China already has a solution to this: train a model on the public model. The only info that releases is that you’re examining the large model.

From that, you create open local models which work just as well for focused tasks on simpler hardware.

You control the local models, so there’s no information leak on how they’re used.

And you use your local models to interact with the commercial models when you have to, so no personal behavior patterns are given away.