Export-control evasion for dual-use stacks
Statement (NASA form)
Given that weights, fine-tunes, and inference APIs move faster than export lists, there is a possibility of a controlled capability reaching a prohibited end user as a product feature resulting in sanctions that exist on paper and not in the API logs.
If it is an HTTPS call, it is not a shipping container.
Composite 15 = 3×4 + 3
Applicable mitigations
Controls · Capability thresholds that cannot be open-released · Know-your-customer on high-end fine-tune clusters · Pair open release with synthesis and exploit screening upgrades · Hardened weight storage and insider controls · Mandatory vulnerability-sharing with national CERTs before launch · Staged release with external red-team gates · Statutory independent safety function at designated labs · External pre-deployment evaluation as a license condition