# Distillation attack

> Source: https://aiwiki.ai/wiki/distillation_attack
> Updated: 2026-11-01
> Fact-checked: 2026-11-01
> Categories: AI Policy & Regulation, AI Safety, Chinese AI, Large Language Models
> License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) - attribute to "AI Wiki (aiwiki.ai)"
> Cite as: AI Wiki. "Distillation attack." aiwiki.ai, 1 Nov 2026. https://aiwiki.ai/wiki/distillation_attack
> From AI Wiki (https://aiwiki.ai), the free encyclopedia of artificial intelligence. Reuse freely with attribution.

A **distillation attack** (also called **illicit distillation** or **adversarial distillation**) is the use of a commercially deployed [large language model](https://aiwiki.ai/wiki/large_language_model)'s outputs, usually obtained at scale through its API and in breach of the provider's terms, to train a competing model that imitates its capabilities. The technique underneath is ordinary [knowledge distillation](https://aiwiki.ai/wiki/knowledge_distillation), in which a "student" model learns from a "teacher" model's outputs. What makes it an attack, in the descriptions published by [Anthropic](https://aiwiki.ai/wiki/anthropic), [OpenAI](https://aiwiki.ai/wiki/openai), Google and the United States government, is that the teacher belongs to someone else, the use is unauthorized (often through fraudulent accounts and proxies, although Google notes that attackers may use legitimate API access), and the volume is industrial.[1][2][5][6][8]

The term moved from security research into policy in 2026. Anthropic's February 23, 2026 post "Detecting and preventing distillation attacks" accused [DeepSeek](https://aiwiki.ai/wiki/deepseek), [Moonshot AI](https://aiwiki.ai/wiki/moonshot_ai) and [MiniMax](https://aiwiki.ai/wiki/minimax) of running such campaigns against Claude.[1] A White House memorandum in April, a joint NSA, CISA and FBI advisory in September, further disclosures by Anthropic and OpenAI, and an October 2026 report by The Information that DeepSeek and Moonshot had leaned on OpenAI's [GPT-6 Astra](https://aiwiki.ai/wiki/gpt_6_astra) followed.[7][8][9] All of the specific attributions below are allegations by the companies or agencies that made them. None has been tested in court; IBTimes UK wrote of the October 2026 Astra allegations that they concern potential breaches of service agreements "rather than conduct established through court proceedings."[11]

## Definitions

The organizations that use the term define it in similar ways. Each accepts that distillation itself is a legitimate technique and draws the line at authorization, scale and method.

| Source | Term used | Definition or description |
|---|---|---|
| Anthropic, September 2026 | Illicit distillation | "an industrial-scale, covert campaign to extract a model's capabilities and replicate them in another model without authorization," typically "enabled by fraud"[2] |
| Anthropic, October 2026 | Distillation attacks | "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model's developers"[3] |
| OpenAI, September 2026 | Adversarial distillation | "the systematic and unauthorized use of one model's outputs or reasoning to help train, reproduce, or improve another model"[5] |
| Google Threat Intelligence Group, February 2026 | Model extraction attacks, "distillation attacks" | An adversary "uses legitimate access to systematically probe a mature machine learning model to extract information used to train a new model," which Google calls "a form of intellectual property (IP) theft"[6] |
| White House OSTP, NSTM-4, April 2026 | Adversarial distillation; "industrial distillation" | Contrasts distillation "legitimately used to produce smaller, lighter-weight models" with "industrial distillation activities that aim to systematically undermine American research and development and access proprietary information"[8] |
| NSA, CISA and FBI, AA26-251A, September 2026 | Malicious distillation | Distillation is "a legitimate and useful technique," but China-based companies are said to engage in "aggressive, malicious, and targeted distillation activities at an industrial scale"[7] |

## Relationship to knowledge distillation and model extraction

Knowledge distillation was introduced as a model-compression method by [Geoffrey Hinton](https://aiwiki.ai/wiki/geoffrey_hinton), Oriol Vinyals and Jeff Dean in the 2015 paper "Distilling the Knowledge in a Neural Network".[15] Laboratories routinely use it on their own models: Anthropic's February 2026 post notes that "frontier AI labs routinely distill their own models to create smaller, cheaper versions for their customers."[1] OpenAI's services agreement allows customers to fine-tune models on OpenAI's platform and to use outputs for non-distributed classifiers and embedding models, while forbidding the use of outputs "to develop artificial intelligence models that compete with OpenAI's products and services."[21]

