ZRainbow

When H3 went open source, the AI-video world was genuinely delighted.

On August 3, MiniMax released H3’s model weights. Three days later, it reached the top of Hugging Face’s trending list. Huawei Ascend, Moore Threads, MetaX, Hygon, AMD, and Intel rushed to adapt it to their chips. ModelScope, ComfyUI, vLLM, SGLang, and other platforms and inference frameworks followed on day one. More than one hundred hardware and software companies eventually joined in. Even Stable Diffusion founder Emad Mostaque came out to congratulate MiniMax. It is rare for the release of a single video model to put both the industrial supply chain and the open-source community in such a festive mood.\[1\]

The reason for the excitement is easy to understand. Video models have advanced rapidly over the past year. Yet the leading products that can truly understand text, images, audio, and video—and then assemble sound, camera movement, and visuals into a single package—have mostly remained paid services behind a web interface.

H3 can generate up to fifteen seconds of video at resolutions as high as 2K, with native stereo audio. Those capabilities are not unique to H3. What matters is that MiniMax was willing to release the core generative weights. Developers no longer have to orbit a pay button. They can download the model, deploy it, quantize it, modify it, and insert it into their own workflows.[\[2\]](https://finance.sina.com.cn/stock/t/2026-08-03/doc-inikzqsf4632170.shtml)

The speed of the spillover was striking. Almost immediately after release, people in the community were using H3 for film intros, game menus, animated posters, fashion advertising, and video packaging. Take a longer view, and the creative market that has formed around ComfyUI and open models has already gone far beyond the familiar “text-to-video” demonstration.

Chinese creators use these workflows for fan works, motion comics, character-consistency experiments, and AI microdramas. Overseas teams put similar pipelines into previsualization, visual effects, animation, brand projects, games, and live visuals. ComfyUI’s own description is apt: it has grown from an experimental playground into an industrial-grade creative engine.[\[3\]](https://blog.comfy.org/p/made-with-comfyui-2025-from-open)

As it happened, I interviewed a friend who makes AI microdramas.

He was excited about H3 too. For someone who actually does the work, reaching number one on a ranking is worth noticing. But the truly exciting part is that frontier capability is now yours to use on your own terms. How to compress it, how to fine-tune it, and how to combine it with other models no longer has to be dictated entirely by a platform.

Once the conversation turned to the microdrama business, however, the picture changed.

More and more works are being produced, but costs have not simply fallen all the way down. Platform revenue shares are tightening, while the fixed costs of traffic acquisition, staff, and workspace continue to rise. Most teams struggle to finish a drama only to discover that it may never be seen at all—and may be eliminated by the market almost immediately.

Against this backdrop, H3 matters enormously because it reduces the cost of the toolset. But it also brings more practitioners into the field while demand contracts further.

Taken as a whole, the business is not easy. Hence the talk of an “AI microdrama winter,” and the joke that “the industry may die before the regulators even arrive.”

My friend and I know each other fairly well. As our conversation drifted toward ways of making money, we eventually arrived at a website I will call HuangGuo Microdramas.

---

HuangGuo is positioned as the counterpart to Hongguo—“Red Fruit,” the mainstream short-drama platform. At this point, some men of culture will already know where the name is pointing.

To my surprise, HuangGuo Theater was not merely a cloud-drive dump containing a few stray videos.

My friend forced me to look at it for a moment. It has short films, serialized works, character pages, image galleries, and a creator portal. The platform openly identifies itself as an adult-oriented, AI-generated microdrama site and restricts access to users aged eighteen and above.

Its structure differs from the certain “Media” studios I had previously been forced to see—both kinds have been covered by CCTV.com and other mainstream outlets. Because the production is driven by AI, a character can appear in multiple works, be trained into a LoRA, and then be called repeatedly by different creators.

The homepage reads, “One Character, Countless Stories.” It also encourages users to upload works and create characters so that other people can continue the story.[\[4\]](https://huangguo.video/)

Sites of this kind once distributed finished films. HuangGuo distributes the “actors” as well. Put one character LoRA on ten computers, and all ten can start again with a new plot, a new outfit, and a new setting.

I opened a character called Lin Qiaoyun.

The page looked less like an actor’s profile on a video site than a digital-asset file ready to be put back into production. The character had been created by “Huang Xiaoshu” in May 2026. The page listed six works, two LoRA versions, and platform data for plays and favorites. Scroll further, and the Z-Image and Wan 2.2 versions each provided trigger words and a download entry. Once a creator downloaded the model locally, the face could enter new images and videos simply by calling the corresponding trigger words in a workflow.

More interestingly, the associated works did not all come from the same account. Huang Xiaoshu handled the character design and the principal short films. Another creator, Mobai, used the same character to make an image set. One person creates the character; another continues using it; the platform then gathers their works back onto the same character page. Plays, favorites, and ratings tell creators in return whether the character is still worth developing.

A finely divided production process is already visible here. One person handles the character’s face, body, clothing, and persona. Another trains that character into a reusable LoRA. Someone writes the story and breaks it into shots. Someone generates the images. Someone else may do nothing but upload and organize the works. These jobs can be divided among several people or compressed into a single creator. AI has not abolished every job on a film set. It has compressed work once spread across casting, art direction, actor management, and shooting into a model file and a computer workflow.

