The Distillation War: When Model Distillation Is Recast as IP Theft — The 2026 US-China Rules Conflict and Its Investment Implications

Verified (multi-source): Fable public July 1; K3 released July 16, Nasdaq -1.40% and Nvidia -2.2% the next day; Kimi paused new subscriptions July 20 amid a compute crunch (Reuters); on July 22 Kratsios accused Moonshot on X of building an internal platform for large-scale covert distillation of US models and of acquiring GB300 servers and accessing GB300s in Thailand, while Bessent declared 'open source is not open season on American IP'; on July 27 K3's full weights shipped, China's MOFCOM warned of countermeasures, and Amodei clarified Anthropic's stance. As of Aug 1: no sanctions, no Entity List designation, no verifiable public evidence. Reported (watch): BIS has opened an investigation; Bessent claims US-model 'watermarks' were found but showed no evidence; Bloomberg (July 31) says Kimi runs on a ~20,000-GPU cluster provisioned through Alibaba. Doubtful: only ~two weeks separate Fable's release from K3's — researchers question whether that window supports the distillation claim; Moonshot denies it, citing original architecture changes. This report renders no verdict.

Distillation — training a weaker model on a stronger model's outputs — is an industry-standard technique; Kratsios himself concedes 'legitimate distillation plays a vital role' in open innovation, hanging his accusation on 'industrial-scale, covert'. Legally it sits in a gray zone: copyrightability of model outputs is unsettled, and violating terms of service is a contract matter, not 'theft' in a criminal sense — recasting distillation as IP theft is a rule change, not a rule application. The July 24 industry letter revealed a telling convergence: 20-plus signatories opposed broad restrictions on distillation techniques while backing targeted legal remedies for 'unlawful extraction' — a remedy path Amodei explicitly endorsed even as he declined to sign. The consistency problem persists: Replit's CEO notes Thinking Machines Lab's open model Inkling was trained with help from Moonshot's Kimi 2.5 ('banning Chinese open models is as good as banning open models'), while Anthropic itself accused Alibaba's Qwen in June of the 'largest known distillation attack' on Claude (Nikkei). Accusation and usage run both ways; one-directional enforcement will keep facing consistency challenges.

Late July widened the gap between the two accusations. Distillation: proof depends on provider-side access logs and the counterparty's training records — nearly impossible to establish publicly. Bessent's 'watermarks' claim came with no technical detail, the White House released no evidence, and Anthropic's official response addressed policy stance without presenting K3-specific evidence. This track functions mainly as public pressure and negotiating leverage. Export controls, by contrast, come with mature tools and precedent: multiple US outlets report BIS has opened a GB300 case; the Thailand transshipment angle sits squarely in EAR extraterritoriality and diversion enforcement — Washington's most practiced terrain; and the Entity List has the full Huawei 2019 precedent — designation would cut Moonshot off from US chips, software and cloud. Pressure is already propagating through the supply chain: Jensen Huang reportedly met Commerce Secretary Lutnick on July 28, even as The Information reports Moonshot seeks more Blackwell compute for its next-gen K4. We maintain our call: if formal action comes, export controls land first.

The tail end of August bears out this report's central claim: the political redefinition of distillation as IP theft is still running ahead of any machinery to enforce it.

Confirmed (DeepSeek release notes; Investing.com, Aug 13): DeepSeek, the most-named target of Washington's accusations, moved its flagship V4-Pro to general availability with upgraded agent capabilities, adding half-price off-peak billing from Aug 16. Reported (Releasebot, Aug 21): an experimental vision model followed a week later. The accusations have not slowed its shipping cadence.

How close it sits to the US frontier is genuinely contested. Reported (Codersera citing Vals AI): 96.4% on SWE-bench Verified, second only to Claude Opus 5; BenchLM's own run put it at 80.6%. Neither figure is cross-verified. When evaluators cannot even agree on the gap, proving how much capability was "distilled away" is harder still — exactly the mismatch between political definition and technical fact this report describes.

On the policy side, ammunition keeps piling up while no trigger gets pulled. Confirmed (Sen. Hagerty's office; Nextgov, Aug 5): the BLADE Act would have Commerce impose export controls and Treasury levy financial sanctions on designated distillation entities. Yet DeepSeek remains off the Entity List, a listing earlier reports said the White House deliberately shelved. The containment toolkit is migrating from copyright rhetoric toward export controls. Watch that variable next.

