If Distillation Is a Crime, Every Frontier Lab Is Guilty

On July 22, the White House got into the business of model training pipelines. OSTP chief Kratsios publicly accused Moonshot AI of distilling Anthropic's Fable model without authorization to build Kimi K3. Treasury Secretary Scott Bessent said sanctions remain on the table. The Hill added a second charge, that Moonshot used restricted Nvidia chips. Cabinet officials are now issuing statements about how a Chinese lab fine-tuned its language model. We should talk about why.

The backdrop matters. Kimi K3 is the 2.8 trillion parameter open-weight model that launched July 16 and sold out its hosted capacity in 48 hours. It is good, it is open, and it is embarrassing to a lot of business models. Earlier this year Anthropic accused a whole roster of labs, DeepSeek, Moonshot, MiniMax, and more recently Alibaba, of distilling Claude's outputs at scale through large numbers of accounts, calling it a terms-of-service violation. So the accusation is not new. What is new is the seniority of the people making it.

What distillation actually is

Strip away the sinister framing and distillation is almost boring. You take a strong teacher model, prompt it with a large pile of inputs, collect the outputs, and assemble them into a synthetic dataset. Then you fine-tune your own student model on that dataset. The student learns to imitate the teacher. That is the whole trick. The black-box version requires nothing but API access, the same access you or I can buy with a credit card. No stolen weights, no hacked servers, no midnight exfiltration. Just a customer using the product a lot and learning from what comes back.

Which is exactly why the outrage rings hollow, because everyone does this.

The open secret

Distillation is not some rogue tactic cooked up in Beijing. It is standard practice at every serious lab, including the ones complaining. Frontier labs train enormous internal teacher models that are never released, models that exist purely to distill stronger production models. Nathan Lambert's RLHF book describes it plainly: labs train a big internal model, an internal Opus or a Gemini Ultra, that is 'just used internally to make stronger models.' The flagship you use every day is very often a distilled student of a bigger sibling you will never meet.

Open-model builders routinely distill from closed APIs. Every lab's data pipeline is stuffed with synthetic data generated by other people's models. And even the labs that swear they never touch a competitor's API are training on model outputs anyway, because model outputs are now everywhere in web scrapes. The internet is marinated in generated text. The entire industry trains on everyone else's outputs, directly or laundered through the open web. That is not a scandal, that is the water everyone is swimming in.

Pick a theory

Here is the first layer of irony. The labs now crying theft built their foundation models by training on the open internet: copyrighted books, news articles, code, forums, mostly without asking anyone. The industry's founding legal theory, the one being argued in courtrooms right now, is that training on other people's output is fair use. That theory is the load-bearing wall of the whole business.

You cannot build your empire on 'training on outputs is fair use' and then call it grand larceny when someone trains on your outputs. Either learning from output is transformative and fine, in which case Moonshot's scraping of Fable is the same move you pulled on every novelist in America, or it is theft, in which case the invoices from publishers are going to be spectacular. Pick a theory. You do not get one rule for your inputs and another for your outputs.

The second layer of irony is legal proportion. What Anthropic actually alleges is a terms-of-service violation. That is a contract dispute. Companies resolve contract disputes with lawyers, account bans, and occasionally a strongly worded blog post. They do not usually resolve them with statements from the White House and sanctions threats from Treasury. When a ToS beef escalates to the cabinet level, the honest read is that this is not about IP law at all. It is geopolitics wearing an IP costume.

What the panic admits

Here is the strategic tell buried in all this. A distillation accusation is a confession that model capability is no longer defensible. If your moat can be extracted through your own front door, at inference prices, by anyone with API access, then it was never a moat. It was a lead time. Six months, maybe twelve, of being the only one who can do the thing, before the thing leaks out through the very product you sell.

The labs know this, which is why the response is political rather than technical. There is no technical fix for black-box distillation short of shutting off your API, and shutting off your API means shutting off your revenue. You cannot sell intelligence by the token and simultaneously prevent people from learning from the tokens. So instead of an engineering answer, we get a sanctions threat. That is not strength. That is a company asking the government to defend a lead time the market has already priced as temporary.

Keeping it honest

None of this makes Moonshot a saint. Using restricted Nvidia chips, if true, is a real export-control violation, a separate matter with actual law behind it, and it should be treated as such. And Anthropic has every right to enforce its terms of service, ban accounts, and sue if it wants. Contracts are contracts. My point is narrower and, I think, sharper: the distillation framing specifically indicts the industry's own playbook. If distillation is a crime, every frontier lab is guilty, and most of them are repeat offenders against their own internal models.

What founders should take from this

Two lessons, and they matter more than the diplomatic theater.

First, capability leaks. Any capability you serve through an API is being copied right now, by someone, at inference prices. Never build your defensibility on being the only one who can do a thing. The half-life of a capability advantage in this market is measured in months, and every query you serve is a free tutoring session for your eventual competitor.

Second, the real moats are the ones that cannot be distilled. Nobody can prompt their way to your customer relationships. No synthetic dataset replicates your proprietary data flywheel, the one that gets better because your customers use you. Workflow integration, the way your product is wired into how a company actually operates, does not fit in an API response. Neither does distribution. Those are the assets worth building, because when your model edge leaks, and it will, they are what is left. The labs shouting about theft this week are learning that lesson in public. You can learn it cheaper by watching.