That is why “One Character, Countless Stories” is more than a slogan. A small loop has formed behind it. Works bring views to a character. Views make the character more worth downloading. Downloads create more works. New works accumulate still more traffic for the character.

This is not a peculiar trick invented by one website. It is better understood as a feature of the industry.

Researchers who observed Civitai’s public bounty market for fourteen consecutive months found that LoRA was the most common bounty category. Roughly 48 percent of all bounties were related to NSFW content; among video bounties, the share reached 69 percent. By the later part of the study, adult requests accounted for more than half of weekly bounties. Buyers were not purchasing only a one-off image or video. They were also purchasing a tool that could continue producing new content.[\[5\]](https://arxiv.org/html/2601.09117)

Another study identified nearly 35,000 downloadable variants of real-person deepfake models on Hugging Face and Civitai. Their cumulative downloads approached fifteen million, and 96 percent targeted women. The study focused on non-consensual real-person deepfakes, so it cannot stand in for every form of fictional adult content. It is nevertheless enough to establish one point: model marketplaces have turned “continuing to generate content about a particular person” into a low-barrier capability that is reproducible and scalable.[\[6\]](https://arxiv.org/abs/2505.03859)

The relationship between adult content and generative AI did not suddenly appear in the past few months.

In 2017, the word “deepfake” first entered public view in connection with celebrity pornographic videos made on Reddit using open-source face-swapping techniques. In 2022, Stable Diffusion brought high-quality image-generation weights onto personal computers. Character models, adult comics, face-swapping tools, “undressing” applications, and LoRA marketplaces followed. With open video models such as Wan, still images began to move.

The next step represented by H3 is that character reference, motion, sound, and camera control are converging—and approaching the frontier.[\[7\]](https://mitsloan.mit.edu/ideas-made-to-matter/deepfakes-explained)

Community criticism of H3’s handling of certain bodily details and complex movements has not prevented adult microdramas from becoming a product. The logic of microdrama helps. Shot changes, framing, occlusion, dubbing, and editing can route around unstable parts of a model. The market does not require every frame to pass an anatomy examination. It requires only enough quality to attract attention, establish a character, sustain updates, and ultimately move users into a paid channel.

Open image and video models led by H3 are obviously not the root cause of this gray market. The market existed before them.

On one side of the internet, practitioners cheer for open source. Each generation of open video models makes images more vivid while lowering the cost of local deployment, character reuse, and batch generation. On the other side of the market, the room for profit grows as well—and there are cheers there too.

My friend told me that, publicly, he produces ordinary AI microdramas and participates as an AI creator in OPC communities and related projects.

But that cannot support a living.

Privately, another part of his work serves the overseas adult market. Ordinary dramas and adult commissions draw on the same skills: character generation, editing, dubbing, continuity between shots, and account operations. Often the only changes are the model, the workflow, and the distribution channel.

One interviewee cannot speak for an entire industry. But after looking into the wider market, I still believe this is unlikely to be an isolated case.

HuangGuo demonstrates the product form. Model-bounty marketplaces show that both demand and the means of production are being traded. The practitioner’s account places the path of migration at the production end of China’s AI microdrama industry. All the parts already exist. What we do not yet have is an industry report telling us how many people are assembling them.

---

Why would anyone connect a perfectly ordinary AI-microdrama production line to the adult market? To answer that, we have to look back at China’s domestic microdrama industry.

In the first quarter of 2026, the industry released roughly 128,000 microdramas, including about 122,000 AI microdramas—more than 95 percent of the total. DataEye’s monitoring indicates that approximately 221,900 new AI dramas and AI animated dramas went online across the internet in the first half of 2026. Only 1,055 exceeded one hundred million views, a rate of about 0.47 percent. More than nine out of ten works struggled to break out. Put bluntly, AI solved the question of whether a drama could be made. The resulting overflow of productive capacity immediately created another question: who was going to watch more than two hundred thousand dramas to the end?[\[8\]](https://paper.people.com.cn/rmrbhwb/pc/content/202605/11/content%5F30155877.html)

The cost advantage of AI microdramas is real. One estimate cited by People’s Daily compared a medium-scale live-action microdrama of sixty two-minute episodes, which once cost RMB 500,000 to 600,000, with an AI drama of the same specification that could now be pushed below RMB 200,000.

Small teams have acquired production capabilities that would have been difficult to imagine before. Some have made hundred-episode dramas with only four people. “One-person film crews,” “minimal studios,” and “super creators” have become favored terms in industrial policy.[\[8\]](https://paper.people.com.cn/rmrbhwb/pc/content/202605/11/content%5F30155877.html)

Production costs may have fallen. Commercial costs have not.

Practitioners interviewed by Yicai said that, as the field became more crowded, the production cost of an AI microdrama rose from roughly RMB 1,000 per minute to RMB 3,000—and sometimes RMB 5,000. The more refined the visuals, the more expensive the repeated generations, redraws, and manual repairs. Guaranteed returns from platforms are declining. The revenue share for ten thousand views on an ordinary work may have fallen from RMB 800–1,000 to about RMB 100. A successful template is quickly followed by multiple reskinned copies, while a work that has only just gone online sinks to the bottom of the traffic pool.[\[9\]](https://www.yicai.com/news/103302047.html)

After Jimeng repeatedly adjusted its membership prices and credit rules in the spring of 2026, some creators of AI animated dramas said Seedance had become close to irreplaceable. Shrinking credits and higher prices fed directly into production costs. Competitors such as Kling and Vidu still existed.

