Detailed Analysis
The article's premise centers on "distillation attacks," a term used to describe the practice of training smaller, cheaper AI models by having them learn from the outputs of larger, more capable models—most notably the concern that firms like DeepSeek may have used outputs from OpenAI's or Anthropic's models to bootstrap their own systems. Model distillation itself is a well-established and legitimate machine learning technique: a "student" model is trained to mimic the behavior of a "teacher" model, often achieving much of the teacher's performance at a fraction of the computational cost. The framing of this practice as an "attack" reflects the anxiety among leading AI labs that their multi-billion-dollar investments in frontier model training can be effectively siphoned off by competitors who simply query the finished product rather than replicate the underlying research and infrastructure.
This tension became a flashpoint in early 2025 when DeepSeek's R1 model, reportedly trained at a fraction of the cost of comparable Western models, sparked accusations from OpenAI and others that Chinese labs had improperly distilled proprietary outputs in violation of terms of service. Anthropic has been notably vocal in this debate, with CEO Dario Amodei and other executives raising concerns about export controls, IP protection, and the strategic risks of allowing rivals—particularly those tied to geopolitical competitors—to leapfrog years of foundational research through distillation. Anthropic has also taken defensive technical measures, such as restricting API access patterns that appear designed to harvest large volumes of outputs for training purposes, treating this as a security and business-integrity issue rather than a purely academic one.
The characterization of distillation as "profoundly stupid" to treat as an attack—if that is indeed the article's argument—would align with a counter-narrative gaining traction among some AI researchers and commentators: that distillation is simply how knowledge diffuses in any competitive technical field, and that trying to prohibit it via terms of service is both unenforceable and somewhat hypocritical given how frontier labs themselves have built on open research, open-source models, and each other's publicly disclosed techniques. Critics of the "attack" framing argue that the real issue is competitive anxiety dressed up in security language, and that the appropriate response is faster innovation and better product differentiation rather than legal or rhetorical gatekeeping.
This debate sits at the intersection of several broader trends shaping the AI industry: the commoditization of model capabilities as techniques diffuse rapidly across labs and borders, the growing US-China rivalry over AI supremacy, and the tension between open scientific norms and the increasingly proprietary, capital-intensive nature of frontier AI development. As companies like Anthropic, OpenAI, and Google DeepMind pour billions into training runs, the specter of that value being "distilled away" by lower-cost competitors raises fundamental questions about whether the current economics of frontier AI development are sustainable, and whether legal, technical, or policy interventions can meaningfully protect that investment—or whether, as this article's title suggests, such efforts are ultimately futile against the basic dynamics of how information and capability spread.
Read original article →