A Small Qwen Model Exposes a Large Gap in U.S. Government AI Policy

A Qwen-powered search function has been removed from the Federal Register website after public scrutiny revealed that the U.S. government service was using technology developed by Alibaba.

The tool allowed visitors to search public comments associated with proposed federal regulations. An X user operating as tleilax___ posted a screenshot of the feature on September 15, drawing attention to the Chinese-origin model behind it.

Officials removed the capability on Wednesday. Archived source code from the website confirmed that the integration had disappeared, while reporting established that it had been accessible for at least one day. It is not known when the National Archives and Records Administration first enabled it.

No evidence indicates that the incident involved a cyberattack, data theft, unauthorized access, or the exposure of confidential government information. Instead, the episode raises unresolved questions about federal AI procurement, model provenance and the distinction between locally controlled open models and services operated by foreign vendors.

The Federal Register used Qwen for document retrieval

The Federal Register provides access to proposed rules, official notices, regulatory documents and comments submitted by members of the public. Its website is operated by the National Archives, an independent federal agency responsible for improving access to government records.

The removed capability reportedly used a small Alibaba model described as being at the “Qwen3 0.6B level.” It was not one of the company’s largest or most capable systems.

Its function was also limited. The model was presented as a document-retrieval and search component, rather than an advanced reasoning system entrusted with drafting policy or making government decisions.

That distinction matters for assessing both operational exposure and potential impact. A compact retrieval model processing material that is already public presents a different risk profile from a remotely hosted chatbot receiving classified documents, internal deliberations or personally identifiable information.

However, the precise architecture remains unknown. The National Archives has not publicly said whether it hosted the model on its own infrastructure, used a contractor, or connected the website to an external service. It also has not disclosed the exact model package, software dependencies or deployment configuration.

The agency did not respond to a request for comment reported by Ars Technica. The White House and FBI had not publicly commented on the removal either.

Why the immediate security risk appears limited

Available information does not show that searches or government data were transmitted to Alibaba. The system was described as an openly available model that could be downloaded and executed locally under the operator’s control.

Local inference can materially reduce exposure. If an agency runs model weights inside its own environment, blocks unnecessary network access and controls logging, user prompts do not need to pass through infrastructure managed by the original developer.

The data involved also appears to have been public. The search function worked against comments submitted in connection with proposed regulations, rather than a repository of classified or internal records.

These factors led experts consulted in the reporting to assess the direct security risk as low. Georgetown University Law Professor Anupam Chander observed that the consequences depend on how the model was trained and operated, but the public nature of the searched material limited the confidentiality concern.

That does not prove the implementation was safe. Several critical facts have not been disclosed:

• whether inference occurred entirely within infrastructure controlled by a U.S. agency;
• whether a contractor hosted or modified the model;
• whether telemetry, update checks or support components contacted third parties;
• where the model weights were obtained and how their integrity was verified;
• which libraries and runtime components supported the deployment;
• whether search queries or logs were retained outside the Federal Register environment.

Senator Warner similarly focused on whether U.S. data passed through systems controlled by Alibaba. Without a documented data-flow analysis, the absence of reported exfiltration cannot substitute for technical verification.

The removal conflicts with a broader federal warning

The controversy is driven less by the apparent sensitivity of this specific application than by its clash with current U.S. policy messaging.

Earlier this month, the FBI identified Alibaba and five other major Chinese companies as alleged participants in large-scale model distillation. U.S. agencies claim that such activity enables China, described as the country’s principal strategic competitor, to reproduce capabilities from American frontier models while reducing development time and cost.

That warning covered the development of systems including Qwen, as detailed in the federal allegations concerning six Chinese AI companies.

Daniel Castro, president of the Information Technology and Innovation Foundation, characterized federal use of an Alibaba model as a contradiction when the FBI is simultaneously encouraging organizations to select American alternatives.

Representative John Moolenaar, chair of the House China Committee, took a broader position: no federal entity should use a Chinese AI model. His objection concerns strategic dependence and government support for a competing technology ecosystem, not merely whether a particular deployment leaks data.

No enacted government-wide prohibition covering all Chinese-origin models was identified, however. That leaves agencies facing an ambiguous boundary between a foreign-operated AI service and downloadable model weights that can be inspected, modified and run on U.S.-controlled systems.

The Federal Register incident sits directly on that boundary.

Open weights complicate country-of-origin controls

Traditional cloud-service risk assessments focus heavily on who receives the data and which jurisdiction controls the infrastructure. Open-weight AI introduces another layer: a model may originate in one country while its execution, network access and software environment are controlled somewhere else.

A remotely managed Alibaba service could expose queries, metadata and operational dependencies to the vendor. A downloaded Qwen model running offline on an agency server might have no continuing technical relationship with Alibaba at all.

Country of origin still matters. Model weights can carry supply-chain, licensing and provenance concerns, while supporting code may introduce vulnerable or unwanted behavior. Agencies may also become dependent on a foreign model family, its tooling and its development direction even when no information leaves their networks.

But origin alone does not describe the entire risk. Operational control determines whether prompts are transmitted externally, telemetry is collected, updates arrive automatically, or third parties can alter service behavior.

A policy study submitted to the U.S.-China Economic and Security Review Commission in March argued that the United States may already be disadvantaged in open-source AI. According to that analysis, U.S. strategy has emphasized leadership in frontier models more than the creation of a broad domestic ecosystem for smaller open systems.

Export controls aimed at advanced semiconductors and frontier training do not directly govern the downstream use of compact, specialized models. Those models require less computing power and can create value through narrow applications such as retrieval, classification and document processing.

If that layer becomes central to industrial AI, restrictions centered on frontier training may fail to address where adoption is actually occurring.

Federal deployments need model-level supply-chain reviews

Removing the Qwen search option ended the immediate deployment, but it did not resolve the procurement gap that allowed the controversy to emerge.

Before using any externally developed open-weight model, agencies should record its exact version, source, cryptographic integrity, license and modification history. The review should also cover runtime libraries, plugins, update mechanisms and every network connection permitted during inference.

Data-flow testing is especially important. Reviewers should determine whether prompts, retrieved documents, logs, crash reports, metrics or authentication data can reach the model developer, a contractor or another third party.

The controls should reflect the data involved. A public-record search application carries less confidentiality risk than a system processing proprietary submissions, law-enforcement material or classified information. It can still create supply-chain and strategic-dependency concerns.

The unresolved policy question is whether federal rules should treat a Chinese model running entirely inside U.S.-controlled infrastructure in the same way as a Chinese-operated online service. A complete ban would answer that question simply, but it would ignore meaningful differences in hosting and data exposure.

A risk-based approach would require more technical evidence. In the Federal Register case, the public still does not know who hosted the model, what connections it made, or how it passed procurement review. Those unanswered questions—not a reported breach—are the core of the incident.