Jeff Dean, head of artificial intelligence at Google LLC, speaks during a Google AI event in San Francisco, California, U.S., on Tuesday, Jan. 28, 2020.
David Paul Morris | Bloomberg | Getty Images
Earlier this year, Google AI lead Jeff Dean, on a podcast, discussed a concept that, at the time, was hardly spoken about outside of wonky tech circles: distillation.
In talking about the development of Google’s AI models, Dean said that he and colleagues discovered artificial intelligence distillation techniques because Google was looking to improve performance on its systems without relying on one large image recognition model.
“Through distillation, which is a key technique for making the smaller models more capable, you have to have the frontier model in order to then distill it into your smaller model,” Dean said in February.
Five months later, distillation has suddenly become a hot-button topic from Silicon Valley to Washington, D.C., as techies and lawmakers debate whether the practice is turning into a national security threat and enabling China to catch the U.S. in the high-stakes AI race. Concern bubbled up late last week after Chinese lab Moonshot AI released Kimi K3, and users quickly found it to be competitive with the best commercially available AI from Anthropic and OpenAI.
Unlike the leading U.S. AI companies, which sell access to proprietary models, Moonshot and other Chinese labs are offering so-called open-weight models that allow users to download the technology, tweak it and run it wherever they want.
Some government officials attribute Moonshot’s ability to catch up so quickly to distillation, describing it as theft of American intellectual property, specifically by incorporating Anthropic’s frontier Fable model.
“We have information that Moonshot AI distilled Anthropic’s Fable for the development of its K3 model,” White House advisor Michael Kratsios posted on X on Wednesday. “To do this they developed a sophisticated internal platform to conduct large scale distillation against U.S. models, allowing them to quickly switch between multiple methods of access to avoid detection.”
At a high level, distillation refers to the use of answers from a chatbot or work product from an advanced AI model to train another model. The practice is controversial because, depending on how it’s used, it can allow a model developer to create a competitive offering by simply using the output from companies that have invested many millions or billions of dollars developing the most sophisticated training technology.
“It’s almost like someone went to the lectures, read the textbook, and did all the hard work of doing the homework,” said Pukar Hamal, founder of AI security firm SecurityPal. “Then some other student is like, ‘Hey, I didn’t do that. Can I just copy your work?'”
Whether it was Kratsios’ post or something else, the biggest tech heavyweights on the planet came together on Friday in what might be unprecedented fashion to make their position clear. After a series of social media posts throughout the week, tech giants Nvidia, Microsoft, Meta, Palantir joined with more than 20 other companies to release a letter urging policymakers to avoid “premature restrictions” on open-weight AI models that would “stifle competition or drive innovation overseas.”
“Distillation, or the practice of using one model’s outputs to help train or improve another, is a widely used technique for model improvement, evolution, and validation,” they wrote.
Complicating the China problem
The emergence of distillation presents a conundrum to U.S. policy makers, who have long been concerned about Chinese technology in terms of both IP theft and national security issues.
Colin Shea-Blymyer, a research fellow at Georgetown’s Center for Security and Emerging Technology, said the U.S. government is trying to figure out its position.
The government could argue that Chinese and Russian companies “have used the outputs of hardworking American models to make themselves more performant, and so they have an unfair advantage there,” Shea-Blymyer said.
Box CEO Aaron Levie was one of the signatories of Friday’s letter. Levie said in an interview that to stay competitive, U.S. companies need to be able to access the best technology, no matter where it’s developed.
“Generally the arc is going to be that the more innovation that there is, whether that’s from the U.S. or China or otherwise, you should expect more AI progress, and generally it’ll bend toward being even lower cost and more efficient over time,” Levie said.
Although much of the current discourse centers on Chinese open-weight AI models like Kimi K3, many companies have incorporated the distillation technique when creating their own models, said Shashi Bellamkonda, research director at Info-Tech Research Group. Nvidia, for instance, used distillation as part of the training process for its Llama Nemotron series of models, as detailed in an accompanying research paper.
“It is a legitimate and a very valuable technique to train a smaller, cheaper model on outputs of a larger model, and is practiced all the time,” Bellamkonda said.
Dario Amodei, co-founder and chief executive officer of Anthropic, during an interview on “The Circuit with Emily Chang” at Anthropic’s headquarters in San Francisco, California, US, on Thursday, April 30, 2026.
Jason Henry | Bloomberg | Getty Images
However, Anthropic has a different view, because the company sees how its models are being used and has a burgeoning business to protect. In February, the company said its Claude capabilities were being distilled on an “industrial scale” by China’s DeepSeek, Moonshot, and MiniMax, which used about 24,000 fake accounts, generating 16 million exchanges.
Anthropic, which is valued at close to $1 trillion and has aspirations of going public in the near future, said stopping illicit distillation was a matter of national security.
“Anthropic and other US companies build systems that prevent state and non-state actors from using AI to, for example, develop bioweapons or carry out malicious cyber activities,” the company said in its February post. And stopping it requires “rapid, coordinated action among industry players, policymakers, and the global AI community.”
OpenAI and Anthropic are banning distilling in their terms of service. Bellamkonda said they’re essentially suggesting that using their larger models without authorization represents potential IP theft.
But with AI costs skyrocketing, companies will do whatever it takes to drive efficiency.
Hamal said he would have no problem using Chinese open-weight models like Kimi K3 at SecurityPal, which automates security assessments using AI. He says it could save them a lot of money.
“We would make sure that there’s no nefarious backdoors in the code,” Hamal said. “But hosting it on our own infrastructure after we’ve done an assessment, why not?”
One big problem for Anthropic and OpenAI as they try to make their case about IP theft is that both companies have relied on other sources of content to build their models, and have been sued for doing so.
Max Pritt, an attorney for Boies Schiller Flexner who represents book authors in copyright litigation against AI firms, said the government is in the same boat.
“The administration, at least publicly, has focused its efforts on the protection of technology companies’ intellectual property, while remaining silent in large part about creators and individuals’ intellectual property that was used without authorization,” Pritt said.
WATCH: China’s AI firms are finding ways to monetize even as their models remain open
