AMERICA’S TOP artificial-intelligence labs have accused their Chinese rivals of being ruthless copycats. This month Anthropic and OpenAI each disclosed evidence that leading Chinese AI labs have illicitly used American models to train their own. The firms accuse Chinese researchers of aggressively “distilling” American chatbots—feeding them prompts in order to learn from and mimic their responses. “China is, in effect, stealing the weights of our best AI models,” says Chris McGuire of the Council on Foreign Relations, an American think-tank. “These are among the most valuable assets on earth.”
Such claims are not new. OpenAI accused DeepSeek of similar behaviour early last year, after the Chinese lab shocked Silicon Valley with the release of its R1 model. Since then Chinese firms have unveiled models that rival American chatbots on certain metrics, with as little as a few weeks’ delay, while being cheaper to train and run. Anthropic’s claim on February 23rd that three leading Chinese firms have secretly tried to emulate its chatbot helps to explain how they have kept pace. American labs say Chinese competitors use “distillation attacks” to jump closer to the frontier of model development for just a fraction of the cost.
AI labs have closely watched rivals’ efforts to train on their products over recent months. Anthropic’s disclosure comes as the industry awaits DeepSeek’s newest model, which could appear as soon as next week. According to Reuters, the Trump administration believes DeepSeek trained the system in a facility in Inner Mongolia on Nvidia’s advanced Blackwell chips, in violation of export controls. DeepSeek is said to be planning to hide its use of the chips, potentially pitching the release as a win for China’s effort to localise its AI supply chain. America’s government, however, argues that the model’s advanced capabilities are likely to rely on distillation.
American firms commonly use the same methods to train non-frontier models on the cheap, especially for free “open-weight” systems. But Anthropic says that using its products to train a rival model, as it alleges three Chinese firms—DeepSeek, Moonshot and MiniMax—have attempted, is a violation of its terms of service. Anthropic alleges they cumulatively created 24,000 fraudulent accounts that engaged with its models more than 16m times. The firms have not responded publicly. Google DeepMind said that it had observed “intellectual-property theft” of its systems in a report earlier this month, but did not attribute the attacks. Both labs said that distillation attempts had become more common over the past year.
One reason for this is that distillation has become more powerful. Until recently, AI labs improved chatbots by feeding them vast quantities of text scraped from the internet. The more a model read, the cleverer it became. But the frontier has shifted. Today, cutting-edge models learn by trial and error, attempting tasks repeatedly and reinforcing only the approaches that work. That eats at the limited computing power of chip-constrained Chinese companies. Distillation helps. By using other people’s machines to produce such “synthetic data”, the labs ensure they keep their own chips dedicated to training.
The rub is that American labs spend billions to create data in the first place. They pay human experts—mathematicians, say—to write step-by-step solutions to hard problems, to create worked examples for their models to learn from. Unlike the diffuse knowledge gained from the web, the know-how needed to complete a task, like a maths problem or booking a flight, is specific and extractable. Copycats can ask models to do tasks and simply harvest their solutions, without all the trial and error.
American labs make expensive bets on training techniques with high failure rates. Individual training runs can cost billions, while firms have committed $5trn of data-centre investment between now and 2030, according to JPMorgan Chase, a bank. Such largesse is challenged by rivals that are nearly as good, but much cheaper. Since DeepSeek released R1, China’s global share of the open-model market has rapidly grown, overtaking America’s, according to researchers at the Massachusetts Institute of Technology in Boston.
It is technically difficult to detect and prevent knowledge distillation, warn American labs. And doing so is made harder by the increasing sophistication of Chinese efforts. These include circuitously routing their online traffic to shield its origins or splitting up tasks across thousands of accounts. Speaking to The Economist, an American official says “a cottage industry” of small firms has sprung up inside China to provide co-ordinated distillation activities, while obscuring the identity of their customers. “The US cannot accomplish open-source leadership if we don’t address this problem,” says the official.
Some Chinese AI researchers point out online that it is hypocritical for labs that trained their models on others’ intellectual property to call foul. Nonetheless, Anthropic, OpenAI and Google DeepMind want action. The American government could ask China’s leadership to crack down on the behaviour, perhaps during Donald Trump’s forthcoming visit to Beijing. But the prospects of Xi Jinping’s government doing so are slim. Alternatively, says Mr McGuire, America could punish Chinese firms engaged in distillation, by booting them from American cloud providers or tightening chip controls. Yet Mr Trump appears unwilling to do anything that might upset the current detente. For now, frontier labs may have to get used to AI firms copying their work.
Subscribers can sign up to Drum Tower, our new weekly newsletter, to understand what the world makes of China—and what China makes of the world.