US AI Firms Warn Over Distillation Attacks, China Warns of Countermeasures
US frontier AI firms voice concern over advanced distillation attacks. China pushes back, vowing countermeasures against containment.
Alarm over distillation attacks is growing between the U.S. government and leading U.S. AI developers. Jon Martindale of Tom’s Hardware reports on the situation, based on Bloomberg’s reporting. Concerns have been raised that China and Russia are using responses obtained from U.S. frontier models to develop alternative models with comparable capabilities at low cost. China has denied the claims while stating it will take countermeasures against measures aimed at containment.
Since the start of 2026, major Western AI research institutions have announced cooperation on anti-distillation measures. Detection and prevention mechanisms are being put in place, but loopholes remain. Cases have been noted in which third-party conversation logs obtained via legitimate accounts are bought and sold, evading countermeasures. The situation has reached a stage where technical defenses alone are difficult to deter.
Concerns Over Distillation Attacks Are
Rising Rapidly
Behind the rapidly growing concern over distillation attacks is intensifying development competition. Training frontier models requires huge investment and computing resources. By collecting only responses in bulk to train smaller models, development time and costs can be compressed. This asymmetry has emerged as a national security issue.
U.S. authorities and developers believe foreign actors are systematically collecting outputs. According to reporting by Jon Martindale of Tom’s Hardware, concern is growing on both the government and developer sides. Developers in China and Russia have been named as the actors in question. The Chinese authority equivalent to the foreign ministry pushed back, mentioning the possibility of countermeasures.
China’s argument is that distillation allegations should not be used as a pretext for U.S. containment. It has shown it will not accept moves to constrain the development of domestic models. The exchanges over technological hegemony are linked to debates over export controls and investment restrictions. AI training methods have come to be treated as a diplomatic issue.
How Distillation Works and Where Misuse Begins
How distillation works and where misuse begins depends on how it is used. Distillation is a technique that teaches a small model the input-output relationships of a large model. It feeds large numbers of prompt-response pairs to imitate behavior. It is used as a legitimate technique for making in-house models lighter and adapting them to specific uses.
Distillation is an effective method of training smaller language models by feeding them prompts and responses from a more advanced model.
The above is the definition of distillation presented by Tom’s Hardware. It uses responses from an advanced model as training material to build a smaller, faster model. It is also a standard method for individual developers creating lightweight models for devices. The problem lies in using another company’s commercial model as training material without permission.
Collecting another company’s model outputs at scale is seen as free-riding on investment. Frontier model developers invest substantial resources in training infrastructure. Many prohibit use for training other models in their terms of service. The dividing line between legitimate research use and illicit appropriation is in dispute.
Speculation surrounding DeepSeek in 2025 and Kimi K3 in 2026 also falls in this context. Both are said to have achieved capabilities approaching U.S. frontier models at low cost. Reporting by Jon Martindale of Tom’s Hardware introduced the view that distillation was a factor in the leap. While gaps remain in reaching the level of Anthropic and OpenAI, their cost-effectiveness has drawn attention.
An ironic dynamic has also been pointed out. OpenAI and Anthropic themselves face criticism for unauthorized use of books and online articles. Citing a claim by the South China Morning Post, it was reported that Thinking Machines’ Inkling used outputs from other models, including Moonshot’s Kimi K2.5, for initial training. The question of whose training is legitimate reverberates across the industry. Opaque rights clearance is deepening mutual distrust.
Open vs. Closed Development Clash
The clash between open and closed development is also an axis of the dispute. Anthropic, OpenAI, and Google operate their models without disclosure. Details of their architectures and training data are hard to see from the outside. The closed approach has been chosen for reasons of safety and business protection.
In contrast, many of China’s leading models are distributed as open weights. Releasing weights and allowing modification and redistribution has become widespread. It is a strategy that gains an advantage through ease of verification and speed of adoption. Differences in development philosophy divide perceptions of the distillation debate.
