A decade-old machine learning technique, described in a 2015 paper co-authored by Google’s current AI lead, has become the subject of White House accusations, Treasury sanctions threats, and an open letter signed by more than two dozen technology companies — all within a single week. This analysis separates what has been documented from what has been asserted, and examines why a routine engineering method became a national security question.

In February 2026, Google AI lead Jeff Dean described distillation on a podcast as a technique for making smaller models more capable, noting that a frontier model must exist before it can be distilled into a smaller one (Leswing & Vanian, 2026). The remark drew little attention outside technical circles. Five months later, the same word appeared in a White House official’s public accusation against a Chinese company, in a Treasury Secretary’s warning about sanctions, and in a joint letter from Nvidia, Microsoft, Meta, and others urging Washington not to overreact.

The velocity of that shift is itself the story. Understanding it requires separating three distinct questions that the current debate tends to collapse into one: what distillation is technically, what specific conduct has actually been alleged and evidenced, and what legal or policy framework — if any — governs it.

What distillation actually is

Knowledge distillation was formally introduced in a 2015 paper by Geoffrey Hinton, Oriol Vinyals, and Jeff Dean, which described compressing the knowledge held in a large model or ensemble of models into a single smaller model (Hinton, Vinyals, & Dean, 2015). The core insight is that a large model’s full probability distribution over possible outputs carries more information than a simple correct-answer label. A smaller “student” model trained to match the larger “teacher” model’s output distribution can therefore reach accuracy it could not achieve training on the raw data alone.

The technique is uncontroversial as engineering. It is standard practice across the industry: Nvidia used distillation in training its Llama Nemotron model series and documented the approach in an accompanying research paper (Leswing & Vanian, 2026). Nearly every commercially deployed small or “mini” model on the market today involves distillation somewhere in its training pipeline. As one industry analyst quoted by CNBC put it, distilling a smaller model from a larger one’s outputs is a legitimate and valuable technique practiced constantly (Leswing & Vanian, 2026).

What has changed is not the method but the relationship between the parties. Distillation is uncontroversial when a company distills its own model. It becomes contested when the teacher model belongs to a competitor, is accessed through a commercial API under terms that prohibit exactly that use, and the resulting student model competes with the teacher. The technical operation is identical in both cases; only the ownership and consent structure differs.

Why the issue detonated in July 2026

The immediate trigger was the release of Kimi K3 by the Chinese lab Moonshot AI in mid-July 2026. Users quickly found the model competitive with the best commercially available systems from Anthropic and OpenAI (Leswing & Vanian, 2026). Critically, Kimi K3 is an open-weight model: unlike the proprietary API-gated systems sold by leading U.S. labs, its weights can be downloaded, modified, and run on infrastructure the user controls.

That combination — frontier-competitive performance, released openly, from a Chinese lab, at substantially lower cost — turned a technical debate into a geopolitical one. On July 22, 2026, White House Office of Science and Technology Policy director Michael Kratsios posted on X that the administration had information indicating Moonshot AI had distilled Anthropic’s Fable model in developing K3, and that Moonshot had built an internal platform to conduct large-scale distillation against U.S. models while switching between access methods to avoid detection (Leswing & Vanian, 2026; Zeff, 2026). Kratsios separately alleged that Moonshot had obtained Nvidia GB300 servers and accessed additional GB300 systems in Thailand — chips barred from sale to Chinese firms under U.S. export controls (Zeff, 2026).

Hours later, Treasury Secretary Scott Bessent stated that sanctions and Entity List designations would be on the table for firms conducting covert, industrial-scale distillation crossing into IP theft, framing the issue with the line that open source is not open season on American intellectual property (Zeff, 2026).

These July statements followed two earlier Anthropic disclosures. In February 2026, the company said its Claude models had been distilled at industrial scale by DeepSeek, Moonshot, and MiniMax using roughly 24,000 fraudulent accounts to generate about 16 million exchanges (Leswing & Vanian, 2026; Field, 2026a). In June 2026, Anthropic alleged in a letter to Congress that operators affiliated with Alibaba and its Qwen lab had used fake accounts to generate more than 28.8 million exchanges with Claude between April 22 and June 5, 2026, targeting agentic reasoning, software engineering, and long-horizon task capabilities (Field, 2026b). Alibaba denied wrongdoing.

Fact check: what is documented and what is asserted

The distinction between these two categories is unusually wide in this episode, and it is where most public commentary loses precision.

Documented. The technique itself and its industry-wide use are well established and openly published. The terms of service of both OpenAI and Anthropic prohibit using their model outputs to train competing models (Leswing & Vanian, 2026). Anthropic’s account-volume figures are the company’s own published findings, disclosed in its February post and its congressional letter. The public statements by Kratsios and Bessent were made on the record and are directly attributable. The July 24 open letter and its signatories are a matter of public record.