Training on another company's API outputs is also not new. Stanford's [Alpaca](https://aiwiki.ai/wiki/alpaca), released in March 2023, was a LLaMA 7B model fine-tuned on 52,000 instruction-following demonstrations generated with OpenAI's text-davinci-003. Its authors said it cost under $600 to reproduce, and they noted that the data came from a model "whose terms of use prohibit developing models that compete with OpenAI," which was one reason they limited Alpaca to academic use.[16]

The academic literature treats the general problem under the heading of [model extraction attacks](https://aiwiki.ai/wiki/model_extraction_attack): black-box query access used to build a replica of a model, recover its hyperparameters or, in some cases, recover parts of its weights. Google uses the two terms interchangeably, saying model extraction attacks "are frequently referred to as 'distillation attacks'."[6] In the 2026 usage, a distillation attack is the large-scale, commercial form of extraction aimed at a frontier LLM's behavior, with particular emphasis on its [chain-of-thought](https://aiwiki.ai/wiki/chain_of_thought) reasoning rather than on its weights.[3][5]

## History

### Early allegations against DeepSeek (2025)

After [DeepSeek-R1](https://aiwiki.ai/wiki/deepseek_r1) unsettled markets in January 2025, OpenAI said in a statement that China-based companies "are constantly trying to distill the models of leading U.S. AI companies," without naming DeepSeek. President Donald Trump's AI adviser [David Sacks](https://aiwiki.ai/wiki/david_sacks) told Fox News: "There's substantial evidence that what DeepSeek did here is they distilled the knowledge out of OpenAI's models." The Associated Press reported that neither had disclosed specific evidence, that OpenAI had been working with [Microsoft](https://aiwiki.ai/wiki/microsoft) to identify and ban accounts attempting to distill its models, and that DeepSeek did not immediately respond to its questions.[13] In September 2025, alongside the peer-reviewed version of the R1 paper, DeepSeek's researchers said that R1's success did not hinge on being trained on rivals' output, as reported by *Nature*.[14]

### OpenAI memo and Google report (February 2026)

On February 12, 2026, OpenAI sent a memo to the U.S. House Select Committee on Strategic Competition between the United States and the Chinese Communist Party. It said OpenAI had observed "activity ... indicative of ongoing attempts by DeepSeek to distill frontier models of OpenAI and other US frontier labs, including through new, obfuscated methods," including accounts associated with DeepSeek employees using "obfuscated third-party routers." It said the majority of adversarial distillation on its platform "appears to originate from China, and occasionally from Russia," and that Chinese actors had moved "beyond Chain-of-Thought (CoT) extraction toward more sophisticated, multi-stage pipelines." The memo refers to an earlier assessment of DeepSeek's distillation techniques that OpenAI gave the committee in March 2025.[4]

The same month, the Google Threat Intelligence Group reported an increase in model extraction attempts against Gemini by "private sector entities all over the world and researchers," though not by tracked state-backed threat groups. One campaign it described used more than 100,000 prompts to coerce Gemini into producing full reasoning traces in non-English languages.[6]

### Anthropic's first disclosure (February 2026)

On February 23, 2026, Anthropic said three laboratories had generated "over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, in violation of our terms of service and regional access restrictions." It said it attributed each campaign "with high confidence" through IP address correlation, request metadata, infrastructure indicators and, in some cases, corroboration from industry partners.[1]

| Laboratory | Exchanges (Anthropic's figure) | Targets Anthropic described |
|---|---|---|
| [DeepSeek](https://aiwiki.ai/wiki/deepseek) | Over 150,000 | Reasoning across diverse tasks; rubric-based grading that used Claude as a [reward model](https://aiwiki.ai/wiki/reward_model) for reinforcement learning; "censorship-safe alternatives to policy sensitive queries" |
| [Moonshot AI](https://aiwiki.ai/wiki/moonshot_ai) | Over 3.4 million | Agentic reasoning and tool use; coding and data analysis; computer-use agent development; computer vision |
| [MiniMax](https://aiwiki.ai/wiki/minimax) | Over 13 million | Agentic coding; tool use and orchestration |

Anthropic said MiniMax "pivoted within 24 hours" to redirect nearly half of its traffic when Anthropic released a new model during the campaign, and that one proxy network had managed "more than 20,000 fraudulent accounts simultaneously."[1] CNBC quoted analysts who said the line between legitimate and adversarial use was "often blurry" and that the controversy lay "not only in the technique itself" but in alleged fraudulent access and possible breach of contractual terms.[18]

