FollowingDay 14in the edition since 21 Oct 202616 sourcesupdated 31 Oct 2026
Kimi K3 and Claude distillation dispute
The gist
Latest: US-China AI Distillation Dispute: defenses, Accusations, and New Detection Tech
Chinese labs are documented to have run large-scale extraction campaigns against US frontier models, and Anthropic's countermeasures have pushed distillers toward other targets rather than stopping the activity. The dispute has policy and legal dimensions: CISA named specific companies, sanctions have been threatened, and the US-China AI capability gap is estimated to be substantially narrowed by distillation.
When stories like this move, I write about them in an email each morning.
One free email each morning, around 8 AM US Eastern.
Check your email.
I have sent you a confirmation link. One click and you are in.
Not in your inbox? Look in spam or promotions. If it's there, mark it "Not spam" so future editions land in your inbox.
The full picture
An OpenAI API bug discovered by researchers at Xint exposed raw reasoning traces, which was fixed on October 23, 2026, with a $6,000 bounty awarded; a commentator noted the bounty was vastly inadequate given that leaking raw reasoning traces would make distillation attacks far easier. This sits within a broader, active dispute over Chinese AI labs extracting capabilities from US frontier models at scale. Anthropic reported its countermeasures reduced data harvested by 90 to 99 percent, after which Chinese labs redirected distillation efforts from Claude to OpenAI's GPT-6 Astra, according to The Information. CISA named Alibaba, MiniMax, StepFun, and Z.AI as conducting systematic distillation: StepFun distilled from multiple Claude and GPT models between late 2025 and early 2026; Z.AI distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 by mid-2026; Alibaba distilled Claude and GPT-5 models in late 2025. Anthropic's October 12 report described three defensive categories and introduced preserved thinking with Claude Fable 5.1 and Opus 5.5, blocking API accounts created on or after August 31, 2026 from editing prior context, and blocking extraction via translation or special tags. The measures cost Anthropic meaningful revenue and trillions of tokens of paying traffic. A Meta paper introduced WM-Basin, which detects distillation by recovering key-specific watermark traces from distilled model weights, achieving 79% detection at a 0.1% false-positive rate across 1,200 distilled models versus 29% for token-counting methods; the trace persisted through quantization, light pruning, and RL post-training, though extensive fine-tuning on clean data weakened it. The Institute for Progress estimated the US holds a roughly 16x training compute advantage over China, yielding a theoretical 13-month lead reduced to approximately 6.5 months by adversarial distillation, and proposed a BIS end-use control on remote cluster access and a DOJ/FTC safe harbor for US company coordination. In July 2026, White House OSTP director Michael Kratsios accused Moonshot AI of distilling Fable 5 to train Kimi K3; Treasury Secretary Bessent warned of possible sanctions and said watermarks of US-made models have been found in numerous Chinese models. Multiple AI experts called the accusations political and reckless, arguing distillation does not constitute intellectual property theft, and a Moonshot employee noted K3 launched only 15 days after Fable 5 went public.
Meta researchers published WM-Basin, a technique for recovering watermark traces from distilled model weights by converting a suspect model's API outputs into gradients and checking alignment against the real watermark key, bearing on US accusations that Chinese labs distilled Fable 5 to produce Kimi K3.
Across 1,200 distilled models, it achieved 79% detection at a 0.1% false-positive rate, compared to 29% for token-counting methods. The trace persisted through quantization and RL post-training, though heavy fine-tuning on clean data weakened it.
Chinese labs redirected distillation from Claude to OpenAI's GPT-6 Astra after Anthropic's countermeasures cut harvested data by 90 to 99 percent, The Information reported.
CISA named Alibaba, StepFun, and Z.AI with specific model names and date ranges from late 2025 through mid-2026, and OpenAI, Anthropic, and Google DeepMind disclosed they are sharing threat intelligence through the Frontier Model Forum. Kimi K3.1 metadata appeared in public libraries, signaling an imminent release from Moonshot AI.
A CSET technical explainer published October 26 cited Anthropic's claim of over 200 million exchanges with Claude across seven Chinese labs and estimated synthetic data from US models may account for 14 to 36 percent of GLM-4.5's post-training data.
CSET identified a key gap: because US companies cannot confirm how much harvested data Chinese labs actually use in training, campaigns' impact may be overstated. China's Commerce Ministry called the accusations 'groundless' while acknowledging distillation is a 'neutral technical means' used by model companies worldwide, including US firms.
The Institute for Progress published a report estimating adversarial distillation reduces a theoretical 13-month US AI compute lead over China to roughly 6.5 months as China's chip access is expected to roughly double by end of 2027, and proposes a BIS end-use control on remote cluster access and a DOJ/FTC safe harbor for US company coordination.
DeepSeek released a V4.1-Flash model in October 2026 whose benchmark chart includes Opus 5 and Sol, and an estimate attributing roughly 50% of Chinese labs' benchmark performance to distillation, up from 30%, entered the discussion.
The US sanctioned five Chinese entities connected to former Google engineer Linwei Ding; Kimi K3.1 metadata appeared in public libraries; DeepSeek released V4.1-Flash.
18 October 2026
Dean Ball said after joining OpenAI that distillation probably plays a bigger role than he had previously thought in explaining Chinese model benchmark competitiveness.
Anthropic published a technical account on October 12, 2026 of its defenses against distillation attacks on Claude, reporting measures including a new 'preserved thinking' feature in Fable 5.1 and Opus 5.5 cut harvested data by around 90 to 99 percent.
The account follows US accusations that Moonshot AI distilled Claude Fable 5 to train Kimi K3: White House OSTP director Michael Kratsios named Moonshot publicly and Treasury Secretary Scott Bessent warned sanctions are possible. A Moonshot employee noted Kimi K3 launched 15 days after Fable 5's July 1 release.
White House OSTP director Kratsios accused Moonshot AI of distilling Fable 5 to train Kimi K3; Treasury Secretary Bessent warned of possible sanctions; multiple AI experts publicly called the accusations political and reckless.
23 June 2026
Parts of the NSA lost access to Anthropic's Mythos 5 after the administration imposed export controls on Anthropic, forcing withdrawal of its most advanced models.
7 April 2026
OpenAI, Anthropic, and Google DeepMind disclosed sharing threat intelligence via the Frontier Model Forum, with Anthropic documenting approximately 16 million adversarial distillation exchanges traced to DeepSeek, Moonshot AI, and MiniMax.