U.S.-China Relations
NextFin News - A technique that lets a small AI model learn from a bigger one — without touching its code, weights, or training data — has moved from an academic footnote to a national-security flashpoint. On Sept. 8, 2026, the National Security Agency, the FBI and the Cybersecurity and Infrastructure Security Agency issued a rare joint advisory accusing six China-based AI companies of "industrial-scale" distillation of American frontier models, alleging they "extracted billions of tokens across millions of exchanges" from systems including variants of Claude, GPT, Gemini and Grok since at least late 2024. The warning lands at the worst possible moment for US AI incumbents: they have spent hundreds of billions of dollars betting that frontier capability is a defensible moat, and distillation is the tool that could turn that moat into a commodity.
The Accusation: A State-Level Campaign, Not a Research Project
The 18-page advisory, numbered AA26-251A, was coordinated with intelligence partners in the United Kingdom, Australia, Canada and New Zealand — the Five Eyes alliance — and it named the firms outright: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. The agencies stopped short of alleging direct government direction, writing instead that the activity was "likely with Chinese government awareness." But the scale they describe leaves little room for the explanation of rogue graduate students with a few API keys. The advisory alleges that these firms "extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models" and organized the effort through what it calls "distributed distillation" — spreading queries across thousands of accounts in multiple countries so that no single account generated enough traffic to trigger automated detection systems.
One unnamed Chinese firm, the document says, generated tens of millions of model queries over an 18-month period, systematically covering technical domains including chemistry, materials science, software development and military logistics, routed through front companies in multiple jurisdictions. CISA Director Jen Easterly framed the activity in stark terms:
It was "a systematic effort to replicate the capabilities of US-developed frontier models while avoiding the export controls and licensing frameworks that govern direct technology transfer."
The techniques described read like an evasion playbook rather than a research methodology: gray-market API proxies the agencies call "transfer stations," bulk premium subscriptions shared across teams, and aggregators that strip account metadata to avoid detection. The result, officials said, was a sustained data-collection effort that looked from the outside like ordinary consumer use.
The advisory arrives after a year of escalating private-sector complaints. On Feb. 23, 2026, Anthropic said it had detected a large-scale campaign by three China-based AI labs, including Moonshot AI, alleging the firm generated more than 3.4 million Claude exchanges through hundreds of fraudulent accounts and multiple access paths, targeting capabilities such as reasoning, coding, computer use and vision. In February, OpenAI submitted a memo to the House Select Committee on Strategic Competition between the United States and the Chinese Communist Party describing "ongoing attempts by DeepSeek to distill frontier models of OpenAI and other US frontier labs, including through new, obfuscated methods." On June 24, Anthropic sent Congress a letter directly accusing Alibaba of "brazen" AI theft through distillation.
What the advisory does not do is announce sanctions. The White House had signaled in July that it was considering designations under Treasury Department national-security authority, and Monday's document is widely read as the evidentiary predicate for those designations. A Treasury official declined to confirm or deny whether designations were being prepared.
What Distillation Actually Is — and Why It Is Not Theft in the Ordinary Sense
Here is the uncomfortable part for the companies sounding the alarm: the technique itself is not new, not secret, and not inherently illicit. Knowledge distillation traces to a 2015 paper, "Distilling the Knowledge in a Neural Network," by Geoffrey Hinton, Oriol Vinyals and Jeff Dean. The core idea is simple. A compact "student" model is trained to replicate the behavior of a larger, more complex "teacher" model. Instead of learning only from hard labels — right or wrong answers — the student learns from the teacher's soft probability distributions, what Hinton called the "dark knowledge" embedded in the model, which carries richer information about how the teacher relates one class of answer to another.
This requires no access to the teacher's source code, no theft of model weights, and no breach of any computer system. It requires only the ability to send inputs to a model and record its outputs — exactly what any paying customer, or any determined adversary with many paying accounts, can do.
Distillation is used legitimately every day. It is how large models get shrunk enough to run on consumer-grade GPUs, on phones, or inside latency-sensitive production systems. Anthropic itself acknowledged in its February statement that AI firms "routinely distill their own models to create smaller, cheaper versions." DeepSeek, when it released its R1 reasoning model on Jan. 20, 2025, published six smaller models distilled from R1 into the Qwen2.5 and Llama families under an open MIT license. The distilled Qwen-based 32-billion-parameter version scored 72.6 on the AIME 2024 math competition and 94.3 on the MATH-500 benchmark, outperforming many directly trained models of similar size. Industry estimates put the payoff in familiar ranges: five to thirty times lower inference cost, roughly four times faster response, and retention of 95% to 97% of the teacher's performance.
