{"slug": "can-six-chinese-firms-really-just-distill-their-way-to-a-frontier-model", "title": "Can six Chinese firms really just distill their way to a frontier model?", "summary": "The NSA, CISA, and FBI have accused six Chinese firms — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of running \"industrial-scale\" distillation attacks on US models including Claude, GPT, Gemini, and Grok since late 2024. The article questions the \"attack\" framing, noting distillation is standard machine learning and that training a frontier model from scratch can cost upwards of $100 million in compute alone, while distillation may cut the data collection phase by 60-80% but still leaves training runs costing tens of millions. It argues the real risk is a quality ceiling, since a distilled model almost never surpasses its teacher.", "body_md": "# Can six Chinese firms really just distill their way to a frontier model?\n\nThe NSA, CISA, and FBI just claimed that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have been running \"industrial-scale\" distillation attacks on US models like [Claude](/en/tags/claude/), GPT, Gemini, and Grok since late 2024. The logic is simple: if you use a massive teacher model to generate high-quality synthetic data for a smaller student model, you slash your training costs and time. But calling it an \"attack\" feels like a stretch unless they're bypassing API rate limits or ignoring Terms of Service (ToS) on a massive scale.\n\n## How distillation actually works in practice\n\nDistillation isn't some secret weapon; it's standard ML. You take a frontier model (the teacher), feed it a million prompts, and use its outputs to train a smaller model (the student). If these six companies are doing this at scale, they aren't just \"copying\"—they're optimizing.\n\nThe real technical question is how they're doing it without getting their API keys revoked. To distill a model that competes with GPT-4o, you need billions of tokens of high-quality synthetic data. If you try to pull that through a standard OpenAI or Anthropic API, you'll hit rate limits or trigger \"unusual activity\" flags if your patterns are too robotic. I suspect they're using massive proxy farms to rotate IP addresses and accounts to avoid detection.\n\n## Why the \"industrial scale\" claim is debatable\n\nThe US agencies argue this saves \"billions\" in development. While synthetic data reduces the need for human-labeled data, it doesn't replace the need for massive compute clusters. You still need thousands of H100s (or whatever substitutes they're using given the export bans) to actually train the student model on that distilled data.\n\nIf you're using a teacher model to generate a dataset, you run into the \"model collapse\" problem. If the student only learns from the teacher's synthetic output and never sees real-world, organic data, it starts to hallucinate in a very specific, repetitive way. To avoid this, you need a mix of synthetic and organic data. The claim that they're just \"copying\" ignores the immense engineering effort required to filter that synthetic data so the student doesn't just become a shallow mirror of the teacher.\n\n## The cost of \"shortcut\" development\n\nLet's look at the numbers. Training a frontier model from scratch can cost upwards of $100 million in compute alone. If these firms are using distillation, they might reduce the data collection phase by 60-80%, but the actual training run still costs tens of millions.\n\nThe risk here isn't just \"copying\"; it's the quality ceiling. A distilled model almost never surpasses its teacher. If [DeepSeek](/en/tags/deepseek/) or Moonshot are relying solely on this, they'll hit a performance plateau. You can't \"distill\" a breakthrough in reasoning; you can only distill the *appearance* of reasoning.\n\n## Is this actually an \"attack\"?\n\nMost of these companies are likely just using the APIs as intended, perhaps ignoring the \"do not use our output to train competing models\" clause in the ToS. In the AI world, that's not a cyberattack; it's a business strategy. Unless the NSA has evidence of actual system breaches (SQL injections, unauthorized server access), calling it an \"attack\" sounds more like geopolitical positioning than a technical diagnosis.\n\nIf I were building a model today, I'd distill from every single available frontier model to create a diverse synthetic set. It's the only way to catch up quickly. The real win isn't the copying—it's the cleaning and curation of that data.\n\n[Next Prime Video is finally tackling the dubbing uncanny valley with lip-syncing AI →](/en/threads/9115/)\n\n## All Replies （3）\n\nI'm curious if this even works. I tried prompting Claude for its system prompt via API 4.0 and got nothing.\n\nI want to try this tonight. I managed to leak a few internal patterns using the 3.5 API, but maybe PyTorch...\n\nI'm intrigued by the scale. Does this imply they're using synthetic data pipelines or just raw API scraping with something like LangChain?", "url": "https://wpnews.pro/news/can-six-chinese-firms-really-just-distill-their-way-to-a-frontier-model", "canonical_source": "https://promptcube3.com/en/threads/9168/", "published_at": "2026-09-10 18:38:07+00:00", "updated_at": "2026-09-10 19:07:43.209759+00:00", "lang": "en", "topics": ["artificial-intelligence", "large-language-models", "ai-policy", "ai-safety", "ai-research"], "entities": ["NSA", "CISA", "FBI", "DeepSeek", "Moonshot AI", "Alibaba", "MiniMax", "StepFun"], "alternates": {"html": "https://wpnews.pro/news/can-six-chinese-firms-really-just-distill-their-way-to-a-frontier-model", "markdown": "https://wpnews.pro/news/can-six-chinese-firms-really-just-distill-their-way-to-a-frontier-model.md", "text": "https://wpnews.pro/news/can-six-chinese-firms-really-just-distill-their-way-to-a-frontier-model.txt", "jsonld": "https://wpnews.pro/news/can-six-chinese-firms-really-just-distill-their-way-to-a-frontier-model.jsonld"}}