Distillation attack

A distillation attack, also called adversarial distillation, illicit distillation or malicious distillation, is the training of a machine learning model, usually a large language model, on outputs collected from another developer's model in breach of that developer's terms of service or access restrictions. The term derives from knowledge distillation, a standard technique in which a "student" model learns from the outputs of a stronger "teacher" model. Developers routinely distill their own models to produce smaller and cheaper versions. The companies and agencies that use the term apply it to competitors who query a model at scale, typically through fraudulent accounts and resold access, to build a rival system for a fraction of what the original cost to develop.

Most of the accusations have come from OpenAI, Anthropic and Google, and most have been aimed at Chinese companies. OpenAI and Microsoft began investigating DeepSeek in January 2025. In February 2026 OpenAI named DeepSeek in a memo to a House committee, Anthropic named DeepSeek, Moonshot AI and MiniMax, and Google reported attacks on its models without naming anyone. Anthropic later accused Alibaba, Xiaomi, Zhipu AI and others, and in September 2026 the FBI, the National Security Agency and the Cybersecurity and Infrastructure Security Agency issued a joint advisory naming six China-based companies. The White House said Moonshot had distilled Anthropic's models to build its Kimi K3 model, which Moonshot denied and independent researchers doubted. Asked under oath in April 2026 whether xAI had distilled OpenAI's models, Elon Musk answered "Partly".

China's government has called the accusations groundless and distillation a common practice, including among American companies. No claim has been tested in court. Legal commentators have described copyright as an unlikely basis for a case and the developers' terms of service as the clearest one, and some have pointed to the Computer Fraud and Abuse Act where fraudulent accounts are involved. Nvidia, Microsoft, Meta and other companies have argued that distillation is ordinary competition, and some commentators have questioned how much it explains the progress of Chinese models. The developers have responded with account bans, detection systems and limits on how much of a model's reasoning is shown. The White House issued a memorandum on the subject in April 2026, and bills to sanction the companies responsible were introduced in both houses of Congress.

Background

On the left, fraudulent accounts send prompts through proxies and resellers across a dashed API line to the developer's teacher model on the right; the outputs come back the same way and are collected to train a student model. Account verification and reasoning summaries are marked on the API line as safeguards.
The pattern AI developers have described: many fraudulent accounts query a teacher model through proxies, and its outputs are collected to train a student model.

Knowledge distillation was described in 2015 by Geoffrey Hinton, Oriol Vinyals and Jeff Dean, who built on earlier work by Rich Caruana and his collaborators. They presented it as a way to compress the knowledge in an ensemble of models into a single model that is easier to deploy. In practice it usually means querying the teacher model on problems in a particular domain and training the student on the results, for example by supervised fine-tuning. The leading developers distill their own models to make smaller versions for customers. Anthropic and the White House Office of Science and Technology Policy have both described the technique as legitimate, and the latter's April 2026 memorandum called it "a vital part" of the AI ecosystem.

Security researchers had studied copying a model through its outputs before large language models existed. In 2016 Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter and Thomas Ristenpart described "model extraction attacks", in which an adversary with black-box query access and no knowledge of a model's parameters or training data duplicates its functionality. They demonstrated the attack against the prediction services of BigML and Amazon Machine Learning, and showed that withholding confidence values from a model's outputs did not prevent it. In 2024 Nicholas Carlini, Tramèr and twelve colleagues showed that part of a production language model could be recovered through its public interface. For under $20 in queries they extracted the embedding projection layer of OpenAI's Ada and Babbage models, and with it the models' hidden dimensions. Google's Threat Intelligence Group applies the 2016 name to language models offered as services: an attacker uses legitimate access to probe a model systematically, then transfers what it learns to a new model through knowledge distillation, which is why Google also calls them distillation attacks.

In 2023 training on a rival's outputs became routine in open research. In March researchers at Stanford University released Alpaca, a version of Meta's LLaMA 7B fine-tuned on 52,000 instruction-following demonstrations generated with OpenAI's text-davinci-003 for under $500 through OpenAI's API. They restricted it to academic research, giving as one reason that OpenAI's terms of use "prohibit developing models that compete with OpenAI". The same month a group from UC Berkeley, Carnegie Mellon, Stanford and UC San Diego released Vicuna, a LLaMA model fine-tuned on about 70,000 ChatGPT conversations that users had posted to the sharing site ShareGPT. Training cost about $300, and the group released the model for non-commercial use only, subject to Meta's license, OpenAI's terms of use and ShareGPT's privacy practices. In June Microsoft researchers described Orca, a 13-billion-parameter model trained on GPT-4's step-by-step explanations rather than on its answers alone, and reported that it matched ChatGPT on one reasoning benchmark while trailing GPT-4. A study led by Arnav Gudibande and Eric Wallace in May 2023 found that such imitation models mimicked ChatGPT's style but not its factuality. On tasks their training data did not cover, the study found, they closed "little to none" of the gap.

Developers also release distilled versions of their own models. When DeepSeek published its R1 reasoning model in January 2025, it released six smaller models distilled from R1 onto Qwen and Llama bases with it. The leading developers' terms still forbid building competitors from their outputs. Google states that distilling its Gemini models without permission violates its terms of service and may lead to takedowns and legal action, and Anthropic does not offer commercial access to Claude in China or to subsidiaries of Chinese companies abroad.

Several names are in use. Google uses "model extraction attacks" and "distillation attacks", Anthropic "distillation attacks" and "illicit distillation", and OpenAI, in a February 2026 memo to the House Select Committee on China, "adversarial distillation". The White House memorandum NSTM-4, signed by Michael Kratsios on April 23, 2026, is titled "Adversarial Distillation of American AI Models" and speaks of "unauthorized, industrial-scale distillation"; the September 2026 joint advisory speaks of "malicious" and "industrial-scale" distillation. Two bills before Congress define a "model extraction attack" as querying a closed-source model to train another in a way that circumvents access controls, uses fraudulent credentials or breaks terms that forbid such use.