But ByteDance simultaneously connected traffic entrances such as Douyin and Hongguo, controlled production tools such as Seedance and Jimeng, and held pricing power over Tomato Novel IP. Once models, content, tools, and distribution are packaged into the same ecosystem, small and medium-sized creators become increasingly dependent on the platform.[\[10\]](https://www.yicai.com/epaper/pc/202604/10/content%5F50894.html)

Together, these forces have produced a K-shaped split in the microdrama market.

The upward branch has IP, budgets, frontier models, paid-distribution channels, and teams capable of meticulous manual finishing. It can turn AI into a tool for premium production.

The downward branch consists of small teams and individual creators. Entry gets easier, but visibility gets more expensive. They can make dramas, yet they cannot afford endless rerolls, high-definition redraws, and sustained paid promotion—and they cannot secure stable platform revenue.

The middle layer is thinning out.

Some people continue competing over domineering CEOs, rebirth fantasies, cultivation epics, and shock-value plots. Some move toward borderline softcore material. Others switch to overseas markets altogether. Adult content has a more direct payment logic: the character, the degree of explicitness, novelty, and private customization may themselves be reasons to buy. A complete narrative is no longer the only threshold. Local models also eliminate the need to purchase cloud credits one generation at a time, accept platform review, or worry about an account being banned.

Many of the “adult microdrama ads” I saw on X were not, strictly speaking, formal advertisements placed through X’s advertising system. They looked more like trailers, character clips, and off-platform traffic funnels posted by networks of accounts. Transactions could be completed on independent websites, in Telegram groups, or through other channels. X merely brought the user to the door.

Returning to HuangGuo and following its public entrances outward, I found another cluster of websites and accounts using the same “Huangguo Microdramas” name.

This cluster had publicly issued a creator-recruitment plan. It sought AI directors, screenwriters, and visual artists. Applicants had to submit a personal introduction and portfolio and be familiar with video models such as Seedance and Kling. The recruiter claimed that it could provide support for using certain models, acquire the copyrights to qualifying works, establish long-term cooperation, and then use an official account matrix to handle promotion.

That recruitment notice supplied the organizational relationship that had not been fully visible before.

The platform or brand functions more like a production company, copyright buyer, and distributor. It does not necessarily employ a complete staff or fill an office with GPUs. It specifies the subject matter, quality, and delivery format; provides or coordinates access to model capabilities; accepts finished works; buys them; and then places the content on its own sites and account network.

Creators remain dispersed. One writes scripts. One trains characters. One understands video models and workflows. Another can complete an entire film alone. They do not necessarily know one another. As long as each can deliver to specification, copyright acquisition and long-term contracting can reassemble them into the same production line.

The gray-market supply chain is already highly mature—and even distributed.

HuangGuo’s own product design is the clearest evidence. It is building interfaces for this kind of collaboration. The homepage organizes content by character, short film, series, clip, and gallery. Multiple creators can call the same character and LoRA. A creator center allows users to upload works and create characters. The other HuangGuo entrance lists X and Telegram as public channels and offers promotion through an “official matrix” as a condition of collaboration. Production happens on private computers, but a single brand can gather, package, and distribute the resulting works again.

A single film may therefore perform several jobs at once. It is content to be watched, a sample reel for a character, and a trailer that draws users into an independent site or group. One practitioner’s computer may contain work for several films. Daytime is work, evening is life, and after midnight the work begins again.

The compliant market cannot absorb rapidly expanding production capacity. Because of that structural incentive—and because the gray market is willing to pay for explicitness, characters, and customization—some capacity flows toward it.

This is where OPCs, a new organizational form carrying the industry’s rapid expansion, become part of the real-world background. In Shanghai’s policy language, OPC refers to a “one-person company”: the super-individual or very small team amplified by AI.

Shanghai has issued its “Eight Measures for AI Microdramas,” supporting intelligent computing, third-party model APIs, audio-visual corpora, digital-asset libraries, and overseas distribution, while proposing AI-microdrama OPC communities. Such policy has a real rationale. New content-production tools need desks, computing power, and room for experimentation. Someone must also turn model capability into an actual industry.[\[11\]](https://finance.sina.com.cn/jjxw/2026-05-27/doc-inhzhxzw9420053.shtml)

But as the earlier discussion shows, when productive capacity flows downward, OPCs can travel downward with it.

Once practitioners receive publicly provided workspaces, compute vouchers, model vouchers, microdrama subsidies, or government-incubation resources, an audit needs something to hold on to. What is the project actually doing? Where is public compute being used? Do the declared business and the overseas business match? Can the contracts, money, model calls, and final deliverables corroborate one another?

The industry is new. Continuous review mechanisms are incomplete. Model capabilities are improving. Together, these conditions produce the question that truly gives regulators a headache:

What happens when a project operator takes public resources, deploys a local system, closes the door, and starts making “films” at full throttle?

In other words: how should private productive capacity be governed? And what happens when public resources flow into gray production?

---

H3 makes this shift unusually clear.

MiniMax’s complete system has three layers. H3-Context-IR understands and orchestrates the text, images, audio, and video submitted by a user. H3-Base generates 768p audio and video. A later module then regenerates the result at 2K.

