On October 12, Anthropic released its report Strengthening Defenses Against Distillation Attacks, detailing measures to make Claude's reasoning traces harder to extract. The company said that after implementation, the volume of reasoning tokens extracted on its own platform by identified distillers fell by approximately 90%–99%.
These defenses focus on protecting the intermediate process through which the model forms an answer. Anthropic restricts modifications to existing reasoning contexts and the use of reasoning traces across models and organizations. It also detects and blocks requests seeking complete reasoning, rate-limits and bans accounts that repeatedly try, and charges for some blocked requests. Its internal experiments show that complete reasoning traces are more useful than summaries for training another model; making these materials harder to obtain raises the barrier to copying the corresponding capabilities.
The report again mentioned Moonshot AI, citing a September investigation alleging that some Kimi user requests had been secretly forwarded to Claude. One involved analysis of surveillance material, and Anthropic judged the user likely to be connected to the military. The distillation controversy therefore involves two data flows that require separate examination: whether outputs from external models entered the training of Chinese models, and whether information users submitted to Kimi was passed to other service providers.
By midday Beijing time on October 13, public materials established that Chinese teams had used ChatGPT and Claude outputs to train specific models, with developers' disclosures corroborated by public datasets and project materials, including million-sample datasets. Anthropic and OpenAI had also made specific investigative allegations about bulk collection by leading companies. How much those data contributed to commercial flagship capabilities, and whether Kimi actually passed on the alleged weapons plans circulating online, still require separate assessment along their respective evidence chains.
1. Clarifying the mechanisms: real-time API forwarding is different from model distillation, and evaluation calls are different from training-data inclusion
In technical terms, model distillation means training or fine-tuning a student model against answers, reasoning steps or tool-use trajectories generated by a high-performing teacher model. Through gradient updates, the student absorbs knowledge and logical patterns from the teacher's outputs, eventually gaining the ability to generate high-quality answers independently. The two systems need not share a neural-network architecture, and the process is not limited to a large model teaching a smaller one.
This training mechanism must be distinguished carefully from engineering-level online forwarding:
- Real-time proxy forwarding: After receiving a user's prompt, a product directly calls a third-party model API and displays the result. This consumes computing resources and network bandwidth but does not change the local model's parameter weights.
- Inclusion in post-training distillation data: The system persistently stores user questions and high-quality third-party answers, then cleans, anonymizes and formats them for a training pipeline that updates model parameters.
Anthropic's allegations about Kimi provoked a strong reaction because it accused Moonshot AI of connecting both routes: using Claude as a real-time question-answering stand-in at the front end, while retaining those interactions at the back end and converting them into training material for its own models.
Model development also involves many auxiliary calls. Teams may use external models as data-cleaning filters, reviewers of synthetic material or judges in benchmarks—LLM-as-a-Judge. The appearance of Claude or GPT in an academic paper only indicates a particular role in the workflow. Listing a model in a benchmark table is fundamentally different from using it as a source in a supervised fine-tuning, or SFT, recipe.
Scale measurements also differ by level. Thousands of registered accounts do not mean an equal number of actual engineers; millions of API requests do not mean an equal number of successfully cleaned training examples ultimately included in a dataset. Establishing that a capability truly comes from external data requires an ablation study that removes those data while tightly controlling the base model and training compute.
2. Examining Kimi's data flows: Anthropic alleges nearly 300,000 forwarded requests in ten days; weapons-plan and disclosure rumors still lack corroborating evidence
On user-data flows, pages 148–149 of Anthropic's September report provide its investigative account of the Moonshot AI case.
The report alleged that during a particular ten-day window, Moonshot AI used a proxy network built from 5,380 fake accounts to route nearly 300,000 customer requests into Anthropic's systems, with the vast majority specifying its top-tier Claude Opus model. After Claude generated answers, Moonshot AI returned the results to end users and retained at least some of the data, extracting reasoning for internal training.
The data flow described in the report was: users submit information to Kimi → Moonshot AI routes it through a distributed proxy pool to Claude → Claude's output is returned to users, while some conversation records are retained and placed in a subsequent training pool.
