AI Distillation: Everyone Blames China, Everyone Does It

Since January 2025, distillation has become Silicon Valley's favorite charge against China. OpenAI started with DeepSeek. Anthropic followed: more than 16 million exchanges with Claude, through some 24,000 fraudulent accounts, attributed to DeepSeek, Moonshot and MiniMax. Then came the White House, then a joint advisory from the NSA, CISA and the FBI naming six Chinese labs.

Yet every one of these texts says distillation is a "widely used and legitimate" technique. And on April 30, 2026, asked under oath whether xAI had distilled OpenAI's models to train Grok, Elon Musk answered: "Partly."

So who distills? Everyone, and everyone says so. The Chinese labs are accused of something else: distilling models nobody sells them, with fake accounts and proxies, at industrial scale. On that specific point, no evidence has been made public.

What is AI distillation?

Distilling an AI model means training a "student" model to imitate the outputs of a "teacher" model that is larger or more advanced. The student picks up a large share of the teacher's abilities at a much lower cost to train and to run.

The idea dates back to 2006. A Cornell team showed that a small neural network could imitate an ensemble of hundreds of classifiers while being "a thousand times smaller and faster", with nearly the same performance (Bucilă, Caruana, Niculescu-Mizil). The word "distillation" was popularized in 2015 by Geoffrey Hinton, Oriol Vinyals and Jeff Dean (arXiv).

There are two ways to distill.

Internal distillation. The student learns from the full probabilities computed by the teacher, not just from its final answer. Those probabilities carry a lot of information: the example in the 2015 paper is that a BMW looks more like a garbage truck than like a carrot. Since you need access to the inside of the model, a lab can only do this with its own.

Distillation from outputs. All you have is the text the model produces, usually through its API. You send it hundreds of thousands of prompts, collect the answers and train the student on them. This is the method at the heart of the accusations. Since models started "thinking" before they answer (o1, DeepSeek-R1, Claude), the most sought-after data is the reasoning itself.

It works remarkably well. DeepSeek fine-tuned Qwen and Llama models on 800,000 outputs from its R1 model. Its distilled 32B version scores 72.6% on the AIME 2024 math competition, against 47.0% for the same model trained with large-scale reinforcement learning (DeepSeek-R1 paper).

Every lab distills its own models

The small model in a family is very often a student of the big one. Labs make no secret of it: it is written in their technical reports.

OpenAI and Anthropic do not say which of their own models are distilled. They do, however, sell distillation. Since October 2024, OpenAI's API lets developers use outputs from GPT-4o or o1 to train GPT-4o mini (OpenAI). Since December 2024, Anthropic has offered on Amazon Bedrock to distill Claude 3.5 Sonnet into Claude 3 Haiku (Anthropic). The only condition: the student stays with them.

Anthropic puts it plainly, in the very post where it accuses Chinese labs: "frontier AI labs routinely distill their own models to create smaller, cheaper versions for their customers" (Anthropic, February 2026).

Distilling other people's models: an old American habit

The next step, distilling a competitor's model through its API, was not invented in China. In 2023, American universities did it in the open.

• Alpaca (Stanford, March 2023): Meta's LLaMA, trained on 52,000 outputs from an OpenAI model, for less than $600 in total. Stanford acknowledged that OpenAI's terms "prohibit developing models that compete with OpenAI", and restricted Alpaca to research use (Stanford).
• Vicuna (LMSYS, March 2023): 70,000 ChatGPT conversations shared by users, about $300 of training (LMSYS).
• Koala (Berkeley, April 2023): same recipe, same conclusion, you can build a good assistant from the data of a more powerful model (Berkeley).
• Orca (Microsoft Research, June 2023): a 13-billion-parameter model that learns from GPT-4's step-by-step explanations (arXiv).
• s1 (Stanford, January 2025): 1,000 reasoning traces produced by Google's Gemini API were enough for a Qwen model to beat o1-preview on math, after 26 minutes of training (arXiv).

A good part of the 2023-2024 open source ecosystem was built this way, on datasets full of GPT-3.5 and GPT-4 outputs.

The big players are no exception. In March 2023, The Information reported that Google's Bard team relied on ChatGPT conversations, and that Jacob Devlin, the lead author of BERT, had left Google after warning its leadership. Google denied it (9to5Google). In December 2023, xAI's Grok turned down a request by citing "OpenAI's use case policy". xAI blamed web data contaminated with ChatGPT output (Futurism).

Then came the Musk v. OpenAI trial. On April 30, 2026, OpenAI's lawyer asked Elon Musk whether xAI had used distillation on OpenAI's models to train Grok. Musk first said that AI companies generally do it, then answered: "Partly" (TechCrunch).

Distilling your model into someone else's happens too. In January 2025, DeepSeek released distilled versions of R1 built on Llama (Meta) and Qwen (Alibaba). Nothing illicit about it: those models are open weight and their licenses allow it.

What the Chinese labs are really accused of

Since January 2025, the accusations have piled up.