Closed models are vulnerable to imitation via outputs. Even if their internal structure is not visible, behavior can be copied by collecting responses. Providers restrict retraining through terms of use, but effectiveness is limited. Countermeasures are needed on both technical and contractual fronts.
Log Trading Makes Defense Difficult
The current situation, in which log trading makes defense difficult, is serious. API providers monitor bulk extraction and automated queries. Mechanisms have been introduced to detect and block abnormal frequency or patterns. Strengthening this detection infrastructure is also central to the cooperation pledge in 2026.
However, detection is difficult if activity is disguised as normal use via legitimate accounts. A route has been pointed out in which third parties collect records of legitimate use and resell them. Buyers can obtain training material without directly conducting attacks. According to reporting by Jon Martindale of Tom’s Hardware, this workaround makes prevention difficult.
Conversation logs are highly valuable as high-quality instruction-tuning data. Question-and-answer pairs from real use capture model behavior. Even small amounts can contribute to performance gains. The commercialized circulation of logs broadens the target of enforcement.
Development of developer infrastructure is also advancing in other fields. In vision and 3D, Streaming 3D Reconstruction Achieves SOTA with Geometric Context Transformer reports improved accuracy. In terms of testing infrastructure, GNOME OS Test Center, Inspired by Apple TestFlight shows more efficient test distribution. In output quality management, LG OLED evo, Creator Original Picture Mode with Prime Video is advancing stricter display standards. For AI evaluation and defense as well, infrastructure development is key.
Impact of US-China Tensions on AI Development
The impact of US-China tensions on AI development is spreading to the institutional level. In the United States, linking countermeasures against API misuse with export controls is under discussion. There is a recognition that regulating computing resources alone cannot stop leakage. Cross-border transfer of response data could also become subject to controls.
China is strengthening its push for technological self-reliance. Its open-weight strategy is directly linked to talent development and expanded applications. External restrictions could accelerate domestic production. The warning of countermeasures is also seen as carrying meaning as bargaining leverage.
This is not unrelated to Japanese companies either. For products using U.S. model APIs, confirming compliance with terms of service is essential. Secondary use for training purposes or providing logs externally could breach contracts. Screening of suppliers and establishing log management systems are required.
Editorial Opinion
In the short term, we expect distillation detection and enforcement of terms of use to be strengthened. We expect API providers to advance blocking of abnormal query patterns. We assess that information sharing between companies will also expand. We expect development and operational burdens to increase over the next 3-6 months.
In the long term, we assess that balancing openness and defense will become a design challenge. We expect the scope of open-weight releases and distribution terms to be reviewed. We expect differences with closed models to become a focus of policy debate. For users, impacts on choice and transparency will remain.
The remaining question is who will draw the line between learning and theft. We see the criteria for distinguishing legitimate distillation from illicit acquisition as not yet established. Without verifiable auditing methods, the confrontation will likely continue. We assess that the industry needs to provide answers on both technical and institutional fronts.
References
- “ US frontier AI companies warn authorities over sophisticated distillation attacks — China warns of ‘countermeasures’ if America tries to constrain domestic AI models “, by Jon Martindale — Tom’s Hardware, 2026-09-18T12:20:00.000Z (ARR)
- Source URL: https://www.tomshardware.com/tech-industry/artificial-intelligence/us-frontier-ai-companies-warn-authorities-over-sophisticated-distillation-attacks-china-warns-of-countermeasures-if-america-tries-to-constrain-domestic-ai-models
Frequently Asked Questions
- What is a distillation attack?
- It is a technique that collects large volumes of prompts and responses from a large AI model to teach a smaller model its behavior. While it is a legitimate technique for lightening in-house models, using another company's commercial model as training material without permission is regarded as a terms violation or misuse.
- Why did it become an issue in 2026?
- Because low-cost models approaching Western frontier models emerged from China, raising suspicion of organized output collection. Combined with cooperation pledges by major research institutions and reports of conversation-log trading, it became an issue of national security and competition policy.
Comments