What is AI distillation and why is at the centre of latest US-China tech clash

The National Security Agency (NSA), Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA) issued a joint cybersecurity advisory on September 8. The agencies said China-based AI companies had carried out what they described as “aggressive, industrial-scale distillation” campaigns against US AI companies.

According to the agencies, the companies sought to extract restricted capabilities and features from US frontier AI models and use them to train their own systems. The NSA said this could allow Chinese AI models to narrow the technology gap without spending the same amount of computing power, electricity, research and development resources required to build frontier models independently.

Anthropic, the US company behind Claude, made similar allegations in its latest threat intelligence report. Anthropic said it had identified and disrupted additional distillation attacks against Claude from seven China-based laboratories since its first disclosure in February. The company said the attacks targeted its generally available models.

However, China has rejected the US allegations. China called the claims “unfounded accusations” and said distillation is a technique used commonly across the AI industry, reported AP.

Distillation itself is not a new or illegal AI technique. The dispute centres on whether companies use it legitimately or use large-scale, unauthorised access to another company’s model to reproduce its capabilities.

What is AI distillation?

AI distillation is a method in which a more capable model acts as a “teacher” for another model. The teacher generates responses to different inputs. Developers can then use those exchanges to train a “student” model.

Anthropic describes legitimate distillation as a process in which a larger model generates responses that help train a smaller model to reproduce some of its capabilities. The company said the method can reduce the resources needed to achieve advanced capabilities.

The technique can have legitimate uses. Developers can use it to create smaller models that are cheaper or easier to operate. It can also help transfer useful capabilities from a large model into a more specialised system.

The concern raised by US authorities involves a different type of activity.

The NSA said China-based companies had carried out industrial-scale campaigns to extract restricted proprietary capabilities from US frontier models. According to the agency, these companies distributed their operations across different AI providers, cloud platforms and infrastructure to avoid detection.

Anthropic uses the term “illicit distillation” for what it describes as covert, industrial-scale efforts to extract a model’s capabilities and reproduce them in another model without authorisation. The company said such operations can involve fake accounts, stolen payment cards, login credentials and API keys.

Distillation does not necessarily involve obtaining the source code or internal parameters of the original AI model. Instead, a developer can collect large numbers of outputs from a powerful model and use those outputs as training material.

Distillation had become a major point of tension in the US-China AI rivalry. Reuters described the process as training smaller AI models with outputs from larger and more expensive models to reduce the cost of developing a new AI system.

Why has distillation become US-China issue?

The dispute comes as the US and China compete over advanced AI, semiconductors, computing infrastructure and military applications. 

The United States has imposed restrictions on China’s access to some advanced semiconductor technologies that can support high-end AI development. China has also invested heavily in domestic AI companies, computing infrastructure and its semiconductor industry.

The US government now says the competition involves another resource: access to the outputs of advanced AI models.

The NSA said the alleged distillation campaigns could help China-based companies obtain capabilities from US frontier models without making the same investment in foundational research and computing. The agency also linked advances in Chinese AI models to potential military and cyber capabilities.

Anthropic made a similar point in its September report. It said unauthorised laboratories could extract and reproduce capabilities from frontier models at a fraction of the time, computing power and cost required to develop those capabilities independently.

US officials had accused Chinese AI developers of “industrial-scale distillation”. Singapore-based academic Will Cong said the US allegations should be treated as a “contested claim” rather than as the sole explanation for China’s progress in AI, reported AP.

Lizzi C Lee of the Asia Society Policy Institute told AP that the US had focused heavily on controlling China’s access to inputs such as advanced chips. She said Washington may now also need to consider the outputs of frontier AI models as a form of technology transfer.

How can distillation help an AI company?

Training a frontier AI model requires substantial computing power, data, engineering expertise and money. A developer that can learn from the outputs of an already capable model may reduce some of the work required to develop particular capabilities.

