Distillation attacks query a target AI model hundreds of thousands or millions of times to generate data that is used to train another company’s model. Through this practice, companies can back out a significant percentage of the AI training process, which is enormously expensive and difficult, at effectively no cost. While all frontier U.S. AI labs do use distillation to train smaller versions of their own models from their larger ones, they do not distill from each other’s models, which is against their terms of service.
All three frontier U.S. AI labs, as well as the White House, have accused China of engaging in distillation attacks at a massive scale. When prompted by users, Kimi K3 even often identifies itself as Anthropic’s Claude, and shows evidence of significant linguistic similarities with Claude Fable—further indicators of distillation.
Chris McGuire, 2026, from the interview “The Latest in U.S.-China AI Competition”
So is this just a fancy way to describe AI companies using their competitors product to generate training data for themselves? That’s funny. Even funnier—Chinese models are usually open models.
Another quote explaining distillation attacks:
Model extraction, where an actor uses legitimate access to an application programming interface (API) to systematically harvest output from a proprietary ‘teacher’ AI system to train a ‘student’ model, is a widely used and legitimate technique. Frontier AI labs – companies developing the most advanced AI models – routinely distil their models into smaller, cheaper versions for commercial deployment, occasionally licensing others to do the same.
Virpratap Vikram Singh, 2026, from the article “AI distillation attacks in the US”
This spoils the silly image in my head of people using the normal chat interfaces to do this. An API makes more sense; less goofy.
Both sources are useful for figuring more out about the dynamics at play; intellectual property; geopolitics; open models.
Here’s something from U.S. Treasury Secretary Scott Bessent:
We support open-source AI and the innovation it unlocks. But open source is not open season on American IP. When PRC firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table.
Treasury Secretary Scott Bessent, 2026, from the tweet “Treasury Secretary Scott Bessent on X”
I would like to amend my previous remark about intellectual property(20260704215606). It’s probably more so a thing because information is the lifeblood of organizations like corporations. People like calling dibs on good ideas. Pooh-pooh.
«