AI Model Theft and Distillation: The Pure Economics of the AI Market
1) For the next five minutes, I will defend something I do not support. 2) 285.9 billion versus 12.4 billion. With such a difference, no one competes fairly. 3) They don't just copy capabilities. They copy the certainty that it can be achieved. 4) Distillation is a great catching-up strategy. And no leading strategy.
For the next few minutes, I will defend something I do not support. I will construct the strongest possible version of the business case for the side that systematically copies AI models via public APIs. The whole thing is a thought exercise, not a manifesto.
A decision-maker thinking in moral categories sees distillation as a scandal and an unfair play. They assume that disclosures, regulations, and political pressure will eventually stop the phenomenon. Meanwhile, on the other side, cold arithmetic is at work, which closes with a surplus regardless of waves of indignation.
Industrial Scale That Messages Cannot Stop
In the disclosed extraction campaigns alone, over 45 million queries were made to frontier models. DeepSeek conducted 150,000 exchanges, Moonshot AI 3.4 million, MiniMax 13 million, and the largest operation by Alibaba 28.8 million exchanges in six weeks between April 22 and June 5, 2026, using approximately 25,000 fake accounts – each of these campaigns, disclosed before February 2026, used networks of fake accounts and proxies on residential addresses to mask an industrial production line. These are not isolated violations of terms, but a production line operating via proxy networks on residential addresses.
Alibaba's campaign launched after public disclosures in February 2026. Despite reactions from the U.S. Senate Banking Committee and the Department of Commerce, it proceeded uninterrupted for a full six weeks. On July 22, 2026, White House Office of Science and Technology Policy Director Michael Kratsios publicly pointed to Moonshot AI's “sophisticated internal platform” for automated distillation of Claude Fable, with traffic routed through servers in Thailand and fine-tuning on Nvidia GB300 systems. The only announced consequence is sanctions that “may” be imposed.
The Google Threat Intelligence Group report, titled “Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use,” noted that in 2025, state-sponsored entities extracted traces of reasoning from Gemini for their own offensive cyber tools. Distillation has become a standard tool for APT groups. The cost of entry into the practice is negligible compared to the potential gain, and fake accounts and proxies are already standard operating procedure.
The Arithmetic of Two Budgets
Private investments in AI in the United States reached $285.9 billion in 2025 alone, while in China they amounted to $12.4 billion. The difference represents approximately a 23-fold financial advantage. One side funds an invention on the scale of a quarter-trillion dollars annually, the other has a more than twentyfold smaller budget and a purely accounting incentive to cut corners.
Training a frontier model from scratch costs billions of dollars in compute, annotators, and data licenses. Distillation shifts the entire risk of pretraining onto the victim laboratory. Claude Fable 5 costs $10 per million input tokens and $50 per million output tokens with a context window of 1 million tokens. Kimi K3 by Moonshot AI, a Mixture-of-Experts model with 2.8 trillion parameters and 16 active experts from a pool of 896, released on July 16, 2026, is offered at $15 per million output tokens. The clone is approximately 3.3 times cheaper on output than the model from which it allegedly drew.
Training a 2.8-trillion parameter model solely on distilled responses is technically infeasible. Moonshot most likely used traces of Claude's reasoning only in the post-training phase, i.e., SFT and reinforcement learning, to rapidly close the capability gap. It is enough to steal the last mile of reasoning, and that is why the math works out so cheaply.
Four Paradigm Shifts
If a model can be queried, it can be cloned. Distillation is not a security vulnerability, but a zero-day of the very business logic of LLMs. The mechanism for delivering value to the customer—answering questions—is simultaneously a vector for theft, and a patch for such a product does not exist.
Model theft has received its own vulnerability identifier. CVE-2026-33626 catalogs automated extractive exploits via API. The phenomenon has been formalized and cataloged like a software bug. This is the moment when the industry stopped treating distillation as a minor violation of terms and began to perceive it as a formal flaw in business logic.