### U.S. government action (April to September 2026)

On April 23, 2026, Michael Kratsios, director of the White House Office of Science and Technology Policy, issued memorandum NSTM-4, "Adversarial Distillation of American AI Models." It said the government "has information indicating that foreign entities, principally based in China, are engaged in deliberate, industrial-scale campaigns to distill U.S. frontier AI systems," using "tens of thousands of proxy accounts" and jailbreaking techniques. It committed the administration to share information with U.S. AI companies, help the private sector coordinate, develop best practices with industry, and "explore a range of measures to hold foreign actors accountable."[8]

On July 22, 2026, Kratsios accused Moonshot of improperly distilling Anthropic's Fable model in developing [Kimi K3](https://aiwiki.ai/wiki/kimi_k3). Treasury Secretary Scott Bessent wrote on X the same day that "when [Chinese] firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table." TechCrunch reported that some experts disputed that K3 could have been built mainly by distilling Fable, which had been public only since July 1.[17]

On September 8, 2026, the NSA, CISA and FBI published joint advisory AA26-251A. It said that "likely with Chinese government awareness," DeepSeek, Moonshot AI, [Alibaba](https://aiwiki.ai/wiki/alibaba), MiniMax, [StepFun](https://aiwiki.ai/wiki/stepfun) and [Z.ai](https://aiwiki.ai/wiki/z_ai) "extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024." Among its recommendations, it suggested serving "downgraded" models to confirmed distillers without telling them. The advisory's company-by-company model lists, technique mapping and recommended mitigations are covered in [NSA, CISA and FBI Distillation Advisory (AA26-251A)](https://aiwiki.ai/wiki/nsa_cisa_fbi_distillation_advisory).[7] China's commerce ministry said that if the United States "suppresses Chinese AI companies under the pretext of targeting distillation, China will take resolute countermeasures," and the foreign ministry called on Washington to "refrain from making unfounded accusations or smears."[20]

### Anthropic's September 2026 report

On September 10, 2026, Anthropic's threat report "Detecting and countering misuse of AI: September 2026" said that since its February disclosure it had "identified and disrupted additional distillation attacks against Claude from seven labs based in China," all aimed at generally available models.[2]

| Laboratory | Anthropic's scale figure | Main allegation |
|---|---|---|
| Alibaba (Qwen / Tongyi Lab) | Over 151 million exchanges, May to July 2026; peak of nearly 3 million a day from more than 3,500 fraudulent accounts | Chain-of-thought extraction from Opus 4.6 and 4.7, used for supervised fine-tuning of [Qwen](https://aiwiki.ai/wiki/qwen) 3.5, 3.6 and 3.7; Anthropic called it "the largest distillation attack we have ever measured" |
| Moonshot AI | Over 23 million exchanges, May to July 2026 | Silently forwarding Kimi customer requests to Claude, saving the exchanges and extracting reasoning traces; nearly 300,000 relayed requests in one ten-day period through 5,380 fraudulent accounts |
| DeepSeek | Over 12.1 million exchanges over 14 days in July 2026 | Relaying some users' requests to Claude Opus and extracting reasoning traces with the same replay technique as Moonshot |
| Zhipu (Z.ai) | Over 3.4 million exchanges over 17 days in June and July 2026 | Reasoning extraction from Claude Opus 4.8 through 273 accounts; targeting U.S. models' cyber capabilities before the release of [GLM-5.3](https://aiwiki.ai/wiki/glm_5_3) |
| Xiaomi | Over 400,000 exchanges over 20 days in March and April 2026 | Replaying conversations from users of its own MiMo models through Claude to generate training data |
| [SenseTime](https://aiwiki.ai/wiki/sensetime) | Not given | Buying transcripts of other users' Claude sessions from third-party data vendors |
| MiniMax | Not given | Running a proxy service through a shell company that offered only Anthropic and OpenAI models, which Anthropic took as evidence of harvesting exchanges for training |

Anthropic said these relayed exchanges included sensitive data from end users, including a request it assessed as likely coming from a People's Liberation Army affiliate analyzing CCTV footage of one person in Chengdu, and that the practices "are likely inconsistent with privacy laws and the labs' own terms of service."[2] CNBC reported that Alibaba, Moonshot, DeepSeek and Xiaomi did not immediately respond to requests for comment.[19] The routing allegations are covered in more detail at [DeepSeek](https://aiwiki.ai/wiki/deepseek), [DeepSeek V4-Flash](https://aiwiki.ai/wiki/deepseek_v4_flash) and [Moonshot AI](https://aiwiki.ai/wiki/moonshot_ai).

