A Reuters wire lands in my feed in late September 2025, and for a moment I assume it is satire. Six Chinese AI companies โ three named, three pointedly not โ stand accused of what federal law enforcement and intelligence officials describe as "massive malicious distillation" of American frontier models. The named victims include OpenAI, Anthropic, Google. And, in a detail that should make any sober analyst blink twice, SpaceX.
Not theft. Not intrusion. Not exfiltration of source code or the wholesale copying of training data. Distillation. In my decade-plus of watching regulators try to put handcuffs on exponential technologies โ first in crypto, now at the intersection of AI and the geopolitical grid โ I have learned that when Washington reaches for an obscure technical term, it is usually because the obvious legal vocabulary would not survive contact with a courtroom. Distillation is a published, peer-reviewed, openly taught machine-learning methodology. It is also, apparently, a federal crime.
The word itself is doing enormous political labor. Strip the adjectives away and this is the first time the United States has formally criminalized not the stealing of a model, but the act of learning from it. As someone who spent the DeFi summer of 2020 auditing governance proposals and watching "community decision-making" devolve into admin keys and Gnosis Safe multisigs, I recognize the pattern: when the powerful cannot win on the merits, they change the definition of the game. Tracing the code back to its chaotic genesis, what we are witnessing is not an enforcement action. It is an epistemological coup.
Context: The Ten-Year-Old Technique That Just Became a National Security Threat
Let us establish what distillation actually is, because the entire edifice of this accusation rests on the gap between the public meaning of the word and the sinister gloss the officials have applied to it. Knowledge distillation was formalized by Geoffrey Hinton and his collaborators in 2015 โ a method by which a smaller "student" model learns to imitate the behavior of a larger "teacher" model, compressing the teacher's knowledge into a more efficient form. It is not a hack. It is not an exploit. It is a foundational pedagogy of modern machine learning, taught in every serious graduate program, deployed by every serious lab, and discussed openly in papers.
The technique has since evolved far beyond its original classroom framing. In the era of closed frontier models, where OpenAI and Anthropic expose their intelligence exclusively through API endpoints rather than released weights, a new form of distillation emerged: using the outputs of those APIs โ including long chains of reasoning, preference data, and high-quality completions โ as training signals for smaller or alternative models. This is what the technical community calls, with varying degrees of comfort, "API distillation" or "output distillation." It is the logical extension of Hinton's idea into a world where the teacher is no longer a downloadable artifact but a remote service.
DeepSeek's own public technical documentation has, for months, described the construction of supervised fine-tuning corpora using outputs from more capable models โ and this was treated as an interesting engineering detail, not a confession. Researchers across Europe, India, Southeast Asia, and even within the United States use similar techniques daily. Academic labs distill. Startups distill. A model distillation itself is not the crime; the crime, it appears, is the passport of the distiller.
The accusation, parsed carefully, points to one of two activities, and possibly both. The first: Chinese AI firms used outputs from OpenAI's and Anthropic's closed APIs โ particularly high-value reasoning traces โ to fine-tune or train their own models, in violation of commercial terms of service. The second: those firms used distillation to compress American frontier capability into smaller local models, thereby evading the export-control regime on high-end compute. The Reuters article, true to the genre of national-security journalism, refuses to distinguish between these two very different activities. One is a breach of a click-through agreement. The other is a strategic circumvention of export law. Conflating them requires a press release, not a legal argument.
This distinction is not pedantry. When the stakes are Espionage Act indictments and entity-list designations, the difference between violating a terms-of-service contract and stealing trade secrets is the difference between a civil dispute and a federal prosecution. The trade-secret path requires proof that distillation involved misappropriation of proprietary information with economic value and reasonable secrecy measures โ a burden that collapses the moment you acknowledge that the "secrets" in question were emitted voluntarily over a public API to paying customers. The contract path, meanwhile, explains why the White House would rather frame this through law-enforcement leaks than through a straightforward civil lawsuit: a contract claim against a Chinese company is hard to enforce, but a national-security narrative can justify almost anything.
