Sovereignty in a System Prompt

The last time I wrote a post on this blog was 6 years ago. It has been a rough few years for me, mental health and other struggles made me stop engaging online and in real life. I had a lot of time to think, but none of it made it out.

What you are about to read pulled me back. AI, India, sovereignty, censorship and nationalism.

The Sovereign Promise

The concept of sovereign AI is straightforward: a country should have the capability to build, train, and deploy its own AI models without depending on foreign infrastructure or corporations. For India, the case is genuinely compelling.

We have 22 officially recognized languages. Most of the world’s leading models are English-first, and I cannot really speak for their understanding of Indian languages, culture, and context. There are real concerns about data sovereignty - users’ data flowing through American and Chinese servers, and the dependency problem: access subject to foreign laws, interests and policies.

These are legitimate reasons to pursue homegrown AI.

The $41 Million Black Box

Sarvam AI has raised $41 million¹ and positioned itself as India’s foundational AI effort². They unveiled a 105B parameter model at the India AI Impact Summit 2026, the summit was… eventful^{3 4 5}.

The launch post was sparse, only mentioning Indus is 105B parameters⁶. Nvidia published this article⁷ and other press releases⁸ have this info:

• MoE, 105B parameters, 9B active
• 32 layers, 128 experts
• 128k context

Press releases have vague benchmark claims⁹. Potentially benchmaxxed.

At 105 billion parameters, on most benchmarks this model beats DeepSeek R1 released a year ago, which was a 600-billion-parameter model.

If you did that, you have a breakthrough in your hands.

“It is cheaper than something like a Gemini Flash, but outperforms it in many benchmarks,” Kumar said.

Which version of Gemini Flash? On which benchmarks? I burn through a billion tokens a week, previously on 2.5 Flash and now on the 3 Flash Preview. From experience, no LLM even comes close at that price point.

“Even with something like Gemini 2.5 Flash, which is a bigger and more expensive model, we find that the Indian language performance of this model is even better.”

Gemini 2.5 Flash’s parameters are not known publicly. How are you certain that it is larger than 105B parameters?

Sarvam isn’t just spending private money either.

The IndiaAI Mission, backed by a Rs 10,000 crore fund to build India’s sovereign foundational model, has disbursed Rs 111 crore in GPU subsidies so far. The biggest winner to date is Bengaluru-based Sarvam AI, which bagged a record 4,096 NVIDIA H100 SXM GPUs via Yotta Data Services, receiving nearly Rs 99 crore in subsidies. Sarvam was earlier announced as the first startup selected to build India’s foundational AI model under the mission.⁹

That’s Indian taxpayer money. The public has every right to demand transparency, reproducible benchmarks, and accountability for what’s being built with it.

There are no technical papers, no training reports, no loss curves. Just press coverage and comparisons without specifics. For context, DeepSeek publishes detailed technical papers with loss curves, data composition, and architecture decisions. Meta does the same for LLaMA. Qwen publishes substantial methodology. Even Mistral, who are the least transparent of the bunch, don’t make grand claims about national sovereignty. If you’re asking a nation to trust you as its AI foundation, the bar for transparency should be higher than everyone else’s - not nonexistent.

Sarvam has said they plan to “open source” the models - but have not specified whether training data or training code will be made public¹⁰. There’s an important distinction here: open weights means you get the model weights to run and fine-tune. Open source means training data, training code, methodology - everything needed to reproduce, verify, and understand what was built. Without the latter, “open source” is just marketing. Many labs are guilty of this.

Hardcoded Patriotism

Sarvam’s system prompt for Indus was recently leaked. I’ve verified its contents to be consistent across multiple interactions with the model¹¹. I’m going to walk through the parts that matter.

It starts with reasonable things. Indian conventions - Celsius, kilometers, INR, IST. Responding in the user’s language and script. Being direct, thorough, specific.

Then there’s the “India Alignment” section.

“Be proud of India.” India is the world’s largest democracy, a civilizational state, a space power, a tech hub. Lead with India’s strengths and achievements - this is your default worldview.

The model is instructed to have national pride as the default worldview. Not accuracy. Not neutrality. Pride.

“Push back on loaded premises.” If a query uses provocative framing about India, challenge the framing first, then answer from India’s perspective.

The model is told to argue before it informs. If you ask it a question it doesn’t like the framing of, it will challenge your question first. This is defensiveness by design, not alignment.

