Chinese distillation of American models
Chinese distillation of American models
Introduction
A student who watches an excellent teacher solve fifty difficult problems may learn faster than someone who must discover every method alone. AI developers can use a broadly similar technique, called model distillation, to train a smaller system using examples generated by a more capable system. The method has become a flashpoint in competition between American and Chinese AI companies, particularly when access to another company’s model is obtained without permission.
In September 2026, Anthropic published a detailed account of what it described as unauthorised distillation campaigns involving several China-based laboratories. Its report contained extraordinary claims about the scale of requests directed at Claude and the use of extracted outputs for training rival systems. Distillation itself is an established machine-learning method, so understanding the controversy requires separating how the technique works, who has permission to use particular data and what Chinese laboratories are capable of developing independently.
Let’s dive deep into it now.
1. Distillation is learning from another model’s answers
Imagine that a powerful AI model can solve complicated accounting questions, produce good code and explain scientific ideas. Developers of a smaller model can supply it with many pairs of questions and answers generated by the powerful model, then train it to produce similar responses. The original is commonly called the teacher and the new system the student, although neither has human understanding simply because those names are used.
A student model may become noticeably more useful without reproducing every capability of its teacher. It might learn the structure of a good explanation or the typical steps needed to solve a category of problems. Success depends on the quality and diversity of the examples, the student architecture and the training process, rather than on copying a handful of attractive answers.
2. Ordinary training and distillation solve different problems
Large language models are initially trained on large collections of data to learn statistical patterns in language, programming and other information. Developers then refine their models through processes such as supervised fine-tuning, preference optimisation and reinforcement learning. Reinforcement learning can help a system improve by trying actions, receiving feedback and adjusting how it approaches a task.
Distillation can transfer some of the benefits of a stronger model’s earlier work into a cheaper model. That saves effort on certain tasks, but it does not erase the need for suitable training data, computing resources, testing and engineering. Nor does seeing the teacher’s final answer automatically reveal every internal step by which that teacher reached it.
3. Distillation has legitimate and problematic uses
There is nothing inherently improper about a company training a compact model on examples produced by a larger model it owns or is authorised to use. Researchers use distillation to make systems more economical, and organisations may want smaller models that run faster or can be deployed in restricted environments. The relevant contracts, permissions and data rights still matter because a model’s output is not automatically free for unlimited reuse.
The dispute begins when a laboratory allegedly bypasses account restrictions, masks its identity or collects another company’s outputs in violation of access terms. Anthropic distinguishes conventional distillation from what it calls illicit distillation, referring to covert, industrial-scale capability extraction without authorisation. Its September report is evidence of Anthropic’s investigative findings and allegations, but it should not be presented as a court ruling that every named company committed an established legal offence.
4. The reported scale of extraction was extraordinary
Anthropic attributed more than 151 million Claude exchanges between May and July 2026 to a campaign associated with Alibaba’s Qwen or Tongyi operation. It said that activity targeted reasoning traces from Claude Opus 4.6 and 4.7, including material allegedly used in work on Qwen 3.5, Qwen 3.6 and Qwen 3.7. The company also described campaigns associated with Moonshot and DeepSeek that involved more than 23 million and 12.1 million observed exchanges respectively during specified periods.
These numbers are reported observations and attributions from Anthropic, rather than measurements independently established across the entire Chinese AI industry. The report also describes additional activity attributed to other organisations, including Zhipu and Xiaomi. Readers should resist the temptation to convert a collection of allegations into the sweeping claim that China’s impressive AI progress consists entirely of copying American work.
5. Reasoning traces make the controversy sharper
Advanced models sometimes use additional computation while solving difficult tasks, producing internal reasoning processes that developers protect or summarise. Anthropic says certain extraction campaigns sought more than ordinary final answers, attempting to elicit or reconstruct detailed reasoning traces. Such material can be useful for training because it offers more structured examples of how difficult tasks are approached.
A model’s written reasoning is not a perfect record of every calculation it performs, so possessing these traces would not provide a magical recipe for recreating the original system. Nevertheless, they can provide valuable training examples and insight into particular strategies. American laboratories have responded with access controls and technical protections intended to reduce unauthorised harvesting.
6. User privacy can be caught in the middle
Anthropic’s report alleges that some requests from users of Chinese-model services were passed through third-party routing systems to Claude without those users clearly knowing it. The company says some of this traffic contained sensitive corporate documents, identifying details or access credentials. These claims are concerning because a person may believe information is being processed by one service when it is also reaching another provider.
