AI Distillation: Why Anthropic’s Model Moat Is Leaking

AI distillation has stopped being merely a technical problem. The tell is where frontier labs are increasingly fighting it: Washington and their terms of service, not model architecture alone. This week Anthropic’s chief executive asked policymakers to crack down on “industrial-scale distillation”. The reason the fight moved to policy is simple – the thing being copied leaks through the one surface a lab cannot close.

The 16-Million-Exchange Accusation

The dispute became concrete in February 2026. Anthropic said three Chinese developers – DeepSeek, MiniMax and Moonshot – generated more than 16 million exchanges with its Claude models using roughly 24,000 fraudulent accounts, in order to “illicitly extract” outputs and train competing systems; MiniMax alone drove over 13 million of those exchanges. Anthropic also published its own account of how it detects the pattern, and OpenAI has described similar activity against its models as “adversarial distillation”.

That set up this week’s escalation. On July 27, Anthropic CEO Dario Amodei said the company had never advocated banning open-weight models, but pressed for chip controls and government action against “industrial-scale distillation”; Anthropic and OpenAI are both pressing Washington to treat the practice as a policy matter. Microsoft’s Satya Nadella, from the other side of the table, called the position “ironic,” arguing that the same labs themselves train on public data under fair-use claims and on their own customers’ usage. “In consuming intelligence, you are creating intelligence,” he wrote in a mid-July post.

Microsoft, notably, sells the infrastructure either way.

How AI Distillation Leaks What Weights Protect

Distillation trains a small “student” model to imitate a large “teacher.” Some variants use the teacher’s internals – logits, intermediate representations – but API-based distillation can be performed on the teacher’s text outputs alone, with no access to its weights; that is the route a rival can walk. A lab can keep its weights secret, but it cannot withhold the outputs whose access forms the core of its API and subscription products. The revenue surface and the leak surface are the same surface.

That is why the response extends beyond engineering – Anthropic describes detection classifiers and access controls, and still asks for terms-of-service enforcement and export policy: any API that sells model answers exposes some training signal; technical controls can raise the cost of extraction, but they cannot eliminate that trade-off.

Separate from Anthropic’s allegation, DeepSeek‘s own R1 report provides public evidence of legitimate self-distillation – it does not establish that R1 was built from anyone’s outputs; it shows how reasoning data generated by R1 transfers benchmark performance to smaller Qwen- and Llama-based students, all open-sourced under an MIT license. The full R1 model has 671 billion parameters and scores 97.3% on the MATH-500 benchmark. Its distilled 7-billion-parameter student – built on an off-the-shelf Qwen base – scores 92.8% on the same test; the 70-billion Llama-based student scores 94.5%.

The report leaves the arithmetic implicit, so here it is. The 7B student lands within 4.5 percentage points of the teacher on MATH-500 (92.8 against 97.3) with roughly one ninety-sixth of the teacher’s total parameter count (calculated here from DeepSeek’s figures) – though R1 is a mixture-of-experts model that activates only around 37B parameters per token, so this is a parameter-count comparison, not an inference-cost one – the compute gap is far smaller than 96x.

The 70B student comes within 2.8 points with roughly a tenth of R1’s total parameter count – though as a dense model that activates everything per token, its inference-cost comparison against the MoE teacher is less straightforward. On this one mature, measurable benchmark, much of the score survives the transfer. The 7B student, in particular, should be substantially cheaper to serve than R1, while the economics of the dense 70B student are less obvious.

The Moat Is a Head Start, Not a Wall

The market already prices smaller models at a steep discount, although that spread does not by itself measure the economics of distillation. Providers sell the small-model tier at a steep discount to the flagship: per OpenAI’s price list as tracked by CloudZero in June 2026, GPT-5 listed at roughly $5.00 per million output tokens while GPT-5-nano listed near $0.40 – a spread of more than tenfold from a single vendor, though these prices move often.

OpenAI’s listed price for flagship output tokens fell from $60 per million at GPT-4’s March 2023 launch to about $5 on the June 2026 list – a decline of more than 90%, though the products and architectures are not directly equivalent. A lab’s pricing power is not attached to having a capability; it is attached to being the only one that has it. Once a capability is demonstrated on public tasks, the relevant question is how quickly a distilled model can approach the same score at a fraction of the cost.

If that holds, the moat is that lag – a head start measured in months – not a wall. One industry essay calls 2026 “the year of fine-tuned small models”: when smaller students preserve this much performance on stable tasks, serving economics favor shrinking the model rather than scaling it.

This claim applies only to demonstrated, measurable tasks. It copies a capability the teacher has already demonstrated on a measurable task; it cannot lift a capability the teacher never showed, and a distilled 7B model is not a frontier model across the board – it trails on the hardest, newest, longest-context work. So margin erodes on the installed frontier, the stable and benchmarkable workloads, while the moving frontier still commands a premium.

