Anthropic Accuses Chinese AI Firms of Model Distillation Attacks: A Full Breakdown

Overview

AI safety research company Anthropic has released a report sending shockwaves through the industry, accusing several Chinese AI companies of carrying out sustained "distillation attacks" against its models. The report names Alibaba, Moonshot AI, and DeepSeek^Ad, claiming these attacks have escalated significantly in recent months amid intensifying competition.

The report comes at a time when competition among large language model developers has reached a fever pitch. Anthropic, the company behind the Claude model family and a company whose core mission centers on AI safety and alignment research, has thrust the question of model intellectual property protection back into the spotlight with this public accusation.

What Is a Model Distillation Attack?

The Dual Nature of Distillation Technology

Knowledge distillation is itself a well-established and legitimate machine learning technique. The core idea is to use a larger, more capable "teacher model" to guide the training of a smaller "student model," allowing the latter to approximate the former's performance at a fraction of the computational cost.

This technique is widely used in the industry for model compression, edge device deployment, and inference cost optimization. However, when the target of distillation becomes a competitor's closed-source commercial model, the situation grows considerably more complicated.

Defining the Distillation Attack

The "distillation attacks" described in Anthropic's report refer to the practice of systematically calling a target model's API at scale to collect large volumes of input-output pairs, then using that data to train one's own model. In essence, this approach "steals" the knowledge and capabilities that the target model acquired through massive investment.

From a commercial and legal standpoint, this kind of behavior typically violates the terms of service of most AI providers — the vast majority of which explicitly prohibit users from using model outputs to train competing models.

The Context: Intensifying Industry Competition

The Rapid Rise of Chinese AI Companies

In recent years, Chinese AI companies have made remarkable strides in the large model space. DeepSeek has drawn global attention with its cost-efficient inference models, Moonshot AI's Kimi has stood out for its long-context processing capabilities, and Alibaba's Qwen series has built a broad following in the open-source community.

These companies have frequently achieved performance close to top-tier closed-source models at significantly lower cost — and the technical path behind that achievement has long been a subject of scrutiny. Anthropic's report is, in some ways, a direct response to that scrutiny.

The Economics of Data and Cost

Training a frontier large model requires hundreds of millions of dollars in compute and data resources. If a company can "replicate" a competitor's capabilities through distillation, it stands to save an enormous amount of that investment. This stark cost differential is the core economic motivation driving distillation attacks.

As industry competition has entered its most heated phase, the temptation to take such shortcuts has only grown. Anthropic specifically emphasizes that these attacks have shown an escalating trend "in recent months" — a detail that underscores the link between competitive pressure and misconduct.

Industry Implications Worth Watching

The IP Protection Dilemma in the AI Era

This incident highlights a new category of intellectual property challenges unique to the AI era. Traditional software code can be protected through copyright and patents, but the "knowledge" embedded in a large model is implicitly encoded in its parameters. Once a model is made available via API, its capabilities become vulnerable to reverse distillation.

How to keep models open and accessible while preventing competitors from extracting their core capabilities is a dilemma that every frontier model company must now confront.

A Microcosm of Geopolitical Tech Competition

It's worth noting that all of the companies named in the report are Chinese firms. This gives the incident a dimension that goes beyond a simple commercial dispute, framing it within the broader narrative of U.S.-China AI competition. Against the backdrop of technology decoupling and supply chain tensions, accusations like these could further deepen the technological trust deficit between the two sides.

That said, it's important to view unilateral accusations like this with some measured skepticism. Proving technically that one model was distilled from another is genuinely difficult — similarities in model outputs could stem from shared training data or similar architectural choices, rather than direct distillation. The companies named have yet to issue formal responses to Anthropic's claims.

Conclusion

Regardless of whether the evidence ultimately proves sufficient, Anthropic's report lays bare an industry reality that cannot be ignored: as large model capabilities become the defining competitive edge, the battle over model knowledge is becoming a new front in the AI race.

For the industry as a whole, establishing clearer intellectual property rules for AI models, more effective technical safeguards, and cross-border industry norms may be the only lasting solution to disputes of this kind. Until those mechanisms mature, similar accusations and controversies are likely to keep coming.