### OpenAI's disclosure about Moonshot (September 2026)

On September 30, 2026, OpenAI said it had disrupted "a coordinated campaign designed to extract protected reasoning from our models." Activity began on July 1, spiked on July 24 and 25 with 16,000 requests using an extraction pattern from more than 4,000 users, and further investigation identified related activity across a cluster of more than 15,000 users, which OpenAI "fully disrupted" by July 28. OpenAI noted that the figures describe "attempted, not necessarily successful, extractions." It said it was unclear whether all the operators were a single actor, but attributed "a core cluster of the activity to individuals associated with Moonshot AI, the developer of Kimi." According to OpenAI, the operators did not break its encryption or access stored conversations; one technique was copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe it.[5]

### Anthropic's crackdown and The Information's Astra report (October 2026)

On October 12, 2026, Anthropic said that "early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%," and that the number of reasoning tokens distillers extracted on its own platform was "consistently 10 to 100 times lower" after it introduced a new classifier. It said it had "turned away meaningful revenue and trillions of tokens' worth of paying traffic from distillers."[3]

On October 28, 2026 (Pacific time), The Information published "OpenAI's Astra Model Becomes Top Distillation Target for China's AI Labs" by Jing Yang, Juro Osawa and Qianer Liu. Its free preview says that DeepSeek and Moonshot "relied heavily on outputs from Astra when training their own latest models, according to people with direct knowledge of the matter," and that distillation "continues to be one of the biggest contributors to the progress made by Chinese open-weight models."[9] Jing Yang's post on X announcing the story named the models as Kimi K3.1 and V4.1-Flash 1017 and said the shift came "after Anthropic intensified the crackdown on distillation recently."[26] The Next Web, which said it had not verified the report, identified them as [Kimi K3.1 Pro](https://aiwiki.ai/wiki/kimi_k3_1_pro), released the week before, and an updated [DeepSeek V4.1-Flash](https://aiwiki.ai/wiki/deepseek_v4_1_flash) launched on October 17. It added that Moonshot claimed K3.1 Pro beat GPT-6 Astra on a coding benchmark.[10] IBTimes UK reported that, according to sources cited in the coverage, Anthropic's restrictions had pushed the Chinese labs toward OpenAI, whose API defenses were "considered relatively looser," and that DeepSeek, Moonshot and OpenAI had not publicly confirmed the Astra allegations.[11] South Korea's SBS, reporting the story on October 29, quoted an OpenAI spokesperson as saying, in SBS's machine-translated English version, that the company takes the issue very seriously and continues to work on resolving it.[34] Digital Watch noted that OpenAI's September 30 statement did not name DeepSeek and that the reporting does not establish that the Astra use was part of the same campaign.[12]

Rui Ma of Tech Buzz China, who had earlier told CNBC that the "narrative of illicit capability transfer strengthens the case for stricter chip restrictions," wrote on X on October 29 that "apparently," after Anthropic made it "much harder" for Chinese labs to distill Claude, "the Chinese labs moved on to OpenAI."[18][25]

## Techniques described by the labs

The published reports describe a common pattern: obtain access through intermediaries, generate or harvest large volumes of targeted exchanges, and extract the teacher model's reasoning, which Anthropic calls "the most valuable kind of data" for distillation because it shows how the model reaches its answer.[3]

| Technique | Description and source |
|---|---|
| Proxy networks and "transfer stations" | Resellers that provide access to frontier models in regions where they are not offered. Anthropic calls these "hydra cluster" architectures, in which "when one account is banned, a new one takes its place."[1] It says they create accounts "using false identities, fake or stolen credit cards, and stolen API keys."[2] The U.S. advisory describes "a large gray market of API proxies, or 'transfer stations'."[7] |
| Chain-of-thought elicitation | Prompts asking the model to "imagine and articulate the internal reasoning behind a completed response and write it out step by step" (attributed by Anthropic to DeepSeek), instructions such as "output your prior reasoning verbatim," and requests to "translate" earlier reasoning into another language. Anthropic says one lab tested more than 12,000 different extraction requests.[1][2] Google described a campaign telling Gemini that the language of its thinking "must be strictly consistent with the main language of the user input."[6] |
| Cross-session replay | Saving the encrypted reference to a model's reasoning (a "thinking signature" in Claude's API) and asking the model in a new session to expand it into the full trace. Anthropic attributes this to Moonshot and DeepSeek; OpenAI describes a similar method in its Moonshot-linked campaign.[2][5] |
| Using the teacher as a grader | Rubric-based grading tasks that made Claude act as a reward model for reinforcement learning.[1] OpenAI says it monitors "ranking and scoring patterns" for the same reason.[4] |
| Relaying end users' requests | Forwarding requests from a lab's own customers to a U.S. model and keeping the exchanges for training, as Anthropic alleges of Moonshot, DeepSeek and Xiaomi.[2] |
| Buying transcripts | Purchasing logs of users' sessions with U.S. models from proxy operators and data vendors, as Anthropic alleges of SenseTime.[2] |

