The Distillation War: When Model Distillation Is Recast as IP Theft — The 2026 US-China Rules Conflict and Its Investment Implications

Verified (multi-source): Fable public July 1; K3 released July 16, Nasdaq -1.40% and Nvidia -2.2% the next day; Kimi paused new subscriptions July 20 amid a compute crunch (Reuters); on July 22 Kratsios accused Moonshot on X of building an internal platform for large-scale covert distillation of US models and of acquiring GB300 servers and accessing GB300s in Thailand, while Bessent declared 'open source is not open season on American IP'; on July 27 K3's full weights shipped, China's MOFCOM warned of countermeasures, and Amodei clarified Anthropic's stance. As of Aug 1: no sanctions, no Entity List designation, no verifiable public evidence. Reported (watch): BIS has opened an investigation; Bessent claims US-model 'watermarks' were found but showed no evidence; Bloomberg (July 31) says Kimi runs on a ~20,000-GPU cluster provisioned through Alibaba. Doubtful: only ~two weeks separate Fable's release from K3's — researchers question whether that window supports the distillation claim; Moonshot denies it, citing original architecture changes. This report renders no verdict.

Distillation — training a weaker model on a stronger model's outputs — is an industry-standard technique; Kratsios himself concedes 'legitimate distillation plays a vital role' in open innovation, hanging his accusation on 'industrial-scale, covert'. Legally it sits in a gray zone: copyrightability of model outputs is unsettled, and violating terms of service is a contract matter, not 'theft' in a criminal sense — recasting distillation as IP theft is a rule change, not a rule application. The July 24 industry letter revealed a telling convergence: 20-plus signatories opposed broad restrictions on distillation techniques while backing targeted legal remedies for 'unlawful extraction' — a remedy path Amodei explicitly endorsed even as he declined to sign. The consistency problem persists: Replit's CEO notes Thinking Machines Lab's open model Inkling was trained with help from Moonshot's Kimi 2.5 ('banning Chinese open models is as good as banning open models'), while Anthropic itself accused Alibaba's Qwen in June of the 'largest known distillation attack' on Claude (Nikkei). Accusation and usage run both ways; one-directional enforcement will keep facing consistency challenges.

Late July widened the gap between the two accusations. Distillation: proof depends on provider-side access logs and the counterparty's training records — nearly impossible to establish publicly. Bessent's 'watermarks' claim came with no technical detail, the White House released no evidence, and Anthropic's official response addressed policy stance without presenting K3-specific evidence. This track functions mainly as public pressure and negotiating leverage. Export controls, by contrast, come with mature tools and precedent: multiple US outlets report BIS has opened a GB300 case; the Thailand transshipment angle sits squarely in EAR extraterritoriality and diversion enforcement — Washington's most practiced terrain; and the Entity List has the full Huawei 2019 precedent — designation would cut Moonshot off from US chips, software and cloud. Pressure is already propagating through the supply chain: Jensen Huang reportedly met Commerce Secretary Lutnick on July 28, even as The Information reports Moonshot seeks more Blackwell compute for its next-gen K4. We maintain our call: if formal action comes, export controls land first.