The allegation leaves significant statistical gaps. Nearly 300,000 measures total forwarding during ten days; the report separately stated that more than 23 million distillation interactions were attributed to Moonshot AI between May and July 2026. Anthropic did not disclose the overlap or deduplication logic between these datasets, preventing outsiders from estimating the share of genuine customer requests in total calls. More critically, Kimi's total request volume during the same period—the denominator—was not public. The industry therefore cannot infer what proportion of Kimi's online service was actually performed by Claude, much less extend the conclusion indiscriminately to every Kimi version, locally deployed edition or access point.
The report highlighted two representative security-sensitive cases:
- Security-surveillance analysis: A user whom Anthropic inferred was likely connected to the military submitted closed-circuit television, or CCTV, archives to Kimi and asked it to assess whether a particular surveillance target showed unusual behavior. The report described feeds from hundreds of cameras in Chengdu, including locations around the external perimeters of some military-related institutions, research institutes and large state-owned enterprises. It explicitly used probabilistic language in identifying the user. There is also a clear security-boundary difference between cameras outside facilities and penetration of a core internal surveillance network.
- Building a state-owned enterprise system: A software engineer at a large state-owned enterprise used Kimi to build an internal corporate system, submitting internal business code from several enterprises and system-access credentials that were active at the time. The report did not disclose company names, system types or credential details.
The technical form of the allegations on these two pages is a platform's investigative narrative, without anonymized original network packets, verifiable API call logs or underlying routing records. The widely circulated screenshot with yellow highlighting is a screenshot of the report's original text on page 149. It repeats the report's claims and does not constitute independent evidence of a disclosure that can corroborate them.
Anthropic's account also differs in its statements about users' knowledge. In the overview it said it could not confirm whether Moonshot AI had notified customers, but in the engineer case it directly assumed that the end user had no way of knowing. Whether users actually knew about and authorized the transfer still requires examination of the specific product access point, applicable contractual terms at the time and actual consent records.
The more dramatic weapons-plan claim currently comes only from Axios's October 3 video interview with Bessent. The transcript confirms that Bessent made the statement, but the relevant segment did not show an original document, a classification determination or records proving data calls. It also did not explain whether the statement referred to the same event as the September Chengdu surveillance case. In its October 12 follow-up on system defenses, Anthropic still relied on the surveillance case from its September report.
Several critical evidentiary leaps separate surveillance material and corporate code and credentials from weapons-development plans, and then from online claims of leaked state secrets. The report explicitly identified the recipient as the commercial entity Anthropic; there is currently no complete evidentiary chain establishing access by U.S. intelligence agencies. Meanwhile, Moonshot AI had denied rumors on September 12 that its founder and employees had been taken away. On the evening of October 12, Beijing police said they had imposed criminal compulsory measures on people who fabricated reports that several employees of a technology company had been taken away. Police did not name the company; STAR Market Daily checked with people familiar with the matter and linked the notice to the earlier Moonshot AI rumor. Its debunking further underscores the need to distinguish emotionally charged online misinformation from serious cross-border technical investigations.
3. Code and paper evidence: from BELLE's 2 million fine-tuning examples to Kimi-Dev's use of 5,016 Claude trajectories
Leaving disputed allegations aside, have Chinese AI developers used U.S. model outputs in training? Yes. This is already documented in public academic literature, open-source code repositories and model-weight libraries.
One publicly documented million-example case is BELLE, open-sourced in 2023 by the Beike technology team. Its paper details the data-production route: researchers translated Stanford Alpaca's seed prompts into Chinese and used ChatGPT to generate large-scale instruction-response data. Using the Bloomz-7b1-mt base, they systematically compared fine-tuning with 200,000, 600,000, 1 million and 2 million synthetic examples. They ultimately released BELLE-7B-2M, combining 2 million Chinese instructions and 50,000 Alpaca examples.