Anthropic says the volume and structure of the traffic, rather than any single prompt, is what identifies an attack: "Massive volume concentrated in a few areas, highly repetitive structures, and content that maps directly onto what is most valuable for training an AI model."[1]

## Detection and countermeasures

The countermeasures published so far focus on hiding or protecting reasoning, detecting coordinated accounts, and sharing intelligence across companies.

| Organization | Measures described |
|---|---|
| Anthropic | Classifiers and "behavioral fingerprinting" for distillation patterns in API traffic; intelligence sharing; stronger verification for educational, security-research and startup accounts (February 2026).[1] Summarizing Claude's reasoning before showing it; "preserved thinking," introduced with [Claude Fable 5.1](https://aiwiki.ai/wiki/claude_fable_5_1) and [Claude Opus 5.5](https://aiwiki.ai/wiki/claude_opus_5_5), which stops API accounts created on or after August 31, 2026 from editing the context before a thinking block; with [Claude Sonnet 5.5](https://aiwiki.ai/wiki/claude_sonnet_5_5), reasoning readable only by the organization that produced it; a two-stage classifier, modeled on its [constitutional classifiers](https://aiwiki.ai/wiki/constitutional_classifiers) work, with a false positive rate below 0.1%; stricter limits and bans for repeat offenders; and, since September 24, 2026, charging for requests blocked before Claude responds in low-false-positive areas including distillation.[2][3] |
| OpenAI | Models trained not to reveal reasoning traces, with input and output classifiers for leakage; classifiers for grading behavior; checks on scale and prompt diversity across accounts; bans for violations (February 2026).[4] Closing a pathway that let someone replay another user's encrypted reasoning, holding streamed output that might expose reasoning, and sharing findings through the [Frontier Model Forum](https://aiwiki.ai/wiki/frontier_model_forum) and government channels (September 2026).[5] |
| Google | Real-time detection of extraction campaigns and "real-time proactive defenses that can degrade student model performance."[6] |
| NSA, CISA and FBI | Detection of anomalous accounts and prompts; "targeted response changes" such as downgraded models or differential-privacy noise for high-confidence distillation requests; cross-organization intelligence sharing among model providers, cloud platforms and API aggregators.[7] |

Anthropic published an internal experiment on the value of summarization. A pretrained Claude model trained on full reasoning transcripts from [Claude Opus 4.8](https://aiwiki.ai/wiki/claude_opus_4_8) scored 80.4% on [SWE-bench Verified](https://aiwiki.ai/wiki/swe-bench_verified); trained on summarized transcripts, it scored 71.8%.[3] Anthropic also acknowledged costs. Preserved thinking required some developers to change their integrations, the classifiers block a small share of benign requests, and users are charged for those blocks. It wrote that it expects distillation "will remain a cat-and-mouse game" and has "yet to see a highly sophisticated and persistent attempt to circumvent" the new defenses.[3] OpenAI's February memo argued for an "ecosystem security" approach because "adversaries will simply default to the least protected provider."[4]

## Legal and contractual status

The main legal basis cited against distillation attacks is contract. Anthropic's commercial terms bar customers from accessing the services "to build a competing product or service, including to train competing AI models," and from attempting to "reverse engineer or duplicate the Services."[23] OpenAI's services agreement prohibits using output "to develop artificial intelligence models that compete with OpenAI's products and services," with narrow exceptions, and its consumer terms of use bar users from using output "to develop models that compete with OpenAI."[21][22] Google says distillation from Gemini without permission violates its terms of service and "may be subject to takedowns and legal action."[6] The U.S. advisory likewise describes the conduct as "violating U.S. AI companies' terms of use."[7]

The enforcement steps the companies have described publicly are account bans, stricter verification and technical restrictions, while Treasury Secretary Bessent has said that sanctions and Entity List designations "will be on the table" for distillation that crosses "into IP theft."[3][4][5][17] Critics have pointed to how frontier models' own training data was gathered. In 2025 the investor and Cornell University lecturer Lutz Finger said that distillation "will violate most terms of service," but called it ironic, "or even hypocritical," for Big Tech to object, noting that "training ChatGPT on Forbes or New York Times content also violated their terms of service."[13]

Anthropic's IPO registration statement, filed on October 26, 2026, lists distillation among its risk factors. It says "competitors, customers, or other third parties have attempted in the past and will likely continue to attempt to replicate, distill, extract, or otherwise derive the functionality or capabilities of our models through permitted or impermissible means," and that countermeasures may "reduce the usability or attractiveness" of its products. In a separate passage, the filing estimates that revenue from customers it later determined were using its services "in violation of our usage policy or commercial terms" was "approximately 5% to 7% of our revenue for the nine months ended September 30, 2026," and says it expects that share to fall after enhanced enforcement "in particular in August and September 2026." That passage does not say how much of that revenue was tied to distillation.[24] See [Anthropic IPO](https://aiwiki.ai/wiki/anthropic_ipo_2026).