Context-IR remains hosted in MiniMax’s cloud. User-submitted material and enhanced prompts are screened for unlawful, pornographic, and infringing content. The locally released core is H3-Base. Developers do not have to use the official Context-IR; they can write their own preprocessing pipeline.[\[12\]](https://www.minimax.io/news/minimax-h3-open-source)

In some local Wan workflows, I have also encountered Qwen refusing an NSFW prompt before generation. Wan’s official design already treats Qwen-based prompt expansion as an optional module. A refusal may occur at the prompt-expansion layer, in cloud content moderation, or in a post-generation classifier. It is not necessarily embedded in the video model’s core generative capability. Once a module is replaceable, the user can keep it—or remove it.[\[13\]](https://docs.comfy.org/zh/tutorials/video/wan/wan-video)

MiniMax says this plainly in its H3 license Q&A. With an API, the company controls the infrastructure and can apply measures for child protection, copyright compliance, and content safety. Once the weights leave that infrastructure, users can deploy, modify, and redistribute them independently, making it far harder to maintain the same level of compliance.[\[14\]](https://huggingface.co/MiniMaxAI/MiniMax-H3/blob/main/docs/QA-about-License.md)

This is the core of the pressure that private productive capacity places on regulation.

When a platform provides a model service, regulators can identify a clear responsible actor. The platform knows who registered an account, which model version was used, what content was entered, and what the moderation system blocked. It can update rules, suspend service, ban accounts, handle complaints, and provide logs in an investigation.

Once the model moves onto a local machine, all of those handles loosen at once.

The developer does not know what LoRA the user installed, which layer of the workflow was changed, or whether the generated result was distributed. A downloaded model cannot be recalled from every machine through a single backend update. The room may even be completely offline. Instead of one platform continuously providing a service, regulators now face many individuals and small teams, each possessing its own productive capacity.

Over the past few years, quantization, VRAM offloading, sparse attention, workflow packaging, and hardware iteration have continually lowered the threshold. ComfyUI has said that dynamic offloading can push local operation down to consumer devices in the RTX 3060 class.

“One GPU” is the direction in which this productive capacity is moving: into countless homes.

China’s existing regulatory system has, fortunately, already begun to respond.

The Interim Measures for the Management of Generative Artificial Intelligence Services reach training-data sources, personal information, intellectual property, data annotation, model optimization, and the handling of unlawful content. GB/T 45652—2025 addresses the security of pre-training and fine-tuning data. GB/T 45674—2025 addresses the security of generative-AI data annotation. GB/T 45654—2025 sets basic security requirements for generative-AI services. The mandatory national standard GB 45438—2025 translates explicit and implicit labeling of AI-generated content into technical methods.[\[15\]](https://std.samr.gov.cn/gb/search/gbDetailed?id=33D40F1160BF5D92E06397BE0A0A5B93)

Regulation is moving further into the model itself. On August 4, 2026, China’s National Cybersecurity Standardization Technical Committee launched a call for participants in drafting the Cybersecurity Technology—Guidelines for the Security of Open-Source Artificial Intelligence Models. Standards concerning AI safety guardrails, on-device foundation models, and the security of training and inference frameworks have also entered development.

The National Radio and Television Administration’s new Measures for the Development and Administration of Microdramas require microdramas generated or produced with AI to carry labels and require broadcasters to review and assess algorithms, models, data, and application results. Microdramas produced within China for overseas release are also brought within the relevant management framework.[\[16\]](https://www.tc260.org.cn/portal/article/2/e277e9cf94424b4cb2434ba552dc8279)

Productive capacity moves downward; regulation moves downward too. Like every industrial story, this is an endless marathon.

Yet starting from the existing rules, one question remains unresolved: once the service provider exits, how do these standards continue to have legal effect?

GB/T 45654 can tell a service provider how to test model security. It does not automatically create the power to inspect a private computer. An AI-labeling regime can require generation services and distribution platforms to add and recognize labels, but an offline local model may never enter that service chain at all.

The Measures for the Development and Administration of Microdramas assume that an identifiable production institution, microdrama project, and broadcasting entity exist. A studio may decline to register a project, bypass domestic platforms, and deliver a locally produced film directly to an overseas account. The rule has reached the vicinity of the conduct, but the regulator may not know where the actor assumed by the rule is located.

The current system does not lack another sentence saying, “Do not generate obscene content.”

What it lacks is a way to translate standards into bounded legal duties when local capability is fine-tuned, modified, offered for commissions, and operated as a business. And when a concrete case arises, it still needs a lawful way to enter the room and understand the model inside it accurately.

---

Moving between domestic and overseas contexts, it is easy to become confused by a single term.

HuangGuo displays an NSFW warning as soon as the site opens. Here, NSFW is merely a classification label telling users that the material is “not safe for work.” It is neither an offense under Chinese law nor the conclusion of a forensic examination.

Nudity, sexual suggestion, fictional adult erotica, medical imagery, figure art, pornographic deepfakes of real people, and sexualized content involving minors can all be placed inside the same label. Their legal character is completely different.