Methods

Accounts of how distillation attacks are carried out come from Anthropic, Google, OpenAI and the September 2026 joint advisory.

Gaining access

Querying at this scale takes a great many accounts. Anthropic put the three campaigns it reported in February 2026 at about 24,000 accounts, most of them opened through its educational, security-research and startup programs. Its September report described accounts created under false identities with stolen credit cards, login credentials and API keys. Among them was a pool of nearly 5,000 accounts it attributed to Alibaba, set up with residential proxies, disposable email addresses and virtual payment cards. The joint advisory describes premium subscriptions bought in bulk and shared among teams of developers. At StepFun, a Shanghai developer the advisory names, employees ran several sessions at once from pools of accounts.

Requests are routed through intermediaries that conceal their origin. OpenAI's memo described accounts linked to DeepSeek employees reaching its models through third-party routers that masked their source, and Chinese companies relying on networks of unauthorized resellers of its services. Anthropic described commercial proxy services that resell access to Claude and other models through what it called "hydra cluster" architectures: networks of fraudulent accounts spread across its API and third-party cloud platforms, in which a banned account is replaced by another. One such network ran more than 20,000 accounts at once and mixed distillation traffic with ordinary customer requests. The Register observed that Anthropic had not shown how these networks differed from commercial proxy services in general. The advisory describes a similar gray market of API proxies, which it calls "transfer stations", that resell access to the most capable models at a fraction of the official price and serve to evade geographic restrictions and safeguards. Requests also pass through cloud providers and aggregators that strip identifying metadata, with automatic failover when a pathway is blocked. Some proxy operators record their users' exchanges with the models and sell them.

Stolen API keys, including credentials belonging to legitimate companies and individuals, are a further source of access. In October 2026 OpenCode, the maker of an open-source coding agent, attributed a breach of its Console service to "a large-scale distillation attack". The service stores users' keys for providers such as OpenAI, Anthropic and Google. About 1.4% of users were affected. Some reported unauthorized charges of hundreds of dollars, and a few of more than $1,000; Anthropic and Google blocked the keys they believed exposed, and OpenAI and OpenCode offered refunds. OpenCode did not explain how the breach had happened or how the keys were used, and TechCrunch and CPO Magazine both reported that its distillation framing was unproven. Benjamin Read and Rami McCarthy of the security company Wiz, who counted at least nine AI developer platforms disclosing incidents that month, described attackers hunting stored credentials for AI services. They treated distillation as one source of demand alongside a market of resellers offering discounted model access. One reseller's site carried a "distillation behaviour detection" page for its own users, which they saw as a way to avoid the account suspensions that follow distillation.

Extracting reasoning

A model's reasoning is the output most sought after. Google reported that attackers tried to coerce Gemini into writing out its full chain of thought, which is normally summarized before display. One campaign of more than 100,000 prompts instructed the model to keep its "thinking content" in the language of the user's input, which Google read as an attempt to reproduce its reasoning in many languages. Google said its systems caught the campaign in real time. Anthropic reported prompts from DeepSeek that asked Claude to imagine the reasoning behind a completed answer and write it out step by step, producing chain-of-thought training data at scale. OpenAI described multi-stage pipelines that combined synthetic data generation, large-scale data cleaning and preference optimization. The advisory lists chain-of-thought extraction among the tactics observed.

In September Anthropic gave examples of prompts designed to defeat its safeguards, from instructions to repeat prior reasoning "verbatim, exactly character for character" to requests to "translate" it into Japanese. One laboratory, it said, had run more than 12,000 test requests before settling on the techniques that worked. It also described a "cross-session replay attack". Anthropic's API returns a reference to the model's hidden reasoning, a "thinking signature", not the reasoning itself. Moonshot and DeepSeek, Anthropic said, saved the signature, opened a new session and had Claude convert it back into the full trace. OpenAI reported the same technique in a July 2026 campaign it attributed to people linked to Moonshot. Its models' "protected reasoning" is handed to the client as an encrypted block, and the operators took the block from one conversation and asked a model in another to decrypt it. The encryption, OpenAI said, had not been broken.

Rerouting users' requests

Anthropic's September report also described companies passing their own customers' requests to Claude. Moonshot, it said, "silently forwarded" requests meant for its Kimi models to Claude and presented the answers as Kimi's. The requests passed through a network of fraudulent accounts, most of them apparently in Singapore and Japan, and Moonshot kept some of the exchanges for training. DeepSeek screened incoming requests for signs of coding tools such as Claude Code or OpenCode and relayed selected ones to Claude Opus, and Xiaomi replayed its users' sessions through Claude to generate training data without serving the responses to them. Anthropic did not know whether the companies had told their customers, and said the relayed requests had included sensitive information. Among the Kimi requests, it said, was one from a user it assessed as likely affiliated with the People's Liberation Army, who asked for analysis of surveillance footage of a single person from hundreds of cameras in Chengdu. The South China Morning Post noted that this was the first time Anthropic had accused Chinese companies of forwarding users' requests directly to Claude.

Detection and countermeasures

Anthropic and Google say they identify distillation traffic by its pattern rather than its content. Anthropic described "massive volume concentrated in a few areas, highly repetitive structures, and content that maps directly onto what is most valuable for training an AI model". It said it had built classifiers and behavioral fingerprinting to detect chain-of-thought elicitation and coordinated activity across accounts. Google advised providers to monitor API access for extraction patterns, though Computerworld noted that researchers and prospective customers also collect large samples of a model's reasoning for legitimate purposes. The joint advisory's indicators include round-the-clock use without the variation or idle periods of human users, unusual ratios of subscriptions to usage, new subscriptions that reach their maximum usage at once, coordinated behavior across pools of accounts and sudden changes in identifying metadata. It recommends stronger identity verification. Anthropic says it uses metadata to attribute proxy-network accounts to a specific organization instead of banning them one at a time.