What differentiates the conduct described in the advisory, US officials said, is not the technique but the scale, the systematic domain coverage, and the coordinated effort to avoid detection — the fingerprints of a state-directed or state-facilitated program rather than normal commercial AI development. The line between legitimate improvement and illicit extraction is technically blurry; researchers routinely use one model's outputs to benchmark or train another. The advisory is an argument about where that line sits when the querying resembles an industrial harvest rather than a research project.
The Economics of the Moat: Why US Firms Are Really Worried
Strip the national-security language away and the commercial fear is plain. American AI companies have spent hundreds of billions of dollars developing advanced chatbots, betting they can earn enough from customers to justify the investment. That business case depends on frontier capability staying scarce. Distillation undermines scarcity. It lets a rival reproduce much of a frontier model's behavior for a fraction of the training cost and time — which is why the advisory's central worry is that competitors can "build competing AI systems for far less."
The second-order consequence is what should concern investors more than the first. If model capability can be transferred without the training run, then capability itself migrates down the value chain toward commoditization. The premium does not disappear; it relocates. It moves up the stack to the assets that distillation cannot replicate: proprietary data that never passes through an API, closed distribution relationships with enterprises and consumers, and the physical infrastructure — chips, data centers, power — that still cannot be distilled.
Sam Altman's OpenAI has been explicit about where it sees the durable moat. In its February memo to lawmakers, the company wrote:
"Infrastructure is destiny: chip development, power generation, transmission, and data center capacity will determine which countries can train and deploy frontier systems."
OpenAI pointed to its Stargate Project, aimed at expanding US AI infrastructure to 10 gigawatts by 2029, and said it was already more than halfway toward that goal one year in. Read alongside the distillation controversy, the statement is a tell: the company that once competed on model quality alone is now arguing that the defensible asset is the electricity and silicon underneath it.
Anthropic's trajectory tells the same story from a different angle. The firm that concedes distillation is "widely used and legitimate" has, over seven months, moved from describing the practice in the abstract to accusing named competitors of "prohibited distillation" and "brazen" theft, while simultaneously advocating for tighter export controls on advanced AI chips to China. The policy position and the commercial interest point in the same direction: raise rivals' cost of capability while protecting one's own.
The Legal Gray Zone: Terms of Service Are Not Criminal Law
There is a reason the advisory recommends "appropriate legislative and regulatory tools" instead of announcing indictments. OpenAI and Anthropic prohibit distillation in their terms of service, but those prohibitions are civil agreements, not criminal statutes. Using a commercial AI service within its stated rate limits, even with the intent to distill its outputs, does not on its own constitute a crime under existing US law. The agencies acknowledged the gap in the advisory.
The broader legal landscape is equally unsettled. In Bartz v. Anthropic, a California federal judge held in June 2025 that using books to train language models was fair use on the record before the court, while retaining millions of books in a central library was not; final approval of a $1.5 billion settlement followed on July 20, 2026, without an appellate ruling on that fair-use analysis. And as of July 22, 2026, no publicly identified court, regulator, arbitral tribunal or criminal proceeding had ruled that Moonshot illegally distilled Anthropic's Claude Fable 5 or that its Kimi K3 model infringes Anthropic's rights. No public record had established which K3 capabilities came from which teacher, what material was retained, or what measurable market harm resulted.
That legal ambiguity is precisely why the government's most likely tools are not prosecutions but sanctions and export controls. DeepSeek's servers have been inaccessible from US-based connections since early August, when the Commerce Department placed the company on its Entity List. The advisory's logic extends that approach: if the behavior cannot be easily criminalized, it can be sanctioned as a national-security threat, and the companies behind it can be cut off from the very US models and chips they are accused of exploiting.
Beijing's Counterpunch: "Politicizing and Weaponizing"
China responded within hours, and the response makes clear this is now an intergovernmental dispute, not a corporate one. On Sept. 9, 2026, a Ministry of Commerce spokesperson said the US allegations were "unfounded both in fact and in law" and accused Washington of "politicizing and weaponizing distillation, which is a normal technical and commercial practice within the industry." The statement went further:
"The advisory is yet another example of the United States pursuing technological hegemony in the field of artificial intelligence, seeking to monopolize computing power, and suppressing competition. China firmly opposes such actions."
