Chinese AI companies accused of stealing US tech through distillation, threatening national security

American AI companies say Chinese copycats are quickly catching up

SAN FRANCISCO -- The U.S. companies building artificial intelligence systems are loudly complaining that their Chinese competitors are unfairly copying their technology, and they are pleading with officials to do something about it. On June 10, Anthropic sent a letter to Sens. Tim Scott and Elizabeth Warren accusing the Chinese tech giant Alibaba of surreptitiously copying its AI technologies using a technique called distillation. Like other Chinese companies, Alibaba tapped into Anthropic's technologies through tens of thousands of unauthorized accounts, according to the letter, which was viewed by The New York Times. Then it used the data it collected to train its own AI systems. Anthropic asked the lawmakers, who lead a Senate committee that was about to hold a hearing on AI, to explore ways of curbing China's distillation. "These distillation attacks are carried out illicitly, systematically and at industrial scale to harvest U.S. AI capabilities across frontier labs and repackage them as their own," Anthropic told the two senators, referring to companies on the frontier of AI development. Experts say China trails the United States in AI development by just six months. Anthropic and other U.S. companies argue that without help from distillation, China would be much further behind, which could affect major AI uses like business planning, drug research, mass surveillance and military weapons. Their complaints have new urgency now that the Chinese startup Z.ai has released an AI model, GLM-5.2, that is nearly as powerful as the top American systems. It rivals them when used for cybersecurity, an area that American AI companies and the Trump administration have singled out as vitally important to geopolitics. But what exactly is distillation, and are Chinese companies the only ones doing it? Here is an explanation. Is distillation a new concept? Not at all. Distillation has been common in the tech industry for more than a decade. A small team of Google researchers first developed the technique in the early 2010s as a way of building more efficient AI systems. Through distillation, researchers can collect data from a particularly powerful system and use that data to build a system that can run on less expensive hardware. The first AI model essentially shows the second model how to behave, said Geoffrey Hinton, a former Google researcher who helped develop the technique. "Think of one model as the teacher and the other as a student," he said. Is distillation a way to copy your own AI? Correct. But some companies used distillation to mimic technologies built by other AI labs. They often copied the behavior of open-source technologies -- systems that anyone can use, modify and copy for free and largely without restriction. That is what labs hope to encourage when they open source their systems. The idea is that everyone benefits because AI is developed more quickly. When is distillation a problem? Anthropic, OpenAI and other AI labs get annoyed when companies use distillation to mimic the behavior of their proprietary systems -- technologies that are not open-source. These are typically their most powerful systems. Anthropic and OpenAI do not allow distillation for their leading systems under their terms of service. But distilling these systems is still common. In April, while testifying in a federal trial in Oakland, Calif., Elon Musk acknowledged the practice at his AI company, xAI. When a lawyer asked if xAI had ever distilled technology from OpenAI, Musk replied, "Generally AI companies distill other AI companies." Is that illegal? That's not clear, said Sarah Tishler, a partner at the law firm Beck Reed Riden who specializes in trade-secret litigation. Some legal scholars argue that the practice violates the Defend Trade Secrets Act, a 2016 law that allows businesses to sue over the theft of trade secrets, but courts have not explicitly decided that. Copyright law does not necessarily apply because distillation is an effort to copy the behavior of the system, as opposed to copying text verbatim. Are the Chinese doing something similar? It is also not completely clear what Chinese companies are doing. They have likely distilled proprietary models in much the same way that U.S. companies like xAI have done. Chinese distillation efforts, however, have caused far more concern among Anthropic, OpenAI and other U.S. companies. About 18 months ago, the Chinese startup DeepSeek shocked Silicon Valley when it showed that it could build effective AI far more affordably than many of its American counterparts. OpenAI soon accused DeepSeek of distilling its technologies. In February, Anthropic accused DeepSeek and two other Chinese startups of improperly harvesting large amounts of data from its systems. Anthropic said the startups had used about 24,000 accounts to generate more than 16 million conversations with its Claude chatbot that could be used to teach skills to their own chatbots. How does Anthropic know this? Anthropic closely monitors how people use its systems. Certain repeated behavior, the company said, showed that accounts linked to China were lifting data from its proprietary models. Anthropic claimed that various Chinese companies had used a network of accounts to gain access to its systems. Each Chinese company, Anthropic said, uses this data to help train its own technologies. Can Anthropic prevent this? Anthropic, OpenAI and Google are sharing information they can all use to combat the practice, they said. But it can be difficult to stop. If Anthropic shuts down too many accounts, it may end up barring legitimate users. Even if U.S. law did bar illicit distillation, Tishler said, it would most likely have little effect on behavior in China. "So much of this conduct is happening outside the United States," she noted. "It would be very challenging to address it through a U.S. court." (The Times sued OpenAI and Microsoft in 2023, claiming copyright infringement of news content related to AI systems. The two companies have denied those claims.) What else can U.S. companies do? Anthropic called on Congress to pass legislation that would allow "deeper collaboration to combat distillation attacks, both between the U.S. government and leading frontier labs as well as between the frontier labs themselves." The company also said the U.S. government should extend its efforts to limit China's access to the specialized computer chips needed to train AI technologies. The world's most powerful chips are designed by U.S. companies, and the federal government has used export controls to stem the flow of those chips to China. It is difficult to do distillation without those chips. Alibaba declined to comment on Anthropic's letter to the two senators. Warren also declined to comment. Scott did not respond to a request for comment. Would a distillation crackdown have an impact? Many experts believe that a crackdown on Chinese distillation would have little effect and that distillation alone cannot build a top AI system as Z.ai did. Others believe that distillation will become less important as companies build systems, like GLM-5.2, that are designed to serve as AI agents. Training these agents -- digital assistants that can use other software to perform tasks -- is much harder to duplicate through distillation. Distillation "won't matter as much for the next era of AI," said Sara Hooker, CEO of Adaption, an AI research lab.

