The case for imposing costs on China’s AI distillation campaigns

U.S. policy circles reacted with a mixture of alarm and confusion when Chinese AI company DeepSeek released its open-source “R1” model in January 2025. R1 appeared to deliver reasoning capabilities competitive with OpenAI’s o1 at a reported training cost of roughly $6 million—a fraction of the investments made by leading U.S. laboratories. That apparent efficiency gap set off intense debate about whether China had found a fundamentally superior approach to AI development. The release was widely described as a Sputnik moment for U.S. AI leadership.

A year later, the picture is considerably more complicated—and in some ways more troubling. It is now clear that China’s apparent efficiency gains did not rest on engineering alone. In February, three leading U.S. AI developers disclosed a broader pattern of industrial-scale extraction attacks against their frontier models. OpenAI informed the House Select Committee on China that DeepSeek employees had developed methods to circumvent its access restrictions and systematically harvest model outputs—a process known as knowledge distillation. Anthropic revealed that three Chinese AI laboratories—DeepSeek, Moonshot AI, and MiniMax—had used more than 24,000 fraudulent accounts to generate over 16 million exchanges with Claude, systematically extracting its reasoning capabilities, chain-of-thought processes, and agentic behaviors. And Google’s Threat Intelligence Group documented similar extraction attempts against Gemini, observing that distillation attacks had increased over the preceding year.

These disclosures did not emerge in a vacuum. As early as 2024, Microsoft security researchers had observed individuals allegedly affiliated with DeepSeek exfiltrating large volumes of data through the OpenAI application programming interface (API). When DeepSeek R1 launched, White House AI and crypto czar David Sacks stated publicly that there was “substantial evidence” that DeepSeek had distilled from OpenAI’s models. The February 2026 disclosures documented the practice at an industrial scale. Dmitri Alperovitch, chairman of the Silverado Policy Accelerator and co-founder of CrowdStrike, observed: “It’s been clear for a while now that part of the reason for the rapid progress of Chinese AI models has been theft via distillation of U.S. frontier models.”

Read more at Just Security