Google and Anthropic both say they summarize their models' reasoning before showing it, so that the transcripts are less useful for training. Anthropic said in October 2026 that a classifier trained on extraction prompts, with limits on replaying earlier reasoning, had cut the reasoning taken from its platform by a factor of 10 to 100, while blocking some legitimate requests. OpenAI closed the pathway that let encrypted reasoning be replayed, added checks on streamed output that might expose reasoning, and extended its protections across users, workspaces, organizations and model families.

The advisory also recommends that companies "subtly alter responses" to suspected distillers. The alterations it lists are noise added through differential privacy, routing to less capable models, shallower reasoning, correct answers reached by different reasoning, and stylistic inconsistencies, varied from request to request so as not to trigger alerts. It advises against telling the targets, since that would help them evade the defense and roll back their training, though it says safety researchers and third-party evaluators should be told of model changes. The campaigns, it says, run their own quality-evaluation pipelines to detect degraded output. Google says its own defenses can likewise degrade a student model's performance.

Beyond detection, the developers rely on account bans and verification. OpenAI bans accounts that break its terms and removes users who appear to be distilling its models, and Google may respond with takedowns and legal action. Anthropic strengthened verification for educational, research and startup accounts, and said in October that it had banned tens of thousands of accounts but did not know how long its gains would last. The Register wrote that enforcement against abusive accounts "can turn into a game of whack-a-mole".

They also share indicators with one another, with cloud providers and with governments. OpenAI, Anthropic and Google reportedly began an initiative through the Frontier Model Forum, an industry body, to exchange information on distillation attempts from China, and OpenAI passed its findings on the July campaign to the forum and to government channels. Joe Khawam of the Law Reform Institute, who has advocated sanctions against the accused companies, wrote that uncertainty over antitrust law had limited what the companies would exchange. The advisory states that sharing IP addresses, domains, query volumes and timing can make distributed infrastructure visible as a single campaign, and the April 2026 White House memorandum committed the government to share information about attackers with the companies.

Accusations

The accusations have been made by the developers and, from April 2026, by the United States government, with Chinese companies as the principal targets. Google, which published its findings in February 2026, named no company and said the attempts it had seen came from private companies and researchers around the world. Anthropic counts in "exchanges", each a request to Claude and its response; OpenAI counts requests, Google prompts, and the joint advisory tokens. The companies named have for the most part not responded to requests for comment from Reuters, TechCrunch, CNBC, Bloomberg and NPR.

Campaigns reported by the accusers, with their own counts
TargetAccuserPeriodVolumeAccountsSource
DeepSeekAnthropicto February 2026over 150,000 exchangesabout 24,000 across the three February campaignsAnthropic post, February 23, 2026
Moonshot AIAnthropicto February 2026over 3.4 million exchangesabout 24,000 across the three February campaignsAnthropic post, February 23, 2026
MiniMaxAnthropicto February 2026over 13 million exchangesabout 24,000 across the three February campaignsAnthropic post, February 23, 2026
not namedGoogleto February 2026over 100,000 promptsnot statedGoogle Threat Intelligence Group report, February 12, 2026
XiaomiAnthropic20 days in March and April 2026over 400,000 exchangesover 1,500Anthropic report, September 10, 2026
AlibabaAnthropicApril 22 to June 5, 2026over 28.8 million exchangesnearly 25,000Anthropic letter to the Senate Banking Committee, June 10, 2026
AlibabaAnthropicMay to July 2026over 151 million exchanges, peaking near 3 million a dayover 3,500 at the peakAnthropic report, September 10, 2026
Moonshot AIAnthropicMay to July 2026over 23 million exchanges, including almost 300,000 relayed user requests in one ten-day period5,380 in the relay networkAnthropic report, September 10, 2026
Zhipu AIAnthropic17 days in June and July 2026over 3.4 million exchanges273Anthropic report, September 10, 2026
Moonshot-linked operatorsOpenAIJuly 1 to 28, 202616,000 reasoning-extraction requestsover 4,000 usersOpenAI post, September 30, 2026
DeepSeekAnthropic14 days in July 2026over 12.1 million exchangesnot statedAnthropic report, September 10, 2026
DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.aiFBI, NSA and CISAsince late 2024"billions of tokens"not statedJoint advisory AA26-251A, September 8, 2026

DeepSeek

The first accusation followed the release of DeepSeek's R1 model in January 2025. Bloomberg reported that Microsoft's security team had observed a group believed to be linked to DeepSeek extracting a large volume of data through OpenAI's API, and that the two companies were investigating. David Sacks, the White House adviser on AI, spoke on Fox News of "substantial evidence" of distillation without giving details. OpenAI did not name DeepSeek, saying only that companies in China and elsewhere were constantly trying to distill leading American models and that it was revoking the accounts involved with Microsoft's help. Fortune noted that OpenAI would find it hard to prove what DeepSeek had done without access to the company's internal data.

In a memo to the House Select Committee on China dated February 12, 2026, OpenAI stated that accounts associated with DeepSeek employees had developed methods to circumvent its access restrictions and written code to obtain outputs for distillation programmatically. The committee's chair, John Moolenaar, called the conduct "part of the CCP's playbook: steal, copy, and kill". Anthropic's post of February 23 described a DeepSeek campaign that targeted reasoning and used Claude to grade answers for reinforcement learning, and its September report described a much larger one in July, together with the rerouting of DeepSeek users' requests. The joint advisory said DeepSeek's publicly quoted training cost of $5.6 million was misleading because it left out the cost of the distilled data. In late October The Information reported, citing people with knowledge of the matter, that DeepSeek's V4.1-Flash and Moonshot's Kimi K3.1 Pro had relied heavily on outputs from OpenAI's GPT-6 Astra. Bahrad Sokhansanj of the Institute for Law & AI observed that Anthropic had counted far fewer exchanges from DeepSeek than from Moonshot or MiniMax. That suggested to him that DeepSeek's distillation had been closer to ordinary industry practice, even though its models were among China's most capable.

