Distillation disputes put Chinese open-weight models under scrutiny

On 8 September 2026 the US National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI issued a joint advisory, AA26-251A, accusing six China-based AI companies of systematically extracting the capabilities of American frontier models at industrial scale. The companies named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies allege that since at least late 2024 they pulled billions of tokens of output from Claude, GPT, Gemini and Grok models, and assess that this likely happened with the Chinese government's awareness.

Two days later, on 10 September, Anthropic published a threat report attributing more than 151 million exchanges with its Claude models between May and July to operators it linked to Alibaba. Beijing rejects the accusations: on 9 September China's Ministry of Commerce said the advisory lacked evidentiary and legal basis and warned of countermeasures. Reuters reported that Alibaba, Moonshot, DeepSeek and Xiaomi did not immediately respond to requests for comment on Anthropic's claims. Also on 10 September, DeepSeek released a new model, V4.1-Flash, and published its weights for anyone to download.

The dispute matters beyond Washington and Beijing. It ties together intellectual property, national security and ordinary procurement decisions. For organisations choosing models, a permissive licence no longer settles whether a model is a prudent choice, and for anyone running heavy automated workloads against commercial APIs, one of the advisory's recommended countermeasures creates a quieter operational risk.

What distillation is, and where the line is drawn

Distillation is a standard way to train AI models. A large, capable model, the teacher, is given a set of prompts and its answers are recorded. Those prompt-and-answer pairs then become training data for a smaller student model, which learns to imitate the teacher's behaviour. The student learns from answers rather than from the teacher's code or weights, and the approach is popular because it cuts the compute and money needed to reach a given level of capability.

None of the parties to this dispute argues that the technique itself is illegitimate. The US advisory acknowledges it as a legitimate and useful research method, and Anthropic's report calls it a legitimate way to train models. The argument is about whose model is the teacher, whether its owner agreed, and how access was obtained.

Reasoning is a particular prize. Many frontier models work through a problem step by step before answering, and providers restrict or summarise that chain of thought for users. According to the advisory, extracted reasoning teaches a student model methods for coding, agentic tasks and proofs, not just facts. Anthropic defines the illicit version as a covert, industrial-scale campaign to replicate a model's capabilities without authorisation, typically enabled by fake accounts and stolen payment details or credentials.

What the US agencies allege

The advisory describes several routes around providers' controls. The most distinctive is a grey market of API proxies known as transfer stations, which resell access to US models at a fraction of the official price and bypass regional restrictions. The agencies also describe premium subscriptions bought in bulk and shared across developer teams, clusters of accounts with similar registration and payment details, third-party aggregators that obscure user metadata, and automatic switching between routes when one is blocked.

Some allegations are specific. The agencies say DeepSeek has run an organised campaign since at least late 2024 to generate training data for models including R1, and that its publicly quoted training cost of $5.6 million is misleading because it leaves out the true cost of data obtained through distillation. They say Moonshot AI extracted significant Claude Fable 5 data to train Kimi-K3, that MiniMax redirected traffic to a newly released Claude model within 24 hours, and that Z.AI had distilled billions of tokens by mid-2026.

The agencies' broader claim is that distillation sits at the centre of these companies' development strategies rather than on the margins. They frame the activity as a breach of US companies' terms of use and a threat to US technological leadership, and call for coordinated information sharing across government, industry and allies.

Anthropic's figures and the privacy angle

Anthropic's report says it has disrupted distillation attempts by seven China-based labs since February, and attributes them to specific labs with high confidence. It describes the Alibaba-linked campaign as the largest it has measured, peaking at nearly 3 million exchanges a day from more than 3,500 fraudulent accounts, and says the harvested reasoning was used to train Qwen models. Anthropic also attributes more than 23 million exchanges between May and July to Moonshot, and more than 12.1 million over 14 days in July to DeepSeek.

The report adds an allegation that concerns ordinary users. Anthropic says Moonshot and DeepSeek silently forwarded some of their own customers' requests to Claude, and Reuters reported Anthropic's claim that these conversations sometimes contained sensitive information and were then used as training data. Anthropic argues such practices are likely inconsistent with privacy laws and the labs' own terms of service. It also contends that safety protections built into its models do not carry over when their capabilities are distilled by another lab, and says Claude now summarises its internal reasoning before responding so that harvested transcripts are less useful for training.

The two lists of accused companies do not match. The advisory names StepFun, while Anthropic's report names Xiaomi and SenseTime, which the advisory does not. That is not necessarily a contradiction, since the two draw on different information, but it shows how partial any single view of the problem is.

The denials, and what remains unproven

Beijing's response has been categorical. According to a translation published by National Law Review, the Commerce Ministry spokesperson called the US accusation baseless, described distillation as "a neutral technical method used by model companies worldwide", and said US developers have themselves disclosed extensive distillation of Chinese models. The ministry accused Washington of double standards, criticised the broad geographic restrictions in some US providers' user agreements, and said China would take countermeasures if the issue were used to suppress Chinese AI firms.

