Anthropic Accuses 7 Chinese AI Labs of Distilling Claude; Experts Say It's Nearly Impossible to Prevent
nashnova research
Anthropic published a 154-page report accusing seven Chinese AI labs of systematically extracting Claude's capabilities; security researcher Yi Liu argues anti-distillation is a losing battle — the real contest is commercial, not technical.
What is "distillation," and what exactly is Anthropic alleging?
Distillation means using a stronger model's outputs to train a weaker one — copying the answers instead of building your own dataset from scratch.
Anthropic claims seven Chinese labs used stolen credit cards, forged accounts, and API keys to access Claude at scale. Some reportedly forwarded user queries directly to Claude or bought conversation logs from third-party routing services for training.
This means → The allegation is not casual copying. It describes organized, industrial-scale capability extraction involving identity fraud and data resale.
Hasn't Anthropic raised this alarm before?
In February 2026, Anthropic named DeepSeek, Moonshot AI, and MiniMax, claiming the three used roughly 24,000 fake accounts for over 16 million interactions with Claude.
Anthropic tightened defenses afterward; OpenAI and Google have been doing the same.
In plain terms = Distillation is not an isolated incident. It is an industry-wide, ongoing offensive, and virtually every frontier U.S. model company is responding.
How do the three layers of defense work?
Researcher Yi Liu — who has twice earned Anthropic bug-bounty awards and studied chain-of-thought theft attacks — breaks anti-distillation into three layers: an embedded classifier that blocks requests when extraction behavior is detected; a product-level compression of the chain of thought (the model's reasoning steps) before output, hiding raw logic; and an external monitor that checks overlap between output and the chain of thought, banning accounts that cross the threshold.
Anthropic also uses prefix caching — a technique that reuses shared prompt prefixes. When multiple accounts share the same cache, the system can link them to a single distiller.
This means → The defense logic is behavioral inference: whoever sends a burst of requests targeting a fixed dataset is flagged as a suspect.
They can catch the behavior — but can they prove it?
Liu points out that Anthropic can identify suspected distillation but struggles to obtain hard proof — "It can accuse a company of attempting distillation, but it is very hard to prove the data actually entered their model."
This reflects a structural limit: open-source models publish weights (model parameters) but not training datasets. Reverse-engineering a distillation source from weights alone is technically near-impossible.
In plain terms = You can catch someone taking photos of your exam paper, but proving they used those photos to pass their own test is a different matter entirely.
Why call anti-distillation "a losing battle" — what is it really protecting?
Liu is blunt: anti-distillation is a "false problem" technically — "As long as a model is available for use, it leaks. As long as distillation is more efficient than building your own dataset, people will distill you first."
He argues the real goal is not protecting the model itself, but the commercial value built on a technological lead — raising rivals' data-collection costs, slowing competitors, extending the lead window, and using public reports to shape narratives and protect valuations.
This means → The 154-page report reads less like a technical document and more like a commercial statement aimed at investors and regulators.
Could a product-architecture shift solve the problem at the root?
On the same day, OpenAI officially launched the Agents API public beta, which hides the intermediate chain of thought and execution entirely — users receive only the task result.
Liu's assessment: "In that scenario, distillation would cost significantly more." The architecture shifts from "here's the answer" to "here's just the result" — distillers can no longer even see what to copy.
In plain terms = This raises the distillation barrier more than account bans or classifiers ever could — but whether it can truly block distillation remains an open question.
市场有风险，内容仅供研究参考，不构成投资建议。