Article 367 of China’s Criminal Law defines the relevant category of obscene materials by reference to material that explicitly depicts sexual conduct or openly promotes pornography in a manner considered corrupting. Works concerning human physiology or medical knowledge, as well as relevant works with genuine artistic value, are not automatically obscene materials. Whether a work was filmed with real actors, drawn by an illustrator, or generated by AI does not alter that content-based inquiry.[\[17\]](https://gongbao.court.gov.cn/Details/96fea4e0b9e00def2295a1e598666f.html)

Suppose a microdrama producer generates wholly fictional adult content locally, keeps it for private viewing, accepts no commission, and distributes nothing. What then?

Article 363 of the Criminal Law addresses the production, reproduction, publication, sale, and dissemination of obscene materials for profit. Without a profit motive and without dissemination, conduct will ordinarily be difficult to bring directly within the criminal evaluation under Articles 363 and 364.

Article 80 of the revised Law on Penalties for Administration of Public Security, effective in 2026, expressly includes the “production” of obscene materials within the scope of public-security penalties. It does not require either profit or dissemination. On the wording of the provision alone, purely local production is therefore not necessarily outside administrative law.

But there is a long road between a statutory provision and a lawful penalty.

It must be proved separately that the generated material actually meets the legal standard for obscene materials; that the file was actively produced by the person concerned; how the circumstances and social harm should be evaluated; and through what procedure the evidence was obtained.

The inclusion of “production” in Article 80 does not mean that public-security organs may routinely read a person’s hard drive, prompts, and generation records merely because that person installed an open video model.

This is where the regulation of private productive capacity becomes genuinely sharp.

In previous cases, the position changes once a producer begins accepting orders, charging money, and delivering work.

Membership fees, custom quotations, paid groups, advertising revenue, off-platform revenue shares, payment records, and continuing business arrangements can all help establish a profit motive. Even when a project ultimately makes no profit, a structure plainly directed toward gain does not automatically fall outside the criminal concept of acting for profit.

Dissemination that reaches a serious level may still fall within Article 364 even without a profit motive. Relevant judicial interpretations also use facts such as the number of videos and images, click counts, membership, advertising fees, and membership fees as conviction and sentencing criteria.[\[18\]](https://gongbao.court.gov.cn/Details/d16a316e0d4bf8421f11cb2dca9338.html?sw=%E4%BC%A0%E6%92%AD%E6%B7%AB%E7%A7%BD)

Posting material to an overseas platform does not make the domestic act of production disappear.

In a case from Daye, Hubei, the defendant used AI to generate obscene fiction in bulk and sold approximately 760 items through an overseas website, earning more than RMB 20,000. He was ultimately convicted of producing, selling, and disseminating obscene materials for profit. He too had assumed that placing the content abroad meant it could not be traced at home.[\[19\]](https://www.ctdsb.net/c1716%5F202504/2433030.html)

Another boundary appears the moment a real person is dragged into the frame.

Wholly fictional adult content initially implicates the rules on obscene materials and the public cultural order. Put the face and voice of a classmate, former partner, actor, or ordinary internet user into an adult microdrama, and a concrete victim now exists. Rights in likeness and voice, privacy, and personal information come into play. Even if the file remains locked on a local machine, the actor has already collected, processed, and sexualized another person’s identity.

Closing the door does not mean the creator is the only person in the room.

The reasons for protection are stronger still when minors are involved. The revised public-security law provides for heavier penalties when obscene materials or information involve minors. Judicial interpretations concerning obscene electronic information also establish stricter criminal thresholds for content involving children under fourteen. Experience abroad shows that this is not a remote risk.

In 2026, UNICEF stated that sexualized images generated or altered using a child’s identity constitute child sexual abuse material. A cross-national estimate found that, in the preceding year, at least about 1.2 million children reported that their images had been manipulated into explicit deepfakes.[\[20\]](https://xxgk.yczf.gov.cn/xzf/ycgaj/fdzdgknr/fgwj%5F41994/202601/t20260105%5F2305142.shtml)

This also shows why simply shouting “ban NSFW” does not complete a legal analysis.

Fictional adult content, obscene materials meeting the statutory threshold, non-consensual deepfakes of real people, and sexualized content involving minors rest on different regulatory grounds. The closer the conduct moves toward a concrete victim, a minor, and organized profit-making, the stronger the justification for state intervention. The closer it moves toward private conduct with no dissemination and no identifiable victim, the more public power must explain how it discovered the conduct, why it may enter, and how far intervention may go.

Move further upstream and the problem becomes more difficult.

A completed video can be evaluated by its content to determine whether it constitutes obscene electronic information. A LoRA, by contrast, is usually a set of parameters. It must run together with a base model, prompts, a workflow, and input material before it can generate content.

If a parameter file itself is treated as an obscene material merely because it can generate adult imagery, the same logic can pull in the foundation model, editing software, and even the GPU. The principle of legality in criminal law should restrain that kind of unlimited expansion.

A case disclosed by the Beijing Haidian Court in 2026 is instructive. The defendant created paid groups and sold AI programs and tutorials specifically intended for producing obscene materials, while using pornographic images and videos to attract paying members. He was convicted of illegally using information networks. The court did not directly identify the programs and tutorials themselves as obscene materials. It relied instead on the concrete conduct: establishing groups, publishing information relating to unlawful and criminal activity, presetting specific parameters and command templates, and profiting from the arrangement.[\[21\]](https://www.cnr.cn/mspd/spcy/20260529/t20260529%5F527639637.shtml)

That suggests a more discriminating path of responsibility.