## Responses from accused companies

Public responses have been limited. DeepSeek did not immediately respond to the AP in January 2025. In documents released alongside the peer-reviewed version of its R1 paper in September 2025, its researchers said the model's success did not hinge on being trained on rivals' output.[13][14] Coverage of Anthropic's September 2026 report recorded no immediate comment from Alibaba, Moonshot, DeepSeek or Xiaomi.[19] In July 2026, shortly before the White House accusation, Moonshot's head of enterprise business Huang Zhenxin told Chinese media that Kimi K3 was "not a distillation or replica of existing models," according to the South China Morning Post.[27] IBTimes UK reported that Moonshot "has previously denied developing its models through distillation" and that neither DeepSeek nor Moonshot had confirmed The Information's Astra report.[11] China's government has rejected the U.S. accusations as a whole.[20]

## Positions within Chinese industry

[ByteDance](https://aiwiki.ai/wiki/bytedance), which is not among the laboratories named in the Anthropic, OpenAI and U.S. government disclosures described above, was reported in August 2026 to have ruled out distillation for its own models. On August 5, 2026, The Information reported that founder Zhang Yiming had told employees "during a meeting last month" that ByteDance would not "resort to distillation as a shortcut to advancing its AI model capabilities, even if that means the company lags behind domestic rivals for now." According to the report, two employees present heard the comments at an all-hands meeting of [ByteDance Seed](https://aiwiki.ai/wiki/bytedance_seed), the company's AI team, which took place "just after Moonshot AI's Kimi K3 model sparked alarms in the U.S." The Information said one reason, according to people close to the company, was ByteDance's "complicated history with the U.S. government" over [TikTok](https://aiwiki.ai/wiki/tiktok).[28]

The next day the Chinese outlet LatePost (晚点 LatePost) published an exclusive by Chen Jiahui and Gao Honghao, mainly about ByteDance discussing the training of a model with more than 5 trillion parameters. It reported that about two weeks earlier Zhang and Seed head Wu Yonghui had jointly held a Seed all-hands meeting. According to LatePost, Zhang said he opposed distillation because, while it can improve a model's performance in the short term, it is in essence still copying capabilities that Claude already has; on that path a model can at most keep closing in on its rival and will find it hard to truly surpass it. He also said he hoped Seed would build its own barriers in AGI at a more fundamental level. LatePost reported that he told the team it need not be overly anxious and that he could accept its models trailing the industry for a period; that he called coding the key current direction but warned it was only one of the current hot spots; and that he praised the video model [Seedance](https://aiwiki.ai/wiki/seedance) as distinctive and technically ahead, encouraging Seed to build models with their own character rather than follow the established routes of other leading models.[29] Reuters, citing the state-backed outlet The Paper, reported the same day that Zhang had told a recent internal meeting that AI development requires "long-termism and delayed gratification, rather than using others' output to achieve short-term leaderboard rankings," and that ByteDance should be willing to "sacrifice some short-term gains for long-term goals."[30] Yicai, also citing The Paper, reported that ByteDance had imposed a strict internal ban on distilling open-source models and enforced it with measures including API-based detection.[35]

Accounts differ on the motive. A report published on August 6 by the Chinese technology outlet Guixinren (硅星人) and republished by 36Kr said that TikTok's prospects carried almost no weight in the decision. It said ByteDance's opposition dated back to April 2023, when, after it introduced checks on use of the GPT API, its model team barred GPT-generated data from the company's training sets. According to the report, Seed held at least three major internal debates over distillation from 2025 onward; in the third, prompted by the success of Kimi K3, some researchers proposed distilling only open-weight models as a compromise, and Zhang rejected distilling either closed or open-weight models. After the all-hands meeting, it said, Seed issued a policy explicitly banning distillation of open-weight models such as K3 and began using API-based technical checks to trace suspected distillation.[31][32] The 2023 date matches what a ByteDance spokesperson told CNN in December 2023, after OpenAI suspended ByteDance's account following a report by The Verge that ByteDance had used OpenAI's API to develop its own model. OpenAI said ByteDance's use of the API "was minimal" and that it had suspended the account while it investigated; the spokesperson said the company had announced internally in April 2023 that GPT-produced data should not be added to the training datasets of its own models.[33] The 2026 reports about Zhang's remarks rest on unnamed employees and people familiar with the matter.[28][29][31]