Asserted but not publicly evidenced. The central claim — that Kimi K3’s capabilities derive from distilling Anthropic’s Fable — has not been supported by publicly released technical evidence. Kratsios has not disclosed logs or artifacts showing Fable outputs incorporated into K3, nor detailed the procurement route for the GB300 hardware (Zeff, 2026). Anthropic’s own findings, while specific, describe account activity and usage patterns consistent with distillation; they are company-internal determinations that have not been independently verified.

Actively disputed on timeline grounds. Multiple researchers have questioned whether the distillation claim is chronologically plausible. Fable 5 became publicly available on July 1, 2026, and Kimi K3 launched roughly two weeks later. A Moonshot employee noted publicly that this would require training an entire frontier model in about 15 days (Global AI experts push back, 2026). Distillation at the scale required to transfer frontier capabilities involves generating large volumes of teacher outputs, curating them, and running a substantial training process — a pipeline most practitioners consider difficult to compress into that window. Moonshot’s business head denied the accusation and attributed K3’s performance to three architectural changes the company had already named in its release materials: Moon Clip, Kimi Delta Attention, and Attention Residuals (Moonshot denies distilling Fable, 2026).

Two caveats cut against a quick dismissal, however. First, a short window between a specific model’s release and a competitor’s launch does not rule out distillation from earlier model versions, which had been available considerably longer. Second, the architectural improvements Moonshot cites and the use of distilled training data are not mutually exclusive; a model can incorporate both. The timeline objection weakens the specific Fable-to-K3 claim without resolving the broader question.

Unverifiable as circulated. A figure has circulated attributing up to $6 billion in annual losses to U.S. AI labs from unauthorized distillation, sourced to unnamed U.S. officials. No published methodology accompanies it. Given that distillation’s economic effect depends on counterfactual assumptions about what competitors would otherwise have built and at what cost, such a figure should be treated as an advocacy estimate rather than a measured quantity until its derivation is disclosed.

Two separate allegations, frequently merged. The GB300 hardware claim and the distillation claim are distinct. Unauthorized acquisition of export-controlled chips would violate export control law regardless of how any resulting model was trained; distillation raises contract and IP questions with no clear criminal analogue. Conflating them produces an impression of a single, larger offense than either allegation establishes on its own.

Enforcement status. As of late July 2026, no sanctions, Entity List designations, or other enforcement actions had been imposed in connection with these allegations. Every announced consequence remains threatened or under consideration.

One further verification note: reporting differed on whether OpenAI signed the July 24 open letter. Several outlets reported that both OpenAI and Anthropic declined to sign; at least one reported that OpenAI subsequently joined. Readers should treat the signatory list as subject to correction.

The legal question is weaker than the rhetoric suggests

The language of “theft” dominates the political discussion, but the underlying legal position is considerably more constrained. Legal analysts examining the earlier OpenAI–DeepSeek dispute have consistently reached a similar conclusion: distillation is unlikely to constitute copyright infringement under existing U.S. law.

Two doctrinal problems drive that assessment. First, copyright protection requires human authorship; model outputs generated without sufficient human expressive contribution are generally not copyrightable, which means training on them does not infringe a copyright that does not exist. Second, distillation resembles reverse engineering conducted through lawful access — it observes outputs and statistically infers patterns without accessing source code, weights, or internal architecture, and reverse engineering has historically received substantial legal tolerance (Monash University, 2025; Winston & Strawn, 2025).

For this reason, AI companies have largely framed the issue as breach of contract rather than intellectual property infringement, resting on terms-of-service provisions prohibiting output-based training. Contract claims are more likely to succeed on the merits but carry practical limits: they bind only parties who agreed to the terms, they are difficult to enforce against foreign entities operating through intermediaries and resold API access, and the remedies available for breach may be modest relative to the value at stake.

Trade secret law offers a third possible avenue but faces its own difficulty: information a company deliberately exposes through a public commercial API is hard to characterize as a secret subject to reasonable protection measures.

The gap between the rhetorical framing and the legal reality helps explain why the response has migrated to export controls, sanctions authorities, and Entity List designations — instruments that do not require proving an IP violation in court.

An industry divided against itself

On July 24, 2026, Nvidia, Microsoft, Meta, Palantir, IBM, Hugging Face, and roughly twenty other firms published a joint letter urging policymakers to avoid premature restrictions on open-weight models that would stifle competition or push innovation offshore. The letter explicitly characterized distillation as a widely used technique for model improvement, evolution, and validation (Capoot, 2026; Leswing & Vanian, 2026).

