Artificial Intelligence

AI Distillation Explained: The Truth Behind the Biggest AI Controversy Right Now

US AI Labs Accused China of Stealing

Louis-François Bouchard

• 12 min read
AI Distillation Explained: The Truth Behind the Biggest AI Controversy Right Now

Anthropic just accused three Chinese AI labs of running what they call “industrial-scale distillation attacks” on Claude. And when I say industrial, I mean it. 24,000 fake accounts, 16 million exchanges, coordinated proxy networks all designed to extract Claude’s reasoning, coding, and agentic capabilities.

And they’re not alone. OpenAI sent a memo to the U.S. House Select Committee on China, accusing DeepSeek of “free-riding” on U.S. frontier-model capabilities. And even Google published a report documenting a 100,000-prompt campaign targeting Gemini’s reasoning traces.

All three reports dropped within 11 days of each other. February 12 to 23, 2026.

So in this article, I want to break down what’s actually being accused, how distillation works technically, the history that got us here, because this didn’t start last month, and we have to cover the part that nobody in Silicon Valley really wants to talk about: the hypocrisy behind these stories.

If you are curious and enjoy watching, I also made a video about this one:

P.S. Please consider subscribing to the channel, we are on the road to 100k subscribers this year! 30% left to go and I'd love if it were you! Click here to subscribe and have tons of AI engineering videos coming your way!

Anthropic’s report is the most detailed of the three, so let me start there. They say they identified three main Chinese labs, DeepSeek, Moonshot AI, and MiniMax, creating thousands of fake accounts to systematically extract Claude’s most valuable capabilities. This wasn’t casual API usage. This was, according to Anthropic, deliberate, targeted capability extraction.

It’s important to note that these three Chinese AI labs are also all great companies and contributors helping the open-source AI space grow and innovate, and the community loves them a lot for that.

But coming back to the accusations… The infrastructure they describe is called a “hydra cluster”: distributed networks of API accounts managed through commercial proxy services. One proxy network managed over 20,000 accounts simultaneously. When one account gets banned, another replaces it. They mixed distillation traffic with legitimate requests to make detection harder. You’ve got to appreciate the engineering effort!

And here’s what’s interesting: each of these labs was going after completely different things. So let’s see what each did and then talk a bit more about distillation and why it’s so important.

DeepSeek only accounts for about 150,000 of those 16 million exchanges. Less than 1%. But what they were doing was arguably smarter than everyone else.

They used Claude for three main things. First, reasoning extraction. They crafted prompts that told Claude to “imagine and articulate the internal reasoning behind a completed response and write it out step by step.” Since Claude’s API doesn’t typically expose its chain-of-thought, DeepSeek considered generating synthetic reasoning-trace data at scale. That’s the exact kind of data you’d use to train a thinking model like DeepSeek-R1 after having the base DeepSeek model, and this kind of data is super expensive to build manually, as you need people to actually write down a whole reasoning for each given answer, and do that hundreds of thousands of times, Ooooorrr you just ask Claude to do it for you.

The second thing DeepSeek did, and this is the most interesting one: rubric-based grading. They used Claude as a reward model. Feed in DeepSeek’s own outputs, have Claude grade them on rubrics. That gives you a free reinforcement learning signal without needing human annotators. You’re basically outsourcing your RLHF to your competitor’s API, which totally makes sense since DeepSeek and other open models are expected to be much less intelligent than closed models.

Third, and this one is wild, censorship-safe alignment. They prompted Claude to generate “safe” alternatives to politically sensitive queries about dissidents, party leaders, authoritarianism. Think about that for a second. They’re using an American AI model to train their Chinese AI model to handle censorship the way the Chinese government wants it handled. Using Claude as their reinforcement alignment step. That’s… creative, I’ll give them that.

But as I said, DeepSeek was only responsible for 150k of these millions of exchanges.

MiniMax drove the overwhelming majority, over 13 million exchanges. Focused on classic distillation of Claude’s biggest strengths: agentic coding, tool use, orchestration. Anthropic said MiniMax systematically queried Claude through fraudulent access pathways and collected Claude’s answers at massive scale, and used those outputs as training data or training signals for its own model. Basically, their goal was to imitate Claude as closely as possible with their new model. They could easily spot that when Anthropic released a newer Claude model during the campaign, MiniMax allegedly shifted nearly half of its traffic to that new version within 24 hours. Anthropic presents that as evidence of a live, monitored distillation operation, not a one-time scrape.

And now the last company. Moonshot AI, with 3.4 million exchanges also targeting agentic reasoning, computer-use agents, and computer vision. Anthropic says request metadata matched public profiles of senior Moonshot staff. Like, they could trace it back to specific researchers.

Moonshot released Kimi K2.5 in January 2026, open source, and it was outperforming Claude 3.5 Sonnet on some coding benchmarks. At 90% lower cost. So not better, but definitely competitive. The community called it a second “DeepSeek moment.” If the distillation accusations are true, well, you can maybe see where those capabilities came from.

But to understand why this is bigger than just “China copies American AI,” you need to understand what distillation actually is. Because it’s not new. At all.

