Knowledge distillation itself is a standard and legitimate machine-learning technique. What U.S. labs are now calling a “distillation attack” is different: unauthorized, industrial-scale extraction of a commercial model's capabilities through fraudulent or evasive access paths. Mixing up those two ideas obscures both the technical issue and the policy fight.
The 2026 controversy around DeepSeek, Moonshot, and MiniMax is not about whether model distillation exists; it has existed for years. The dispute is over whether a competitor can use fake accounts, proxy routes, and large-scale API harvesting to copy the reasoning, tool use, coding, and other differentiated capabilities of frontier commercial models at a fraction of the cost. In the U.S.-China context, that turns a classic efficiency technique into a live question of IP, capability transfer, and national security.
Legitimate distillation
A standard teacher-student transfer method used to build smaller, cheaper models.
Distillation attack
Unauthorized, large-scale extraction of a commercial model's capabilities through abusive access.
Targeted abilities
Agentic reasoning, tool use, coding, long-context processing, and other valuable workflows.
Policy question
Not whether the method exists, but how capability transfer is governed.
1. What knowledge distillation is in normal ML practice
Knowledge distillation is a classic compression and transfer technique popularized in modern deep learning by Hinton and colleagues. The core idea is straightforward: a strong teacher model produces outputs for many inputs, and a smaller student model is trained to match those outputs. The result is that the student can inherit some of the teacher's behavior while being cheaper to run and easier to deploy.
Critically, what gets transferred is often more than just a final answer. In practice, distillation may rely on soft targets, output distributions, or other traces that preserve how the teacher behaves. That is why distillation can be so effective. Used within a lab's own model family or on properly licensed data, it is a normal optimization tool—not a scandal.
2. What turns it into a “distillation attack”
The phrase distillation attack refers to using that same idea without permission, at scale, and through abusive access methods. Anthropic said in February 2026 that it found industrial-scale campaigns by DeepSeek, Moonshot, and MiniMax involving roughly 24,000 fraudulent accounts and more than 16 million exchanges with Claude. In that framing, the issue is not the existence of distillation as a research method; it is the combination of unauthorized access, evasive routing, and systematic capability extraction.
OpenAI has likewise said it detected attempts by Chinese actors to use its models for distillation-related purposes. So the line between legitimate and hostile use is best understood through permissions, access methods, contractual restrictions, and scale—not through the raw math of teacher-student learning alone.
3. The common technical pattern in attack-style distillation
Based on public reporting, the operational core is large-scale query generation to build synthetic training corpora. The goal is to extract the parts of the teacher that matter most commercially: agent loops, tool use, coding ability, data analysis, and long-form reasoning. The resulting outputs can then be cleaned, filtered, prioritized, and reused in student-model training or reinforcement-style tuning pipelines.
Anthropic also described more elaborate access infrastructure: proxy and reseller pathways, “hydra”-like account clusters, and rapid pivoting toward newly released models to capture their freshest capabilities. This article intentionally does not cover implementation steps or bypass instructions. The point is to explain the structure of the controversy, not to operationalize it.
4. Why it matters even if the student is imperfect
Attack-style distillation does not need to recreate a frontier model perfectly to be strategically important. If a competing lab can cheaply acquire enough of the teacher's coding, tool orchestration, reporting, or reasoning style, it may move a smaller system much closer to “good enough” for real deployment. That can compress time, cost, and competitive distance dramatically.
It also raises a second concern: the student may inherit useful capability without inheriting all of the original guardrails. Reuters' reporting on Chinese military researchers using outputs from OpenAI and Anthropic models in defense-related work illustrates why this matters. Even when a foreign military cannot directly adopt an outside model, its outputs and reasoning traces may still help train or shape domestic systems.
5. How defenders are responding
Public disclosures point to four main layers of defense: traffic analysis and rate controls; account-correlation and behavioral fingerprinting; model or API designs that make outputs less useful for illicit distillation; and intelligence-sharing or policy escalation with cloud providers and governments. Export controls also matter because industrial-scale extraction still depends on substantial compute for downstream training.
But the difficulty is conceptual as well as technical. Distillation itself is a legitimate part of model development. So the real governance challenge is not to outlaw the method in the abstract, but to distinguish normal research and compression from unauthorized capability harvesting.
6. The real debate is about governing capability transfer
That is why the distillation dispute matters in the wider China-AI story. DoorDash's use of Kimi, DeepSeek's lower-cost agent performance, Kimi K3's rollout strategy, and the distillation controversy are not isolated episodes. Together, they show several routes by which Chinese models can gain ground: price, distribution, and capability transfer.
So the deeper policy issue is not “is distillation good or bad?” It is: which capabilities are moving, through what channels, under whose rights, and with what downstream safeguards? That is where a normal ML technique becomes a geopolitical flashpoint.
Key points
- Knowledge distillation is a standard teacher-student learning method in ML
- A distillation attack adds unauthorized access, evasive routing, and industrial scale
- Anthropic publicly tied DeepSeek, Moonshot, and MiniMax to large-scale extraction claims
- The strategic issue is governance of capability transfer, not the existence of distillation itself