Chinese laboratories stand accused of systematically extracting knowledge from the most advanced American artificial intelligence systems. They do so through a method known as distillation. The practice has sparked fierce debate in Washington and Silicon Valley. It raises fresh questions about who will control the future of this transformative technology.
Anthropic first sounded the alarm in February. The company detailed how three Chinese startups — DeepSeek, Moonshot AI and MiniMax — generated more than 16 million exchanges with its Claude model. They relied on roughly 24,000 fraudulent accounts to do it. The goal appeared clear. Harvest reasoning patterns, chain-of-thought processes and tool-use behaviors. Then fold those insights into their own systems. All at a fraction of the original development cost. Anthropic called the campaigns coordinated and growing in sophistication.
But the story didn’t stop there. In June Anthropic sent a letter to Senators Tim Scott and Elizabeth Warren. It accused Alibaba’s Qwen team of an even larger effort. Roughly 25,000 unauthorized accounts produced over 28.8 million interactions with Claude. “These distillation attacks are carried out illicitly, systematically and at industrial scale to harvest U.S. A.I. capabilities across frontier labs and repackage them as their own,” the letter stated, according to The New York Times.
OpenAI leveled similar charges. The company told Congress that DeepSeek employees built code to bypass restrictions. They harvested outputs programmatically for training purposes. Google documented parallel attempts against its Gemini models. The three firms later agreed to share intelligence on these threats through the Frontier Model Forum. The White House took notice. In April it issued a memo labeling such activities a national security concern. Michael Kratsios, director of the Office of Science and Technology Policy, pointed to foreign entities principally based in China.
Yet distillation itself breaks no laws. AI developers have employed the technique for years. They train smaller, cheaper models on the outputs of larger ones. The tutor-student dynamic compresses knowledge efficiently. American companies do it too. OpenAI once released tools to help customers create distilled versions of its systems. Elon Musk testified in May that his xAI relies on the method. It is common across the industry.
The difference lies in permission. Terms of service for leading U.S. platforms prohibit using model outputs to train competitors. Chinese operators allegedly ignore those rules. They create fake accounts, route traffic through proxies and generate synchronized queries at massive scale. Some campaigns target specific capabilities. DeepSeek focused on reasoning and evaluation. Moonshot emphasized agentic behaviors and tool use. MiniMax ran the biggest operation, exceeding 13 million exchanges.
Evidence of success appears in Chinese research. A February 2025 study from Peking University and the Chinese Academy of Sciences examined leading domestic models. Most showed clear signs of distillation drawn from American systems. One Qwen variant identified itself as Claude nearly a third of the time during tests. The findings aligned with what U.S. firms had observed. Chinese models have narrowed the gap dramatically. They now trail top American systems by an average of only seven months.
That progress carries real commercial weight. U.S. executives have begun routing workloads to Chinese alternatives. Andy Fang, co-founder of DoorDash, noted in an X post that his team sends complex tasks to Anthropic’s top model while handing routine work to Moonshot’s Kimi. The combination delivers better results at lower cost. Models from DeepSeek and Zhipu handle simpler jobs for many American businesses. They offer good-enough performance without the premium price tag.
But the advantages extend beyond price. Chinese firms release open-weight versions that run efficiently on modest hardware. They ship these models globally, including back to the United States. American developers face a stark choice. Build on Chinese foundations or risk falling behind in deployment speed. The dynamic distorts markets. Companies that invest billions in frontier research watch competitors replicate capabilities for pennies on the dollar.
Anthropic tried technical countermeasures. In March it deployed tracking code aimed at China-based users of its coding assistant. The software sought to identify suspicious patterns. It flagged accounts likely engaged in distillation. Privacy advocates cried foul when a developer exposed the tool last week. Anthropic removed the code. The episode highlighted tensions between security needs and user trust. The company had already banned nearly 700,000 accounts tied to Chinese usage.
Beijing shows no sign of slowing down. Chinese authorities met with top AI firms in recent weeks. They discussed restricting overseas access to the country’s most powerful models. The moves would limit both closed-source systems and capabilities in open-weight releases from firms like DeepSeek. The Wall Street Journal reported the talks could affect models not yet public. The timing feels strategic. As U.S. pressure mounts, China appears ready to safeguard its own advances.
Analysts disagree on the long-term impact. Some argue distillation merely accelerates what China would achieve anyway through domestic innovation and alternative hardware. Others see a direct threat to American leadership. A Brookings Institution fellow named Kyle Chan captured the stakes. He noted that Anthropic frames the issue as more than commercial competition. It represents a contest for strategic advantage in the most powerful technology of our time.
The U.S. government has begun to respond in kind. Policymakers debate new penalties for model copying. The House Select Committee on China has heard testimony on the topic. Proposals include tighter controls on API access, expanded sanctions and requirements for cloud providers to monitor unusual query patterns. Yet enforcement remains tricky. Proxy services and obfuscation techniques evolve quickly. Fraudulent accounts can appear faster than they are shut down.
Recent developments add urgency. A July report from the International Institute for Strategic Studies highlighted how open-weight Chinese models have closed the capability gap. It pointed to distillation as one factor in that compression. Meanwhile, American firms continue to pour resources into detection and prevention. They experiment with watermarking outputs, rate limiting and behavioral analysis. Success could buy time. Anthropic has suggested that blocking these practices might secure a 12-to-24-month lead for the United States.
The debate spills into public forums. On X, users trade claims and counterclaims. Some defend Chinese progress as legitimate competition. Others call it outright theft subsidized by state support. One recent post highlighted how Chinese resellers offer premium Claude access for a fraction of U.S. prices through secondary markets. Another noted that certain Chinese models consistently mimic the style and knowledge cutoff of specific American systems.
No easy answers emerge. Distillation exposes the porous nature of AI knowledge. Once a model generates outputs, those tokens exist independently. They can be collected, analyzed and reused. The technique rewards scale and audacity. It punishes those who play strictly by the rules. For an industry built on rapid iteration, the temptation proves hard to resist.
American companies now find themselves in an awkward position. They must protect intellectual property while competing against entities that face fewer constraints. They lobby for government intervention yet worry about overregulation slowing their own pace. Chinese firms, for their part, deny systematic theft. Some point to parallel research paths and the universal availability of synthetic data techniques. A state-run Chinese publication dismissed U.S. complaints as absurd hype aimed at justifying further sanctions.
The coming months will test both sides. U.S. labs race to release new frontier systems while hardening defenses. Chinese developers push efficiency on domestic chips and explore self-improvement loops that reduce reliance on external tutors. Policymakers weigh export controls, investment restrictions and international alliances. The AI race has always been about compute, data and talent. It now includes a fourth element. The ability to guard what you build while learning from what others reveal.
So the distillation controversy marks more than a technical dispute. It reveals the asymmetric rules shaping global technology competition. One side spends lavishly to push boundaries. The other observes, extracts and deploys at speed. Whether that pattern persists may determine which nation’s models shape the next decade of innovation. And which economy reaps the greatest reward.
WebProNews is an iEntry Publication