US Says China's AI Giants Are Stealing American Models — and Beijing Just Threatened Countermeasures
Beijing is done playing defense. On Wednesday, September 16, the People's Daily — the Chinese Communist Party's official mouthpiece — rejected U.S. accusations that Chinese AI companies are stealing American models through "distillation" as "without factual or legal basis" and warned that Beijing will deploy countermeasures if Washington uses the claims to suppress China's AI sector. It was the sharpest escalation yet in a fight that has moved, in a matter of weeks, from industry reports to a joint NSA-FBI-CISA advisory — and now onto the agenda of the September 24 Trump–Xi summit in Washington.
This is no longer a technical debate about how models learn from each other. It is a confrontation over the future of the AI industry — one that could end with sanctions, Entity List designations, and a further splitting of the global AI ecosystem. Here is what is actually verified, what is merely alleged, and why the next ten days matter so much.
Beijing's warning: countermeasures are on the table
The People's Daily commentary, published September 16 and reported by the South China Morning Post, is the clearest signal yet that Beijing views the distillation fight as economic warfare by another name. The paper argued that Washington is "politicising" what it describes as a routine technical and commercial practice, and accused the United States of expanding its restrictive measures from chips to AI-model access — "rooted in deep-seated anxiety over the potential erosion of its technological dominance." Crucially, it warned that Beijing would take countermeasures if the accusations are used to suppress China's AI sector.
The commentary followed a September 14 briefing in which Foreign Ministry spokesman Guo Jiakun rejected the suggestion that China's AI progress poses a risk to U.S. national security, saying AI development "concerns the shared well-being of all humanity" and urging an open, inclusive approach.
China's commerce ministry struck a similar tone a week earlier, responding to the U.S. advisory by saying the allegations "lacked factual basis and legal grounding," calling distillation a "neutral technical method in nature" — and adding a pointed twist: some American companies, it claimed, had "extensively distilled Chinese models" themselves. Foreign ministry spokeswoman Mao Ning urged the U.S. to "refrain from making false accusations and smearing China."
The September 8 advisory that named names
The latest U.S. volley came September 8, when the NSA, FBI, and CISA released a joint Cybersecurity Advisory — AA26-251A — with an unusually blunt title: "China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies." The advisory named six firms: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI.
According to Reuters' account of the advisory, U.S. officials said the named companies are "engaging in aggressive, malicious and targeted distillation activities at an industrial scale" — campaigns running since at least late 2024 that allegedly extracted billions of tokens from Claude, GPT, Gemini, and Grok through proxies, "transfer stations," and fleets of fake accounts. The advisory assessed the campaigns were conducted "likely with Chinese government awareness."
Anthropic's own September report, covered by the Financial Express and Infosecurity Magazine, put numbers on the alleged activity — but with an important caveat: the figures come from Anthropic's own investigations and have not been independently verified. The company attributed more than 151 million exchanges to an Alibaba-affiliated campaign between May and July, peaking at roughly 3 million exchanges per day across more than 3,500 fraudulent accounts; more than 12.1 million exchanges to DeepSeek over 14 days in July; and more than 3.4 million to Zhipu over 17 days in June and July.
What is distillation, and why is Washington so angry about it?
Distillation is one of the most ordinary techniques in machine learning: one AI model learns by studying the outputs of another, typically to make a smaller, cheaper, or more specialized version. It is how countless startups have built products on top of frontier models — and even the White House has acknowledged the practice is legitimate. Michael Kratsios, director of the White House Office of Science and Technology Policy, wrote in July that "legitimate AI distillation used to create smaller, more efficient models plays a vital role in this open innovation ecosystem."
Kratsios drew a line, though: "large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable."
The line is blurrier than Washington admits. In sworn testimony in 2026, Elon Musk said his own company, SpaceXAI, had distilled OpenAI's models to develop Grok — and that the practice was common across the industry. And when Treasury Secretary Scott Bessent claimed in July that officials were "finding watermarks of our U.S. large language models on many of the Chinese models," Treasury never explained what those "watermarks" actually are, and did not respond to TechCrunch's request for clarification.
The July flashpoint: Moonshot, Kimi K3, and the sanctions threat
The distillation fight turned political on July 22, when Kratsios posted on X that the United States had "information that Moonshot AI distilled Anthropic's Fable for the development of its K3 model." He alleged Moonshot had built "a sophisticated internal platform to conduct large-scale distillation against U.S. models," allowing it "to quickly switch between multiple methods of access to avoid detection" — and further alleged the Beijing lab had acquired Nvidia's GB300-equipped servers and accessed GB300 chips in Thailand, Blackwell-generation hardware banned from sale to China.
Kratsios shared no public evidence for any of it. TechCrunch noted at the time that he "did not share more details about the sources of his allegations." The GB300 claim has never been publicly substantiated.
The same day, Bessent posted on X: "We support open-source AI and the innovation it unlocks. But open source is not open season on American IP. When [Chinese] firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table." A day earlier on Fox Business, he had said: "If we see, especially that overseas models are stealing from our great companies, we have the ability to sanction them because of this theft."