Moonshot AI

Anthropic's February post attributed a campaign to Moonshot through request metadata that matched the public profiles of senior staff, and its September report added the rerouting of Kimi users' requests. The most contested allegation concerned Kimi K3, released in mid-July 2026 with open weights and benchmark results close to those of the leading American models. On July 21 the Treasury secretary, Scott Bessent, said on Fox Business that the government was "finding watermarks of our U.S. large language models on many of the Chinese models" and could sanction their makers. He did not say what the watermarks were. Kratsios then wrote on X that the government had information that Moonshot had distilled Claude Fable, Anthropic's most capable generally available model, for K3 through an internal platform that switched between access methods to avoid detection, without saying where the information came from. Bessent added that for "covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table".

Moonshot denied that K3 had been built by distillation and said its gains came from its own innovations; Anthropic made no accusation over K3. Independent researchers were doubtful too. Braden Hancock of the Laude Institute said "you can't distill that much data, train a model, and release it in two weeks"; Fable had been public only since July 1. Nathan Lambert of the Allen Institute for AI argued that distillation mattered less as Chinese models approached the frontier and training shifted to reinforcement learning. Two researchers, Benji Berczi and Kyuhee Kim, found that K3 and Zhipu AI's GLM 5.2 sometimes identified themselves as Claude, which they took as evidence that "Claude's self-concept is embedded in these models' weights" but "not proof of a distillation". On September 30 OpenAI attributed "a core cluster" of the July reasoning-extraction campaign to individuals associated with Moonshot, noting that it was unclear whether all the operators were one actor and that its figures counted attempts rather than successes. The Hacker News observed that it published no technical evidence for the attribution.

Alibaba

In a letter of June 10 to Tim Scott and Elizabeth Warren of the Senate Banking Committee, made public later that month, Anthropic described the largest campaign it had seen, by operators linked to Alibaba and its Qwen laboratory. The campaign, it said, had targeted Claude's ability to handle long and complex tasks and its approach to decision-making. The letter asked Congress to penalize the companies responsible, expand intelligence sharing, clarify antitrust rules so that developers could share information about attacks, and tighten export controls. The September report described a still larger Alibaba campaign between May and July. It said the campaign had extracted Claude's reasoning transcripts for the training of the Qwen 3.5, 3.6 and 3.7 models, and that Alibaba had also used Claude to help build its own training infrastructure.

Zhipu AI, Xiaomi and others

In its September report Anthropic said Zhipu AI, branded outside China as Z.ai, ran a pipeline that replayed captured Claude reasoning back through Claude to clean it for the training of its GLM models. In October Anthropic added that Zhipu had distilled the cyber capabilities of American models while developing GLM-5.3, and had switched to an older Claude model and another company's model after Anthropic's safeguards degraded its attacks. Xiaomi, the report said, had replayed sessions between its users and its own MiMo models through Claude to generate training data. MiniMax, named in February, had "pivoted within 24 hours" when Anthropic released a new model during its campaign and directed nearly half its traffic at the new system. The September report said MiniMax had built its own proxy network through a shell company that offered only Anthropic's and OpenAI's models. The report also said SenseTime's training pipeline had included transcripts of users' Claude exchanges bought from data vendors. The joint advisory named StepFun, which it said had distilled Claude and GPT models to improve the coding abilities of its Step 4 model, alongside DeepSeek, Moonshot, Alibaba, MiniMax and Z.ai. It said the six had extracted billions of tokens from Claude, GPT, Gemini and Grok since at least late 2024, "likely with Chinese government awareness".

xAI

Cross-examined in Musk v. Altman on April 30, 2026, Elon Musk was asked whether xAI had used distillation on OpenAI's models to train Grok. He called it a general practice among AI companies and, pressed on whether that meant yes, answered "Partly", adding that using other companies' models to validate one's own was standard. Lisa Klaassen, writing in Lawfare, later argued that if model outputs are not protectable, the six companies named in the advisory had done nothing "that Elon Musk has not freely admitted to under oath, without consequence".

Reported military use

In July 2026 Reuters reported that researchers linked to the People's Liberation Army and other military institutions had used outputs from OpenAI and Anthropic models to train smaller systems for defense use. The report drew on a review of more than 80 Chinese academic papers and patents and on research shared with Reuters by the Jamestown Foundation. One paper from a PLA cyber-warfare unit described using GPT-3.5 to summarize military source code and training a domestic model on the summaries so that it could run inside military networks. Another, from the North University of China, used Claude 3 Haiku to generate training data for a social-media monitoring classifier. Sunny Cheung of Jamestown, who analyzed more than 60 of the papers, said they showed researchers "trying to transfer that expensive, proprietary reasoning from Western models into smaller systems they can control and deploy locally". Reuters noted that the dispute centered on unauthorized extraction rather than on distillation itself, and that Chinese military researchers were also studying distillation as a security risk to their own models. Anthropic repeated that it does not offer commercial access to Claude in China.

Responses

United States

The first legislative response came on April 15, 2026, when Bill Huizenga introduced the Deterring American AI Model Theft Act, H.R. 8283. It would require the State Department to assess within 180 days which foreign entities had carried out model extraction attacks or run "fraudulent account networks", and to maintain a public "AI Model Extraction Attackers List". The Commerce Department would consider listed entities for the Entity List, and the president could block their property under the International Emergency Economic Powers Act. The bill treats authorized distillation as "a legitimate research method" and allows the purpose of querying to be inferred from "the totality of circumstances", such as volume, coordination and timing. On April 22 the House Foreign Affairs Committee voted 43 to 0 to report it with an amendment that moved the assessment from the State Department to the Commerce Department. as of November 2026 it had 21 cosponsors and had not been taken up by the full House.

