Roman Ledak

LLM Model Distillation: How AI is Stolen and How OpenAI Fights Back

·Insight·2 min read·Roman Ledak

1) 25,000 fake accounts. 28.8 million conversations. Six weeks. 2) Three labs admitted that someone was systematically draining their models. Here are the numbers. 3) OpenAI responded to model theft with its own integrated circuit. 4) Weights can be extracted via API. Silicon cannot be distilled.

25,000 fake accounts. 28.8 million conversations. Six weeks. Three labs admitted that someone was systematically draining their models.

An IISS analysis from May 2026 confirms that in the first half of the year, each of the three leading American AI labs detected organized distillation campaigns. Google Threat Intelligence Group recorded multi-million queries aimed at Gemini, which extracted reasoning chains.

DeepSeek: 150,000 exchanges. Moonshot AI: 3.4 million exchanges. MiniMax: 13 million exchanges. Alibaba: 28.8 million exchanges in six weeks from April 22 to June 5, 2026, using nearly 25,000 fake accounts.

The Alibaba campaign circumvented R&D costs worth hundreds of millions of dollars. It triggered interventions from the US Senate Banking Committee and the Department of Commerce.

All four campaigns went through legitimate APIs. If a model can be queried, it can be cloned. Distillation is a zero-day vulnerability built into the business logic of LLMs.

Moonshot AI's Kimi K3 model costs $15 per million output tokens. Claude Fable 5 costs $50.

That's why OpenAI no longer fights with terms of service. It lowers the cost of inference below the profitability threshold for cloning.

On June 24, 2026, it was revealed that OpenAI designed the ASIC Jalapeño chip in collaboration with Broadcom. They used GPT-5 to optimize the matrix multiplication architecture. They completed the project in nine months.

OpenAI's strategy assumes lowering the marginal cost of GPT-6 inference on its own silicon. To a level where distillation and self-hosting a clone lose economic sense.

Model weights, synthetic data, and alignment techniques can be systematically extracted via API. Dedicated silicon cannot be distilled.

The AI war has moved from software to the physical layer.

Key takeaways

  • LLM model distillation through legitimate APIs is an inevitable zero-day vulnerability in the current business logic of AI.
  • Foreign entities have extracted tens of millions of conversations from American models, circumventing hundreds of millions of dollars in R&D costs.
  • Traditional terms of service do not protect AI, which is why OpenAI is investing in dedicated ASIC Jalapeño silicon to reduce inference costs below the profitability threshold for cloning.
  • The war for dominance in artificial intelligence has ultimately moved from the software layer to the hardware infrastructure.

Frequently asked questions (FAQ)

What is AI model distillation?
AI model distillation is the process of extracting knowledge and reasoning chains from an advanced LLM model by querying it extensively via API. This allows for the creation of a cheaper clone, bypassing hundreds of millions of dollars in research and development expenses. It is a systemic vulnerability stemming from the very architecture of publicly available models.
How do companies clone American LLM models?
Distillation campaigns use thousands of fake accounts to generate millions of exchanges through official APIs. For example, Alibaba conducted 28.8 million conversations in six weeks using 25,000 accounts. Similar activities have been detected for DeepSeek, Moonshot AI, and MiniMax.
Why don't API terms of service protect against model cloning?
Terms of service are ineffective because distillation queries go through fully legitimate APIs. If an AI model is publicly available for querying, it is technically always possible to extract its weights and logic. For this reason, legal protection is being replaced by an economic strategy.
How does OpenAI plan to stop AI model theft?
OpenAI aims to lower the marginal cost of inference for its models to a level where self-hosting a clone becomes unprofitable. To this end, the company designed its own ASIC chip called Jalapeño in collaboration with Broadcom. This will cause competition to lose the financial incentive to distill models like GPT-6.
What is OpenAI's ASIC Jalapeño chip?
Jalapeño is a dedicated silicon chip designed by OpenAI and Broadcom using GPT-5 to optimize matrix multiplication. The project was completed in nine months to transfer technological advantage to the physical layer. Unlike model weights or synthetic data, dedicated silicon cannot be distilled via API.

No CTA. Closing with a fact: the AI war has moved from software to the physical layer. Part three next week — where I step into the attacker's shoes.

Keep reading