Under Secretary of State Jacob Helberg called the alleged conduct "a heist of invaluable American Intellectual Property." No sanctions have actually been imposed on Moonshot or any of the named firms to date.
The target of the allegation is a serious company, not a bit player. Moonshot AI, founded in March 2023 by Yang Zhilin — a Tsinghua-trained researcher who interned at Google Brain and Meta and co-authored transformer papers before GPT-3 existed — released its Kimi K3 model on July 16: a 2.8-trillion-parameter open-weight model billed as the largest open-weight model in the world, near or above frontier U.S. models on coding benchmarks. Full weights were released July 27. The company is valued at roughly $50 billion, confidentially filed for a Hong Kong IPO in early September, counts Alibaba, Tencent, IDG Capital, and HSG among its investors, and is targeting $2 billion in annualized revenue by the end of 2026, per Bloomberg via TechCrunch.
But the experts aren't so sure
Here is where Washington's case gets uncomfortable: the technical community has pushed back hard on the flagship allegation — that K3 was built by distilling Anthropic's Fable model.
The problem is the calendar. Anthropic's Fable 5 was re-released July 1 after being briefly taken offline over export controls. Moonshot released K3 on July 16. "I don't think you get a model this strong and this quickly on the heels of Fable doing strictly distillation," Braden Hancock, a researcher at the Laude Institute and co-founder of Snorkel AI, told TechCrunch on July 23. "There's just not even frankly time, right? Fable's only been publicly available since July 1st. You can't distill that much data, train a model, and release it in two weeks."
Hancock added a broader warning: "In general, Americans are understating the technical expertise of these Chinese teams… These are legitimate researchers and engineers doing solid work… They're not just riding coattails here."
Nathan Lambert, an AI researcher at the Allen Institute for AI, said distillation is "becoming less and less impactful over time as the Chinese models get closer to the frontier and the training regime shifts to [reinforcement learning]," noting that "if it were the case, everyone would be easily able to catch up to a GLM or to a K3 by using its data for distillation. But we have not." Researcher Elie Bakouch pointed out the same 15-day window. OpenAI's head of strategic futures, Dean Ball, said he didn't believe K3's performance could be "explained away by distillation or anything like that." Wharton professor Ethan Mollick summarized the tension: "every sign so far is that there is growing tension about open-weight models between the US & China: the US announcing that they reserve the right to act against distilled models, then saying Kimi distills."
Moonshot itself has denied copying. A company employee, Randy Xian, posted on X in July: "Yes, Fable went public on July 1 and K3 launched on July 15. We trained a brand new frontier model in JUST 15 DAYS. Guinness World Record stuff." The company told China's National Business Daily that K3's performance came from original architectural improvements, not distillation — a claim reported by Reuters.
What remains unproven: that Moonshot's K3 was built mainly by distilling Fable. What is established: that Kratsios made the allegation, that U.S. agencies named six Chinese firms in a September advisory, and that the volume-based claims come from Anthropic's own investigations.
What happens next: a weekend meeting and a summit
The dispute is now a diplomatic fixture. Treasury Secretary Scott Bessent told the House Financial Services Committee on September 15 that "with China, we have had some very good private discussions, and I look forward to those continuing this weekend when I meet my Chinese counterpart Vice [Premier] He Lifeng." According to the South China Morning Post, the long-awaited official U.S.–China AI dialogue will be folded into that weekend economic meeting — what would be the first official bilateral AI-exclusive dialogue of Trump's second term. Reuters reported September 16 that "AI rivalry hangs over Trump–Xi talks," naming distillation as a key flashpoint. As TechPulse USA reported this week, Bessent has signaled openness to discussions on avoiding shared AI risks and avoiding bifurcation — a dialogue that could now be defined by this dispute.
Then comes September 24, when Xi Jinping is expected in Washington for a bilateral summit with Trump — with AI CEOs including Sam Altman, Elon Musk, and Dario Amodei converging on the capital at the same time. Amodei himself sharpened the stakes with a September 12 essay calling for a crackdown on unauthorized distillation by companies in authoritarian countries, warning that "a Chinese lead in AI would pose grave danger for the United States and the world."
The collision is the story: one track of U.S.–China engagement is trying to build guardrails, and another is threatening sanctions over alleged theft — over the same models, in the same rooms, within days of each other. Bessent has said China could "never get ahead" of the U.S. in AI because of distillation, per the South China Morning Post. Beijing, via the People's Daily, says it will answer suppression with countermeasures.
Whoever proves right, the distillation dispute has already become the template for the next phase of the AI rivalry: less about chips — which the U.S. has been restricting for years — and more about the knowledge inside the models themselves. Washington is trying to turn AI weights into an export-controlled asset. Beijing is calling that AI hegemonism. And next week, both sides will be in Washington arguing about it in person.
Sources: South China Morning Post (Sept 16), Reuters (Sept 8, Sept 16), TechCrunch (July 22, July 23, Sept 11), Straits Times/AFP, Financial Express (Sept 16), Infosecurity Magazine, The Hindu, WaterISAC (AA26-251A), Cointelegraph, CoinDesk.
Comments
Post a Comment