Chinese AI Labs Accused of Harvesting US Model Outputs to Skip Training Costs

The Allegation

A joint advisory issued last month by the National Security Agency, FBI, and Cybersecurity and Infrastructure Security Agency landed with unusual specificity: Chinese artificial intelligence developers have been systematically extracting capabilities from US frontier models to reduce their own computing, electricity, and training expenses. Days later, Anthropic echoed the claim, stating that usage patterns consistent with knowledge distillation had been detected on its Claude platform, originating from entities it believes are based in China.

The accusation is not that Chinese labs are stealing code or weights. Instead, the allegation centres on a technique known as model distillation, in which a smaller, cheaper model is trained to mimic the outputs of a more capable system. By querying a frontier model millions of times and feeding the responses into their own training pipeline, developers can replicate much of the original's performance without the compute budget that built it. If true, the practice would represent a workaround to both US export controls on high-end chips and the capital intensity of training large language models from scratch.

At Opentechwire, we have tracked distillation as a standard optimisation method across the industry. What distinguishes the current allegations is scale, intent, and geopolitical context. The question is whether this constitutes research, industrial espionage, or simply rational arbitrage in an environment where API access is easier to obtain than H100 clusters.

How Distillation Works, and Why It Matters

Knowledge distillation is a well-documented technique in machine learning research. A student model learns to approximate a teacher model by training on the teacher's outputs rather than on raw data. The method is efficient: it transfers learned representations without requiring access to the original training corpus or the computational resources that produced the teacher.

In commercial settings, distillation is routine. Developers use it to compress models for deployment on edge devices, to reduce inference costs, or to build domain-specific variants. Anthropic itself has published research on the topic. The technique becomes contentious when the teacher model is proprietary, the student model is trained by a competitor, and the scale of querying suggests systematic extraction rather than exploratory use.

According to the joint advisory, Chinese entities have been observed making API calls in volumes and patterns inconsistent with normal application use. The agencies did not name specific companies, but the advisory noted that the activity often involved rotating accounts, obfuscated billing details, and query structures designed to probe model boundaries. Anthropic's statement, while similarly vague on attribution, pointed to usage that clustered around specific times of day and exhibited behaviour consistent with automated data collection.

The technical threshold for distillation is low. A well-funded lab can query a frontier model tens of millions of times for a few hundred thousand dollars, then use those outputs to fine-tune an open-weight model or train a proprietary one. The result is a system that performs comparably on benchmarks but cost a fraction to produce. For Chinese labs operating under US chip export restrictions, the economics are compelling.

The Export Control Context

The allegations arrive in the middle of a multi-year US effort to restrict China's access to advanced semiconductors and the AI capabilities they enable. Since 2022, the Commerce Department has imposed successive rounds of controls on chips used for AI training, targeting Nvidia's A100 and H100 lines and, more recently, cutting off sales of any chip capable of dense matrix operations above certain thresholds.

The policy logic is straightforward: if Chinese labs cannot buy the hardware to train frontier models, they cannot build systems that rival or exceed US capabilities. But the logic assumes that training is the only path to capability. Distillation offers an alternative. If a Chinese developer can access a US model through an API, the export control on chips becomes less binding. The bottleneck shifts from hardware to data extraction.

This is not lost on policymakers. The joint advisory explicitly framed distillation as a circumvention tactic, noting that it allows adversaries to "leapfrog compute constraints." The implication is that API access, which has largely escaped regulatory scrutiny, may need to be treated as a controlled technology in its own right.

Anthropic's public statement is significant because it comes from a company that has positioned itself as a safety-focused lab willing to engage with regulators. By confirming that it has observed suspicious activity, Anthropic lends credibility to the government's claims and signals that the issue is not hypothetical. The company did not say whether it has blocked the accounts in question, nor whether it plans to implement new verification measures for high-volume users.

What Chinese Labs Say, and Do Not Say

No major Chinese AI company has directly addressed the allegations. Alibaba Cloud, Baidu, and ByteDance, all of which operate large language models, declined to comment when asked by Opentechwire. Smaller labs have similarly stayed silent.