Knowledge distillation was formalized in 2015 by Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Three of the most important names in deep learning. Hinton, godfather of deep learning. Vinyals, now one of the heads of Gemini. Jeff Dean… I mean, Jeff Dean needs no introduction, leading most AI efforts at Google for many years.

The original idea behind distillation is quite simple. You train a smaller model to match the full probability distribution of a larger model. Not just its final answers, but its uncertainty across all possible answers. When the teacher generates a text token and is 85% confident about it, we give it to our student model to imitate exactly. Hinton called this “dark knowledge.” And it works: the student model gets performance way beyond what its size would suggest, especially if you focus the training on a specific area where the teacher is pretty good at.

It’s an amazing technique because you only need a good model, and you can feed it questions and use its answers to train another one. Typically, we do that to train a much smaller, cheaper model to be as good as the teacher on a specific task, such as coding. It allows the use of all the teacher’s knowledge in a much denser model and reduces overall costs. But the main problem is that you need this teacher model. And you need its weights, its parameters, its exact probability outputs.

And this is a problem for these Chinese labs and other smaller open-source efforts, since we cannot have access to the best models’ internal parameters. We can only use them through the chat interface or the API, and what we get when talking to them are just tokens. The final outputs. We don’t see these probabilities that we would need to train our student model.

Well, fortunately, people found a workaround. Even if you cannot see the teacher model’s internal probabilities, you can still learn from its text outputs alone. You ask the model thousands or millions of carefully chosen questions, collect its answers, explanations, code completions, tool calls, refusals, and judgments, and then train your own model to imitate those patterns. It’s a weaker form of distillation than training on the probabilities themselves, but at enough scale it still works remarkably well. As always, scaling is all you need! And if you target the right domains, like coding, reasoning, or agent workflows, you can transfer a surprising amount of the teacher’s behaviour into your own model.

And that is basically the allegation here. These Chinese AI labs are not being accused of stealing model weights. They are being accused of using frontier models like Claude or GPT as black-box teachers: querying them at massive scale through APIs, harvesting the outputs, and turning those outputs into training data for their own systems. And if that sounds familiar, it should. Because that’s basically what OpenAI, Google and Anthropic do by querying the Internet and books at a massive scale to use the data and train their models. ;)

And an important thing to note is that every AI company uses distillation legitimately, and probably in a less legitimate way, without saying it, too. When you use the Gemini Flash or a mini model like Claude Haiku, those are all distilled from bigger models internally. It’s the whole product strategy for making AI affordable.

This is fine when it’s done in-house, and it’s a powerful technique for training smaller models to be almost as good as larger ones that require a lot of data to train. The problem comes when you try to do this by leveraging other models. Especially closed ones. But as I said, this is nothing new…

In March 2023, Stanford released Alpaca, a 7B parameter model, fine-tuned on 52,000 instruction examples generated from OpenAI’s API. Total cost: about $600. It performed similarly to ChatGPT on many tasks. Not all, but the crucial ones, people want the LLM to be good at. That number shocked people.

Within weeks, Vicuna and WizardLM followed. Vicuna cost $300, trained on ShareGPT conversation data. Claimed 90% of ChatGPT quality. Stanford took down the Alpaca demo eventually, but it didn’t matter. The proof was in. Frontier model behaviour was a commodity you could harvest through a public API. For less than the price of a nice dinner.

Then, on December 2024 DeepSeek released V3 and right after, on January, 2025, they released R1. The biggest shock to American AI has happened. It claimed performance parity with OpenAI’s o1 and GPT-4o, the best models to date. Training cost: approximately $5.6 million, whether or not that was true. About 2,000 older Nvidia H800 GPUs. Not H100s. Not Blackwells. Older chips that weren’t even supposed to be competitive anymore.

Nvidia dropped 17% that day. Roughly $589 billion in market value. The worst single-day loss of market cap in stock market history. The entire Nasdaq fell over 3%. Over $1 trillion in tech value evaporated in a single day. I remember covering this on the channel. I knew it was probably mostly hype and temporary, but matching OpenAI’s results and being open-source still is a big signal.

OpenAI and Microsoft immediately launched an investigation. And the suspicion was clear: how much of DeepSeek’s capability came from distilling Western models? DeepSeek said it was their architecture, their innovation with Multi-head Latent Attention, pure reinforcement learning. But the cold-start data question never really went away.

Now here’s where the story gets really interesting. Because the companies making these accusations have their own data acquisition history. And it is not clean.

In September 2025, Anthropic settles a class-action copyright lawsuit for $1.5 billion. The largest copyright settlement in history at the time. The case? They trained Claude on approximately 7 million books downloaded from pirated databases: Library Genesis, Pirate Library Mirror.

And then the court documents got really interesting. They unsealed details about something called “Project Panama,” an internal Anthropic operation where they bought physical books in bulk, used hydraulic machines to cut off the bindings, scanned the pages at high speed, and then destroyed the physical copies. The legal theory was that if you buy a physical copy, scan it for training, and destroy the original, you’ve maintained “one copy” under fair use.