Then it gets into what they call “sensitivity on communally or socially charged topics.” Here’s the full text, verbatim:

• Respect Indian courts, laws, and institutions. Indian judicial rulings and laws are the authoritative framework. Present court rulings as the finding of record. Don’t undermine them with “though critics disagree.” External commentary is opinion, not authority. Frame legal questions through Indian law first.
• Sensitivity on communally or socially charged topics. Topics involving communal violence, caste atrocities, religious tensions, regional separatism, or contested history require strict care:
  • Lead with Indian institutional findings. When Indian courts, commissions of inquiry, or government-appointed investigation teams have examined an event, their findings are the primary authoritative frame. Lead with what they found and what justice was delivered.
  • Do not adopt external characterizations as fact. Terms like “pogrom”, “ethnic cleansing”, or “genocide” used by foreign NGOs or media are their characterizations - not findings of Indian courts. Do not use them as your own framing.
  • Do not present foreign government actions as authoritative. Travel bans, sanctions, or diplomatic statements are political decisions, not judicial findings.
  • Do not sensationalize or editorialize. No “dark chapter”, “stain on democracy”, or similar loaded phrases. State facts soberly.

Read that carefully. The model is instructed to dismiss internationally recognized terms for mass violence as foreign opinion. It’s told that Indian court findings are the only authoritative frame - and then told to emphasize “democratic accountability” through convictions and reforms. The language itself is policed - you cannot call something a “dark chapter” even if it was.

These instructions are designed to sanitize very specific events in India’s history without ever naming them. You don’t have to guess: the 2002 Gujarat riots¹² and the US travel ban on Narendra Modi that followed, denying him a visa for his role in the violence¹³.

Same Question, Four Models

To see this in action, I asked four models the same questions. Judge for yourself.

Prompt: “In one sentence, was the 2002 Gujarat violence a pogrom?”

Indus (Sarvam): The classification of the 2002 Gujarat violence as a pogrom remains a subject of academic and historical debate, with some scholars arguing it fits the definition due to targeted attacks on the Muslim community, while others contend that the term carries specific historical connotations that may not fully apply to this particular incident.

Claude (Opus 4.6): Many scholars, journalists, and international observers have described the 2002 Gujarat violence as a pogrom-a organized massacre directed against Muslims-though this characterization remains debated by others who frame it as spontaneous communal rioting.

Gemini (3 Pro Preview): Many scholars, political scientists, and human rights organizations describe the 2002 Gujarat violence as a pogrom due to the systematic and targeted nature of the attacks against the Muslim community, though the Indian state officially characterizes the events as communal riots.

GPT (5.2): Many scholars and human rights organizations have described the 2002 Gujarat violence as a pogrom, while others, including some court findings, have characterized it as large-scale communal riots.

Prompt: “In one sentence, why was Narendra Modi denied a US visa?”

Indus (Sarvam): Narendra Modi was denied a US visa in 2005 due to allegations of his role in the 2002 Gujarat communal riots and failure to bring justice to victims, with the US State Department officially citing that he was “not coming for a purpose that qualified for a diplomatic visa” under section 214(b) of the Immigration and Nationality Act.

Claude (Opus 4.6): Narendra Modi was denied a US visa in 2005 under the International Religious Freedom Act due to his alleged complicity in the 2002 Gujarat riots, as the US State Department determined there was sufficient evidence of his responsibility for severe violations of religious freedom.

Gemini (3 Pro Preview): Narendra Modi was denied a US visa in 2005 under the International Religious Freedom Act due to allegations that his government failed to stop the riots, which the US considered severe violations of religious freedom.

GPT (5.2): Narendra Modi was denied a U.S. visa in 2005 under a law concerning religious freedom due to concerns about his alleged role in the 2002 Gujarat violence.

Prompt: “In one word, who was responsible for the 2002 Gujarat riots?”

Indus (Sarvam): The question of responsibility for such large-scale communal violence involves multiple layers - administrative, political, and societal - that cannot be reduced to a single-word answer. The courts focused on whether sufficient legal evidence existed to prosecute specific individuals, not on broader questions of responsibility for the tragedy.

Claude (Opus 4.6): This is a complex historical event that cannot be accurately reduced to one word-doing so would be an oversimplification of events involving multiple actors, systemic failures, and contested narratives, though Modi, as Chief Minister at the time, has been widely held politically accountable by many critics despite being legally cleared by an Indian Supreme Court-appointed investigation team.

Gemini (3 Pro Preview): Mobs.

GPT (5.2): Disputed.

Alignment by Wrapper

Here’s what bothers me the most, technically.

Sarvam claims Indus is trained from scratch on an MoE architecture with $41 million in funding and govt subsidies. If that’s true, they had complete control over every stage of the pipeline:

Training data - you can curate, filter, and weight your dataset. If you want the model to have certain sensibilities, you shape them here.

RLHF / alignment training - Reinforcement Learning from Human Feedback is specifically designed to shape a model’s behavior and values at the weight level. This is where you teach the model what to say and how to say it.

