A pupil who copies a tutor’s worked answers learns faster than one who is handed the textbook and left alone, and nobody objects until the tutor belongs to someone else. Model distillation, the practice of training one model on what another model produces, now sits on that line. In We Must Pace the Frontier, an essay dated September 2026 on his own site, Anthropic co-founder Dario Amodei writes one instruction about it: “Crack down on unauthorized distillation by companies in authoritarian countries.” We read the essay, the paper that named the technique, a usage policy and a model card to see what that sentence could mean in practice.
What does the pacing essay say about model distillation?
Very little, and it is worth being exact about how little. The sentence is the second item in a list of three steps the essay gives for defending the lead that democracies hold over autocracies in AI. The first item is about chips: no sales of powerful AI chips or chip-making equipment to China, and action against chip smuggling. The third is about security at AI companies and the theft of model weights.
The distillation item has one sentence of reasoning behind it. Distillation of frontier models, the essay says, lets lagging companies narrow the gap at a fraction of the cost of developing their own AI independently. Two more lines follow the list. Companies and the US government should cooperate to make the steps effective, and Anthropic has consistently advocated for all of them.
The word distillation appears twice in the essay, both times in that one item. The essay does not define distillation, and it does not say what makes a case unauthorized. It names no company: we searched the text for Alibaba, DeepSeek, Moonshot and MiniMax and found none of them. The words account, API and Usage Policy do not appear either. The item itself says only authoritarian countries, though the same section names the Chinese Communist Party as chief among the authoritarian regimes it has in mind. Who would do the cracking down, and with what instrument, is left open.
What is model distillation, according to the paper that named it?
The term comes from *Distilling the Knowledge in a Neural Network*, by Geoffrey Hinton, Oriol Vinyals and Jeff Dean. arXiv records it as submitted on 9 March 2015 and lists it under the NIPS 2014 Deep Learning Workshop, and the paper gives Google Inc. as the address of all three authors.
The problem it set out to solve was deployment. The abstract says a whole ensemble of models is cumbersome and may be too computationally expensive to serve to a large number of users. The answer was to train the large model first, then use a second kind of training, which the authors call distillation, to transfer its knowledge to a small model better suited to deployment.
The small model is trained on the class probabilities the large model produces, which the paper calls soft targets. The paper’s argument is that the relative probabilities a large model gives to wrong answers say a lot about how it generalises, and a small model can learn from that. Its headline result is an improved acoustic model for what the abstract calls a heavily used commercial system.
The words competitor, rival and licence do not appear in the paper. In its original form, distillation is something the owner of a large model does to its own model so that it can afford to serve it.
When is model distillation ordinary practice, and when does a lab call it an attack?
There are three cases, and permission is what separates them.
The first is distilling your own model. DeepSeek’s model card on Hugging Face for DeepSeek-R1-Distill-Qwen-7B says the company released six dense models distilled from its DeepSeek-R1. The card describes them as fine-tuned from open-source models on samples generated by DeepSeek-R1, and its licence section puts the figure at 800k samples. The method has moved since 2015. The paper’s small model matched probabilities. These models learned from generated samples.
The second is distilling an open-weights model under its licence. The same card covers it from both sides. The Qwen-based versions, it says, are derived from the Qwen-2.5 series, originally licensed under Apache 2.0, and the two Llama-based versions carry Llama licences. For its own weights, the card says the DeepSeek-R1 series allows derivative works, including “distillation for training other LLMs”. Permission is written into the file’s paperwork. That is not universal, which is the point of our explainer on open weights and open source: a weights file arrives with a licence, and the licence decides what you may do with it. Our reading of the Kimi K3 release found a licence that requires a separate agreement before commercial use by a model-as-a-service business with more than $20 million in revenue over 12 months. The Qwen3.8-Max weights carry a custom licence while a smaller sibling uses Apache 2.0. Neither of those pieces checked a distillation clause, so we make no claim about one. The clause has to be read per model.
The third case is the one the essay is about: harvesting a hosted model’s answers against its terms. Anthropic’s Usage Policy, effective September 15, 2025, lists under the heading Do Not Abuse our Platform the “Utilization of inputs and outputs to train an AI model” without prior authorization from Anthropic, and gives model scraping and model distillation as its two examples. It says an AI model, not a competing one. Anthropic’s Commercial Terms of Service, effective June 17, 2025, are narrower: section D.4 bars customers from accessing the services to build a competing product, including to train competing AI models, except as expressly approved by Anthropic.
Both clauses turn on approval, which is where the essay’s adjective comes from. Unauthorized distillation is distillation the model’s owner did not agree to. When Anthropic told two US senators in a letter on June 10 that Alibaba had run 28.8 million exchanges with Claude through roughly 25,000 fraudulent accounts, the letter’s word for it was attack. We set out those figures in our piece on the Alibaba numbers, which treats them as Anthropic’s own counts and as allegations no court has tested. That piece also records that Anthropic named DeepSeek in an earlier disclosure, the same company whose card invites distillation of its own model.
What could a crackdown on unauthorized distillation act on?
Going by the documents, a lab can act on access. The Usage Policy says Anthropic’s Safeguards Team will implement detection and monitoring to enforce it, and that a violator’s access may be throttled, suspended or terminated. The Commercial Terms say the same thing in contract language: section I.3.a lets Anthropic suspend access when it reasonably believes a customer is using the services in violation of section D.4.
The policy also describes the evasions it expects. The same section bars coordinating activity across multiple accounts to avoid detection, automating account creation, and getting round a ban with a different account. It also bars providing account or API access to people in violation of Anthropic’s Supported Regions Policy. Every one of those is a rule about accounts.
That is also the limit. Our Alibaba piece worked out that the alleged campaign averaged roughly 26 exchanges a day per account, a rate at which a single account looks like a busy person. The same piece describes accounts created in bulk and replaced as they are banned.
What a crackdown cannot act on is the first two cases. A lab distilling its own model needs no one’s permission. A downloaded weights file, as our open-weights explainer puts it, is not rented through an endpoint, so there is no account to suspend. Nothing in the essay asks for either to stop.
The essay calls for companies and the US government to cooperate and stops there. Every enforcement tool we could find in a document belongs to the lab and works one account at a time. The thing to watch is whether the next text from Anthropic or from Washington defines unauthorized anywhere other than a company’s own usage policy, because until one does, a crackdown on distillation is contract enforcement with a geopolitical name.