The project's complete assets—a JSON dataset with 2 million prompt-answer rows, LoRA and full fine-tuning scripts, and weights on Hugging Face—remain publicly downloadable. That a Chinese team used millions of ChatGPT-generated examples to fine-tune models is an established fact supported by a complete evidence trail in the academic and open-source communities.
The clearest technical evidence directly related to Moonshot AI appears in Kimi-Dev, a paper on a specialized model jointly published by Moonshot AI and universities including Tsinghua. The research aimed to build a specialist agent for long-horizon software engineering. It used Alibaba's open-source Qwen2.5-72B as the base, combined large-scale code pretraining and reinforcement-learning feedback, and used external multiround tool interactions to repair code.
Section 4 explicitly records that, during an additional supervised fine-tuning stage for SWE-Agent adaptation, the team directly introduced 5,016 complete software-engineering agent trajectories generated by Claude 3.7 Sonnet, provided by the open-source SWE-smith project. The trajectories recorded Claude's multiround operations and feedback while locating bugs, calling a terminal and running tests. In this adaptation setting, Kimi-Dev achieved a final single-attempt resolution rate of 48.6% on SWE-bench Verified.
This establishes actual use of high-quality Claude reasoning trajectories in a specific model's post-training. Two boundaries remain. First, Kimi-Dev is a research agent model built for a particular coding benchmark; those 5,016 trajectories cannot be extrapolated directly into the training recipes of general-purpose commercial bases such as Kimi K2 or K3. Second, a dataset's open-source license does not automatically mean its upstream service provider authorized commercial model training. Yet training on external outputs alone is also insufficient to establish illegality; the specific conduct and applicable rules still need examination.
4. Escalating platform allegations: Anthropic discloses hundreds of thousands to hundreds of millions of interactions involving Alibaba and four others, but attribution logs do not trace through to model weights
As model competition intensifies, foreign model providers' restrictions on API outputs have evolved from early anti-scraping measures into large-scale threat-intelligence tracking of industrialized extraction.
On February 23, 2026, Anthropic first publicly accused three Chinese vendors together of systematic distillation. It alleged approximately 24,000 fake accounts and more than 16 million interactions—over 150,000 for DeepSeek, 3.4 million for Moonshot AI and 13 million for MiniMax—using reverse prompting to extract reasoning chains and coding actions in bulk.
In its September 10 report, Anthropic broadened the monitoring scope and provided specific observation windows and call-volume figures:
| Accused organization | Observation window | Total interactions disclosed in the report |
|---|---|---|
| Alibaba | May–July 2026 | >151 million |
| Moonshot AI | May–July 2026 | >23 million |
| DeepSeek | 14 days in July 2026 | >12.1 million |
| Zhipu AI | June–July 2026 (17 days) | >3.4 million |
| Xiaomi | March–April 2026 (20 days) | >400,000 |
These figures show intensive, industrial-scale calling patterns. As the platform directly handling the traffic, the provider has privileged network visibility and first-hand anti-fraud evidence, including request-IP clusters, linked payment paths and sudden changes in call frequency. Technical details in the report, such as a single proxy intermediary handling traffic for several organizations and automated scripts circumventing rate limits, have substantial threat-intelligence credibility.
A critical technical gap nevertheless remains between threat intelligence and independently reproducible training attribution. Although the report disclosed some fingerprints and anonymized prompts, it did not include end-to-end call logs connecting particular companies' accounts with underlying requests. The accompanying 209 indicators of compromise, or IoCs, primarily support network defense. They do not contain the campaign identifiers corresponding to companies in the distillation section and cannot fill the gap in public distillation-attribution logs. Observation windows also differ, so interaction counts cannot be summed into a total of effective training samples.
OpenAI presents a parallel line of allegations. In a February 2026 memorandum to the U.S. Congress, it said accounts associated with DeepSeek employees had extracted model outputs in bulk through third-party gateways disguising their origins. Previously published excerpts from an OpenAI letter also concerned extracting reasoning, scoring and filtering answers, and transforming training data.
