What Is AI Distillation?
Imagine a brilliant, experienced professor—the 'teacher'. Now imagine a new student who, instead of reading every book in the library, simply learns by mimicking everything the professor says and does. In the world of artificial intelligence, this is 'knowledge
distillation'. A large, powerful AI model (the teacher) is used to train a smaller, more efficient 'student' model. The student learns to replicate the teacher's outputs and, crucially, its patterns of reasoning. This allows developers to create compact, fast, and cheaper models that retain a surprising amount of the original's power without the immense cost and computing resources required to build the teacher from scratch.
The Problem of Industrial-Scale 'Theft'
While distillation can be a legitimate tool for model optimization, Anthropic and other leading labs say it has been weaponized for what they describe as a form of intellectual property theft. They report covert, industrial-scale campaigns where rival companies, often using networks of thousands of fraudulent accounts, systematically query models like Claude to extract their core capabilities. The goal is to build a competing model for a fraction of the cost and time. Anthropic has specifically pointed to several China-based AI labs, such as DeepSeek, Moonshot AI, and Zhipu, as being involved in these campaigns. The company argues this not only undermines its competitive position after investing heavily in creating its frontier models but also poses significant security risks.
National Security and Safety Concerns
The concern goes beyond business. Anthropic warns that when these 'distilled' models are created, they often lack the extensive safety guardrails built into the original. For instance, the company claims that Zhipu used distillation to enhance the cyber capabilities of its GLM-5.3 model, which was later assessed as a highly capable open-weights model for developing security exploits. This raises the risk of powerful AI tools being used for malicious purposes in biosecurity or cyber warfare. Furthermore, Anthropic argues that these capabilities could be integrated into foreign military and intelligence systems, creating a direct national security risk.
Anthropic's New Defenses
In response, Anthropic has rolled out a multi-layered defense system that has reportedly cut data harvesting from these attacks by 90 to 99 percent. The strategy focuses on protecting Claude's 'reasoning'—the step-by-step thinking process the model uses to arrive at an answer, which is the most valuable data for distillers. The new measures include advanced classifiers that detect and block distillation attempts with a very low false-positive rate, similar to the robustness of its bioweapon defense systems. The company is also making it harder for attackers to use different models or accounts to piece together reasoning, tightening usage limits for suspicious activity, and banning accounts linked to persistent campaigns.
The Inevitable Customer Trade-Offs
These robust defenses are not without consequences for legitimate customers. Anthropic has acknowledged several trade-offs. To make distillation harder, some technical integrations may need to be updated by developers. While the system is highly accurate, there is still a small chance that legitimate user requests are blocked. Perhaps most notably, since late September 2026, the company has started charging for user requests that are blocked by its safeguards in areas where the system is highly accurate, including distillation. Anthropic says it has turned away significant revenue and traffic from a paying customer base it identified as distillers, framing it as a necessary cost to protect its technology and ensure responsible AI deployment.