## See also

- [Knowledge Distillation](https://aiwiki.ai/wiki/knowledge_distillation)
- [Model extraction attack](https://aiwiki.ai/wiki/model_extraction_attack)
- [NSA, CISA and FBI Distillation Advisory (AA26-251A)](https://aiwiki.ai/wiki/nsa_cisa_fbi_distillation_advisory)
- [ByteDance Seed](https://aiwiki.ai/wiki/bytedance_seed)
- [Extended thinking](https://aiwiki.ai/wiki/extended_thinking)
- [Jailbreak (artificial intelligence)](https://aiwiki.ai/wiki/jailbreak)
- [AI chip export controls](https://aiwiki.ai/wiki/export_controls)
- [Open weights](https://aiwiki.ai/wiki/open_weights)

## References

1. [Detecting and preventing distillation attacks, Anthropic, February 23, 2026](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks)
2. [Detecting and countering misuse of AI: September 2026 (section "Illicit distillation and scaled abuse"), Anthropic, September 10, 2026](https://www.anthropic.com/threat-intelligence-report-september-2026)
3. [Strengthening our defenses against distillation attacks, Anthropic, October 12, 2026](https://www.anthropic.com/news/distillation-defenses)
4. [RE: Updated Stakes for American-Led, Democratic AI, OpenAI memorandum to the U.S. House Select Committee on Strategic Competition between the United States and the Chinese Communist Party, February 12, 2026](https://assets.bwbx.io/documents/users/iqjWHBFdfxIU/rRmql_jJcxb4/v0)
5. [Disrupting a coordinated model-distillation campaign, OpenAI, September 30, 2026](https://openai.com/index/disrupting-a-coordinated-model-distillation-campaign)
6. [GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use, Google Threat Intelligence Group, February 2026](https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use)
7. [China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies, Joint Cybersecurity Advisory AA26-251A, CISA, September 8, 2026](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a)
8. [NSTM-4, Adversarial Distillation of American AI Models, Michael J. Kratsios, Office of Science and Technology Policy, April 23, 2026](https://www.whitehouse.gov/wp-content/uploads/2026/04/NSTM-4.pdf)
9. [OpenAI's Astra Model Becomes Top Distillation Target for China's AI Labs, The Information (Jing Yang, Juro Osawa and Qianer Liu), October 28, 2026 (paywalled; free preview only)](https://www.theinformation.com/articles/openais-astra-model-becomes-top-distillation-target-chinas-ai-labs)
10. [DeepSeek and Moonshot trained new models on GPT-6 Astra, report says, The Next Web (Ana Maria Constantin), October 29, 2026](https://thenextweb.com/news/deepseek-moonshot-gpt-6-astra-distillation)
11. [DeepSeek and Moonshot AI Accused of Copying GPT-6 Astra Capabilities Through Distillation Attacks, IBTimes UK (Bal Marsius), October 30, 2026](https://www.ibtimes.co.uk/deepseek-moonshot-openai-gpt-6-astra-distillation-1828951)
12. [DeepSeek and Moonshot reportedly used OpenAI for AI training, Digital Watch Observatory (Geneva Internet Platform), October 30, 2026](https://dig.watch/updates/deepseek-moonshot-distilled-openai-astra)
13. [Did DeepSeek copy ChatGPT to make new AI chatbot? Trump adviser thinks so, Associated Press (Matt O'Brien and Kelvin Chan), January 29, 2025](https://apnews.com/article/deepseek-ai-chatgpt-openai-copyright-a94168f3b8caa51623ce1b75b5ffcc51)
14. [Secrets of DeepSeek AI model revealed in landmark paper, Nature, September 17, 2025](https://www.nature.com/articles/d41586-025-03015-6)
15. [Distilling the Knowledge in a Neural Network, Geoffrey Hinton, Oriol Vinyals and Jeff Dean, arXiv:1503.02531, March 9, 2015](https://arxiv.org/abs/1503.02531)
16. [Alpaca: A Strong, Replicable Instruction-Following Model, Stanford CRFM, March 13, 2023](https://crfm.stanford.edu/2023/03/13/alpaca.html)