Beijing's double-standard charge is not empty. The commerce ministry noted that reports published by US companies on their own model development have disclosed extensive distillation of Chinese models, while Chinese open-source models remain available to companies around the world, including American ones. China's foreign ministry also rejected the allegations as groundless. And it drew a line: if the United States uses combating distillation as a pretext to contain and suppress Chinese AI companies, "China will resolutely take countermeasures." The ministry added that the two heads of state have agreed to establish an intergovernmental dialogue on artificial intelligence and that China is willing to engage through that channel — an offer of diplomacy paired with a threat of retaliation.
Cyclical Panic or Structural Shift?
Investors should separate two things the market is currently blending. The first is cyclical: the anxiety over AI capital spending and return on investment that has weighed on technology shares through September 2026. The so-called Magnificent Seven — Nvidia, Apple, Alphabet, Microsoft, Amazon, Tesla and Meta Platforms — now account for nearly 34% of the S&P 500, and concentration risk means a sentiment shift can amplify a routine de-risking month into something harsher. That anxiety can revert if earnings validate the spending.
The second is structural, and it will not revert on its own. Distillation is a regime change in how capability is produced. Once the knowledge embedded in a frontier model can be transferred to a smaller system without repeating the training run, the cost curve of frontier competence bends down permanently. The moat that survives a world of cheap distillation is not model quality alone; it is control of proprietary data, distribution relationships, and compute infrastructure. Those are cyclical fears and a structural shift, and they point in different directions: sentiment may recover, but the pricing power of a standalone model API is unlikely to return to what it was.
The Adversarial Case, and What Would Prove It Wrong
The strongest argument against the US position is straightforward: distillation is a normal, legally ambiguous technique that American firms use themselves, and the advisory is industrial policy dressed as national security. The "industrial scale" framing, on this reading, is leverage for sanctions and export controls, not evidence that protected expression or trade secrets were copied. The advisory's own hedged language — "likely with Chinese government awareness" — and the absence of any judicial finding support the skeptics. Technical observers have noted that the boundary between legitimate AI improvement and adversarial exploitation is often blurry, since researchers routinely train on one model's outputs.
The answer to that argument is that the security concern is not that distillation exists. It is that the scale described — billions of tokens, millions of exchanges, systematic coverage of domains including military logistics — combined with an architecture designed to evade detection, points to something other than commercial research. The adversarial case is strongest on the legal front, where no court has ruled, and weakest on the national-security front, where the pattern of behavior is the evidence.
The falsifying signal is concrete. If the Justice Department or the Treasury brings formal charges or sanctions backed by public evidence of trade-secret or copyright copying — not just terms-of-service violations — within the next six to twelve months, the industrial-policy reading weakens sharply. If no enforcement follows in that window, the security framing was mostly negotiating leverage, and the market should treat it as a political risk premium rather than a fundamental threat to Chinese competitors.
What Comes Next: Winners, Losers, and the Signals to Watch
The beneficiaries of a distillation-constrained world are not necessarily the model makers making the loudest complaints. They are the owners of assets that cannot be distilled: semiconductor and data-center infrastructure providers, networking and custom-silicon suppliers, cloud platforms that can gate API access, and firms with proprietary data and closed distribution. The exposed are pure-play model API sellers whose differentiation was capability alone, Chinese AI firms facing Entity List placement and potential sanctions, and open-weight ecosystems whose development model relies on cross-lab learning.
Three time horizons matter. In the short term, watch for Treasury designations, the Five Eyes national advisories expected in the coming days, and the volatility they trigger in AI-exposed equities. In the medium term, watch whether providers can actually distinguish distillation from ordinary use through new detection tooling, tighter rate limits, and stricter terms-of-service enforcement — a technically difficult problem the advisory itself concedes. In the long term, watch where capital flows: if investment migrates from model training toward data acquisition, distribution deals, and power and chip capacity, the market will have answered the moat question without anyone saying so.
Three scenarios frame the path. The base case: targeted sanctions on the named firms, no broad criminal findings, and distillation continuing quietly under tightened terms of service. The upside case for US incumbents: sweeping sanctions plus new legislation that raises the legal cost of large-scale output scraping, partially restoring the moat. The downside case: no meaningful enforcement, Chinese retaliation, and capability commoditization accelerating faster than infrastructure spending can offset it.
Distillation did not just shrink models. It shrank the distance between a frontier lab and its competitors, and the question now is whether the moat that survives is made of code — or of the infrastructure, data, and legal walls built around it.
Explore more exclusive insights at nextfin.ai.