For example, a student model can learn from thousands or millions of examples generated by a stronger model. Developers can then use those examples to improve the student’s performance on specific tasks.

The student does not necessarily become identical to the teacher. It learns patterns from the teacher’s responses.

Anthropic said the capabilities targeted in the alleged distillation campaigns included agentic capabilities and tool use, coding, data analysis and logical reasoning.

The company gave specific examples in its September report. It said a campaign that it attributed to Alibaba-affiliated operators reached almost 3 million exchanges a day at its peak and involved more than 3,500 fraudulent accounts. Anthropic said it observed more than 151 million exchanges linked to the campaign between May and July 2026.

Anthropic also said it attributed more than 12.1 million exchanges over 14 days in July to a distillation campaign involving DeepSeek. It separately reported more than 3.4 million exchanges associated with Zhipu over 17 days in June and July.

These figures come from Anthropic’s own investigation and attribution. They represent the company’s assessment of activity involving its systems and should not be treated as independent confirmation of every allegation.

Is distillation the same as copying an AI model?

Distillation and direct copying are different processes. In conventional distillation, the developer does not receive the teacher model’s complete internal parameters. Instead, the developer uses the teacher’s outputs to train another model.

That distinction appears in the US government’s own description of the issue.

The September 8 NSA advisory said distillation itself is a legitimate and useful AI research technique. Its objection concerned what it described as Chinese companies’ industrial-scale extraction of restricted capabilities from US frontier models.

Anthropic makes a similar distinction. The company said legitimate distillation involves using a teacher model to generate responses for training a student model. It uses “illicit distillation” to describe covert and unauthorised campaigns designed to extract and reproduce capabilities.

The alleged campaigns can involve large numbers of automated queries. Anthropic said some China-based laboratories used proxy services to access its models and circumvent geographic restrictions. It also said some unauthorized laboratories obtained transcripts of exchanges with US frontier models through third-party resellers.

The scale of such activity makes detection more difficult. A single query may look like ordinary use. A large network of accounts making millions of requests can form a different pattern.

Anthropic said some operators used fake identities, fraudulent payment information and stolen API keys to gain access.

What do US and China say?

The US agencies have framed the issue as both a technology and national-security concern. The NSA, FBI and CISA said on September 8 that the alleged campaigns could help Chinese AI models close the technology gap and could have implications for US military and cybersecurity capabilities.

Anthropic has separately described the activity as unauthorised use of its models. It said it had disrupted the campaigns and strengthened safeguards against them.

China has disputed the US characterisation. Beijing rejected the allegations and said distillation is widely used by AI companies. China also accused Washington of seeking a monopoly over the AI industry, reported AP.

The issue had become a flashpoint in the broader US-China AI relationship. US officials had accused six Chinese companies in September of maliciously copying American AI products through distillation, reported Reuters. The Chinese embassy in Washington had previously called similar US allegations “baseless”.

US Treasury Secretary Scott Bessent said Washington was open to discussing “shared risks” from AI with China, reported US-based media outlet Axios.

Could distillation change AI race?

Distillation does not remove the need for computing power, engineers, data or research. It also does not guarantee that a student model will reach the same performance as the teacher.

But the technique can reduce the resources required to reproduce some capabilities. That is why US officials and AI companies have focused on the issue.

The NSA said the alleged Chinese campaigns could allow companies to narrow the gap with US frontier models without spending the same level of resources on research and development.

Anthropic made a similar assessment. It said illicit distillation can allow unauthorised laboratories to reproduce frontier-model capabilities at a lower cost than independent development.

The broader US-China AI competition therefore involves more than chips and computing capacity. It also involves access to advanced models and the information that those models generate. The issue had become part of the broader technology rivalry between Washington and Beijing.

At the same time, the existence of distillation does not by itself prove that one country’s AI progress comes from another country’s models. AP quoted academic Will Cong as saying the US allegations should be treated as a contested claim rather than as the explanation for China’s overall AI catch-up.