On September 30, OpenAI further disclosed a bulk extraction incident targeting unpublished internal hidden chain of thought, or Hidden CoT. On July 24–25, more than 4,000 users launched about 16,000 highly specialized probes seeking to induce the model to transcribe hidden deeper reasoning; subsequent linkage analysis identified more than 15,000 users in total. OpenAI qualified the disclosure carefully: these were extraction attempts and did not necessarily succeed; no database breach or defeat of encryption occurred. Ultimately, it attributed only one core cluster to individuals associated with Moonshot AI, rather than assigning all anomalous traffic to one entity.
Official documents also require technical cross-checking. For example, a September 8, 2026 joint advisory by the U.S. National Security Agency, Cybersecurity and Infrastructure Security Agency and Federal Bureau of Investigation placed DeepSeek activity from late 2024 to mid-2025 alongside Claude Sonnet 4.5, Opus 4.1 and GPT-5. Public records, however, show those three models were officially released between August and September 2025. This chronological mismatch prevents that passage from serving directly as precise evidence of model versions and timing. It weakens the reliability of that particular statement; other platform investigations still require individual assessment.
5. Third-party reverse detection: behavioral-overlap experiments detect prompt responses but struggle to exclude standard solutions and base-model coincidence
Without fully white-box model weights, researchers have tried to infer relationships between large models through black-box output similarity and conditional probability distributions. Recent academic debate shows that these methods are highly susceptible to misattribution.
The August 2026 preprint Stolen Thoughts designed a comparative experiment using 30 complex interdisciplinary problems. Researchers fed the first 1% of Claude Opus 4.8's solution chain of thought to Kimi K3 as a fixed prefix, asked it to continue, and compared the continuation with Claude's original answer at the token level.
For 29 of the 30 problems, Kimi's n-gram overlap increased after the Claude prefix was added. The average metric rose from 0.160 to 0.305 in the STEM group and from 0.203 to 0.289 in the non-STEM group; both differences remained significant after correction for multiple testing. The experiment detected significant behavioral compatibility: a particular teacher's solution clues produced greater textual overlap in the model's visible answers. It measured local overlap of contiguous one- to three-token fragments in the first 100 answer tokens, combining each problem's highest-overlap results at sample counts of 1, 10, 50 and 100. It cannot be interpreted as showing that 30.5% of ordinary answers were copied directly. A subsequent style classifier also easily distinguished Kimi from actual Claude, so this cannot directly establish a causal training relationship.
The subsequent AuxMark study further exposed the method's limitations. The team retested some published examples using Kimi K2.6 and the open-source GPT-OSS-120B; K2.6 is a different version from the original experiment's K3. Four samples per group showed:
- For a classic geometry problem, Kimi K2.6's maximum overlap was 0.565 with a teacher-biased opening, but rose to 0.662 with the non-teacher prefix “This is an unfamiliar”;
- For a differential-equation problem with standardized solution steps, GPT-OSS-120B's spontaneously generated answers averaged about 0.50 overlap even without a teacher prefix.
This indicates that similar outputs on highly specialized mathematics and logic tasks may also result from standardized solution paths and the statistical tendency of repeated sampling to increase maximum similarity. Such overlap cannot simply be equated with direct distillation inheritance inside a model.
In white-box probability detection, another study, DistillDetect, examined open-weight models' cross-entropy loss when predicting teacher answers. The authors retained 19 improved students from 24 controlled distilled models. In a ranking task where the true teacher was known to be in the candidate list, all 19 teachers were ranked correctly. Another experiment tested whether a true teacher was present among candidates, combining 19 students, two test sets and teacher-present or teacher-absent conditions into 76 test units. Accuracy was 82.9% when only the tested student was excluded from threshold calibration; it was 60.5% when all cases from the tested teacher's family were excluded. Under the latter condition, after removal of the true teacher, five of the 19 students were still significantly attributed to other candidates. Ranking and teacher-presence detection are different tasks; 100% and 60.5% cannot be presented as a decline in the same accuracy measure. In tests on DeepSeek R1, the algorithm ranked Alibaba's QwQ and OpenAI's o1 as the leading suspects on two different benchmarks. These diagnostic rankings change with the test set and cannot directly establish teacher identity. The method reads open-weight model probabilities rather than merely comparing black-box outputs.
