www.cfr.org/articles/deepseek-v4-signals-a-new-phase-in-the-u-s-china-ai-rivalry
[21] StrongMocha. “China Sphere Capability Gap, Q2 2026 Update: Five Labs, Five Strategies, One Narrowing Frontier.” June 2026. Five Chinese labs (Z.ai, Moonshot, DeepSeek, Alibaba, Xiaomi) release in April 2026. URL: https://strongmocha.com/ai-infrastructure-data-centers/china-sphere-capability-gap-q2-2026-update-five-labs-five-strategies-one-narrowi/
[22] Digital in Asia. “What is China’s AI Strategy in 2026?” May 2026. Andreessen Horowitz 80% estimate; OpenRouter data; OCBC, Indosat, Malaysia deployment examples. URL: https://digitalinasia.com/china-ai-models-chips-strategy/
[23] CSIS. “DeepSeek, Huawei, Export Controls, and the Future of the U.S.-China AI Race.” May 2026. URL: https://www.csis.org/analysis/deepseek-huawei-export-controls-and-future-us-china-ai-race
[24] TenBizT / CNA. “Trump Called Jensen Huang to Join Air Force One.” May 27, 2026. Huang Channel NewsAsia quote; CNBC original reporting May 13, 2026. URL: https://en.tenbizt.com/news/sports/2026/05/27/trump-called-jensen-huang-to-join-air-force-one-the-last-minute-trip-to-china/ ; URL: https://www.cnbc.com/2026/05/13/nvidia-says-ceo-jensen-huang-is-joining-trumps-china-trip.html
[25] CSIS. “From Divide to Delivery: How AI Can Serve the Global South.” October 14, 2025. IMF warning on AI and cross-country income inequality. URL: https://www.csis.org/analysis/divide-delivery-how-ai-can-serve-global-south
[26] Brookings Institution. “How to Bridge the Global AI Divide.” June 2026. 24.7% vs 14.1% AI tool usage data; 75% of data center capacity in U.S. URL: https://www.brookings.edu/articles/how-to-bridge-the-global-ai-divide/
[27] Professor Daron Acemoglu, MIT. Quoted in Network Readiness Index. “Artificial Intelligence in the Global South: Will AI Advancement Deepen Digital Divides?” URL: https://networkreadinessindex.org/artificial-intelligence-in-the-global-south/
[28] James Landay, HAI Co-Director, Professor of Computer Science (Anand Rajaraman and Venky Harinarayan Chair), Stanford University. “Stanford AI Experts Predict What Will Happen in 2026.” Stanford Report, December 2025. URL: https://news.stanford.edu/stories/2025/12/stanford-ai-experts-predict-what-will-happen-in-2026
[29] AlphaStreet / Meta Platforms. “Meta Platforms (META) Bets on Open-Source Llama While Rivals Stay Closed.” April 6, 2026. Meta FY2025 capex $72.22B; 2026 guided $115B–$135B. URL: https://news.alphastreet.com/meta-platforms-meta-bets-on-open-source-llama-while-rivals-stay-closed-what-it-means-for-investors/
[30] DigiTimes. “Meta reportedly delays Llama successor, shifts to closed-source AI amid internal reorganization.” December 11, 2025. DeepSeek Llama architecture concern; Zuckerberg on superintelligence open-source. URL: https://www.digitimes.com/news/a20251211PD206/meta-llama-development-2026.html
[31] Atlantic Council. “Eight Ways AI Will Shape Geopolitics in 2026.” January 15, 2026. India sovereign LLM; Tess deBlanc-Knowles quote on AI sovereignty momentum. URL: https://www.atlanticcouncil.org/dispatches/eight-ways-ai-will-shape-geopolitics-in-2026/
[32] Nvidia Corporation. Form 10-Q, FY2026 (quarter ended April 26, 2026). U.S. SEC Filing. Export controls risk disclosure. URL: https://www.sec.gov/Archives/edgar/data/0001045810/000104581026000052/nvda-20260426.htm
[33] Marc Bara. “What Dario Amodei Just Proposed in Policy on the AI Exponential.” Medium, June 10, 2026. Regulatory capture critique; Anthropic structural advantage in compliance. URL: https://medium.com/@marc.bara.iniesta/what-dario-amodei-just-proposed-in-policy-on-the-ai-exponential-13f28e35c159
[34] World Economic Forum. “How AI Can Enhance Digital Inclusion and Fight Inequality.” June 4, 2025. McKinsey AI adoption data; monopolization risk. URL: https://www.weforum.org/stories/2025/06/digital-inclusion-ai/
[35] Sam Winter-Levy and Teddy Tawil. “AI Model Outputs Demand the Attention of Export Control Agencies.” Just Security, June 11, 2026. Model weights vs. outputs challenge; full quote on weight possession risk. URL: https://www.justsecurity.org/126643/ai-model-outputs-export-control/
[36] Deloitte. “New Supply Chain Tech — Semiconductor Technologies and AI.” Technology Predictions 2026. Export controls expanding footprint across semiconductor stack. URL: https://www.deloitte.com/us/en/insights/industry/technology/technology-media-and-telecom-predictions/2026/new-supply-chain-tech.html
[37] GAIA Insights. “Sovereign AI: The New Front Line in the Global AI Cold War.” December 11, 2025. Five-layer sovereign AI stack analysis; U.S.-China gravitational centers; non-aligned nation anxiety. URL: https://gaiinsights.com/blog/sovereign-ai-the-new-front-line-in-the-global-ai-cold-war
[38] Crypto Briefing. “Nvidia CEO Jensen Huang Warns Against Hindering AI Application Layer.” June 2026. Huang warning on application-layer restriction; cascade logic. URL: https://cryptobriefing.com/nvidia-huang-warns-ai-application-layer/