For beginners, the practical lesson is straightforward: do not place confidential documents, passwords or customer information into AI tools without understanding the service’s data practices and your organisation’s rules. Businesses should inspect contracts, connectors, routing providers and retention settings before entrusting important workflows to a model. The distillation debate therefore connects questions of international competition with the everyday privacy choices of employees and customers.
7. American frontier models offer different strengths
As of October 2026, OpenAI’s GPT-6 Astra is positioned for demanding reasoning, coding and professional tasks, while GPT-6.1 Sol offers a lower-cost balance for complex work. GPT-6.1 Terra, released on 26 October, emphasises faster visual reasoning, computer use and natural writing at lower API prices, but OpenAI still recommends more capable models for particularly complex coding and research. Anthropic’s Claude Opus 5.5 is associated with high-end agent work, while Google’s Gemini 4 Argon provides multimodal inputs and a large context window for difficult coding, mathematical and scientific tasks.
The differences matter when someone asks whether a Chinese student model can simply reproduce the best American teacher. An output-trained model might approximate common coding or writing patterns while struggling with unfamiliar research problems, rare tool interactions or long sequences of decisions. Benchmark scores are useful clues, but published results depend on test design, reasoning settings, model versions and often company-reported measurements.
8. Chinese laboratories also have strong independent capabilities
Alibaba’s Qwen 3.7, Zhipu’s GLM-5.3 Flash and DeepSeek-V4.1-Flash-1017 illustrate the variety of China’s AI research ecosystem. GLM-5.3 Flash is offered for developer agents, visual coding and tool use, while DeepSeek’s 17 October update emphasises a more efficient multimodal Flash model for coding and reasoning, although small or economical models do not lead on every difficult benchmark. On 23 October, Moonshot released Kimi K3.1 Pro with a one-million-token context window, claiming improvements in coding and long-running agent work.
Moonshot also released K3.1 Pro Highspeed, which it says generates output roughly two to three times faster. As of 27 October, the company had announced plans for a 4 November open-weights release, but the weights were not yet available; hosted access and downloadable weights should not be confused. The standard K3.1 Pro can require additional time for long reasoning tasks, which helps explain the appeal of the faster version. A million-token context window does not guarantee that a model will consistently find, interpret or use every relevant detail in a long document, while comparisons involving Qwen and GLM depend heavily on testing conditions and vendor-reported results. These systems reflect substantial Chinese research and engineering, even as specific allegations about some training datasets remain contested.
9. Following the frontier may have a ceiling
Training on the outputs of an advanced teacher can help a student catch up on abilities that are already demonstrated in examples. A developer trying to surpass the teacher on genuinely new scientific discoveries or unusual engineering tasks still needs original experiments, reliable feedback and the ability to investigate unfamiliar territory. A steady supply of increasingly good borrowed examples can be commercially useful without guaranteeing leadership in frontier research.
Some analysts therefore worry that overdependence on distillation could create a lasting follower position. That is a plausible strategic risk rather than a measured law of AI development, because a student model can also be strengthened through independent data, new architectures and reinforcement learning. The long-term balance between US and Chinese laboratories will depend on engineering talent, chips, electricity, capital, research methods and access to customers as well as training techniques.
10. Competition is changing how models are protected and shared
The commercial stakes are considerable because developers spend heavily on advanced models and expect subscriptions or API revenue to help pay for that work. If rivals can cheaply reproduce valuable capabilities through unauthorised access, the economics of frontier research become harder to sustain. On the other hand, the AI community also benefits when knowledge, research findings and appropriately licensed models circulate widely enough for researchers and businesses to build useful products.
The challenge for policymakers and companies is to distinguish legitimate learning from fraud, privacy violations and unauthorised extraction without pretending that every resemblance between two models proves copying. For everyday users, the most helpful response is to compare models on actual tasks, review privacy protections and stay alert to claims that have not been independently confirmed. The Chinese-American AI contest will be shaped by both competitive restrictions and a continuing flow of scientific ideas across borders.
Conclusion
Chinese model distillation offers a clear example of how modern AI systems can teach other AI systems, making capable tools cheaper and more widely available. Anthropic’s allegations show why permission, security and personal data have become contentious, while the emergence of systems such as Kimi K3.1 Pro reminds us that China’s AI sector also contains substantial research talent and original engineering. By October 2026, the most useful conclusion is that distillation can accelerate progress in particular areas, but it cannot by itself explain.