The White House memorandum NSTM-4 followed on April 23. It states that entities based principally in China were running "deliberate, industrial-scale campaigns" using tens of thousands of proxy accounts and jailbreaking. The resulting models fell short of the originals, it says, but could appear comparable on selected benchmarks at a fraction of the cost, with their security protocols stripped out. The memorandum commits the administration to share information with AI companies about the tactics and actors involved, help the companies coordinate, develop best practices with them and explore "a range of measures to hold foreign actors accountable". Helen Toner of Georgetown's Center for Security and Emerging Technology had told a Senate hearing the previous day that there was "strong evidence" of Chinese companies distilling American models. Zhang Ruiwang, a Beijing-based information systems architect quoted by the South China Morning Post, said start-ups that had relied on distillation while describing their models as self-developed could be forced out within six to twelve months. Khawam wrote in Just Security that the memorandum and the bill did "not yet impose costs" but laid "the groundwork for doing so". Theo Bearman of the Institute for AI Policy and Strategy, a think tank, called the memorandum "a meaningful first step". It said nothing, he wrote, about the link between distillation and semiconductor export controls, or about how attackers would be held to account. He proposed amending the House bill to deem the listed entities to have engaged in trade-secret theft, which would open sanctions under the Protecting American Intellectual Property Act of 2022.

The Senate counterpart, the Blocking Large-scale Adversarial Distillation Efforts Act, S. 5252, was introduced on August 5 by Bill Hagerty with Tim Scott, Andy Kim and Catherine Cortez Masto. Dave McCormick and Jeanne Shaheen joined two days later. It mirrors the amended House bill, but directs the Commerce Department to add listed entities and subsidiaries they at least half own to the Entity List, and requires rather than permits the blocking of their property. It was referred to the Senate Banking Committee, where as of November 2026 it remained.

The joint advisory of September 8 from the FBI, NSA and CISA calls distillation "not a supplement to these companies' AI model development, but the critical core of it". The Associated Press described it as more detailed than the government's earlier accusations, and NBC News noted that it did not claim that Chinese intelligence had taken part. Khawam told the South China Morning Post that its publication two days before Anthropic's report suggested the administration would raise distillation at the US–China AI talks planned for that month. President Donald Trump and Xi Jinping met in Washington on September 24. CNBC had listed chip export controls and the distillation accusations among the main points of friction going in. The Council on Foreign Relations said the summit brought no breakthrough on AI. The two governments agreed to open a dialogue on AI, with a further meeting in November, and a channel for reporting AI incidents.

China

China's government has rejected each accusation in turn. At the World Artificial Intelligence Conference in Shanghai on July 18, the assistant foreign minister Liu Bin said that "some countries hype up distillation" in a way that was "misguided and counterproductive", without naming the United States. After Bessent's remarks, a commerce ministry spokesperson said on July 27 that the accusations "lack any actual evidence, have no legal backing, and effectively amount to a double standard". The ministry argued that the interval between American releases and the Chinese models said to copy them was too short for distillation, and said that "many U.S. AI companies have distilled from China's models". The Register found the counter-allegation plausible but not necessarily a sign that American companies were abusing intellectual property, noting that Kratsios himself had called distillation legitimate when used to make smaller, more efficient models.

After the September advisory the ministry called the accusations groundless and described distillation as "a common practice" among AI companies worldwide, including American ones. It accused the United States of seeking a monopoly of the industry out of "anxiety and double standards", and promised "resolute countermeasures" against any suppression of Chinese companies under the pretext of targeting distillation. The foreign ministry spokesperson Mao Ning attributed China's progress in AI to its own self-reliance and urged the United States to "refrain from making unfounded accusations or smears".

No accusation has been tested in court, and as of October 2026 no American developer had sued. Klaassen noted that OpenAI and Microsoft had accused DeepSeek of breaching their terms without litigating, and that Anthropic had published reports and written to Congress without filing a case. One reason, she suggested, is that a ruling that terms of service govern what may be done with model outputs would in effect create an intellectual property right in those outputs, which the publishers suing the developers over their own training data could then turn against them.

Commentators give copyright little chance. John Ruwitch of NPR reported that AI-generated answers have generally not been considered copyrightable. Ridoan Karim of Monash University made the same point and compared distillation to reverse engineering, which American courts have permitted where it targets function rather than expression. Klaassen wrote that claiming trade-secret protection for text sold with an API key is "a tricky business", because commercializing a secret usually destroys its protection. Sokhansanj argued that ordinary outputs are available to any account holder and so are unlikely to qualify as secrets. The terms of service of OpenAI, Anthropic and Google all forbid using outputs to build competing models. Klaassen considered the terms the one thing distillation clearly violates, so that the accused companies, if the allegations are true, could face a suit for breach of contract. Karim cautioned that a contract binds only its parties, that access through layers of accounts and intermediaries makes attribution difficult, and that a breach of contract is not in itself a crime.

Sokhansanj, writing in Lawfare in July 2026, saw the Computer Fraud and Abuse Act as the more promising route. Since the Supreme Court's 2021 decision in Van Buren v. United States, he wrote, an ordinary terms-of-service violation does not exceed authorized access under the act, but false identities, misrepresented credentials or proxy access used to get around a provider's cutoff could support civil or criminal claims. He warned against answering distillation by creating new quasi-property rights in model outputs, which he said would favor the developers' commercial interests over the public's. Khawam suggested that the data-privacy aspects of the rerouting allegations could implicate Chinese law as well.