The metric worth tracking is the distillation lag itself: the months between a frontier capability shipping and an open or distilled model reaching within ~5 points of it on the same public benchmark. There is not yet a closed-frontier lag series, so one quarter is a threshold to test, not a compression trend already established; Anthropic’s own detection reports are the counter-signal to watch for whether policy enforcement actually slows the extraction.

A second judgment follows. As installed capabilities commoditize, more of the incremental value shifts from the teacher toward infrastructure operators. Infrastructure providers can monetize model substitution because frontier and distilled models alike still need deployment, inference and distribution. Their exposures differ – Microsoft is tied more closely to the frontier labs, while Groq, Together and Fireworks sit more directly on inference and serving – but each has ways to monetize inference and distribution even if frontier-model pricing weakens, which is exactly why Nadella can afford to needle the labs.

Enterprise software is the second beneficiary – a company that self-hosts a distilled small model for a stable, high-volume task may cut serving costs materially, although the result depends on utilization, hardware and operating overhead, which in turn pressures the pricing of AI features sold on top.

And inference silicon could shift with the workload: distilled models can run on cheaper inference-grade and increasingly on-device accelerators, which may move some demand from training-grade clusters toward the edge – a continuation of the on-device pressure already visible in the DRAM squeeze from on-device AI and the model pricing and benchmark economics reshaping how capability is sold.

The labs built a detector. Nobody built the enforcement.

The competitive response to this has taken a specific institutional shape, and its limits are written into that shape. OpenAI, Google and Anthropic now share threat intelligence on adversarial distillation through the Frontier Model Forum — rivals cooperating on the one problem none of them can solve alone, because the attack runs through the product each of them sells. Anthropic’s own count of suspicious exchanges traced to DeepSeek, Moonshot AI and MiniMax is what gave this article its opening number.

But the Forum is an industry nonprofit. It cannot subpoena, cannot fine, and cannot block. It can establish that a pattern of queries looks like extraction and tell its members so, which improves detection and leaves incentives untouched. A defender who can see the theft and cannot stop it has bought information, not protection — and information about a leak that keeps leaking is a running cost rather than a moat.

Statute is where the enforcement would have to come from, and it has started to appear. The first designations under the PAIP Act were made on 24 February 2026, and the drafting reaches past the labs doing the distilling: it covers entities providing “significant financial, material, or technological support” for the theft, which is language wide enough to catch commercial proxy services and API aggregators — the intermediaries that make bulk querying practical in the first place. Whether it is used that way is a different question from whether it could be. Separately, reporting has traced outputs from US frontier models into Chinese military research, which is the version of this story that moves it from a commercial dispute to an export-control one.

The through-line matters for the argument above. If a head start is the whole moat, its length is set by how fast a copy can be made, and every actor with an interest in shortening that lag is currently better funded than the machinery for lengthening it.

The distillation fight looks like a US-China security story, and in part it is. Underneath, it is an admission about unit economics: when the product you sell is the answer, the answer is also your competitor’s textbook, and no license clause changes the physics of that. The durable value is quietly migrating from owning the best model to owning the distribution and the compute the model runs on – which is the position Microsoft has been building toward, and the one a pure model lab cannot easily occupy. The working threshold is one fiscal quarter: if the distillation lag consistently falls below that, “frontier pricing” stops meaning “durable pricing.”

A lag is a measurable thing, and so is an enforcement action. Both leave records.

• A PAIP designation names an intermediary. The statute’s support language reaches proxy services and API aggregators, not only the labs training on the outputs. A designation against a reseller would show the enforcement is aimed at the plumbing that makes bulk extraction cheap. Designations that stay confined to named foreign labs leave the plumbing intact.
• The Forum publishes anything. Shared detection is currently a private channel between competitors. A published methodology, or a joint figure for extraction volume, would turn detection into something a buyer or regulator can check. Continued silence keeps it a cost centre for the members and nothing more.
• A frontier lab restricts its own output surface. Rate limits, output watermarking or tiered access on reasoning traces would be the first admission that the revenue surface and the leak surface have to be priced separately. It would also be the first move that costs the lab its own customers, which is why nobody has made it.
• The lag crosses a quarter, in public. No closed-frontier lag series exists yet. The moment anyone publishes one — capability shipped, date; open model within five points, date — this argument becomes arithmetic instead of inference, and the head start acquires a length.

Sources

• anthropic.com — Anthropic’s own account of detecting distillation attacks (detection classifiers, access controls, policy ask) (2026-02-23)
• arxiv.org — DeepSeek-R1 technical report: 671B model 97.3% MATH-500; distilled students (Qwen/Llama) scores; MIT license (2025-01-22)
• Institute for AI Policy and Strategy — Policy analysis: first PAIP Act designations made 24 February 2026; the statute reaches entities providing “significant financial, material, or technological support” for the theft, language wide enough to cover proxy services and API aggregators; detection without enforcement is unlikely to change adversary incentives (2026)
• axios.com — Amodei rejects open-weight ban, calls for crackdown on industrial-scale distillation and chip controls (2026-07-27)