The split is economically legible. Firms whose business depends on selling proprietary API access to frontier models bear the direct cost of distillation and benefit from restrictions. Firms selling compute, cloud infrastructure, developer tooling, or enterprise deployment benefit from a large and diverse model ecosystem, including open-weight models, and are harmed by rules that shrink it. Neither position is disinterested, and the alignment between stated principle and commercial interest is close enough on both sides to warrant caution in reading either as neutral analysis.

A further complication runs through the entire debate. Both leading U.S. labs face ongoing copyright litigation over their own use of third-party content in training. An attorney representing authors in that litigation observed that the administration has focused on protecting technology companies’ intellectual property while remaining largely silent on the intellectual property of creators and individuals used without authorization (Leswing & Vanian, 2026). Whatever one concludes about the merits of either claim, the asymmetry is real and is unlikely to go unremarked as policy develops.

What the episode actually reveals

Three structural conditions, rather than any single actor’s conduct, explain why this became unavoidable.

First, capability leads are compressing. Whether or not distillation explains K3 specifically, the gap between frontier proprietary models and fast-following open-weight alternatives has narrowed materially, and the economics of that narrowing favor the follower.

Second, the business model of selling API access to a frontier model is structurally exposed. Any system that must produce high-quality outputs to paying users necessarily emits the training signal a competitor would need. Detection and account enforcement mitigate but cannot eliminate this; the exposure is inherent to the product.

Third, the legal architecture was not designed for this. The applicable frameworks — copyright, trade secret, contract — each address part of the problem badly. That vacuum is why the debate moved so quickly from courts to trade policy, and why the eventual resolution is more likely to arrive as export controls and procurement rules than as case law.

None of this determines whether the specific accusations against Moonshot or Alibaba are accurate. Those remain contested, thinly evidenced in public, and — in Moonshot’s case — potentially testable: the company stated it would release full model weights, which would allow outside researchers to examine architecture and results currently available only through an API (Moonshot denies distilling Fable, 2026). Independent technical analysis of those weights is the most likely near-term source of evidence either way. Until it exists, the responsible position is to treat the allegations as serious, unproven, and consequential regardless of how they resolve — because the policy machinery now in motion will not wait for them.

References

Capoot, A. (2026, July 24). Nvidia, Microsoft, Meta warn against ‘premature restrictions’ of open-weight models. CNBC. https://www.cnbc.com/2026/07/24/nvidia-microsoft-meta-open-weight-ai-models.html

Field, H. (2026a, February 24). Anthropic accuses DeepSeek, Moonshot and MiniMax of distillation attacks on Claude. CNBC. https://www.cnbc.com/2026/02/24/anthropic-openai-china-firms-distillation-deepseek.html

Field, H. (2026b, June 24). Anthropic accuses Alibaba of campaign to ‘brazenly’ and ‘illicitly’ extract AI capabilities. CNBC. https://www.cnbc.com/2026/06/24/anthropic-alibaba-distillation-campaign.html

Global AI experts push back on US ‘distillation’ claims against Moonshot’s Kimi K3 model. (2026, July 23). South China Morning Post. https://www.scmp.com/tech/tech-war/article/3361625/global-ai-experts-push-back-us-distillation-claims-against-moonshots-kimi-k3-model

Hinton, G., Vinyals, O., & Dean, J. (2015). Distilling the knowledge in a neural network (arXiv:1503.02531). arXiv. https://arxiv.org/abs/1503.02531

Leswing, K., & Vanian, J. (2026, July 25). From Silicon Valley to DC, the tech world is suddenly obsessed with one concept in AI: Distillation. CNBC. https://www.cnbc.com/2026/07/25/hat-is-distillation-and-why-is-everyone-so-obsessed-with-it-this-week.html

Monash University. (2025). AI distillation and the law: Why learning from Claude or GPT may not be copyright infringement. Monash Lens. https://lens.monash.edu/ai-distillation-and-the-law-why-learning-from-claude-or-gpt-may-not-be-copyright-infringement/

Moonshot denies distilling Fable and credits K3 gains to its own architecture. (2026, July). Implicator.ai. https://www.implicator.ai/moonshot-denies-distilling-fable-and-credits-k3-gains-to-its-own-architecture/

Winston & Strawn. (2025). Is AI distillation by DeepSeek IP theft? https://www.winston.com/en/insights-news/is-ai-distillation-by-deepseek-ip-theft

Zeff, M. (2026, July 22). Treasury threatens sanctions after White House claims Moonshot distilled Anthropic’s Fable. TechCrunch. https://techcrunch.com/2026/07/22/treasury-threatens-sanctions-after-white-house-claims-moonshot-distilled-anthropics-fable/