3 Major Distillation Attacks Push US AI Firms to Seek Cyber Defenses

A growing coalition of U.S. artificial intelligence companies is turning to the federal government for help in combating what they describe as widespread illicit model distillation by Chinese competitors. Anthropic has taken the most concrete step, sending a letter on June 10, 2026, to Senators Elizabeth Warren and Tim Scott, ranking members of the Senate Committee on Housing, Banking and Urban Affairs, explicitly naming Alibaba's Qwen model as a product of unauthorized distillation. This follows a string of earlier accusations: in early 2025, OpenAI and Microsoft alleged that DeepSeek used distillation and exfiltrated large volumes of data to build its blockbuster R-1 model, and in February of that year Anthropic disclosed suspicious query patterns from DeepSeek, Moonshot AI (developer of Kimi K2), and MiniMax. Distillation—a technique in which a student model is trained on the outputs of a more capable teacher model—is not illegal in itself and is widely used as a cost-efficient shortcut. However, U.S. firms assert that the Chinese labs are violating terms of service, engaging in data exfiltration, and systematically copying proprietary model behavior in ways that undermine billions of dollars in research investment. The current protective framework offers limited remedies; model owners are left to police access through rate-limiting and API keys, measures that determined adversaries can circumvent with synthetic accounts and proxy networks. The companies are now pushing for government intervention, with Anthropic explicitly requesting export controls on distillation technology and stiffer regulations. This marks a significant escalation in the commercial AI race, intertwining intellectual property disputes with national security concerns and the broader U.S.-China tech rivalry. The implications are far-reaching. If the U.S. government imposes export controls or sanctions related to distillation, it could reshape the global AI supply chain, much like chip export restrictions have done for semiconductors. Frontier models are increasingly seen as dual-use technologies, and Washington may be receptive; the Senate committee with jurisdiction over banking and urban affairs is being drawn in, signaling a whole-of-government approach beyond traditional tech or defense channels. On the commercial side, sustained distillation could erode the competitive advantage of U.S. AI leaders, potentially lowering the quality of their paid offerings and incentivizing a race to the bottom on pricing. For the cybersecurity community, model distillation constitutes a novel attack vector that sidesteps traditional network defenses and instead targets algorithmic intellectual property through query-based extraction. Organizations rely on AI-as-a-service providers like OpenAI and Anthropic, and a compromised teacher model could leak sensitive organizational data or degrade model integrity for downstream users. From a legal standpoint, the situation tests the boundaries of existing international IP law, which struggles to address algorithms and training data as protectable assets, especially when the alleged infringement occurs across borders through API calls. The timeline of accusations reveals a pattern: each major Chinese model release—DeepSeek R-1, Kimi K2, now Alibaba's Qwen—is accompanied by allegations of illicit training. This suggests that distillation is not an isolated incident but a systematic strategy to leapfrog U.S. capabilities at a fraction of the cost. Anthropic's June 10 letter may be the catalyst, but the industry is watching for whether the government will treat this as a trade enforcement issue, a cybersecurity threat, or both. Looking ahead, we can expect a bipartisan push in Congress, potentially folding AI model protections into existing export control frameworks like the Export Administration Regulations (EAR) or new AI-specific legislation. U.S. firms may also invest in more robust model watermarking and adversarial hardening techniques to detect and resist distillation. However, such technical countermeasures are still nascent and could be circumvented by dedicated attackers. The standoff is likely to intensify, with Chinese labs continuing to leverage low-cost distillation while U.S. policymakers debate the balance between protecting innovation and maintaining open scientific exchange. The outcome will set a precedent for how nations govern the intangible assets of the AI age.