Core: The Real Target Is Not Distillation โ It Is the Logical Layer of Control
Where logic meets the absurdity of market hype, a more interesting pattern emerges. This accusation did not materialize in a vacuum. It is the third act of a play that began with chips, moved to models, and has now arrived at knowledge itself. Watch the escalation: Huawei and SMIC were placed under chip restrictions in 2020. High-end GPU export controls followed in 2022 and 2023, cutting Chinese AI labs off from the H100s and B200s that had become the oxygen of the industry. Then, in January 2025, the AI Diffusion Rule โ the outgoing Biden administration's parting gift โ extended controls beyond silicon to model weights and the computational capacity to run inference, imposing a parameter threshold calibrated around 10^26 operations.
And now this. The premise of the September 2025 accusation is that the hardware controls have a hole in them: distillation allows a determined actor to approach frontier capability using one to two orders of magnitude less compute. In the silence between the block hashes of this escalating regulatory war, what Washington is admitting is profound. You can embargo the chips. You can sanction the data centers. You can restrict the weights. But you cannot embargo the "lesson" โ the distilled knowledge that flows through tokens and logits, crossing borders at the speed of light without ever touching a physical export control.
This is the deepest reframe of the entire story: the critical infrastructure of the AI era is no longer merely the fab and the data center. It is the API itself. The frontier model, delivered as a service, is simultaneously a product, a teacher, and a vector for knowledge transfer. And knowledge, unlike silicon, is non-rivalrous. Once a model's output has been observed, the genie does not return to the bottle. You cannot un-mine a block; you cannot un-learn a lesson.
The economics of distillation explain precisely why the accusation landed at this moment. DeepSeek's V3 and R1 series became a strategic embarrassment for Washington not because they were brilliant acts of reverse engineering, but because they achieved near-frontier performance at a reported training cost around six million dollars. Six million. By way of comparison, the frontier labs in America were spending orders of magnitude more, and the gap was widely attributed โ correctly, in my assessment โ to the clever use of distillation and synthetic data rather than to brute-force scale. The model had, in effect, absorbed the teacher's knowledge at a fraction of the teacher's tuition cost. Every export-control regime that had been built around the physical means of computation was rendered moot by a technique that substitutes data efficiency for raw flops.
This is why the word "distillation" matters so much more than any single company named in the article. The officials did not accuse the Chinese firms of hacking into OpenAI's servers. They did not claim source code was stolen. They accused them of doing what the entire global AI research community does, only with better execution and at larger scale. The implicit evidence, as I read the signals, is not forensic โ it is observational: patterns of API calls, statistical similarities between model outputs, the telltale fingerprints of a student that has internalized its teacher's style. That is circumstantial evidence of learning, not of theft. But in the national-security frame, learning has been redefined as attack.
Consider also the odd detail of SpaceX appearing on the victim list. SpaceX is not an AI model provider in the same sense as OpenAI, Anthropic, or Google. Its inclusion suggests one of two possibilities, both revealing. First, the definition of "distillation" here extends far beyond large language models โ perhaps encompassing the use of American technical capabilities in areas like autonomous systems, simulation, or engineering code. Second, and more cynically, SpaceX was added to pad the victim list with a name that evokes rockets, Mars, and military contracts, strengthening the emotional resonance of the "national security threat" frame. Either way, the inclusion tells us that this accusation is less a precise legal document and more a political Rorschach test.
The Chilling Effect and the Missing Names
Perhaps the most telling detail in the entire report is the count. Six companies, the officials say. Three are named โ DeepSeek, Moonshot AI, and Alibaba. Three are not. My years in this industry have taught me that naming and shaming is a deliberate psychological technology. Washington knows exactly what it is doing by leaving three names in the dark. The message to every Chinese AI company that reads the wire is not "you are safe." It is "you might be next."
The uncertainty is the point. If the Department of Commerce wanted maximum compliance behavior, it would release the full list. By withholding it, the unnamed three become a distributed chilling effect across the entire Chinese AI ecosystem. Every lab, every cloud provider, every research group must now assume it is under scrutiny. I have seen this playbook before โ in 2019, when Reuters published the "Huawei backdoor" story that relied on unnamed officials and never produced public judicial evidence; in 2022, when the GPU control stories first leaked through similar channels. The pre-sanction press cycle is a well-established ritual in Washington. Officials brief a journalist at a trusted wire service, the story circulates as "reported truth," and the policy groundwork is laid for the actual enforcement actions that follow weeks or months later.