17. [Treasury threatens sanctions after White House claims Moonshot distilled Anthropic's Fable, TechCrunch (Rebecca Bellan), July 22, 2026](https://techcrunch.com/2026/07/22/treasury-threatens-sanctions-after-white-house-claims-moonshot-distilled-anthropics-fable/)
18. [Anthropic joins OpenAI in flagging 'industrial-scale' distillation campaigns by Chinese AI firms, CNBC (Matthew Chin), February 24, 2026](https://www.cnbc.com/2026/02/24/anthropic-openai-china-firms-distillation-deepseek.html)
19. [Chinese AI labs secretly used millions of Claude exchanges to train their models, Anthropic says, CNBC (Jenny Lee), September 10, 2026](https://www.cnbc.com/2026/09/11/chinese-ai-labs-moonshot-deepseek-alibaba-anthropic.html)
20. [China slams US claims of 'industrial-scale' AI theft, Al Jazeera, September 9, 2026](https://www.aljazeera.com/news/2026/9/9/china-slams-us-claims-of-industrial-scale-ai-theft)
21. [OpenAI Services Agreement, section 3.3 and definition of "Permitted Exception", OpenAI, effective January 1, 2026](https://openai.com/policies/services-agreement/)
22. [Terms of Use, OpenAI, effective January 1, 2026](https://openai.com/policies/row-terms-of-use/)
23. [Commercial Terms of Service, section D.4, Anthropic, effective June 17, 2025](https://www.anthropic.com/legal/commercial-terms)
24. [Anthropic, PBC, Form S-1 Registration Statement (preliminary prospectus), October 26, 2026, archived copy](https://web.archive.org/web/20261026130626/https://www.sec.gov/Archives/edgar/data/2130357/000162828026067168/anthropicpbc-sx1.htm)
25. [Rui Ma (@ruima), post on X, October 29, 2026](https://x.com/ruima/status/2115904379547181312)
26. [Jing Yang (@jingyanghk), post on X, October 28, 2026 (Pacific time; October 29 UTC)](https://x.com/jingyanghk/status/2115628862910640545)
27. [Global AI experts push back on US 'distillation' claims against Moonshot's Kimi K3 model, South China Morning Post, July 23, 2026](https://www.scmp.com/tech/tech-war/article/3361625/global-ai-experts-push-back-us-distillation-claims-against-moonshots-kimi-k3-model)
28. [ByteDance's Founder Rules Out Distillation on AI Models, The Information (Juro Osawa and Qianer Liu), August 5, 2026 (paywalled; free preview only)](https://www.theinformation.com/articles/bytedances-founder-rules-distillation-ai-models)
29. [晚点独家丨字节讨论训超 5 万亿参数模型，张一鸣：不蒸馏、别被 Coding 这种短期热点影响 (LatePost exclusive: ByteDance discusses training a model of more than 5 trillion parameters; Zhang Yiming: no distillation, don't be swayed by short-term hot spots like coding), 晚点 LatePost (Chen Jiahui and Gao Honghao), August 6, 2026, NetEase repost](https://www.163.com/dy/article/L3M6SMII0531M1CO.html)
30. [ByteDance founder tells staff to avoid AI distillation, The Paper reports, Reuters, August 6, 2026 (via The Galveston County Daily News)](https://www.galvnews.com/news_reuters/business/bytedance-founder-tells-staff-to-avoid-ai-distillation-the-paper-reports/article_2b515543-549a-569f-85de-ea0954cb3144.html)
31. [字节Seed为什么不蒸馏别的模型？ (Why doesn't ByteDance Seed distill other models?), 硅星人Pro (Guixinren; Luo Yihang), August 6, 2026, 36Kr repost](https://www.36kr.com/p/3927760148052100)
32. [ByteDance's Ban on Distilling Rival AI Models unrelated to U.S. regulatory concern and dates back to 2023: Report, Pekingnology (Zichen Wang), August 6, 2026](https://www.pekingnology.com/p/bytedances-ban-on-distilling-rival)
33. [TikTok parent ByteDance says it's using OpenAI technology to test its own AI models, CNN (Laura He), December 20, 2023](https://edition.cnn.com/2023/12/20/tech/bytedance-openai-gpt-use-intl-hnk)
34. ["DeepSeek and Moonshot's Main Target for 'Distillation' Is Astra", SBS (Kim Young-a), October 29, 2026](https://news.sbs.co.kr/english/article.do?news_id=N1008821513)
35. [ByteDance's Zhang Rejects Model Distillation as Shortcut in Long-Term AI Push, Yicai Global, August 6, 2026](https://www.yicaiglobal.com/news/bytedances-zhang-rejects-model-distillation-as-shortcut-in-long-term-ai-push)