Anthropic Accuses Alibaba of Illicit Model Distillation

Anthropic Accuses Alibaba of Large-Scale Model Distillation

Anthropic has formally accused Alibaba, the Chinese technology giant, of illicitly extracting capabilities from the Claude AI model through a process known as "distillation." In a letter sent to the U.S. Senate Banking Committee, Anthropic described the campaign as the largest known attack of its kind against the company, alleging that operators affiliated with Alibaba and its AI lab, Alibaba Qwen, used nearly 25,000 fraudulent accounts to generate over 28.8 million exchanges with Claude between April 22 and June 5, 2026.

Model distillation involves training a less capable model on the outputs of a more powerful one to accelerate the development of advanced capabilities. Anthropic claims this specific effort was designed to help Alibaba reach the capabilities of Anthropic's advanced Mythos Preview model more quickly.

The Broader Context of Chinese AI Extraction

This accusation is part of a wider pattern of alleged extraction efforts by Chinese AI labs. Anthropic previously identified similar campaigns in February 2026 involving other Chinese entities:

MiniMax: Over 13 million exchanges.
Moonshot AI: Over 3.4 million exchanges.
DeepSeek: Over 150,000 exchanges.

These events coincide with escalating tensions between the U.S. and China regarding AI intellectual property. In April 2026, the White House accused China of stealing U.S. AI intellectual property on an industrial scale. Simultaneously, the U.S. government has taken mixed actions: while Alibaba was added to the Pentagon's Chinese military companies list in June 2026, the Commerce Department has reportedly held off on blacklisting DeepSeek despite it being deemed a national security risk.

Technical and Economic Perspectives on Distillation

Industry observers and technical commentators highlight that distillation is a common practice in AI development, though its legality and ethics are contested.

Distillation Methods

Technical analysis suggests two primary forms of distillation occurring in these scenarios:

Black Box Distillation: A massive approach where a model is queried, and the answers are used for reinforcement.
Targeted Distillation (RLAIF): A more sophisticated method where one model directly informs, trains, or guides another model, essentially fine-tuning the student model with direction from the teacher model.

The Token Resale Economy

Some analysts point to a secondary market in China that facilitates this extraction. Resellers reportedly offer Claude tokens at 70-90% discounts by pooling accounts and reselling reasoning chains to Chinese labs. These resellers subsidize access in exchange for user logs and reasoning traces, which are then sold as high-value training data.

Industry Debate: IP Theft vs. Fair Use

The accusations have triggered a significant debate regarding the "original sin" of LLM training data and the hypocrisy of claiming intellectual property (IP) rights.

Arguments Against Anthropic

Many critics argue that Anthropic cannot claim IP theft when its own models were trained on massive datasets harvested from the internet without explicit consent from copyright holders.

"Crawl the whole Internet to build a gargantuan sized LLM and then complain you're being copied..."

Critics further suggest that Anthropic's appeals to the U.S. government are a form of "regulatory capture," attempting to use national security concerns to build an anti-competitive moat and protect its valuation from lower-cost competitors like GLM 5.2 or DeepSeek.

Arguments in Support of Anthropic

Conversely, some argue that systematic distillation allows competitors to "fast-follow" and bypass the millions of dollars in compute and human effort required for RLHF (Reinforcement Learning from Human Feedback). From a safety perspective, there is concern that if advanced capabilities are distilled into open-weight models, the safety guardrails and defenses implemented by the original creator are stripped away, potentially increasing the risk of the models being used for cyberattacks or biological threats.