AI Distillation Isn't Model Theft, Policy Experts Argue

Why it matters

As Washington considers new restrictions on AI model access in response to Chinese training practices, the legal distinction between distillation and actual theft could determine whether policy protects legitimate competition or creates sweeping new intellectual property rights that favor a few frontier labs over the broader AI ecosystem.

The Distillation Debate Heats Up

Chinese AI developers have drawn intense scrutiny for large-scale "distillation" of U.S. frontier models—using massive volumes of queries to improve their own systems. In February, Anthropic reported that three Chinese labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts. Similar activity has been detected at OpenAI and Google.

The response from U.S. policymakers has been swift. The White House issued a memorandum in April warning about "deliberate, industrial-scale campaigns," while the House Foreign Affairs Committee advanced the Deterring American AI Model Theft Act. Anthropic released a policy paper during President Trump's China visit highlighting distillation as a competitive threat.

But according to analysis published on Lawfare, the "theft" framing may be legally and technically inaccurate—with significant implications for how policy should respond.

What Distillation Actually Does

Distillation involves prompting a frontier model to generate outputs, then using those prompt-output pairs as training data to improve a different model. The practice is widespread in legitimate AI development. Elon Musk acknowledged during recent testimony that xAI had distilled OpenAI models, noting that "generally AI companies distill other AI companies." The White House Office of Science and Technology Policy has recognized distillation as "vital" for creating open models and maintaining competition.

Crucially, distillation doesn't involve breaking into systems to download model weights or source code. The model remains a black box to the distiller.

The Legal Gap

The analysis examines whether distillation constitutes intellectual property theft under current law and finds major obstacles:

Copyright doesn't apply because distillation can't copy protected code, and model outputs themselves lack the human authorship required for copyright protection.

Patents aren't infringed by distillation alone, and frontier labs haven't claimed otherwise.

Trade secrets present the strongest argument but face a fundamental problem: outputs returned through public-facing interfaces aren't kept secret. While mass distillation using fraudulent accounts or jailbreak prompts pushes boundaries, the information obtained is still the type available to legitimate users.

The clearest legal violations occur when distillers use false identities or circumvent access controls—potentially triggering the Computer Fraud and Abuse Act. But that targets the access method, not distillation itself.

A Different Policy Path

Rather than treating distillation as theft, the analysis recommends focusing on three distinct concerns:

Access security: Help labs detect fraudulent accounts and share threat information. The White House has proposed facilitating coordination between frontier labs and government, potentially through antitrust guidance or dedicated legislation.

Cybersecurity: Use existing CFAA authority against actors who bypass authentication or misrepresent credentials to maintain access after being cut off.

Capability diffusion: Study whether distillation meaningfully improves dangerous capabilities before imposing restrictions.

The risk of overreach is real. Expanding IP rights in model outputs could prevent legitimate open models from competing and concentrate AI development among a few well-resourced companies. Frontier labs have themselves benefited from open-source software, published research, and training on publicly available data.

Effective anti-distillation policy should enable information sharing, support access security, and prosecute unlawful conduct—without creating broad new property rights that distort competition or restrict legitimate uses.

These details were first reported by Bahrad A. Sokhansanj writing for Lawfare.