In June 2025, Judge William Alsup held that Anthropic’s use of lawfully acquired books for training was fair use, but he also found the company could be liable for keeping more than 7 million pirated books in a central library. Hence the $1.5 billion.

And, five months after paying $1.5 billion for pirating books and valuing the company at much more than that thanks to those books, Anthropic publishes a report accusing Chinese labs of stealing from them. You can see why some people have mixed feelings about this.

Many, including Elon Musk, didn’t hold back on this story. Quote: “Anthropic is guilty of stealing training data at massive scale and has had to pay multi-billion dollar settlements for their theft.” He called them “super smug, sanctimonious and hypocritical.” And critics were quick to point out that Anthropic’s legal exposure does not stop with books. Reuters reported in January 2026 that music publishers alleged Anthropic infringed more than 20,000 songs, with potential statutory damages above $3 billion. That remains a live allegation, not a final judgment, but it makes the moral posture here look even less tidy.

George Hotz, the tiny corp guy, made a different point: that the Chinese labs paid for those API tokens. Like, they were paying customers. And Anthropic was apparently monitoring what those customers were doing with their tokens. Which raises its own questions about privacy.

The good thing with this story is that at least the memes are winning right now.

Basically, everyone is stealing from everyone in this story, and model provider companies are the first ones to do so.

None of us gave permission for our data to be scraped in the first place. These companies took the entire internet, trained on it, and now they’re upset when their outputs get taken.

But this is nothing new again. Companies steal stuff to make a profit. At least, most of these are in the grey zone.

But why did all three stealing reports from the three main AI companies drop within 11 days? Is that a coincidence?

These accusations did not land in a vacuum. OpenAI sent its memo to the House Select Committee on China on February 12. Anthropic’s report explicitly argues that distillation undermines the point of export controls unless restrictions stay tight. And just weeks earlier, the Commerce Department had shifted certain chip-export reviews from a presumption of denial to case-by-case treatment for qualifying advanced parts. That does not prove coordination. It does make the timing politically legible

Rest of World reported skepticism about the timing, suggesting it was motivated by chip-access politics as much as IP protection. And I think that’s worth considering. These companies have billions riding on the U.S. maintaining its AI advantage. The reports are conveniently timed to influence policy.

And in the background? DeepSeek is reportedly preparing V4 and R2. They’ve been delayed. Apparently, the CEO was unsatisfied with the results, and they had trouble training on Huawei chips, but they’re coming. If those models match or beat Western frontier models, these accusations won’t change anything.

So, where does all this leave us?

The cost of replicating frontier intelligence is deflating at roughly 70% per year for GPT-4-equivalent performance. That trend isn’t stopping. As long as frontier models sit behind public APIs, their intelligence is extractable.

The legal framework is genuinely unclear. The U.S. Copyright Office says AI outputs need sufficient human authorship for copyright protection. So calling distillation “theft” rests on terms-of-service violations, not IP law. That’s a much weaker foundation than anyone admits.

Western labs are also trying to move value out of raw model output and into products, workflows, and ecosystems. Claude Code is a good example of that logic. The moat is less about the naked model and more about the tooling around it; distillation matters less. That’s smart, honestly. Until they leaked the whole codebase as well, which is a whole other problem I talked about in a recent video if you are interested in what happened with Claude Code’s leak!

But the safety argument is real. If distilled models strip out safety guardrails, if a model inherits the capability to reason about, say, chemical synthesis but doesn’t inherit the refusal mechanisms, that’s not a trade dispute. That’s a genuine safety problem.

Look, I’ve been recommending DeepSeek and Kimi models for months. I’ve tried all of them. My current stack is ChatGPT for quick tasks, Claude for most heavy lifting (code and automations with Cowork), Gemini for image generation and deep research-related tasks, and increasingly the open-source options for things I want to run locally and efficiently, or for tasks requiring data privacy. And then Anthropic published this report.

I think distillation will happen regardless. It’s been happening since 2023. Alpaca proved the concept for $600, and the techniques have only gotten more sophisticated since then. You’re not going to stop it with terms of service.

The interesting question isn’t whether it’s happening. It’s whether it matters. If Chinese labs can produce models that match Western ones at a fraction of the cost, whether through distillation, clever architecture, or pure engineering, it’s only good for us, the users and builders, and it only means open-source can get as good as proprietary models at a maximum, which isn’t such a big threat.

If DeepSeek trains its v4 model on GPT 5, and when it’s released, we are already at version 5.4, OpenAI will still be ahead.

All in all, distilling has benefits: it helps research, it helps smaller labs, and it helps people who don’t have unlimited budgets. But it does have downsides. It is technically against the terms of use of these model providers. It’s definitely not the cleanest way to get an edge.

But, regardless of what we think of it, this story isn’t over. DeepSeek V4 is coming. More accusations will follow for most new models and companies. And nobody has a clean answer to the question at the center of all this: who gets to own intelligence built on everyone’s data?

What’s your take? Is this theft, or is this just how the technology works? Let me know in the comments.

Thanks for reading through!

Sign up for more like this.

Enter your email
Subscribe