Behind the Dispute Over Model Distillation: How AI Capabilities Are Copied

Behind the Dispute Over Model Distillation: How AI Capabilities Are Copied

The most interesting part of Anthropic’s accusation against Alibaba is not the familiar story of American and Chinese technology companies competing for advantage. That story is there, of course, but it is not the deepest one. The deeper question is simpler and harder at the same time: in the age of large language models, can a capability itself be copied?

Reuters reported that Anthropic accused operators linked to Alibaba and Qwen of using nearly 25,000 fraudulent accounts to generate more than 28.8 million interactions with Claude between 22 April and 5 June 2026. Anthropic says the purpose was to extract Claude’s model capabilities. That should be stated carefully. This is a reported accusation by Anthropic, not a court finding and not an independently published technical audit. The news is real. The final factual judgement is not yet settled in public.

Model distillation is often misunderstood. It does not mean that someone has stolen source code or taken model weights. It usually means that the outputs of a stronger model are used as training material for another model. A smaller system learns from a larger one. A newer system imitates the behaviour of a more capable one. In many contexts this is normal and useful. Anthropic itself has described distillation as a legitimate technique when used properly. The controversy begins when the process allegedly relies on fake accounts, access restrictions are bypassed, and the extraction is carried out at industrial scale against a competitor’s model.

That makes this different from ordinary plagiarism. Traditional copying usually deals with objects: a paragraph, an image, a line of code, a file, a database. These things are not always easy to protect, but at least they are relatively clear things. A language model’s most valuable asset is not a single answer. It is the ability to produce many kinds of answers across many different situations. The valuable thing is not static content. It is a repeatable capability.

This is why the boundary is hard to draw. A person can ask Claude a question, learn something from the answer, and use that knowledge. That is ordinary use. A developer can use Claude to understand an algorithm. A researcher can compare models. None of this should automatically be described as theft. But if an organisation uses thousands of accounts to make tens of millions of calls, collects the responses systematically, and uses them to train a competing model, the situation changes. The interface is no longer just being used. It is being used as a channel for capability transfer.

A musical analogy helps. If you hear a pianist perform and learn something about phrasing or touch, that is normal. If you listen carefully to many recordings and absorb aspects of style, that is still part of learning. But if you conceal your identity, record every lesson, rehearsal and practice session, and then use that material to train a commercial machine that imitates the pianist’s abilities, the moral and commercial structure changes. You have not stolen the pianist’s hands or the piano. You have still tried to reproduce a trained capability.

The same kind of issue is appearing around AI models. Claude’s value is not only in its answers. It is in its stable performance across software engineering, complex reasoning, tool use, contextual judgement and safety constraints. If another system tries to reconstruct part of that performance through massive input-output sampling, then what is being copied is not merely content. It is the behavioural outline of a capability.

This is why I would avoid turning the story into a simple political headline. The geopolitical background matters, but it should not hide the structural issue. Once an AI capability is exposed through an API, it is no longer protected only by servers, model weights and source code. Every interaction reveals a small part of the model’s behavioural surface. With enough calls, and with questions designed carefully enough, that surface may become training material for another system.

Our current language of intellectual property is not well prepared for this. Copyright protects works. Patents protect inventions. Trade secrets protect confidential information. Contracts protect agreed access conditions. But model capability sits uneasily across all of these categories. It is not exactly a work, not exactly an invention, not exactly a secret once it is exposed through use. It is closer to a stable operational structure that appears through behaviour.

That is why the future dispute will not be only about Anthropic and Alibaba. Every frontier AI company will face the same problem. OpenAI, Google, Anthropic, Meta, Alibaba, DeepSeek, Moonshot and MiniMax all operate in an environment where model abilities can be accessed, tested, compared and possibly imitated through conversation. The real distinction will not be found in a single prompt or a single answer. It will depend on scale, intent, access method, account behaviour, circumvention of restrictions, and whether the outputs are used to train a competing system.

My view is that AI companies are going to spend the next decade trying to define what might be called a capability boundary. This boundary allows users to benefit from a model’s abilities, but it does not allow a rival to disguise itself, violate access conditions, and extract those abilities at scale for competitive training. The boundary will not be as clean as copyright. It will be contested, technical and contractual at the same time. But it will become one of the central boundaries of the AI economy.

The lesson is direct. AI intellectual property disputes are moving from the question of “who copied what content” to the question of “who reconstructed what capability, and by what means”. That shift matters more than this single news story. Once capability can be approached through dialogue, an open interface is not only a service entrance. It is also the edge at which capability can leak.

References
Reuters, “Anthropic says Alibaba illicitly extracted Claude AI model capabilities”, 24 June 2026.
Anthropic, “Detecting and preventing distillation attacks”, 23 February 2026.