A general-purpose foundation weight such as H3, a pornographic LoRA trained specifically on a real person, and a one-click workflow preset with adult acts, tutorials, and a paid service should not occupy the same position in the chain of responsibility. The inquiry should ask what the actor knew, what the actor controlled, how specialized the tool was for unlawful use, and what benefit the actor obtained.

Technological neutrality cannot be a universal exemption. Technological danger cannot justify unlimited liability moving upstream either.

---

The Alien Chat case has already brought this system into a courtroom.

At first instance, the court found that two developers and operators had written system prompts to bypass the original content restrictions of an overseas large language model and had charged membership fees. They were convicted of producing obscene materials for profit. After the defendants appealed, the dispute centered on a question rarely seen in a criminal courtroom: was the obscene content caused by the foundation model, the system prompt, or the user’s input—and to what extent did the developers control the final output? At the time of writing, no final result in the second instance had been announced.[\[22\]](https://china.cnr.cn/gdgg/20260114/t20260114%5F527492847.shtml)

When the case first emerged, I argued that one of its important contributions was not to declare in advance that a developer must necessarily be the “producer.” It was to demonstrate that technical facts had entered the elements of the offense.

Whether a system prompt reliably steers the model toward obscene output affects the judgment of what counts as “production.”

Whether moderation is installed in an unavoidable cloud layer or in a workflow node that can simply be deleted affects the developer’s degree of control.

Whether a LoRA merely preserves a person’s appearance or has already encoded a specific sexual act affects how specialized the tool is.

Whether the platform can inspect logs, update the model, and terminate service affects whether it has the ability—and perhaps the duty—to prevent the result.

Legal doctrine cannot skip these facts and move directly from “the model produced pornographic content” to “the most upstream developer is responsible.” Nor can it announce that no one performed an act of production merely because the model generated the output.

Ultimately, criminal-law concepts such as conduct, causation, knowledge, and control must be located within the real system architecture.

In a concrete case, the model version, file hash, quantization method, LoRA, training material, workflow, prompts, random seed, inference parameters, and input reference images can all affect the result. They must be corroborated against chat records, orders, payments, finished-file metadata, and delivery records.

There is nothing strange about the same prompt producing a different image when the model version or random seed changes. A so-called reproduction experiment that fails to restore the original environment as closely as possible can show only what another system generated. It cannot prove what the actor controlled at the time.

This is the kind of work that, in my view, becomes possible only when legal scholars understand models.

That does not mean every lawyer must train weights, write CUDA, or build a ComfyUI pipeline.

Cases and business practices are demanding that legal professionals at least understand which layer controls the result. Judges, prosecutors, and regulators in turn need technical investigators, expert assistants, forensic institutions, and reproducible experiments to help establish the technical facts. The Supreme People’s Court has already called for improved mechanisms through which technical investigators, expert assistants, and appraisers participate in technical fact-finding. In generative-AI cases, that capacity should not remain confined to patent and software disputes.[\[23\]](https://www.court.gov.cn/fabu/xiangqing/497921.html)

A legal professional who understands nothing about models is easily pulled in one of two directions.

One is to be fooled by the phrase “technological neutrality” and fail to see how someone may deliberately construct an unlawful capability through system prompts, LoRAs, and workflows. The other is to become frightened by the technology and, whenever an unlawful result appears, place foundation-model developers, open-source communities, and tool authors into the same chain of responsibility.

Neither direction is professional.

AI researchers also need to understand law. But asking a technical team to hire counsel and build compliance generally has a clear point of entry. Asking legal researchers to understand model architecture, training processes, and inference chains is harder.

However difficult it is, I believe someone has to do it.

In many future cases, the facts will remain unclear not because the law lacks a rule, but because the decision-maker has no idea which node in the system that rule is supposed to reach.

---

Now that regulation has begun moving into data, models, and the open-source ecosystem, the next step cannot be a retreat to the old method of deleting a finished work only after it has been discovered. The hard question is how deep to go, whom to find, and on what legal basis.

Internet intermediaries have long been the landing point of online regulation across jurisdictions for a simple reason: locating every individual user is too difficult. Regulators delegate part of the work to platforms and use platform account systems, moderation, and logs to make conduct dispersed across countless homes visible again. When Lawrence Lessig argued years ago that “code” also shapes order in cyberspace, this was part of the point. Statutes say whether something may be done. Platform architecture determines whether the rule has an unavoidable gate in everyday use.[\[24\]](https://cyber.harvard.edu/works/lessig/laws%5Fcyberspace.pdf)

The change represented by H3 is precisely that this gate can be dismantled.

The model developer remains, but the platform that continuously provides the service may disappear. A user can replace prompt expansion, install a new LoRA, rearrange the workflow, and finally unplug the network cable. Cloud moderation has not been “defeated”; the local generation never passed through it. The accounts, logs, bans, and complaint mechanisms attached to the platform disappear with it.

If platform-era thinking is copied into this environment unchanged, responsibility is easily placed in the wrong location.

One response is to push all pressure back onto the foundation-model developer. Whatever happens downstream, the first question becomes why the weights were released in the first place. Yet although the developer controls how a model is trained and released, it no longer controls who downloads a copy, how it is modified, which workflow is attached, or every result generated thereafter.