None of these texts takes issue with the technique. The NSA, CISA and FBI advisory says it in two sentences: distillation "is recognized as a legitimate and useful technique in AI research", but the Chinese labs allegedly run activities that are "aggressive, malicious, and targeted… at an industrial scale".

The first grievance is about access. Anthropic does not sell Claude in China. According to the company, resellers provide access through proxies, and a single network managed more than 20,000 accounts at once. When one account is banned, another takes its place.

Next come the terms of service: OpenAI, Anthropic and Google all forbid using their outputs to develop a competing model. Then the scale: tens of millions of exchanges, nothing like the 52,000 outputs of a university project. The accusers add a safety argument: a model distilled this way would lose the original's safeguards.

The US bill introduced in April 2026 to sanction these "model extraction attacks" follows the same logic: it explicitly excludes distillation that the terms of service allow (H.R. 8283).

The word "distillation" actually covers five practices:

Evidence that stays in the drawer

Anthropic's and OpenAI's figures are precise, but they come from the accusers. No technical evidence has been published: not in January 2025, not for Kimi K3, and not for the "watermarks of our U.S. large language models" that Treasury Secretary Scott Bessent says were found in Chinese models (GovInfoSecurity).

The public clues are weak. In late 2024, DeepSeek V3 sometimes introduced itself as ChatGPT. But the web is now full of ChatGPT-generated text, and Gemini once introduced itself in Mandarin as Baidu's chatbot (TechCrunch). DeepSeek, for its part, stated in Nature that it had not deliberately included OpenAI-generated content in its data.

Then there is the question of what distillation actually contributed. For Kimi K3, several experts are doubtful: Claude Fable 5 had been public for only about two weeks, and Nathan Lambert (Ai2) believes distillation contributed "at most to a relatively small degree" (Implicator). Lawfare notes that DeepSeek reportedly had only about 150,000 exchanges with Claude, an ordinary volume, and is still one of the best Chinese models (Lawfare).

Research confirms that distillation has limits. A 2023 Berkeley study shows that models imitating ChatGPT copy its style well but close "little to none of the gap" on knowledge (arXiv). The DeepSeek-R1 authors themselves write that surpassing the teacher may require more powerful base models and larger-scale reinforcement learning. Distillation saves time and money, but it is not enough to catch up with a competitor.

Nor are all the attacks Chinese. In February 2026, Google reported a campaign of more than 100,000 prompts aimed at getting Gemini to reveal its reasoning, without naming China: it attributes these attempts mostly to private companies and researchers around the world (NBC News).

Beijing turns the accusation around

China has denied everything from the start. In April 2026, its foreign ministry called the accusations "entirely baseless" and "a slanderous smear" (WION).

In July, Beijing went on the offensive. The commerce ministry claimed that "many American AI enterprises" had distilled Chinese models. It did it again in September, after the NSA advisory: "Distillation is a common method in the AI field in which models learn from one another", and the United States was offering a "textbook case of double standards" (The Next Web).

Beijing names no one and shows no evidence. As Reuters noted at the end of July, "No Chinese companies have accused US rivals of distilling closed-source models so far" (Reuters via Gulf Times). American companies do build on Chinese models, but openly: Cursor acknowledged that its Composer 2 model was based on Moonshot's Kimi K2.5. That is fine-tuning an open weight model, which is lawful.

Washington is divided

On July 24, 2026, Nvidia, Microsoft, Meta, Mistral, Hugging Face, IBM and about twenty others published an open letter, "Open Weights and American AI Leadership". It asks Washington not to "conflate legitimate model-development techniques with misappropriation". Distillation, it says, "is a widely used technique for model improvement, evaluation, and validation" that "reflects a long tradition of learning from, building upon, and improving existing technologies" (letter PDF).

OpenAI and Google were not among the first signatories. They signed the following weekend, according to Axios (Let's Data Science). In the July 30 version, the letter has 235 signatories, including OpenAI, Google, Amazon and SpaceX, xAI's parent company.

So OpenAI, which has accused DeepSeek since January 2025, signed a text defending distillation. So did SpaceX, three months after Musk's admission. Anthropic is the only major American lab missing. Dario Amodei replied that "Anthropic has never advocated for a ban on open-weights models", while calling for a crackdown on industrial-scale distillation.

Business goes on meanwhile: according to the Financial Times, OpenAI and Google were supplying AI services to Singapore-based subsidiaries of Alibaba, Baidu and Tencent (Daily Guardian).

Is it illegal to distill an AI model?

In general, distilling through an API breaches a contract: the terms of service. That is the labs' main weapon, and it is a limited one. The cost of a contract breach is small compared with the value extracted, and it is hard to see how a judgment could be enforced against a Chinese lab.

Copyright does not help them. In the United States, a work without a human author cannot be protected: the Copyright Office restated this in January 2025, and in March 2026 the Supreme Court declined to hear the Thaler case, which challenged the principle (SCOTUSblog). The outputs the labs say were "stolen" are not theirs under copyright law.

Trade secret protection is fragile too, since those outputs are available to anyone with an account. And since the Van Buren ruling in 2021, a mere breach of terms of service does not violate the federal Computer Fraud and Abuse Act. For Lawfare, the most solid route is to go after the fake accounts and the proxies rather than distillation itself: "if every TOS violation counts as 'theft,' then the concept has no limiting principle."