Anthropic's most capable model, Claude Mythos 5, stripped of its safety classifiers, is reserved exclusively for the U.S. government's cyber defense under Project Glasswing. When technology of national security importance is at stake, expecting rivals to refrain out of decency is naive. From their perspective, theft is simply rational.
The technology for proving theft already exists. The GuardEmb framework embeds a statistical watermark in embeddings through perturbation of moderate frequency tokens, detectable with over 96% verification effectiveness without loss of model utility. ModelShield applies a similar perturbation directly to the outputs of generative text. Theft can be proven, and even irrefutable proof does not change the thief's calculation, because the problem is purely economic.
Enterprises can today implement behavior-aware rate limiting, which detects systematic, rapid queries scanning unrelated topics, and output granularity reduction, which limits the detail of responses to final text completions. These defense layers complement hardware solutions and raise the cost of an attack before watermarking provides proof.
Market Response in Silicon
The strongest reaction to distillation was not legal, but hardware-based. OpenAI designed its own ASIC chip, “Jalapeño,” with Broadcom in just nine months, using GPT-5 to optimize matrix multiplication architecture. The chip is set to power GPT-6. Weights, synthetic data, and alignment techniques can be distilled via API. Proprietary silicon cannot.
The goal of gigawatt data centers is to push the marginal cost of GPT-6 inference so low that distillation simply ceases to be profitable. Economics is answered solely by economics. A player who understands the asymmetry systematically destroys the profitability of an attack.
Counter-Argument Closing the Steelman
Distillation enables benchmark gaming. A student model fine-tuned on a teacher's answers to benchmark-style questions shows inflated results, so tables of cheap clones should be treated as promotional material. A Semgrep audit showed that Kimi K3's precision in detecting vulnerabilities in code is significantly lower than in standard frontier model configurations, and on large corporate repositories, the F1 score drops to a level that generates a mass of false positives despite excellent results on paper.
A copy costs a fraction of the original because in precision it remains a fraction of the original. Sober reading works both ways.
One side pays for inventing the capability, the other only for copying it. Whoever understands this stops being surprised and begins to read the AI market soberly, without astonishment, without moralizing, and without conspiracy theories.
Three articles, one phenomenon, zero conspiracy theories. If someone in your circle is now choosing an AI model for their company, pass this series on to them.
Key takeaways
- AI model distillation is a loophole in the business logic of LLMs, where providing answers via API allows for cheap copying of model capabilities.
- The enormous budget gap makes stealing the last mile of reasoning a rational economic decision for rivals.
- Watermarking technologies can prove theft, but the only lasting solution is to lower the inference costs of the original model.
- Cheap clones often achieve excellent benchmark results, but in production applications, their precision drops drastically.
Frequently asked questions (FAQ)
- What is AI model distillation and how does it work?
- AI model distillation is the process of copying the capabilities of an advanced model by automatically querying its public API. This allows for acquiring traces of reasoning and fine-tuning one's own, cheaper model without incurring the gigantic costs of initial training.
- Can an AI model be effectively protected against theft via API?
- There is no direct software patch, because the mechanism for answering questions itself is also an attack vector. However, intelligent query limits, reduced response granularity, and digital watermarks are used to enable later proof of theft.
- Why do market entities choose to distill competitors' models?
- The main reason is financial asymmetry and the lack of necessity to cover research budgets. Creating a model from scratch requires billions of dollars, while acquiring the last mile of reasoning allows offering a clone at a fraction of the cost.
- What are the business risks associated with using cloned AI models?
- Cloned models often have artificially inflated results in standard tests. In real corporate environments, their precision can be significantly lower, leading to a high level of false positives and errors in code analysis.
- How do AI model providers combat the economic viability of theft?
- The most effective response is designing dedicated hardware and extreme infrastructure optimization. The goal is to lower the marginal cost of inference for the original model to a level where counterfeiting it is no longer profitable.
No sales CTA and no question for comments. Series conclusion: three posts, one phenomenon, zero conspiracy theories. If someone in your circle is now choosing an AI model for their company, pass this series on to them.