Debate

TechCrunch saw "no small amount of irony" in the leading laboratories objecting to distillation given their "bending and alleged breaking of copyright rules" in assembling their own training data. Anupam Chander of Georgetown Law noted that the companies had themselves argued "that learning from others is a perfectly fair use of other people's copyrighted work". Microsoft's chief executive, Satya Nadella, called it "ironic" that model providers claimed fair use for training on public data and then imposed restrictive terms on distillation. Klaassen set the September advisory beside a Justice Department brief filed eight days earlier in OpenAI's copyright case with The New York Times, which argued that training on copyrighted text is fair use. "Both propositions cannot hold simultaneously," she wrote. She also noted one difference in the Chinese companies' favor: they had paid for the subscriptions whose terms they were accused of breaking.

In the week of Kratsios's post about Kimi K3, Nvidia, Microsoft, Meta, Palantir and more than twenty other companies published a letter urging policymakers to avoid "premature restrictions" on open-weight models and "not to conflate legitimate model-development techniques with misappropriation". The Register observed that nearly every major American AI company apart from Amazon and Anthropic had signed. Aaron Levie of Box, a signatory, said American companies needed access to the best technology wherever it was developed. Jensen Huang of Nvidia called distillation "competition" and said a company that objected should "know your customers, and disable the service". Clément Delangue of Hugging Face called it "a very small factor in the ability to create good models" and a practice that everyone, including American companies, engaged in.

How much distillation explains the Chinese models' progress is also disputed. Aidan Gomez of Cohere, a co-author of the 2017 paper that introduced the transformer, told CNBC in September 2026 that the Chinese laboratories had distilled "to an extent" but had also developed "an exceptional capability independent of distillation". Some of their models now beat the best American models on some benchmarks, he said, and "you can't copy or distill to better". Sriram Krishnan, a former senior White House policy adviser on AI, said that services such as ChatGPT and Claude "came out of distilling human content" and that it was unclear how much distillation added to the Chinese models. Neil Shah of Counterpoint Research argued that chip restrictions had forced Chinese developers "to build leaner, smarter architectures", and that dismissing this as imitation "fundamentally misjudges the competition".

Khawam wrote in May that the debate "has so far been based on corporate disclosures by the targeted labs" and that the public record did not show how central distillation was to any company's development. Sokhansanj argued that too little was known about how much distillation contributed to Chinese models' capabilities, and proposed that the Center for AI Standards and Innovation study the question before stronger measures were adopted. Anthropic says it attributes campaigns through IP addresses, request metadata and infrastructure, in some cases corroborated by other companies that observed the same actors.