As for occasional identity errors in ordinary interactions, such as claiming to be an assistant developed by Anthropic, an identity-recognition paper published at ACL 2025 noted that role-playing and leading prompts can also create identity contradictions. Such responses are leads for further examination, not independent proof of training origins. A secret watermark must be planted in teacher outputs in advance and calibrated for false positives; ordinary identity claims lack such a provenance marker.
6. Disentangling capability sources: external demonstrations cannot reveal flagship dependence; reinforcement learning and self-distillation underpin independent training
Where do large-model capabilities come from? Modern large-language-model engineering shows that high-quality external demonstrations and independently developed core systems are not mutually exclusive; they work together in complex pipelines.
In the Kimi-Dev paper, researchers compared four types of student model using the same pool of 5,016 Claude trajectories. In the vast majority of settings across different fine-tuning token budgets, students that had already undergone code reinforcement learning, or RL, performed better. Students with different training histories used the same demonstrations with different effectiveness. This shows that high-quality external demonstrations act more like a catalyst: their conversion into capability depends heavily on a team's own work in base pretraining and reinforcement-learning alignment algorithms.
Anthropic's internal experiments released on October 12 similarly demonstrated the marginal effect of data form. Training its own Claude student on complete Opus 4.8 chains of thought produced an 80.4% SWE-bench Verified score, 8.6 percentage points higher than the 71.8% achieved with summarized reasoning trajectories. This demonstrates the high information density of full reasoning, but ablation results within Anthropic's own closed experimental setup cannot be mechanically converted by any formula into the share of Chinese vendors' capabilities attributable to external models.
Technical reports from leading Chinese vendors show diverse self-distillation and synthetic-data pipelines:
- Moonshot AI describes in its Kimi K2-to-K3 development notes a multi-teacher collaborative distillation system using predecessor models and internally developed heterogeneous expert models;
- DeepSeek comprehensively discloses its self-distillation architecture in its formal technical report. Its open-source distilled series, such as DeepSeek-R1-Distill-Qwen/Llama, explicitly uses its own R1 as teacher to train Qwen- and Llama-based students;
- MiniMax disclosed a rotating-teacher mechanism for agent training in its M2 report without naming the teachers. Its M3 training summary separately lists synthetic data generated by its own M2.7 model.
Large-language-model advances are thus systems-engineering outcomes combining pretraining on vast unlabeled datasets, very large-scale synthetic-data filtering, alignment with human intent, reinforcement-learning self-play and multistage knowledge distillation. With no company fully publishing training-cluster logs and weight-ablation records, an assertion that a certain percentage of a flagship model's overall capability comes from U.S. models is unsupported scientifically and technically.
Taken together, the public evidence supports three clear conclusions:
First, direct evidence of fine-tuning exists. Chinese development teams have used ChatGPT and Claude outputs as fine-tuning material in academic exploration and specialized engineering models. BELLE's 2 million synthetic examples and the Kimi-Dev paper's 5,016 Claude trajectories are firmly documented public facts.
Second, industrial-scale calling allegations have first-hand platform evidence, but cannot quantify flagship dependence on external models. Anthropic's tens or hundreds of millions of interactions, along with bulk extraction activity separately disclosed by OpenAI, point to industrialized collection attempts. Without public records tracing individual traffic through to final model weights, outsiders cannot quantify or characterize commercial flagships' external dependence conclusively.
Third, user-data transfers and weapons-plan allegations lack a complete objective evidence chain. Claims that Kimi transferred sensitive material remain a service provider's unilateral investigative account, with the core underlying data chain unavailable to the public. The sole weapons-plan claim in the Axios interview lacks third-party corroboration or technical records. Rumors that company personnel had been taken away have meanwhile been challenged by an anonymized police notice and corresponding media verification. Examination of technical flows between large models still needs to rest on verifiable code, weights and actual call logs.
