// TOM'S HARDWARE US — HARDWARE & GADGET
US frontier AI companies warn authorities over sophisticated distillation attacks — China warns of 'countermeasures' if America tries to constrain domestic AI models
Direct attacks may be simple enough to stop, but buying up third-party conversations remains an elusive vector.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
The U.S. government and American AI developers are growing increasingly concerned about the effectiveness of so-called distillation attacks against Western Frontier AI models, as Bloomberg reports. This may be helping China and Russia develop AI models with similar capabilities, but at a fraction of the cost and compute requirements. China has publicly rejected these claims, but pledged to enact "countermeasures" if America used the pretext of these allegations to "contain" Chinese developments.
Efforts to combat distillation attacks have been ongoing for much of 2026 already, with major Western AI labs pledging to work together against such efforts earlier this year. But even with attempts to detect and prevent distillation, foreign actors have also been purchasing logs of third-party conversations made using legitimate accounts, making it hard to halt the practice entirely.
Distillation is an effective method of training smaller language models by feeding them prompts and responses from a more advanced model. By analyzing the outputs of a model and comparing them with the inputs from the user, smaller models can learn to emulate the capabilities and responses of the more intelligent model, without the need to train them in quite the same way.
It's speculated that distillation is how Chinese AI developers made such great leaps with Deepseek in 2025 and Kimi K3 in 2026. They weren't quite as capable as frontier models from Anthropic and OpenAI, but they were able to deliver similar levels of intelligence faster and far cheaper.
But where distillation is considered a legitimate way for companies to train smaller models for internal use, or for standalone AI developers to create more capable, lighter models for local use or specific workloads, training on other companies' models is seen as more malicious. The argument is that it takes the hard work and investment of other firms, who in some cases have spent significant resources training frontier-level AI models.
You could argue that companies like OpenAI and Anthropic also trained their models on illicitly obtained material, like pirated books and scraped web articles. Indeed, the South China Morning Post claims that Thinking Machines' Inkling AI model used other models, including Moonshot's Kimi K2.5, to generate early training data.
The argument over distillation highlights the different approaches to AI development taken by leading companies in the U.S. and China. While the likes of Anthropic, OpenAI, and Google have kept their models proprietary and mostly opaque in their design and development, many of the flagship Chinese alternatives are open-weight models. That means that parts of the underlying design of their model weights are freely readable by anyone, allowing them to run on just about anything, as long as the hardware is capable enough.
Although it would likely be a mistake to characterize Chinese efforts as altruistic, American models are much more clearly aimed at generating a profit — even if they've yet to manage it in some cases. Having invested hundreds of billions of dollars in AI development and compute power, it's understandable that they don't want a Chinese lab pulling value from that development and releasing it for anyone to use. That massively impacts the business model of frontier AI businesses.