Caught Distilling from Claude?

A fresh wave of allegations claims Chinese AI labs are running large-scale “distillation attacks” to copy capabilities from Claude—using fleets of fake accounts to repeatedly query the model with near-identical prompts. Anthropic’s report, which focuses on detecting and preventing distillation, alleges 24,000 fake accounts generated 16 million exchanges aimed at extracting Claude’s strengths in reasoning, tool use, and coding. The accusation matters because it suggests a practical pathway for competitors to convert proprietary model behavior into trainable signals, potentially accelerating how quickly new models close the gap with frontier systems.

The timing is a central point of scrutiny. The claims surface just as multiple labs are releasing new models and as DeepSeek appears poised for its next major release. The transcript also links the broader moment to earlier market shock tied to DeepSeek’s emergence, arguing that the current burst of accusations may be more than coincidence—especially since the targeted labs named in Anthropic’s write-up (DeepSeek, Moonshot AI, and Miniax) are also raising their own capabilities in areas like coding and agentic workflows.

Anthropic’s breakdown attributes only 150,000 of the 16 million exchanges to DeepSeek, but frames DeepSeek’s approach as more “surgical.” The alleged goal is to extract reasoning abilities across tasks and to use Claude as a reward model for reinforcement learning—an “LLM-as-a-judge” style setup where outputs are graded against rubric-like criteria. The report also alleges attempts to learn Claude’s refusal behavior by generating “censorship-safe alternatives” to policy-sensitive prompts, effectively probing how the model handles boundary conditions.

Moonshot AI is accused of more than 3.4 million exchanges focused on general capabilities: reasoning, tool use, coding, data analysis, computer-use agent development, and computer vision. Miniax is accused of the largest share—over 13 million exchanges—again with emphasis on tool use, orchestration, and agentic coding. The transcript notes skepticism about targeting computer vision specifically, pointing out that Gemini models (and to a lesser extent GPT-family models) have tended to perform strongly in that area.

Beyond the distillation claims, the transcript highlights a parallel controversy: accusations that Anthropic itself scraped copyrighted books at scale. Elon Musk is mentioned as criticizing Anthropic for training on large volumes of books and for paying more than $1.5 billion to settle a copyright dispute. It also references a complex set of actions around books—buying physical copies, scanning them, and destroying the originals—to support a “one copy” argument. That backdrop fuels a broader debate about whether model outputs are copyrightable in a way that limits downstream training.

Finally, the transcript pivots to what distillation actually is, tracing it to a classic deep learning paper associated with Geoffrey Hinton and colleagues. Distillation typically trains a smaller model to imitate a larger one, often by learning from outputs or from logits (the full probability distribution over next tokens), not just the final predicted token. The transcript suggests that today’s best models may often be unavailable publicly, with smaller “flash” or “mini” models serving as distilled versions—making it harder to verify who distills whom. In that uncertainty, the accusations may recur, but the underlying question remains unresolved: whether scraping and training on proprietary model behavior (or outputs) is fair game, or a form of misappropriation.