In Europe, the 2016 trade secrets directive treats observing or testing a product made available to the public as lawful, unless a contract forbids it (directive 2016/943). Here again, everything rests on the terms of service. The AI Act does not ban distillation. It requires counting the compute used to train the original model when deciding whether a distilled model crosses the systemic-risk thresholds.

French law firm Haas Avocats (in French) and the American press both pointed out the irony: the labs that denounce copying trained their models on the web without asking the authors. Anthropic paid $1.5 billion to settle a class action over pirated books, the largest settlement in the history of US copyright law (Jurist). The New York Times is still suing OpenAI. In January 2025, 404 Media ran the headline: "OpenAI Furious DeepSeek Might Have Stolen All the Data OpenAI Stole From Us" (404 Media).

Can distillation be stopped?

The labs first hid what was worth the most: the reasoning. As early as September 2024, OpenAI decided not to show o1's raw chains of thought, citing "competitive advantage" among its reasons (Simon Willison). Google and Anthropic followed by showing only a summary. With Anthropic, you pay for every thinking token but only get to read that summary (Claude documentation).

Detection and bans came next. On October 12, 2026, Anthropic said it had cut the data harvested by distillers by "around 90 to 99 percent", thanks to classifiers and tens of thousands of banned accounts, often within two hours (Anthropic). It also admits it has "yet to see a highly sophisticated and persistent attempt to circumvent" its defenses. The figure has not been independently verified.

Researchers remain skeptical. In August 2026, a team showed that the encrypted reasoning of Anthropic, OpenAI and Google models could be recovered in plain text by feeding it back into a weaker model from the same provider (arXiv). More simply, a campaign can be split into queries where "each query in itself is benign" (Scientific American). Ben Thompson sums it up: stopping a distillation that is "literally just querying the API" is nearly impossible (Stratechery).

All these protections run into the same problem: the more useful a model is, the easier it is to imitate.

What it means for a business

Most of the small models you can run on your own servers are distilled: Gemma, Llama 3.2, Ministral, the distilled versions of DeepSeek-R1. That is what makes them usable on modest hardware. Their limits come from there too: they inherit their teacher's style more easily than its knowledge. We cover this in our article on running LLMs locally.

The fight against distillation also has a cost for legitimate customers. Model reasoning has become invisible: you pay for it without being able to read it, which makes debugging and auditing an agent or a pipeline harder.

Frequently asked questions about AI distillation

What is AI model distillation?

Distillation means training a "student" model to imitate the outputs of a "teacher" model that is larger or more advanced. The student picks up a large share of the teacher's abilities at a much lower cost. The technique dates back to 2006 and was popularized in 2015 by Geoffrey Hinton. All major labs use it to build the smaller versions of their models, such as Gemma at Google or Llama 3.2 at Meta.

Is AI distillation legal?

Yes, the technique itself is legal. Distilling your own models, or an open weight model whose license allows it, is common practice. Distilling a competitor's closed model through its API, however, breaches the terms of service of OpenAI, Anthropic or Google, which forbid it. That is a breach of contract. Copyright offers little protection for AI outputs, which have no human author.

Did DeepSeek copy ChatGPT?

OpenAI has claimed so since January 2025, and in February 2026 told the US Congress that DeepSeek had bypassed its access restrictions to distill its models. Anthropic also accuses DeepSeek, citing more than 150,000 exchanges with Claude. No technical evidence has been made public. DeepSeek says it did not deliberately use content generated by OpenAI.

What is a distillation attack?

Distillation is a legitimate training technique. Labs call it a "distillation attack" when someone harvests their model's outputs at scale in breach of their terms of service, often using fake accounts and proxies. That is what American labs accuse DeepSeek, Moonshot, MiniMax, Alibaba and Zhipu of doing.

Is a distilled model as good as the original?

Rarely. A distilled model often does very well on the tasks it was trained for, but a 2023 Berkeley study shows that models imitating ChatGPT mostly copy its style and close little of the gap on knowledge. In practice, the student remains limited by the teacher and by the quality of its own base model.

Did Elon Musk admit that xAI distilled OpenAI's models?

Yes. On April 30, 2026, during his trial against OpenAI, Elon Musk was asked under oath whether xAI had used distillation on OpenAI's models to train Grok. He said AI companies generally do it, then answered: "Partly."

---

The industry builds its small models by distillation. American universities and Microsoft distilled other people's models long before anyone had heard of DeepSeek, and Musk admitted under oath that xAI did it too. The accusations against the Chinese labs are about fraudulent access and scale. They may well be founded. I have no reason to think Anthropic made up its 16 million exchanges. But as long as the evidence stays with the accusers, they remain accusations.

What strikes me most in this story is the July letter. The weekend after it was published, OpenAI signed it: DeepSeek's first accuser put in writing that distillation is a legitimate, widely used technique. Nobody really wants to ban distillation. Everyone just wants to be the one distilling, not the one being distilled.