“Block China’s Unauthorised Copying”: Rival U.S. AI Titans Form Unusual ‘United Front’

China accused of exploiting the machine-learning technique of ‘distillation’
Securing vast troves of data by inducing millions of conversations
“Undermining the price competitiveness of U.S. AI and threatening national security”

Major U.S. artificial intelligence companies have launched an unusual coordinated response to attempts by Chinese rivals to replicate their models. The move reflects rising concern that technologies capable of reproducing high-performance models at low cost are emerging as a dual threat to industrial competitiveness and national security. In particular, as evidence mounts that Chinese firms have been extracting core capabilities through massive query volumes and account manipulation, tensions over AI technology leakage are spreading beyond commercial rivalry into the realms of technological sovereignty and military and intelligence systems.

OpenAI, Google, Anthropic Step Up Countermeasures Through Information Sharing

According to Bloomberg on the 6th local time, OpenAI, Anthropic and Google are sharing information through the Frontier Model Forum to detect attempts at “adversarial distillation” — extracting outputs from U.S. AI models to build comparable systems. The collaboration is unusual in that direct competitors have moved to mount a joint response. U.S. AI companies are particularly concerned that the proliferation of low-cost products modelled on their systems, especially in China, could erode price competitiveness and drive customer attrition, while also escalating into a national security risk.

Distillation is a technique for building a new model with comparable performance at lower cost by leveraging an existing AI model. The concept was first introduced in a 2015 paper by Geoffrey Hinton, widely known as one of the “godfathers of AI.” At the time, researchers had improved performance through the use of “ensemble” techniques that combined multiple models, but running those models simultaneously was highly inefficient. Hinton and his co-authors concluded that if the knowledge embedded in an ensemble could be transferred into a single model, the process would be far more efficient.

In practice, the application of distillation techniques has been shown to cut graphics processing unit (GPU) usage by as much as 90%. It also offers the advantages of reducing response latency and enabling operation in edge and mobile environments. That said, while the use of distillation by a company for internal efficiency gains, such as slimming down its own models, is generally accepted, controversy arises when a third party uses another company’s model outputs without authorisation to build a similar system. OpenAI states in its terms of service that users may not use data generated by its systems to develop technologies that compete in the same market.

OpenAI told Bloomberg that it is participating in the sharing of information related to adversarial distillation through the Frontier Model Forum. It also referred to a recent memo sent to the U.S. House Select Committee on China, in which it criticised Chinese company DeepSeek for attempting to “free-ride” on capabilities developed by OpenAI and other leading U.S. AI laboratories. The U.S. government estimates that unauthorised distillation is inflicting annual losses worth billions of dollars on Silicon Valley companies.

AI Technology Replicated Through 16 Million Acts of Theft

The distillation controversy began to intensify across the industry early last year, when DeepSeek unveiled its R1 reasoning model. At the time, R1 sent shockwaves through the global AI market and heightened vigilance among U.S. companies. A startup that had remained largely under wraps demonstrated performance on par with products from U.S. big tech groups, while requiring only a fraction of the computing resources and cost. At the centre of that development was the distillation technique. Microsoft and OpenAI later launched an investigation into whether DeepSeek had improperly extracted data from their models, while OpenAI reported to Congress that DeepSeek was using distillation to develop successor models.

John Moolenaar, the Republican chairman of the House China Committee, denounced the practice, saying, “Steal, copy and erase — that is the Chinese Communist Party’s standard playbook,” adding that “Chinese companies will continue extracting U.S. AI models and exploiting them for their own benefit.” David Sacks, the White House’s science and technology adviser, had also said in a media interview last year that there was evidence DeepSeek had carried out unauthorised extraction from U.S. AI models, including those of OpenAI.

In February, Anthropic detected a large-scale distillation attempt aimed at extracting the core capabilities of its large language model, Claude, without authorisation. According to Anthropic, Chinese AI companies including DeepSeek, Moonshot AI and MiniMax mobilised roughly 24,000 fraudulent accounts and generated more than 16 million queries in an organised effort to systematically extract Claude’s differentiated capabilities. Anthropic said the activity displayed a repetitive, large-scale and targeted structure that was clearly distinguishable from normal usage patterns.

All three companies concentrated on Claude’s core functions, including reasoning, tool use and coding, collecting data through repetitive and large-scale query patterns. DeepSeek attempted to induce Claude to describe its internal reasoning process step by step in order to secure large volumes of chain-of-thought data. Moonshot AI sought to extract tool-use, computer vision and data-analysis functions through hundreds of forged accounts. MiniMax was found to have sent more than 13 million requests to secure coding and fine-tuning data needed to train its own model.

Spread of Models Stripped of Safeguards Could Destabilise National Security and Export-Control Regimes

U.S. AI companies are deeply concerned that models produced through distillation may fail to fully inherit the safety guardrails embedded in the original systems. U.S. firms design and tune their models to block high-risk uses, including the design of biological and chemical weapons, malicious cyber activity, and large-scale fraud and disinformation operations. Unauthorised extracted models, however, could weaken those layers of protection.

They also warned that if Chinese AI firms integrate capabilities obtained in this way into military, intelligence and surveillance systems, the result could be the advancement of offensive cyber operations and large-scale surveillance and censorship architectures. They further pointed out that if distilled models trained by copying the performance of other models are released as open source, dangerous capabilities could spread widely beyond any meaningful sphere of control.

Beyond distillation, the “open weight” approach mainly adopted by Chinese AI companies is also drawing controversy. Open weight is not fully open source, but refers to a model in which the adjusted numerical parameters acquired during training are disclosed so developers can customise it. DeepSeek’s R1 and Alibaba’s Qwen are representative examples.

That approach is in direct conflict with the closed-model strategy pursued by U.S. companies. American firms keep their models private and allow access only through application programming interfaces, or APIs. An API is a gateway that enables outside developers to connect to and use a specific program or service, with charges imposed according to usage. For U.S. companies that must recoup the enormous cost of infrastructure investment, including data centres, this leaves them at an inherent disadvantage on price competitiveness.