See also

References

  1. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 Google Threat Intelligence Group (February 12, 2026). "GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use". Google Cloud Blog. Google. Retrieved October 29, 2026.
  2. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 National Security Agency; Cybersecurity and Infrastructure Security Agency; Federal Bureau of Investigation (September 8, 2026). China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (Report). Cybersecurity and Infrastructure Security Agency. Joint Cybersecurity Advisory AA26-251A. Retrieved October 29, 2026.
  3. 1 2 3 4 Fernholz, Tim (July 23, 2026). "Experts say exploiting Anthropic's Fable isn't how Kimi K3 got so good". TechCrunch. Retrieved October 29, 2026.
  4. 1 2 3 4 5 Baptista, Eduardo (July 31, 2026). "Chinese military researchers tap US AI models to train defence systems". Reuters. Retrieved November 1, 2026.
  5. 1 2 3 4 Fernholz, Tim (April 30, 2026). "Elon Musk testifies that xAI trained Grok on OpenAI models". TechCrunch. Retrieved October 29, 2026.
  6. 1 2 3 Chan Ho-Him (September 9, 2026). "China hits back at US claims of 'malicious' AI distillation ahead of planned Trump-Xi talks". AP News. Associated Press. Retrieved November 1, 2026.
  7. ↑ Hinton, Geoffrey; Vinyals, Oriol; Dean, Jeff (March 9, 2015). "Distilling the Knowledge in a Neural Network". arXiv:1503.02531 [stat.ML].
  8. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 "Detecting and preventing distillation attacks". Anthropic. February 23, 2026. Retrieved October 29, 2026.
  9. 1 2 3 4 Kratsios, Michael J. (April 23, 2026). Adversarial Distillation of American AI Models (PDF) (Report). Office of Science and Technology Policy. NSTM-4. Retrieved October 29, 2026.
  10. ↑ Tramèr, Florian; Zhang, Fan; Juels, Ari; Reiter, Michael K.; Ristenpart, Thomas (2016). Stealing Machine Learning Models via Prediction APIs. 25th USENIX Security Symposium. USENIX. arXiv:1609.02943. Retrieved October 29, 2026.
  11. ↑ Carlini, Nicholas; Paleka, Daniel; Dvijotham, Krishnamurthy Dj; Steinke, Thomas; Hayase, Jonathan; Cooper, A. Feder; Lee, Katherine; Jagielski, Matthew; Nasr, Milad; Conmy, Arthur; Yona, Itay; Wallace, Eric; Rolnick, David; Tramèr, Florian (March 11, 2024). "Stealing Part of a Production Language Model". arXiv:2403.06634 [cs.CR].
  12. ↑ Taori, Rohan; Gulrajani, Ishaan; Zhang, Tianyi; Dubois, Yann; Li, Xuechen; Guestrin, Carlos; Liang, Percy; Hashimoto, Tatsunori B. (March 13, 2023). "Alpaca: A Strong, Replicable Instruction-Following Model". Stanford Center for Research on Foundation Models. Stanford University. Retrieved October 29, 2026.
  13. ↑ Chiang, Wei-Lin; Li, Zhuohan; Lin, Zi; Sheng, Ying; Wu, Zhanghao; Zhang, Hao; Zheng, Lianmin; Zhuang, Siyuan; Zhuang, Yonghao; Gonzalez, Joseph E.; Stoica, Ion; Xing, Eric P. (March 30, 2023). "Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90%* ChatGPT Quality". LMSYS Org. Retrieved November 1, 2026.
  14. ↑ Mukherjee, Subhabrata; Mitra, Arindam; Jawahar, Ganesh; Agarwal, Sahaj; Palangi, Hamid; Awadallah, Ahmed (June 5, 2023). "Orca: Progressive Learning from Complex Explanation Traces of GPT-4". arXiv:2306.02707 [cs.CL].
  15. 1 2 3 4 5 6 7 8 9 Klaassen, Lisa (October 8, 2026). "The AI Model Distillation Paradox". Lawfare. Retrieved October 29, 2026.
  16. ↑ Gudibande, Arnav; Wallace, Eric; Snell, Charlie; Geng, Xinyang; Liu, Hao; Abbeel, Pieter; Levine, Sergey; Song, Dawn (May 25, 2023). "The False Promise of Imitating Proprietary LLMs". arXiv:2305.15717 [cs.CL].
  17. ↑ DeepSeek-AI (January 22, 2025). "DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning". arXiv:2501.12948v1 [cs.CL].
  18. 1 2 3 4 5 6 Lyons, Jessica (February 14, 2026). "How AI could eat itself: Competitors can probe models to steal their secrets and clone them". The Register. Retrieved October 29, 2026.
  19. 1 2 "H.R. 8283: Deterring American AI Model Theft Act of 2026 (Introduced in House)". Congress.gov. Library of Congress. April 15, 2026. Retrieved October 29, 2026.
  20. 1 2 "S. 5252: Blocking Large-scale Adversarial Distillation Efforts Act of 2026 (Introduced in Senate)". Congress.gov. Library of Congress. August 5, 2026. Retrieved October 30, 2026.
  21. 1 2 3 4 Seetharaman, Deepa; Arámburo, Fabiola (February 12, 2026). "OpenAI says China's DeepSeek trained its AI by distilling US models, memo shows". Reuters. Retrieved November 1, 2026.
  22. 1 2 3 Bellan, Rebecca (February 23, 2026). "Anthropic accuses Chinese AI labs of mining Claude as US debates AI chip exports". TechCrunch. Retrieved October 29, 2026.
  23. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 Anthropic (September 10, 2026). Detecting and countering misuse of AI: September 2026 (PDF) (Report). pp. 143–153. Retrieved October 29, 2026.
  24. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 Lee, Jenny (September 10, 2026). "Chinese AI labs secretly used millions of Claude exchanges to train their models, Anthropic says". CNBC. Retrieved October 29, 2026.
  25. 1 2 3 Culafi, Alexander (September 9, 2026). "US Government Accuses Chinese AI Firms of Distilling Frontier Models". Dark Reading. Retrieved October 29, 2026.
  26. 1 2 3 Claburn, Thomas (February 24, 2026). "Anthropic accuses China's AI labs of ripping off content – just like it did". The Register. Retrieved October 29, 2026.
  27. 1 2 3 4 Pogorelec, Anamarija (September 9, 2026). "Chinese AI firms are siphoning capabilities from American models, CISA warns". Help Net Security. Retrieved October 29, 2026.
  28. ↑ Poireault, Kevin (October 19, 2026). "OpenCode Breach Could Affect OpenAI, Anthropic and Google". Infosecurity Magazine. Retrieved October 29, 2026.
  29. 1 2 Mehta, Aditya (October 19, 2026). "Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts". TechCrunch. Retrieved October 29, 2026.
  30. 1 2 Hope, Alicia (October 22, 2026). "OpenCode AI Coding Tool Exposes API Keys in Suspected Distillation Attack, Triggering Unauthorized Charges". CPO Magazine. Retrieved October 29, 2026.
  31. ↑ Read, Benjamin; McCarthy, Rami (October 30, 2026). ""Black October" for AI Developer Platforms". Wiz. Retrieved October 31, 2026.
  32. 1 2 3 Swain, Gyana (February 13, 2026). "Google fears massive attempt to clone Gemini AI through model extraction". Computerworld. Retrieved October 29, 2026.
