Distillation is how the industry copies frontier AI models. It's also how you can build your own, legally, for a fraction of the cost.
In February 2026, Anthropic published a short announcement that most people skipped. The headline was dry: "Detecting and Preventing Distillation Attacks." The content was not.
Three Chinese AI laboratories, DeepSeek, Moonshot AI (the company behind Kimi), and MiniMax, had been systematically using Claude's API to copy its capabilities into their own models. DeepSeek ran over 150,000 exchanges. Moonshot ran over 3.4 million. MiniMax ran over 13 million. They used fraudulent accounts, proxy networks, and carefully crafted prompts designed to extract specific capabilities: reasoning, agentic coding, tool use, computer vision.
Four months later, Alibaba was doing it too. 25,000 accounts. 28.8 million exchanges. April 22 to June 5, 2026. The target was Mythos, Anthropic's cybersecurity model, whose vulnerability-finding capabilities a Chinese security researcher had described as "a terrifying change" that "democratized" finding exploitable flaws. Anthropic laid out the operation in a June 10 letter to Senators Tim Scott and Elizabeth Warren.
The reporting called all of this "distillation attacks." Nobody explained what that means.
Distillation, in the technical sense, is simple.
A large model, the teacher, knows things that took enormous compute to learn. You want a smaller model, the student, to learn the same things without that compute. So instead of training the student from scratch on raw data, you train it on the teacher's outputs. The student learns to approximate how the teacher responds. Done well, a much smaller model can get close to frontier performance on specific tasks because it's learning from already-refined answers, not from unstructured source material.
This is not exotic. It is a standard technique. OpenAI used it when building early versions of GPT. It's why smaller open-source models have improved so dramatically over the past two years: they were trained on outputs from larger ones. The academic literature on distillation goes back to 2015. Every major lab does some version of it.
The intuition is straightforward. If a frontier model took 100 million dollars and six months to train, you cannot reproduce that process. But if you can get 10,000 examples of how that model reasons through hard problems, you can train a much cheaper model to reason through the same class of problems in a similar way. You don't get everything. You get the slice you targeted. That is the technique.
What makes the Anthropic cases "attacks" rather than normal practice is three things: scale, evasion, and competitive intent.
DeepSeek didn't use the API to build products. They used it to build a competing frontier model, through fraudulent accounts with synchronized traffic patterns. Moonshot ran hundreds of fraudulent accounts spanning multiple access pathways. MiniMax ran 13 million exchanges targeting specific capability clusters. Alibaba used proxy networks and obfuscation techniques to avoid detection while running 28.8 million exchanges against a model they couldn't legally access at all because Anthropic doesn't offer commercial access in China.
The technique is available to anyone with an API key. The legal problem is what they did with it.
Let's be specific about what DeepSeek actually did, because the method is instructive.
Their prompts asked Claude to "imagine and articulate the internal reasoning process" behind its responses. Not just to give answers, but to externalize the step-by-step thinking that produced them. When you train a student model on that kind of data, you're not just teaching it what to say. You're teaching it how to think through problems.
That is a substantially more effective distillation strategy than collecting input-output pairs. Most naive distillation captures surface behavior: ask a question, collect the answer, repeat. The DeepSeek approach was designed to capture reasoning architecture. At 150,000 exchanges, they were building something closer to a reasoning curriculum than a dataset.
At 28.8 million exchanges targeting cybersecurity capabilities, Alibaba was attempting something closer to a full capability transfer of a model they had no right to access.
The scale difference is not incidental. It is the point.
The technique is standard practice. What made it a crime was the scale, the evasion, and what they intended to build with it.
Here is the part worth understanding if you're building AI products: the gap between 150,000 exchanges and 28.8 million isn't a gap in technique. It's a gap in what you're trying to accomplish.
A domain-specific distillation project, training a model to handle one specific task relevant to your business, typically needs between 1,000 and 5,000 high-quality examples. The reason DeepSeek needed 150,000 and Alibaba needed 28.8 million is that they were trying to capture general capabilities across a wide range of tasks. You don't need that.
The legitimate version of this technique works at a fraction of the scale and is in use at companies today.
The workflow:
Define your task precisely. Customer support for a specific product. Contract clause extraction for a specific document type. Code review for a specific language and framework. The narrower the task, the fewer examples you need and the better the fine-tuned model performs.
Use a frontier model to generate high-quality labeled data. Send your real examples through Claude or GPT-4 and collect the outputs. Add reasoning traces if your task requires step-by-step thinking. This is your training dataset. At 2,000 examples, you have enough to start.
Fine-tune an open-source model on that data. Llama 3, Mistral, Qwen, and their derivatives are all legal to fine-tune and deploy commercially. A 7-billion-parameter model fine-tuned on domain-specific frontier outputs will outperform the same model trained on general data for your specific task.
The economics work at scale. Inference on a fine-tuned 7B model costs a fraction of API calls to a frontier model. Once fine-tuned, the model runs on your infrastructure, not theirs. The unit economics improve dramatically as volume grows.
What makes this legal, and what the Alibaba case was not, comes down to three distinctions. First, targeted scope: you're capturing capability for a specific domain, not engineering general intelligence transfer. Second, your own product: you're building something that serves your customers, not a competing general-purpose frontier model. Third, terms compliance: you're accessing the API under its actual terms, with real accounts, not running 25,000 fraudulent ones through proxy networks.
The line is not the technique. The line is what you're building and how you're accessing the model to build it.
Anthropic's February post ended with a sentence that reads differently now than when it was published.
"But no company can solve this alone. Distillation attacks at this scale require a coordinated response between government and industry."
At the time, the post documented three labs and roughly 16.5 million total exchanges. Four months later, one additional operation added 28.8 million more. The pace is accelerating, not stabilizing.
What's worth noting about the Alibaba case is the target. DeepSeek went after reasoning. Moonshot went after agentic capabilities and computer use. MiniMax went after coding. Alibaba was specifically targeting cybersecurity. A model capable of finding exploitable vulnerabilities at scale, in the hands of an actor with no safety constraints and no accountability structure, is a qualitatively different risk than a better coding assistant.
The security researcher who called Mythos "a terrifying change" was describing what happens when that capability is deployed safely, with appropriate guardrails intact. The Alibaba operation was trying to capture those same capabilities and remove them from Anthropic's control entirely.
That distinction, capabilities with safety constraints versus capabilities without them, is the actual stakes of the distillation debate. Not IP theft in the ordinary corporate sense. Something closer to: who controls what these systems can be used for, and under what conditions.
Alibaba was simultaneously suing the US Department of Defense over being classified as a Chinese military company while running 28.8 million API calls designed to transfer capabilities into models outside any regulatory jurisdiction. Those two facts together are a complete sentence.
Save this for when someone asks why you're building a custom model instead of just using the API
The answer is that a fine-tuned small model on domain-specific data outperforms a frontier model on that specific domain, costs a fraction of the price to run at scale, and runs on infrastructure you control.
The technique is the same one four labs used at tens of millions of exchanges. You need 2,000 examples. The difference is the scope, the intent, and whether you read the terms of service before you start.