Introducing the Researcher Restriction Index.

The signal is in the specification. The surprise is a reading failure.

Chinese AI researcher restrictions ran through three waves between 2020 and 2026. The first wave — Entity List actions in 2020 and 2021 — targeted Huawei, supercomputing centers, and quantum-AI institutes, with researcher-level effects concentrated in joint US–PRC programs. The second wave landed October 7, 2022: a US-persons restriction that drove low-hundreds of US-passport engineers out of YMTC, CXMT, SMIC, and the chip-design houses around them. The third wave — the one most recently legible — runs in the other direction: passport custody and pre-travel review extending from state labs into DeepSeek, Moonshot, Zhipu, Alibaba DAMO and Tongyi, with the May 2026 Bloomberg dispatch and a same-week Tech Times confirmation as the founding press citations.¹

The historical work exists in slices. MacroPolo's AI Talent Tracker mapped stocks and flows from 2020 through its 2024 discontinuation. CSET tracks aggregate inflows and outflows. Stratfor and Recorded Future publish episodic risk briefings on named individuals from behind subscription walls. None of these is a dated, public, per-researcher forward score. None is Brier-scored.²

What is new here is the intersection. The prior work cited above operates at one of two registers — aggregate flows (MacroPolo, CSET), or named individuals behind subscription walls (Stratfor, Recorded Future). This paper occupies the cell neither register fills: a per-researcher forward probability, published under its own falsification regime, with the source list, the feature weights, and the held-out Brier visible on the same page as the score. The contribution is not novelty of underlying data — the public restriction record is what it is. The contribution is the willingness to commit a number, on a person, with a date, in a form that can be marked right or wrong twelve months later.

The May 2026 reporting matters for the next twelve months because it crosses a threshold the 2025 reporting only approached. In 2025, The Information's March 14 dispatch and the Bloomberg and Wall Street Journal confirmations on DeepSeek read as firm-internal compliance plus informal local-authority guidance — sufficient to put DeepSeek senior staff on the watchlist, not yet sufficient to widen it to the rest of the private frontier. The May 2026 Bloomberg reporting names Alibaba DAMO, Tongyi, Moonshot, and Zhipu by name and describes the same passport-custody mechanism. If the reporting is correct, the index's prior over the next twelve months should treat every senior researcher at a private frontier firm as carrying a non-trivial baseline travel-curb exposure regardless of individual feature loading, and the index's job becomes ranking inside that baseline rather than identifying whether the baseline exists. The current scoreboard reflects that posture: two of five profiles sit at the 0.80 guardrail ceiling.

Forward Indicators publishes the per-researcher score: prior public, features versioned, three baselines run on the same scoreboard with the Brier score reported, and the editorial standards described below binding on every published number. This release covers five profiles. The next cohort release is scoped for twenty-five, with named profiles gated on a documented criterion. The point of the founding release is not the prediction itself — the point is that the prediction now exists in a form that can be wrong in public.

Six moving parts. Each is versioned. Each ships with its limits stated.

The pipeline implements the Forward Indicators spine on a single corpus: a public-source profile for each researcher, labelled against the six-year restriction record, scored by a logistic baseline, and reviewed against two trivial baselines on every release.

Six hand-engineered features — institutional tier, research area, U.S. co-authorship density, citizenship-and-visa status, party-affiliation signals, and recent mobility — all derived from public lab pages, arXiv, conference proceedings, or announced funding rosters. Each feature carries an empirical band drawn from a specific historical case. Two further features — stated geopolitical alignment, and mentor lineage — are scoped for a later release that uses language-model extraction to read public statements at scale, and are not in the current scorer.

Seventeen primary restriction events drawn from the public record, plus a long tail of inductive instances expanded from the same patterns into an event-cluster corpus. Positive instances are populations affected by each event — for example, the U.S.-passport engineers who departed YMTC in late 2022. Negative instances are peer researchers at the same labs in the same time windows who do not appear in the restriction record. The labeled dataset totals 1,016 instances with a positive rate of roughly 21%.

A logistic regression on the standardized hand-engineered features is the scorer. Coefficients are stable in sign across re-seeds: recent mobility loads heaviest (+1.68), research area and institutional tier moderately positive (+0.68, +0.48), U.S. co-authorship density mildly protective at this point in the regime cycle (−0.18), and party-affiliation signal count mildly negative (−0.26) once tier and area are controlled for. Calibration is approximate; the headline metric is the Brier score, not point accuracy.

Three baselines run alongside on every release: a constant predictor at probability 0.20, the last-observed positive rate from training, and the production logistic regression. After the October 2022 sign-flip encoding shipped in the next revision, the logistic regression cut calibration error roughly in half versus the trivial baselines on the held-out split (Brier 0.082 against around 0.167), and lifted rank-discrimination from 0.50 to 0.92. Both metrics are recorded to the backtest artefact on every pipeline run.

Brier score is the headline. Alongside: AUC-ROC, calibration curve (reliability diagram), precision @ top-20 and top-100, and lift over each baseline. The reliability diagram — not point accuracy — is the chart on the scoreboard.

Three honest limitations belong on this page rather than buried in an appendix. First, the scoreboard is five profiles. Five is small enough that any single resolved event will move headline calibration metrics noticeably; the right way to read it is as a worked example of the methodology, not as a population estimate. Second, the baselines are deliberately simple. The trivial baselines (random, last-observed) make the logistic look good; they are not the right comparison for the planned twenty-five-profile release, where the relevant baseline is a tier-by-area lookup table the logistic should beat under stricter conditions. Third, the current scorer encodes the October 2022 sign-flip on U.S. co-authorship density (covered in detail in the next release) but still ships without language-model-extracted features such as stated geopolitical alignment and mentor lineage. The sign-flip encoding moved the Brier from 0.088 to 0.082; the language-model extraction lane is scoped for a later release and will likely move it again. Until those land, the Brier of 0.082 should be read as a floor for what the methodology can do, not a ceiling.

What we will and will not publish.

Public profiles only. Every input field is recoverable from a public lab page, arXiv, conference proceedings, or an announced funding roster. No private personal information enters the pipeline.

Pseudonyms by default.Real names enter the registry only after either a documented restriction event becomes available as a citable anchor for the named individual, or an external advisor review explicitly approves a named profile on the basis of the researcher's own publicly-stated positions. This release ships with zero real-name case studies.

No published score above 0.80 without a supporting evidence pack. The scorer clamps at 0.80 by construction; this guardrail will remain in force through the next two releases.

Right to correction. Researchers named in this index, and any reader with a corroborated correction to a row in either the events table or the scoreboard, may request a change through the submission form. Corrected records carry a versioned diff; the prior version remains visible in the append-only log. The submission form is the only channel — the project does not accept corrections via direct email, in order to keep the audit trail public.

Single-source claims marked. Every fact that rests on a single press source is marked on the row. Every fact for which a specific URL or document identifier is not yet pinned down is flagged as unverified on the row and resolved on the punch list before the next release.

How to read a five-profile scoreboard.The scoreboard is a worked example, not a population estimate. Two of the five profiles sit at the 0.80 guardrail ceiling; the spread between those two and the bottom of the table is meaningful, the spread between adjacent low-signal rows is not. The 90% confidence intervals are wide on every profile and especially wide on the low-signal tail — reading rank ordering inside the bottom half of the table is, at this stage, reading noise. The planned twenty-five-profile release will be the first one for which the scoreboard supports cohort-level inference. The current release is the version that proves the methodology produces a number at all.