Anthropic calls Chinese AI distillation 'theft,' citing national security risks

A student model does not need a subscription, it needs question-and-answer pairs in bulk, and Anthropic's own detection heuristic sketches the volume: a distilling account asks thousands of prompts where an ordinary one asks dozens ^[16], call it a fortyfold signal ^[20], and if you take the top of the account range Klein attributes to Moonshot, a hundred thousand accounts at a thousand prompts each, the implied haul is on the order of a hundred million logged responses ^[14][19]. That is a training corpus, assembled by asking politely.

Who pays for the inference is the more telling question. Those accounts, per Klein, are stood up with compromised credentials and stolen card data bought on dark web marketplaces ^[14], so the compute behind the answers is billed to a cardholder who never asked for it, and the model developer manufactures its own competitor's dataset at its own gross margin. Or rather, the more interesting version: the queries are indistinguishable in kind from the ones a paying enterprise sends, which is why the mechanism resists a clean fix. Klein concedes as much, calling it hard to stop fully and worth slowing down ^[17].

Which is why the word choice matters. Theft ^[1] points at the April administration memo, which called distillation that undermines American research unacceptable and promised to explore a range of measures against foreign actors ^[6], rather than at a docket, because a contract remedy against an entity in a jurisdiction that will not enforce it prices at roughly zero. The counter-thesis deserves equal billing: this is moat maintenance from a five-year-old company valued near a trillion dollars and possibly listing in October ^[7], and expensive incumbents have always described cheap entrants unkindly, particularly one whose Kimi K3 is being picked up in Silicon Valley precisely for costing less and tailoring more easily ^[8]. What cuts against the cynical read is that OpenAI and Google have published their own distillation findings ^[11], and that the source concedes distillation can be lawful, which puts the accusation on the fraud rather than the technique ^[4].

This is probably wrong, but the enforceable version of this fight sits in the identity plumbing already built for sanctions, where Claude, Gemini and ChatGPT are restricted for Iran, Russia and North Korea ^[13], well ahead of anything intellectual property law can reach. Extend that to volume, and the practical remedy is verification and rate discipline at the API perimeter, which is a cost paid by every legitimate high-volume buyer to slow down a set of buyers who are not paying in the first place. Anthropic has so far chosen detection, bans and policy pressure over filing a complaint, and threat-intelligence headcount spent on account-level whack-a-mole ^[16] is headcount not spent anywhere else.

I would drop the thesis on two findings: pre-listing disclosures showing fraudulent traffic too small to move the margin, or a memo whose measures never attach to a named company ^[6]. Until then, a hundred million answers is a cheap way to buy a frontier model, and any gate has to make that expensive.