How China is ripping off cutting-edge AI from Anthropic, OpenAI -- and threatening US national security

Anthropic and OpenAI warn that China has been ripping off their cutting-edge AI to produce cheap, open-source chatbots -- a massive, unchecked technology heist that threatens not only the US's razor-thin lead in artificial intelligence but also its national security, according to experts. On June 24, San Francisco-based Anthropic -- headed by outspoken CEO Dario Amodei -- sent a letter to Congress directly accusing Alibaba of "brazen" AI theft through so-callled "distillation" -- a technique where an advanced AI model is used to train a less capable one without permission and at a fraction of the cost and time. That was just months after Sam Altman's OpenAI in February accused China-based DeepSeek of "ongoing efforts to free-ride" on its work. That same month, Google warned of surging "malicious activity" originating in China, Iran, North Korea and Russia. As The Post reported, these attacks have helped Chinese models to steal away US business customers by dangling rock-bottom prices for the increasingly costly "tokens" needed to use them. Six of the top 10 most-used AI models were developed by Chinese tech firms, including Z.AI, Minimax and DeepSeek -- all of which boast capabilities nearly as advanced as Anthropic's Claude or OpenAI's ChatGPT. "If today we say China is roughly 6-9 months behind us on frontier models, we think that if they were not able to distill or they were less effective, they'd probably be closer to something like 18-plus months behind," a source close to Anthropic told The Post. "That number of months makes a big, big difference." Anthropic -- whose powerful "Mythos" and "Fable" models were temporarily taken offline due to the White House's concerns they could be weaponized by China -- have regularly briefed Trump national security officials about distillation attacks, including as recently as this month, sources close to the company told The Post. "We have basically spoken to every part of the government about this," including the White House and Congress, one of the sources added. If the Chinese hacks aren't stopped, sources warn they could allow adversaries to erode America's global leadership on AI development - or even aid the spread of terrifying hacking or autonomous weapon capabilities. The Trump administration has identified distillation as a key challenge in the winner-takes-all race to develop advanced AI. In April, the White House's Office of Science and Technology published a memo accusing "foreign entities, principally based in China" of engaging in "deliberate, industrial-scale" theft campaigns. China's distillation attacks are the "ultimate form of industrial homework theft," according to Theresa Payton, who served as the White House's chief information officer under President George W. Bush. "It allows foreign adversaries to clone the smartest kid in the class for pennies on the dollar," Payton told The Post. "They effectively are bypassing United States chip bans by using our own multi-billion-dollar AI model to build their own." The distillation technique is a crucial strategy for China in part because its AI labs have been hamstrung by US export controls on the powerful computer chips needed to build advanced models, such as those sold by Nvidia. In its June 24 letter to the Senate Banking Committee, Anthropic alleged it had evidence that Alibaba employees illicitly generated 28.8 million outputs from its Claude chatbot using nearly 25,000 fraudulent accounts from April 22 through June 5 of this year. Soon after the letter surfaced, Alibaba banned its employees from using Anthropic's Claude model - an empty gesture, according to company sources, because Anthropic already bans China-based entities from using its AI models. The Post reached out to Alibaba for comment on Anthropic's allegations. Anthropic previously called out three other China-based AI labs in February - DeepSeek, Moonshot and Minimax - for using the same distillation tactic to improve their models. Meanwhile, OpenAI briefed the Congressional-Executive Commission on China and other Congressional staffers on China-linked misuse of AI in June, a company spokesperson said. The briefing included details on how China uses AI to conduct malicious influence operations and OpenAI's view that stronger policy tools are needed to hold bad actors accountable for distillation attacks. OpenAI also wants the NSA's AI Security Center to serve as a centralized hub for the US tech industry -- both AI giants and smaller startups -- to share details on distillation attacks and other common AI security threats, the spokesperson added. Distillation itself is a legitimate technique used in-house by AI labs to improve their own models. The tactic becomes "plagiarism" when a rival or foreign adversary uses a competitor's code to train their own without permission, according to Payton. In April, White House tech advisory Michael Kratsios said the administration would take a range of actions to protect US companies, including sharing intel when distillation attacks are detected, improving coordination with private companies to fight back and enacting new measures to "hold foreign actors accountable." The House Select Committee on China - which released a major report in April detailing China's "history of AI Chip Smuggling and Model Distillation" - said it is pushing for legislation to combat the threat. Potential options include the AI Overwatch Act, which would require affirmative government permission for any sale of advanced AI chips to "countries of concern." "China's effort to develop its own AI models is driven by theft, not innovation. This is a threat to our tech companies and our national security," Select Committee Chairman John Moolenaar said in a statement to The Post. "The CCP buys what it can and steals what it must, so it is vital for our government and our companies to prevent China's theft in the AI arms race. "In Congress, I will continue working to pass bills that support common-sense export controls and ensure our tech companies close cloud computing loopholes that China exploits," Moolenaar added. Part of the challenge for US officials that it's "hard to quantify how much of their performance gains are resultant from distillation versus bona fide technical innovation," according to Jared Dunnmon, a former technical director for AI at the Pentagon. Aside from the national security implications, the attacks represent a threat to the fragile business models of US AI giants and American AI leadership as a whole, Dunnmon added. "This is not necessarily because it gets China to the frontier and has better models than the best US ones," Dunnmon said. "It is because it helps them get close enough that Chinese firms can offer near-frontier capabilities for a fraction of the cost of US alternatives, meaning developers and firms around the world build on a Chinese AI software stack."