This particular timing is not accidental. The AI Diffusion Rule's transition from its 180-day grace period into a stricter implementation phase was approaching in November 2025. Congressional hawks were maneuvering to attach China-specific AI restrictions to budget legislation. The release of the "malicious distillation" narrative in this window serves precisely the function that the Huawei stories served before the 2020 sanctions and the GPU stories before the 2022 export rules: it manufactures urgency, legitimizes escalation, and normalizes the idea that Chinese AI capability growth is illegitimate by construction.
Logic fails, but the narrative persists. And the narrative here is doing something even more ambitious than justifying new export controls. It is retroactively explaining the failure of the old ones. If DeepSeek and Moonshot and Alibaba reached near-frontier capability despite every chip embargo, the answer must be that they cheated โ not that the export-control paradigm is fundamentally unsuited to governing intangible assets. The alternative explanation, that American hard-power instruments have structural limits against a diffusion-resistant technology, is too threatening to the entire national-security bureaucracy to be spoken aloud.
The Crypto Mirror: What a Decade of Failed Code Controls Taught Me
To understand what comes next, it helps to have lived through the crypto wars. Not the 1990s crypto wars โ though those are instructive โ but the post-2020 attempt by the U.S. government to police code as a weapon. I watched Tornado Cash's smart contracts be sanctioned as if they were a person. I watched the Treasury Department try to put a border around a protocol that had no border. I watched open-source developers learn that writing code could make you a felon in a jurisdiction you had never visited.
The lesson from those years is that the physical layer can be controlled, but the logical layer cannot. You can restrict the export of cryptography hardware; you cannot restrict the export of a mathematical idea. You can sanction the developers of a privacy protocol; you cannot prevent the deployment of code that already lives on a permissionless network. The same lesson now applies at the frontier of AI. Hardware-oriented export control was a strategy designed for a world of physical scarcity โ a world where capability was a function of chips and fabs and data centers. The world that emerged in 2025 is one where capability is increasingly a function of learning algorithms, distillation techniques, and the efficient use of whatever compute is available. The United States fought the last war of controls against silicon. The current war is over something much harder to embargo: methodology.
When the AI Diffusion Rule attempted to extend controls to "model weights," the crypto community recognized the architecture immediately. Weights are, in effect, a form of compiled intelligence โ valuable, but once they leak or are approximated through distillation, no revocation mechanism exists. The rule's architects seemed to believe that capability could be regulated by regulating the artifact of the trained model. Distillation attacks that assumption at its root, because it allows a competitor to reconstruct the equivalent of the artifact without ever possessing it. Every distillation event is, in cryptographic terms, a side channel through which knowledge flows from the controlled domain to the uncontrolled domain โ and unlike a physical side-channel attack, this one cannot be patched by a firmware update.
For those of us who have spent years arguing that open-source resilience is a feature and not a bug, the hypocrisy of the victim list is almost comical. Google, listed as a victim of distillation, also operates DeepMind, which has benefited for years from the broader ecosystem's intellectual output โ and which was simultaneously defending itself against multiple copyright lawsuits over the very training-data practices that make modern AI possible. The industry's foundational premise is that models learn from the world's knowledge, largely without permission. To now claim that one company's learning from another's outputs is an existential threat is to deny the industry's own origin story. There is no clean line between "training on the public internet" and "training on a competitor's API outputs" โ both are forms of learning from signals, the former with less legal cover than the latter, at least when the outputs are accessed pursuant to a terms-of-service agreement.
The Contrarian Test: Can the Chains of the Narrative Hold?
Let me steel-man the American position before I dismantle it, because a purely one-sided reading of this affair would be an insult to the complexity of the situation. The security chain the officials are implicitly advancing runs as follows: distillation โ Chinese AI capability leap โ Chinese government knowledge and endorsement โ military and cyber enhancement โ threat to U.S. national security. Each link in this chain carries a different epistemic weight, and the honest analyst must attach different confidence levels to each.
First, the distillation behavior itself. Here I have high confidence โ the probability that leading Chinese AI labs have used outputs from American frontier models in their training pipelines is, in my assessment, above eighty percent. It is an industry-standard practice, documented in public technical reports, and its efficiency advantages are too large to ignore. Where I part ways with the officials is on the moral coloring: the same practice executed by a European startup or an American university would be described as "best-in-class use of synthetic data." The technique itself is neutral. The nationality of the practitioner is what makes it malicious.