Verified (VOA Chinese, September 12, 2026): On September 10 Anthropic published a report naming operators linked to Alibaba, Moonshot AI, DeepSeek, Xiaomi and other Chinese companies for extracting Claude outputs at scale for training. The report gives account-level figures: Alibaba-linked operators used more than 3,500 fake accounts and made over 151 million exchanges between May and July, peaking near 3 million a day; about 23 million Moonshot and 12.1 million DeepSeek user requests were forwarded to Claude. These are the first comparable numbers since the White House accusation of July 22.

Reported (Dealroom, September 11, 2026; runtimewire, September 10, 2026): Anthropic alleges that Moonshot silently forwarded some Kimi user requests to Claude and displayed Claude's answers as Kimi's own; the report covers December 2025 to August 2026. runtimewire says most of the 5,380 accounts tied to the Moonshot traffic appeared to be in Singapore and Japan, that the routing allegation itself covers nearly 300,000 requests sent mainly to an Opus model, and that the available record does not tie the traffic to K3 or any particular Kimi release. The Moonshot figures differ across reports and are not combined here. As of September 11 Moonshot had made no public response; Anthropic's launch post drew about 30 million impressions in roughly a day.

Verified (VOA Chinese, September 12, 2026): On September 9 the Ministry of Commerce said it "firmly opposes" the US government's joint report of September 8, calling the accusations groundless in fact and in law; on September 11 the Ministry of Foreign Affairs said it was "not aware" of the Anthropic report and opposed distortion and smearing of China. None of the reports cited here mentions an Entity List designation of Moonshot by BIS or a published conclusion of the GB300 export-control inquiry.

Effect on this report's conclusions: Section three's judgment that "distillation is hard to prove" needs revision. The party carrying the evidence has changed from a government to a model developer, and the evidence has changed from verbal accusation to account counts, request counts and proxy locations. That is a material shift. Three caveats remain: the numbers come from the accuser's own logs, without third-party audit or judicial finding; the Moonshot routing allegation mainly concerns an Opus model and cannot be tied to K3, which is a different matter from the original charge of distilling Fable into K3 within 15 days; Moonshot's silence is not an admission, and 30 million impressions do not make a claim true. The "trigger not pulled" judgment is reinforced: a month on, the reports cited here show no US sanctions or Entity List action, Beijing's response is denial rather than cooperation with an inquiry, and the conflict remains at the level of statements.

Per company disclosure (OpenAI, as reported by CNBC, September 30, 2026): OpenAI said it identified and disrupted a coordinated campaign to extract protected reasoning from its models, attributing a core cluster of the activity to individuals associated with Moonshot AI. By OpenAI's account, the activity began in early July, later surged to 16,000 requests from more than 4,000 users over two days, ultimately spanned more than 15,000 users, and was fully disrupted by July 28. The operators did not breach its encryption, databases or stored user conversations. OpenAI said it was unclear whether all operators were tied to a single actor and that it shared its findings through the Frontier Model Forum and government information-sharing channels. Moonshot did not immediately respond to CNBC. CNBC also noted that weeks earlier Anthropic had accused Chinese developers including Moonshot and Alibaba of using its model to train their own systems.

Verified (Al Jazeera, CBS News and The Washington Post, September 26, 2026; Beijing News relaying Xinhua, September 28, 2026): After the Trump-Xi summit in Washington, the White House said the two sides agreed to set up a bilateral communication channel for AI incidents. The other summit outcomes listed by Al Jazeera centered on extending the trade truce and similar items, with no mention of distillation or chip export controls. On September 28 Foreign Ministry spokesperson Guo Jiakun said China is willing to keep communicating with the US through channels such as intergovernmental AI dialogue.

Impact on this report's thesis: both facts are consistent with our layered view that distillation is hard to prove while export controls are enforceable. The US AI companies publicly accusing Moonshot have grown from Anthropic alone to two, but the evidence is still company-reported account and request counts, with no finding from a regulator or court, and OpenAI itself says it cannot confirm that all operators were a single actor. On policy, the summit's public AI outcome was a communication channel rather than penalties, so our view that the ammunition is loaded but the trigger has not been pulled still holds. The thresholds for changing it remain two: a Commerce Department entity-list designation of Moonshot, or a published conclusion to the GB300 export-control probe. The two leaders are next due to meet at the APEC summit in Shenzhen in November.