China's foreign ministry also dismissed the advisory, urging Washington to stop making unfounded accusations and attributing the country's AI progress to technological self-reliance, according to reports of spokesperson Mao Ning's remarks. Asked about Anthropic's report, the foreign ministry said it was not aware of it and opposed smears against China, according to Reuters. The Ministry of Commerce had already accused the US of AI hegemonism over earlier distillation allegations on 27 July, Rest of World reported.

Much remains unproven. Neither the advisory nor Anthropic's report is a legal finding, and both describe their evidence rather than publishing it, so outsiders cannot inspect the account records or traffic behind the figures. Anthropic's numbers come from a company that competes with the accused labs and has publicly called for more restrictions on Chinese AI. The legal character of the conduct is unsettled too: the advisory speaks of terms-of-use breaches and extracted proprietary capabilities, while Beijing says there is no legal basis for the charge. Neither document quantifies how much of any accused model's performance derives from distilled data.

A permissive licence settles whether you may use a model; it does not settle whether you can defend that choice to a customer, a regulator or a board.

Open weights keep shipping while Washington argues

The accusations have not slowed releases. DeepSeek's changelog describes V4.1-Flash as the smallest model in a new architecture family, with native visual understanding, alongside a table of benchmark scores the company reported itself. The weights sit on Hugging Face under the MIT licence, in a repository of roughly 510 GB, which means any organisation with enough hardware can run the model on its own infrastructure.

Chinese open-weight models have become hard to ignore. Rest of World reported on 3 August that Moonshot's Kimi K3 ranked fourth on Artificial Analysis' intelligence index, behind two Anthropic models and one from OpenAI. It also reported that some US companies route simpler tasks to Chinese models to save money, and that self-hosting lets firms avoid sharing data with outside parties.

American industry is split. Nvidia's chief executive Jensen Huang shared an open letter on 24 July backing open models, later joined by Microsoft, Google, Meta and OpenAI, and 179 startups wrote to the Trump administration asking it to preserve access. Anthropic has pushed for more restrictions. Inside the administration, technology adviser Michael Kratsios accused Moonshot of distilling Anthropic's Fable 5 and Treasury Secretary Scott Bessent raised the prospect of sanctions, while adviser David Sacks argued that restricting Chinese open models would hurt the US companies that use them.

The silent downgrade problem

The advisory's mitigations deserve close reading by anyone who runs large automated workloads. It asks providers to watch for new accounts that hit maximum usage immediately, unusual ratios of usage to subscription level, and enterprise-scale throughput. For suspected distillation it recommends subtly altering responses, for example by reducing reasoning depth or introducing stylistic inconsistencies, and varying those changes so they are hard to spot.

The advisory is explicit that users from China-based companies suspected of distillation should not be told of a switch to a downgraded model, and that responses to confirmed distillers should be altered without notice, although safety researchers and third-party evaluators should be informed of changes. It also suggests that correlating signals across several providers can justify degradation with little or no risk to legitimate users.

The difficulty is that legitimate workloads can look similar on a traffic graph. Fleets of agents, bulk evaluation runs and synthetic data pipelines generate high, steady volumes from accounts that may be new. If a provider misjudges such traffic, the customer would, by design, receive weaker answers without any notice. Teams relying on consistent model behaviour have reason to watch for that possibility rather than assume it cannot affect them.

What organisations deploying AI should do

For most organisations the practical question is governance rather than geopolitics. Being free to use a model under its licence is a different question from being able to justify that choice afterwards to a customer, a regulator or a board. Six steps help keep that choice defensible, whichever way the dispute goes.

• Keep a documented risk assessment for every model in production, including open-weight models from Chinese labs: licence, origin, any open allegations, sanctions exposure and censorship behaviour, with a tested fallback model ready if policy shifts on either side.
• Separate self-hosted weights from hosted APIs in that assessment. Running published weights on your own infrastructure keeps prompts in-house; calling a hosted service sends them to the provider, and Anthropic alleges some labs relayed customer traffic to third parties.
• Buy model access directly or through authorised partners only. Discounted proxy and reseller routes are the channels the advisory describes, and Anthropic says some proxies log and sell users' exchanges.
• Make heavy automated workloads legible to your providers. Use enterprise agreements, ramp volumes gradually, and tell account teams in advance about large evaluation or synthetic-data jobs.
• Detect silent quality drift. Run a fixed regression suite against each model on a schedule, track accuracy and reasoning length over time, and seek contractual commitments on notification if service levels change.
• Check terms of use before training on any commercial model's outputs, since the advisory treats breaches of those terms as central to the conduct it describes.