The silence is not necessarily evidence. Chinese companies operating in the AI sector face intense scrutiny both domestically and internationally. Any public acknowledgment of distillation practices, even if framed as legitimate research, risks triggering sanctions, platform bans, or domestic political fallout. At the same time, the absence of denial leaves the allegations uncontested in the international discourse.

What is clear is that Chinese labs have made rapid progress in recent quarters. Models from DeepSeek, Zhipu AI, and MiniMax have approached or matched GPT-4-class performance on certain benchmarks, despite those companies operating with far smaller disclosed compute budgets than OpenAI or Google. Some of that progress is attributable to algorithmic efficiency, open-weight foundation models, and aggressive fine-tuning. But the speed of convergence has raised questions, particularly among researchers who understand the resource intensity of frontier training.

One possibility is that Chinese labs are using a hybrid approach: training smaller base models on domestic hardware, then augmenting them with distilled knowledge from US systems accessed through third-party channels. This would allow them to claim indigenous development while still benefiting from the capital and compute that went into the original models. The practice would be difficult to detect from the outside, since the final model weights would not obviously reveal their training provenance.

The Enforceability Problem

Even if the allegations are accurate, enforcement is non-trivial. API providers can monitor for unusual query patterns, but determined actors can distribute their activity across many accounts, use proxy billing, and throttle requests to stay below detection thresholds. Rate limits help, but they also constrain legitimate high-volume users, including enterprises and research institutions.

Anthropic, OpenAI, and Google all maintain acceptable-use policies that prohibit using their models to train competing systems. Violations can result in account suspension. But proving that a given user is conducting distillation, rather than simply running a high-traffic application, requires forensic analysis of query content, timing, and downstream model behaviour. Few platforms have the visibility or legal authority to audit what happens to the data after it leaves their servers.

The US government has more tools. It can sanction entities, restrict API access through Commerce Department rules, or pressure cloud providers to implement know-your-customer requirements for AI services. But each of these measures has costs. Sanctions require attribution, which intelligence agencies may be reluctant to provide in public. API restrictions risk fragmenting the global AI ecosystem and pushing Chinese developers further toward self-sufficiency. And know-your-customer rules add friction to a market that has thrived on open access.

There is also the question of reciprocity. If the US restricts API access to Chinese users, other countries may follow suit, reducing the global reach of American models and creating an opening for regional competitors. The result could be a more balkanised AI landscape, with distinct technology stacks in different jurisdictions.

What Comes Next

The immediate effect of the allegations is likely to be tighter scrutiny of API usage, both by platform providers and by regulators. Anthropic's statement suggests that the company is already reviewing its monitoring systems. OpenAI and Google have not commented, but both have compliance teams focused on export control and dual-use technology.

In the longer term, the issue may force a reckoning over what constitutes controllable AI technology. If the goal of US policy is to maintain a lead in frontier capabilities, restricting chip exports is necessary but not sufficient. Distillation, fine-tuning, and other post-training techniques allow capabilities to propagate beyond the original training environment. That raises uncomfortable questions about how much control any developer can exert over a model once it is deployed.

For Chinese labs, the path forward is narrower. If API access tightens, they will need to rely more heavily on open-weight models, domestic chip supply, and algorithmic innovation. That may slow their progress, but it is unlikely to halt it. The incentives to close the capability gap remain strong, and the technical methods for doing so, distillation included, are well understood.

The broader risk is that the distillation controversy accelerates the decoupling of AI ecosystems. If US models become inaccessible to Chinese users, and Chinese models remain under export scrutiny, the result is two parallel technology stacks with limited interoperability. That outcome may serve national security objectives in Washington and Beijing, but it complicates everything else, from research collaboration to global standards to the deployment of AI in multinational enterprises.

At Opentechwire, we see this as a case study in the limits of technology export controls in an era of API-driven distribution. The tools that make AI accessible also make it harder to contain. The question is not whether distillation is happening, it is whether anyone can stop it without breaking the open architecture that has driven the last five years of progress.