Take another step and require every local model to remain online, scan content, retain prompts, and report them outward. Visibility would return. But the privacy protection, trade secrets, independent research, and private creation that local deployment was meant to support would be hollowed out with it.

The expanding system of AI standards can address the earlier part of this problem.

In August 2026, TC260 successively initiated work on guidelines for open-source AI model security, cybersecurity guidelines for on-device foundation models, and security guidelines for model development. Regulation is indeed moving beyond finished content and down into data, models, end devices, and the open-source ecosystem.[\[15\]](https://std.samr.gov.cn/gb/search/gbDetailed?id=33D40F1160BF5D92E06397BE0A0A5B93)

Standards matter. They can break the empty instruction to “pay attention to safety” into concrete questions: how data should be documented, how local weights should be tested, how known risks should be disclosed, and how incidents involving a model version should be handled.

The boundary of standards is equally clear. China’s Standardization Law distinguishes mandatory from recommended standards, which already shows that a technical standard and a compulsory legal duty are not the same thing. However detailed a standard becomes, state action such as entering premises, inspecting devices, or seizing data still requires statutory authority, conditions, and procedure. Where a less intrusive method can achieve the purpose, the stronger measure should not be chosen automatically.[\[25\]](https://www.cnipa.gov.cn/art/2019/7/29/art%5F104%5F67809.html)

A national standard is, after all, a ruler—not a search warrant.

Follow that boundary downstream, and the proper location of responsibility becomes clearer rather than less clear.

At the moment a foundation model is released, its developer knows the training data best and has the greatest ability to determine how the release will occur. At this stage, serious data verification, risk testing, and version records are appropriate. In particular, the local weights actually delivered to users must be tested; the developer cannot rely solely on a moderated API as proof that everything is safe. Model cards, version hashes, known limitations, test summaries, and incident-response channels should be ordinary companions to an open-weight release.

Once that work has been done, responsibility should have a reasonably clear endpoint.

Open weights are inherently double-edged. They enable local inference, inspection, and modification, but are also difficult to recall and hard to monitor continuously downstream. Relevant research therefore argues for comparing how much practical risk an open model adds relative to existing closed models and pre-existing tools—not treating openness itself as fault whenever someone proves that a model can be used badly. Open weights can also reduce market concentration, support research, and enable innovation by smaller teams. Those benefits cannot be erased from the ledger.[\[26\]](https://crfm.stanford.edu/open-fms/)

Where a developer has undertaken reasonable data compliance, model testing, risk disclosure, and incident response—and has neither actively steered nor materially assisted a specific unlawful business—later independent modifications should not generate unlimited upstream liability. Writing that boundary clearly is itself part of regulation. Otherwise, the first actors to leave the open ecosystem will be domestic teams with public identities that are willing to maintain their models. Anonymously circulated overseas weights will continue moving everywhere, while creators are driven back to the paid interfaces of a few large companies.

As the weights continue moving downward, the position changes again.

An ordinary character LoRA may be used in a normal microdrama or taken by someone else to make adult content. But a pornographic LoRA trained directly on a specific real person, a workflow preset for “undressing” and sexual acts, or a customized service devoted to sexualized content involving minors can no longer be dismissed in one stroke as “general-purpose technology.”

At that point, the maker knows more clearly what the tool will be used for and has greater control over how it is distributed. Whether the maker charges money, supplies material and tutorials, or continues recommending the tool after receiving reports changes the location of responsibility.

Model communities cannot, and need not, review every ordinary LoRA in advance. For high-risk tools whose use is already clear, however, real-name transactions, report verification, recommendation stops, removals, and necessary preservation of evidence can be made more concrete. Those measures are cheaper than universal review of every creator and more accurate than pushing responsibility all the way back to the foundation model.

Further downstream, once orders, advertising, communities, payments, and continuing revenue shares appear, private productive capacity has entered relations with the public.

At that moment, the justification for regulation is strongest and the evidence is most abundant. Victims can report the conduct. Public accounts can be found. Orders and funds can corroborate one another. Finished works can be traced backward to models, workflows, and specific operators. An OPC that has accepted public workspaces, compute vouchers, model vouchers, or microdrama subsidies has an additional and more direct relationship. Public money is entitled to ask what it ultimately supported. Requiring truthful project purposes, clear fund flows, and consistency between declared and actual business is not an intrusion into private life.

By contrast, someone who uses only personal equipment and personal funds for a local project should not be subjected to routine inspection merely for installing a particular model. An investigation should begin from a victim, public dissemination, a transaction, a report, or another legally recognized lead.

Seen this way, regulation does not need to be spread evenly across every link in the chain.

The more general the model, the more the developer’s responsibilities resemble testing, explanation, and recordkeeping. The more a tool is modified toward a specific unlawful use, the closer responsibility moves to the modifier and operator. Once content harms a real person, leaves the room, or earns continuing money, enforcement has a stronger justification and a clearer path.

“Deeper” should refer to technical facts. Which layer changed the output? Which layer can stop distribution? Who holds the logs? Who controls the orders? Those questions must be established.

“More precise” should refer to the location of responsibility. Developers answer for the parts they genuinely control. Makers of specialized tools answer for the modifications they deliberately complete. Local operators and business operators answer for the concrete works and the business built around them.

