AI's Distillation Fight Turns on One Exhibit the Government Didn't Publish

On September 8, three U.S. agencies — the FBI, NSA, and CISA — issued a joint advisory naming six China-based companies for industrial-scale theft of American AI capability. The named firms were DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The charge was specific: since at least late 2024, they allegedly extracted "billions of tokens" across "millions of exchanges," often "likely with Chinese government awareness," targeting models from Anthropic, OpenAI, Google, and xAI. Beijing called it "unfounded accusations" and "smears" the next day.

Here is the grade. This is a government assertion, not a published exhibit. The advisory that names six companies and asserts industrial scale supplies, for independent verification, a list of behavioral detection indicators — new accounts instantly hitting usage caps, round-the-clock traffic with no idle pause, switches between access methods when one is blocked. What it does not supply is a single reproducible thing: no IP ranges, no query logs, no model traces, no data manifest a reader could open. The most consequential AI allegation of the year arrives as a warning, not a dossier.

The absence of receipts is not a bureaucratic quirk. It is the whole investment question in miniature.

Why distillation is a moat attack

Knowledge distillation is a legitimate machine-learning method: a smaller model is trained on the outputs of a larger one to learn its behavior more cheaply. The advisory itself concedes it is a "valid training method." The allegation is that the method was weaponized — that API requests were run at industrial scale, through proxy "transfer stations" and shared subscriptions, to pull a competitor's reasoning out of its frontier model and rebuild it. The mechanism is the smallest checkable piece of the story, and the one Washington has actually detailed.

The worked example came first. On July 22, White House technology chief Michael Kratsios alleged that Moonshot AI distilled Anthropic's Claude Fable model to build its flagship Kimi K3 — claiming Moonshot built an internal platform that switched between access methods to avoid detection. Moonshot's own marketing positioned the model as near-frontier, an "open 2.8 trillion parameter" model that outperformed others on several coding and agentic benchmarks while conceding it "still trails" Claude Fable 5 and GPT 5.6 Sol. It was the exact profile a distilled model would produce: uncomfortably close performance, far below the cost of building from scratch.

Then came the escalation. The September advisory folded the single-case Moonshot claim into a six-company campaign narrative. Alibaba, separately, had been accused earlier of running 28.8 million interactions through 25,000 fraudulent accounts in six weeks.

Now the investment stakes. The frontier lab's proprietary model is the asset that supposedly justifies enormous training budgets and the valuations layered on top of them. Distillation is an attack on that specific asset — not on compute, not on data, not on distribution. If a reasoning model's capabilities can be siphoned through its own API, then the one layer of the stack investors have treated as the moat is the one layer that demonstrably leaks.

Where the moat moves

Strip the accusation to what both sides would accept, and you get the economic claim underneath: frontier capability is becoming extractable and thereby cheaper. The going body of evidence suggests the model layer is commoditizing independent of this dispute. Token prices for leading open-weight models have settled toward the hardware cost of serving them rather than the intelligence inside; open-weight alternatives are roughly 30–100x cheaper than premium models per million tokens; OpenAI's fourfold flagship price increase over a year sat alongside budget-tier cuts. The advisory's numbers — billions of tokens extracted "since at least late 2024" — describe a channel that, if real, would accelerate exactly this.

Read that way, the dispute is less an isolated scandal than an input to a larger argument that models cannot stay the durable source of AI profit. The analysts making that case point downstream: value survives in the hardest-task capability and reliability that wins enterprise renewal, and in the "operational residue" a deployed system accumulates — evaluation sets, error libraries, workflow memory — that cannot be downloaded because it only exists through years of operation. Weights can be distilled; accumulated operating history cannot. That distinction is why investment commentary now talks about "the model is not the moat" at all.

So the same evidence bucket does double duty. If you believe the model layer is already commoditizing, the advisory confirms the mechanism doing it. If you believe proprietary frontier models still hold pricing power, the advisory is precisely the kind of document that would erode that belief — except it lacks the one thing that would let you grade it.

The innocent reading, and the fact that settles it

Beijing's rejection is worth taking seriously, and not only because every nation denies diplomatic claims. Distillation is practiced on both sides of this rivalry; U.S. frontier labs themselves train on crawled public internet, which is the source of the licensing lawsuits against them. Moonshot denied the Kimi K3 charge in July, crediting its own architecture rather than any stolen model, and as of this writing neither Anthropic nor the government has published a manifest tying Fable 5 outputs to K3's training. A researcher's note on the case concedes that building K3's base model entirely from Fable 5 is "extraordinarily unlikely", while targeted post-training on Fable-derived data is technically possible but unproven.

That is the boundary the reader should hold. What is established: six companies are named, a mechanism is described, and a scale is asserted. What is alleged, not adjudicated: that each named firm actually did it, and that it happened with government awareness. What makes the difference is a single class of fact — a published data manifest, a declassified query log, a court finding, or a settlement carrying actual terms. None has appeared. In this writer's box, "undisclosed" and "illegal" are different drawers with different burdens of proof, and the advisory lives in the first.

The break condition is therefore easy to state: when a reproducible receipt appears, the debate stops being about whether U.S. frontier capability is being extracted and becomes about how much. Until then, the sane investor reading is calibrated — the direction of travel (model commoditization threatening the proprietary moat) has independent evidence behind it, while the specific accusation that would reprice the trade today is an allegation with authority but no exhibit to check.

Watch the advisory's own recommendation, which is the tell. It asks U.S. labs to share infrastructure indicators and behavioral telemetry with each other and to attenuate suspected attack traffic. Washington is asking the companies to build the evidence it chose not to publish. The marketplace will get receipts eventually. The stories over which shares move in the meantime are the ones to price at a discount.