Second, the question of Chinese government involvement. Here my confidence drops to the middle range โ perhaps forty to sixty percent. China's generative-AI regulations require model providers to file training-data documentation with the Cyberspace Administration before deployment. It is difficult to imagine that large-scale reliance on American closed-model outputs escaped the notice of regulators during this filing process. However, there is a vast difference between tacit awareness of an industry-wide technical practice and active government direction of specific distillation operations targeting American models. The more plausible scenario is that Chinese officials know their labs employ this technique, tolerate it, and would defend it as consistent with international norms โ but have not necessarily issued targeted orders for each instance.
Third, the claimed military benefits โ and this is where the narrative chain frays most visibly. The assumed link between distilled general-purpose capabilities and concrete military applications such as battlefield decision support or offensive cyber tools is never articulated with specificity. The logic is remarkably non-exclusive: if the Chinese military wanted advanced AI capabilities, distillation of American API outputs would hardly be the only avenue. Open-weight models from Meta and Alibaba, academic papers from global conferences, and China's own substantial research base would provide alternative paths. The assertion that distillation uniquely contributes to Chinese military advantage requires evidence that the capability gained through this channel could not have been obtained through other legitimate means. No such evidence is presented in the Reuters report, and absent that exclusionary proof, the military-gain inference remains dangerously thin.
Fourth, and most cynically, consider the economic beneficiaries of the proposed response. If distillation of closed-model outputs is criminalized as a matter of U.S. law, and if the export regime is extended to prohibit the use of American API outputs in training competitive models, the winners are not the American people and not the global AI ecosystem. The winners are OpenAI, Anthropic, Google, and a handful of frontier labs that would receive a statutory moat โ a legal prohibition on learning from their outputs, enforced not by the quality of their models but by the coercive power of the U.S. state. This is not national security. This is rent-seeking dressed in the robes of patriotism, a form of model-level colonialism where the frontier remains in America, the rest of the world consumes via API, and any attempt to graduate from consumption to learning is defined as a security threat.
This is the moment where the crypto analogy becomes almost painful. If Washington had succeeded in criminalizing the act of forking a protocol, the industry would not exist. Open source depends on the freedom to learn from, modify, and improve upon the work of others. DeepSeek's strategy of releasing weights openly โ which I have defended in public debates as the correct ethical choice in the crypto-native tradition of transparency โ makes the "malicious distillation" accusation particularly corrosive. The attack is not merely a legal threat to DeepSeek itself. It is an attempt to poison the legitimacy narrative of the entire Chinese open-source ecosystem in the eyes of global developers, most of whom have been perfectly happy to download DeepSeek weights and build atop them.
Infrastructure and the Unclosable Side Channel
There is a deeper infrastructure story buried beneath the political noise, and it explains why this accusation, whatever its legal merits, cannot achieve its stated objective. The United States has discovered that its export-control framework suffers from an architectural vulnerability: knowledge travels. If API-based distillation is formally declared illegal, the response will not be that Chinese labs stop learning. The response will be that knowledge transfer routes through third countries. Singapore, the United Arab Emirates, Saudi Arabia โ all of them host substantial compute infrastructure, all of them are courted by Washington as partners in the AI diffusion regime, and all of them have their own commercial incentives to stay friendly with Chinese capital and Chinese customers. A Chinese company could rent compute in a Middle Eastern data center, access American frontier models through that jurisdiction's cloud infrastructure, perform distillation there, and transmit only the resulting weights back to China. To close this loop, the United States would have to enforce its export regime not just at its own borders but at the borders of every jurisdiction where American cloud services operate โ a task that is administration intellectually and legislatively impossible, the equivalent of trying to enforce the 1990s cryptography export rules in a world where the code is already on the internet.
The policymakers behind this initiative may know this. Which raises the question of what the "malicious distillation" narrative is actually for. If it cannot stop the flow of knowledge, perhaps its purpose is simpler and more domestic: to signal strength to the hawkish wing of the American political establishment, to justify the next budget cycle's AI security spending, and to frame the inevitable continued progress of Chinese models not as evidence that Chinese scientists are brilliant but as evidence that the threat is so severe that only stronger measures โ and stronger budgets โ can contain it. This is the classic behavior of an institutional apparatus that has become committed to a policy objective it cannot achieve but must be seen to be pursuing.
