Do you have a source for this? Genuinely curious, I've seen reports online of MIC contractors already using it extensively on-prem. In fact, one of the issues they bring up is how there is no official guidance right now, so no one really knows what to do.

General guidance we’ve received for deployment on protected gov’t networks the past few years has been any open source, whether software libraries or models, won’t pass security review if there are substantial contributions from Chinese/Russian/etc. nationals. There’s even an exceptions list for “well known software” where there are vetted versions for deployment (nginx).

I don't have a source unfortunately, this is mostly internal directives from my work within NIH. I've had many conversations with security officers and IT about my plans to use local models for various projects, and hackles were always raised in regards to Chinese models.

I also did a short stint with an IT operations company, and we were told Chinese models were a no-go as well from our deployments on DoD hardware.