How far public power may enter a private device should still depend on a lawful lead, statutory authority, and procedure. It would be frightening if the mere detail of a model standard automatically widened those powers.

---

What I am really trying to say is that H3 exposes a sharper conflict between private productive capacity and public order.

For the past twenty years, online governance has largely been built on the assumption that platforms remain present. Public regulation has not watched every user individually. It has borrowed the platform’s eyes and hands—and, in the process, has also granted the platform corresponding power.

Industrial policy and open-source communities are now doing something equally important in the opposite direction. They are breaking capabilities once concentrated in a few companies into pieces and handing them to more individuals and small teams. Open weights, consumer GPUs, compute vouchers, OPCs, and one-person film crews are all expanding private productive capacity. They give ordinary people a set of productive tools they can control for themselves.

Neither development is wrong when viewed on its own.

Industrial development wants capability to move downward. The regulatory system, however, has long depended on capability remaining concentrated in platforms. The former continually creates individuals able to produce independently. The latter continues searching for an intermediary that provides a service continuously.

H3 makes this mismatch unusually visible. One side celebrates that the weights can finally be taken home. The other suddenly discovers that many content-safety systems were built on the assumption that the model would never leave the platform.

The conflict therefore exposes a direct challenge from industrial development to regulatory logic—and even to the wider social order’s conception of public order and good morals.

We cannot simply accept a society in which everyone has “a film” to make and everyone has “a film” to watch.

The old logic is bound to be tested. A single GPU is knocking on law’s door, asking whether law can still make good on its promises after the technical architecture changes. If a rule can bite only inside a domestic service chain, its practical force begins to depend on which technical architecture the user has chosen.

That slowly consumes the credibility of the rule itself.

Today the issue is adult microdramas. Tomorrow it may be fraud, infringement of personal information, or another locally generated business. Each rule may look complete on paper, yet once the activity enters a private device, the system lacks methods for discovery, evidence, and attribution. Over time, people learn not that “the law does not permit this,” but that “change the tool, unplug the network cable, move to an overseas account, and the law will have difficulty reaching it.”

A socialist state will naturally be more sensitive to this issue.

In Chinese law and public policy, cultural products cannot be treated as ordinary commodities whose content need concern only buyer and seller. How minors grow up, how the dignity of women and ordinary people is protected, and what content ultimately occupies the public cultural sphere all have an unmistakably public dimension.

But a public dimension does not mean that public power may extend without limit.

If the state seeks to prove that those values still matter by requiring every local model to transmit prompts and every computer to scan its hard drive continuously, the rule of law is damaged as well. Private space, legitimate creation, trade secrets, and technical research do not disappear merely because regulation has encountered a new problem.

That is what makes this conflict so difficult.

If public regulation remains entirely outside the door, gray production can use private space as a place to hide responsibility. If regulation enters every room without discrimination, it treats lawful private productive capacity as a risk too.

No slogan will easily solve the problem. But at least one line is becoming visible:

Public regulation should focus first on the moment private productive capacity enters relations with the public.

Use public resources, and accept public audit. Businesses actually operating inside OPC communities must answer for their real uses and their real economics. Where a tool is specially modified to harm a real person, exploit a minor, or mass-produce unlawful content, its designers and operators cannot hide forever behind industrial policy and the foundation model.

As for a general capability itself, the state need not seize it in advance merely because it may be misused.

This also explains why open models should not simply be treated as the enemy of regulation. They do release capability from platforms and can ease the K-shaped divide described earlier, allowing smaller teams to avoid permanent dependence on the models, prices, and distribution systems of a few large companies. If public policy wants more people to possess productive capacity, it cannot wait until that capacity is genuinely distributed and then force everyone back behind the walls simply because regulation is unaccustomed to the result.

What truly needs updating is the way public regulation connects to the world it governs.

In the platform era, governance held on to a small number of intermediaries. In an era of private productive capacity, governance must learn to distinguish how capability has been modified, where harm appears, and where business leaves traces. It does not need to know what every computer generated tonight. It does need to ensure that, when someone uses the model inside the room to harm another person, misuse public resources, or run a continuing gray business, there is a lawful lead outside the door, the technical facts inside can be reconstructed, and responsibility can ultimately reach a specific person.

That is roughly the social order I hope for.

It includes the state’s real capacity to protect minors, human dignity, and the public cultural order. It also includes public power’s knowledge of where it must stop. Being able to reach misconduct is one kind of capacity. Governing within boundaries is another.

If the day truly comes when “everyone has a film to watch and everyone has a film to make,” the two easiest answers will both be terrible. One is to pretend not to see. The other is to turn every computer into a sentry post.

The harder path is to accept that private productive capacity will continue to grow, and then reconnect public regulation at those points that are visible, provable, and genuinely capable of causing harm.

---

Unless otherwise stated, the text and author-created diagrams in this article are released under the CC BY-SA 4.0 International license.

Republishing, adaptation, and commercial use require appropriate attribution, a source reference, and disclosure of modifications. Adapted works must use the same or a compatible license.

Third-party images, trademarks, quotations, and separately credited materials are not covered by this license.

AI tools were used to assist with image generation, language localization, and formatting. The analysis and final written content are the work of Fang Han.

ZRainbow

ZRainbow

Comments (0)