For the Chinese AI industry, the strategic implication is unambiguous. The era of relying on American frontier models as "teachers" is ending โ not because distillation will suddenly stop working, but because the legal and political costs of doing so openly have become prohibitive. The rational response is to build a "teacherless" technical path: internal teacher-model systems, synthetic data generation pipelines, self-supervised alignment techniques, and a deliberate reduction of dependence on American model outputs in the pretraining and post-training stages. This is a harder path. It may take longer and produce intermediate results that lag the frontier. But it is also the path that converts the current crisis into a forcing function for genuine technical originality. In much the same way that sanctions compelled Chinese-foundry innovation in the semiconductor space, this accusation may accelerate a Chinese divergence from American model architectures โ non-Transformer alternatives, novel alignment algorithms, and self-distillation methodologies that do not require an external teacher at all. The unintended consequence of trying to deny Chinese AI the ability to learn from American models is that Chinese AI will develop the ability to invent its own curriculum.
Meanwhile, the global research ecosystem โ the European labs, the Indian startups, the Southeast Asian universities โ finds itself collateral damage in a war it did not choose. These actors have benefited enormously from distillation as a technique, and the American attempt to brand it as nefarious will force them to justify practices that were previously uncontroversial. Multinational research collaborations that involve Chinese institutions will face additional scrutiny. Academic papers describing distillation results may require new compliance reviews. HuggingFace, which hosts the weights of open models that are themselves the products of distillation pipelines, may find itself pressured to remove or restrict content that Washington deems the fruit of illegal learning. The scientific commons, which has always operated on the principle that knowledge should be shared, will be carved up by a security logic that treats the direction of knowledge flows as a matter of state control.
The Swiss or the Indians are unlikely to comply quietly. Neither, for that matter, will the American research community, which knows full well that distillation is a technique taught in every American machine-learning course. The contradiction at the heart of this policy is that it asks the global AI community to treat a standard method as a crime when practiced by a certain nationality. Technique does not wear a flag. Research does not respect jurisdiction. And no amount of official rhetoric can make a stochastic parrot stop learning from the sounds that reach it.
Where the Analogy Breaks Down
An evangelist who doubts his own gospel must concede the places where the crypto analogy fails. If the crypto industry's experience teaches us that code distribution is unstoppable, the AI industry's experience teaches something more uncomfortable: concentration of capability is a real problem, and the open-weight ecosystem has yet to prove it can produce frontier intelligence without relying on the closed frontier's outputs.
There is an uncomfortable truth hidden in the hysteria: DeepSeek did not simply "distill in a few million dollars of API calls" and magically become a frontier lab. Distillation is a force multiplier, but it requires real research ingenuity to apply effectively โ choosing the right teacher outputs, curating the right training mixtures, designing the right student architecture. Six million dollars of compute spent without that intellectual work would have produced nothing. The officials who attribute DeepSeek's success entirely to distillation are, in effect, paying Chinese researchers a backhanded compliment: they are admitting that the Chinese ecosystem has mastered the extraction of maximum value from limited resources, a skill that American labs, awash in compute, never needed to develop. The capacity for efficiency under constraint is itself a competitive advantage that no export control can remove.
And yet. The asymmetry between the Chinese and American positions is real, and it would be a mistake to pretend otherwise. American frontier labs genuinely are the teachers of the global AI moment โ their outputs define the quality bar that everyone else aspires to reach. Chinese labs have, at least until recently, been the world's most sophisticated students. Banning the student-teacher relationship does not make the Chinese labs less sophisticated; it makes them more independent, and an independent student is a far more dangerous competitor than a dependent one. The policy is self-defeating in the most elegant way imaginable: every attempt to prevent Chinese AI from learning from American AI ensures that the next generation of Chinese models will contain zero American intellectual contribution โ and will therefore be harder for American intelligence agencies to understand, predict, or influence. The optimal strategy for maintaining visibility into Chinese AI development would have been to keep those labs dependent on American API access for as long as possible. This accusation accelerates their decoupling.