  33. 1 2 3 4 5 6 7 Downing, Shane (October 1, 2026). "OpenAI says actors linked to China-based Moonshot AI spearheaded a campaign to extract its models' hidden reasoning". Tom's Hardware. Retrieved October 29, 2026.
  34. 1 2 3 4 5 6 "Disrupting a coordinated model-distillation campaign". OpenAI. September 30, 2026. Retrieved October 29, 2026.
  35. 1 2 3 4 Chow, Vincent (September 11, 2026). "Moonshot, DeepSeek secretly routed user requests to Claude, Anthropic claims". South China Morning Post. Retrieved October 29, 2026.
  36. 1 2 3 4 5 "Strengthening our defenses against distillation attacks". Anthropic. October 12, 2026. Retrieved October 29, 2026.
  37. 1 2 3 4 Khawam, Joe (May 5, 2026). "From Diagnosis to Deterrence: The Emerging U.S. Response to Adversarial Distillation". Just Security. Retrieved October 29, 2026.
  38. 1 2 3 4 5 "Chinese AI companies 'distilled' Claude to improve own models, Anthropic says". NBC News. Reuters. February 24, 2026. Retrieved October 29, 2026.
  39. 1 2 Metz, Rachel; Eastland, Maggie; Robertson, Jordan (September 10, 2026). "Moonshot Secretly Routed User Requests Through Claude, Anthropic Says". Bloomberg News. Retrieved October 29, 2026.
  40. 1 2 3 4 5 6 Ruwitch, John (July 28, 2026). "Allegations of AI distillation spark debate about IP theft. But is it illegal?". NPR. Retrieved October 29, 2026.
  41. 1 2 Mishra, Disha (October 29, 2026). "DeepSeek, Moonshot used OpenAI's GPT-6 Astra to train latest models, The Information reports". Reuters. Retrieved November 1, 2026.
  42. 1 2 3 Chia, Osmond (June 25, 2026). "Anthropic accuses Chinese rival Alibaba of illicitly extracting AI capabilities". BBC News. Retrieved November 1, 2026.
  43. 1 2 3 4 Nelson, Jason (June 25, 2026). "Anthropic Urges Congress to Crack Down on AI Distillation By Chinese Rivals". Decrypt. Retrieved October 29, 2026.
  44. 1 2 3 4 Collier, Kevin; Perlo, Jared (September 8, 2026). "U.S. agencies say top Chinese AI companies systematically copied American models". NBC News. Retrieved October 29, 2026.
  45. ↑ Shilov, Anton (January 29, 2025). "Microsoft and OpenAI investigate whether DeepSeek illicitly obtained data from ChatGPT". Tom's Hardware. Retrieved October 29, 2026.
  46. 1 2 Nolan, Beatrice (January 29, 2025). "DeepSeek used OpenAI's model to train its competitor using 'distillation,' White House AI czar says". Fortune. Retrieved October 29, 2026.
  47. ↑ Ghaffary, Shirin; Eastland, Maggie (February 12, 2026). "OpenAI Claims DeepSeek Distilled US Models to Gain an Edge". Bloomberg News. Retrieved October 29, 2026.
  48. 1 2 3 4 Sokhansanj, Bahrad A. (July 16, 2026). "Responding to AI Distillation Without Panic". Lawfare. Retrieved November 1, 2026.
  49. 1 2 3 Bellan, Rebecca (July 22, 2026). "Treasury threatens sanctions after White House claims Moonshot distilled Anthropic's Fable". TechCrunch. Retrieved October 29, 2026.
  50. 1 2 3 Leswing, Kif (July 25, 2026). "From Silicon Valley to DC, the tech world is suddenly obsessed with one concept in AI: Distillation". CNBC. Retrieved October 29, 2026.
  51. 1 2 3 Bellan, Rebecca (July 21, 2026). "US threatens sanctions against Chinese AI models over IP theft". TechCrunch. Retrieved October 29, 2026.
  52. 1 2 3 Claburn, Thomas (July 27, 2026). "Researchers find GLM and Kimi can adopt Claude's identity, but the evidence stops short of proving distillation". The Register. Retrieved October 29, 2026.
  53. ↑ Lakshmanan, Ravie (October 1, 2026). "OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates". The Hacker News. Retrieved October 29, 2026.
  54. ↑ "Musk v. Altman week 1: Elon Musk says he was duped, warns AI could kill us all, and admits that xAI distills OpenAI's models". MIT Technology Review. May 1, 2026. Retrieved October 29, 2026.
  55. ↑ Cheung, Sunny (July 30, 2026). "Chinese Research Details Distillation for Military Use". China Brief. 26 (16). Jamestown Foundation. Retrieved October 29, 2026.
  56. ↑ "H.R.8283 – Deterring American AI Model Theft Act of 2026: All Information". Congress.gov. Library of Congress. Retrieved November 1, 2026.
  57. 1 2 Bearman, Theo (May 12, 2026). "AI Distillation Attacks: Executive and Congressional Action Can Go Further". Institute for AI Policy and Strategy. Retrieved November 1, 2026.
  58. ↑ Breuninger, Kevin (April 23, 2026). "White House warns of 'industrial-scale' efforts in China to rip off U.S. AI tech". CNBC. Retrieved October 29, 2026.
  59. ↑ Chang, Minxiao; Feng, Coco (April 24, 2026). "US crackdown threat could shake out China's 'distillation' AI copycats: analysts". South China Morning Post. Retrieved October 30, 2026.
  60. ↑ "S.5252 – BLADE Act: All Information". Congress.gov. Library of Congress. Retrieved November 1, 2026.
  61. ↑ Kelley, Alexandra (August 7, 2026). "Tech bills of the week: Deterring AI distillation; Taxing AI developers; and more". Nextgov/FCW. Retrieved October 29, 2026.
  62. ↑ Nicol-Schwarz, Kai (September 23, 2026). "Trump-Xi summit puts AI safety talks on the table but neither side wants to slow down". CNBC. Retrieved November 1, 2026.
  63. ↑ Sacks, David (September 27, 2026). "The Limits of Trump and Xi's Photo-Op Summit". Council on Foreign Relations. Retrieved November 1, 2026.
  64. ↑ "China Dismisses Claim that It Illicitly Extracts Foreign AI Tech". Bloomberg News. July 18, 2026. Retrieved October 30, 2026.
  65. ↑ "Ministry of Commerce Press Spokesperson Answers Reporter's Question about the United States Threatening to Launch Investigations and Implement Sanctions Against Chinese Artificial Intelligence Enterprises". Center for Security and Emerging Technology (Translation of a statement by China's Ministry of Commerce). Georgetown University. July 27, 2026. Retrieved October 29, 2026.
  66. 1 2 Sharwood, Simon (July 28, 2026). "China fights back in AI spat with claim US AI companies distil Chinese models". The Register. Retrieved October 29, 2026.
  67. 1 2 Karim, Ridoan (March 16, 2026). "AI distillation and the law: Why learning from Claude or GPT may not be copyright infringement". Monash Lens. Monash University. Retrieved October 29, 2026.
  68. ↑ Nicol-Schwarz, Kai (September 28, 2026). "Jensen Huang says AI distillation is 'competition.' Scott Bessent has called it 'theft'". CNBC. Retrieved October 29, 2026.
  69. ↑ Kharpal, Arjun; Nicol-Schwarz, Kai (September 18, 2026). "The U.S. says China's AI progress is down to 'distillation.' But is it that clear cut?". CNBC. Retrieved November 1, 2026.