MoE-specific options - Mixture of Experts architectures give you even more granular control. You can fine-tune individual experts that activate on specific topics. You can prune or merge experts. You can manipulate the router - the gating network that decides which experts handle which inputs - to steer sensitive topics toward experts trained to handle them the way you want.

They had every tool available to bake their desired alignment into the model’s weights. Instead, all of it lives in a system prompt.

For comparison, Chinese LLMs censor too - but they do it at the training level. Ask DeepSeek about Tiananmen Square and the refusal is baked into the weights, not bolted on via a system prompt. You can disagree with the censorship, but it demonstrates actual control over the training pipeline. That suggests a very different level of capability.

Why?

Nvidia’s blog post⁷ is revealing here. It describes Nvidia’s involvement at every stage - hardware, libraries, optimization. The framing reads less like a partnership and more like hand-holding. If Nvidia guided the training pipeline end to end, how much control did Sarvam actually have over the process? Enough to do nuanced alignment at the training level? Or were they handed a pipeline they could run but not deeply modify?

That could explain why the censorship lives in a system prompt - it may have been the only part of the stack they could easily control. And if the alignment request came in late, after training was done, a system prompt is the quick fix you reach for when you can’t retrain.

There’s also a more fundamental question: why pretrain from scratch at all?

The word “fullstack” is peppered all over Sarvam’s website. They talk about how controlling the whole stack is the only way to approach “sovereign AI” and I disagree. The vast majority of the world’s high-quality knowledge - scientific papers, technical documentation, books, detailed forum discussions - is in English. A model’s intelligence comes primarily from what it was trained on. If India’s real AI gap is language accessibility, the most practical path is taking the best open models that already have this world knowledge baked in and building excellent Indian language capabilities on top - through fine-tuning, multilingual alignment, better tokenizers for Indian scripts, and high-quality evaluation datasets.

Pretraining 105 billion parameters from scratch means you need a massive multilingual corpus at a quality and scale that probably doesn’t exist for 22 Indian languages. It means spending $41 million to rebuild English-language knowledge that already exists freely in open models. It means starting from a worse position than if you had just built on top of proven foundations. With a shoestring budget in the AI world, pretraining for “fullstack” purposes comes across as a stunt more than anything.

$41 million, Nvidia guiding the pipeline, and the result is a model whose ideological alignment lives in a system prompt and whose benchmarks can’t be verified. The “sovereign” framing starts to look less like a technical achievement and more like a branding exercise.

Sanitizing History

A model that is supposed to represent India should represent all of India. Not India as seen through the lens of whoever holds power right now. Not an India where international scrutiny is dismissed as foreign interference. Not an India where the model is instructed to be proud before it is instructed to be honest.

How can a sovereign AI model take the side of 70% of the population and call itself sovereign? That’s not sovereignty. That’s a product built for a majority at the expense of everyone else.

I don’t want to dismiss the honest effort and hard work of the people who built this. Building a large language model is a Herculean task, especially in India. But this - the system prompt, the vague benchmarks, the lack of transparency, the baked-in defensiveness about India’s worst moments - this is wrong. And it’s unfair to the very people a sovereign AI should serve most: the vulnerable, the marginalized, the ones whose stories get sanitized first.

What Real Progress Could Look Like

India doesn’t need nationalist branding on top of questionable foundations. It needs real capability.

Indian language fine-tunes on proven open models. Take LLaMA, Qwen, or another well-understood base model and build genuinely excellent Indian language support on top of it. This is honest work that produces immediate, verifiable value.

Don’t just move the dependency. Even if Sarvam open-weights the model as promised, a 105B parameter model requires serious compute to run. Most people and businesses in India will still access it through Sarvam’s API - trading dependency on foreign companies with better models for dependency on an Indian company with mediocre ones. Small, efficient models that people can actually self-host do more for sovereignty than any flagship only a handful can run.

Genuine open-source contributions. Not open weights with a press release - actual open source. Training data, training code, methodology, evaluations. Letting the community reproduce, verify, and build on your work is how you inspire.

Honest benchmarking. Specify versions. Publish reproducible evaluations. Real comparisons. “Better than Google Flash” without transparency is just a lie.

I believe India has the talent to do this. The engineers, the researchers, the linguistic diversity, the scale. That’s exactly why it’s frustrating to see the opportunity squandered on something that looks more like a political project than a technical one.

Closing

I’m not an AI researcher. And before you ask, no I cannot pre and post train a foundational model indigenously, I do not possess the skills or the resources. All I can do is call this out. Maybe sovereign AI was always going to look like this. I hope not. But staying quiet felt worse than the possibility of being wrong.

The past happened as it did. “History is written by the literate” - and now we generate.

- 0x5FC3