In the silence between the block hashes โ between the enforcement announcements and the retaliatory measures that will inevitably follow โ a strange symmetry emerges. The crypto community learned a decade ago that you cannot regulate mathematics. Borders are simply lines drawn on a map, and the internet flows across them as if they do not exist. When I organized my first EthFin meetups in Toronto in 2017, I framed Ethereum as an economic protocol that would render obsolete a generation of gatekeepers who believed they could control the terms of transactions. Eight years later, watching the American government attempt to control the terms of cognition itself, I feel a disturbingly familiar sensation. This was never about technology. It was always about who gets to learn, who gets to know, and who gets to define what counts as legitimate intelligence. The attempt is doomed, but the damage it will do before failing โ to research freedom, to open collaboration, to the global diffusion of knowledge โ will be substantial.
If the United States truly believes that six Chinese companies can only advance by imitating American models, then it has profoundly misunderstood the nature of scientific progress. If, on the other hand, it believes that even the imitation of American models advances Chinese capability faster than the United States can tolerate, then it is engaged in something far more disturbing than export control: it is attempting to slow down the intellectual evolution of a rival by cutting off its access to educational materials. Models that cannot learn from better models will eventually learn from their own errors. There is, in the emerging Chinese response, a plan for what this moment demands: a concentrated national push toward architectural originality, a deliberately constructed ecosystem of domestic teacher models, and a reorientation of the incentives that previously drove Chinese labs to feed on American API outputs. The teacher is being dismissed. The student must now become its own teacher.
The question that will define this decade is not whether the distillation accusation is legally sound โ it is not โ nor whether it chills legitimate research on a global scale โ it will โ but whether the American regulatory state can tolerate a world in which it does not control the frontier of knowledge. The answer is that it has no choice. Control over the physical means of computation was always a fragile foundation for empire building, because intelligence has a stubborn habit of flourishing in constrained environments. Chinese language models will continue to improve, with or without the blessing of American regulators, because the human talent behind them is real, the datasets they generate internally are increasingly rich, and the compute available through domestic supply chains, while constrained, is not negligible. What the American approach has accomplished is to strip away every excuse for Chinese dependence. The next generation of Chinese models will not be dismissed as distillation products. They will have to be judged on their own merits โ which, ironically, is all the global AI community ever asked for in the first place.
Logic fails, but the narrative persists, and the narrative's greatest vulnerability is the thing it can never admit: that the technique it calls malicious is so universally practiced that the category cannot be sustained for long. The definitions that Washington is stretching today will be precedent for the restrictions imposed tomorrow, not just on Chinese companies, but on any researcher, in any country, who dares to learn from the frontier without permission of the frontier's owners. The rest of the world observes this with alarm. Europe already reads the "malicious distillation" charge as a warning shot: if the United States can define learning from API outputs as a national-security crime when done by geopolitical rivals, it can someday apply similar logic to friends who displease it. The attempt to police knowledge transfer will not survive contact with the global research community for a simple reason that every cryptographer understands and every regulator eventually learns: you cannot export-control a difference of opinion.
And here is the final obstacle the hawks will not surmount. The China market was always a layer of abstraction through which the implications of American rules propagated to the rest of the world. The American policy community has spent five years tightening boundary conditions on code, on capital, and now on cognition, in an attempt to wall off its frontier advantage. Each tightening, each new accusation, each leaked official story about intelligence threats and malicious distillation campaigns, accelerates the only possible response available to a sufficiently sophisticated counterpart: abandon the commons and build a separate garden. Within a handful of years โ if not sooner โ the global AI ecosystem will have split into two nearly hermetic worlds: one centered on American closed models and the export-controlled weights that follow from them, the other built around open-weight ecosystems, Chinese models, and a growing stack of non-American compute. The bridging experiments that might have prevented this chasm โ joint research programs, shared benchmarks, interoperable safety standards โ are precisely the casualties that an accusation like this one claims. We will not get a warning. We will only get this moment to ask whether the border was worth building.
If a person learns from a teacher, they are a student. If a company learns from an API, they are now a national security threat. The word had to be invented because the reality it describes is the warp and woof of every intellectual tradition in history. Distillation is not a crime against the frontier. Distillation is how frontiers have always moved, and the attempt to arrest it today is nothing more than an incumbent's prayer that the future will not arrive on a rival's schedule.