AI Model Theft via API: What is Distillation?
1) This is the only theft that looks like using the product as instructed. 2) There's no break-in. No stolen password. There's an API invoice. 3) If a model can be queried, a model can be cloned. 4) This loophole cannot be patched. It is inherent in how the product operates.
An AI model can be stolen without breaking into anything. You just need to interact with it (article 1/3)
Distillation is the only type of theft indistinguishable from normal product use as instructed. There's no break-in, no stolen password, no malicious code. There's just an API bill paid to the penny, terms and conditions accepted, and logs full of polite, correct queries. A decision-maker who hears "model theft" usually imagines a hacker in a hoodie and stolen files. Meanwhile, the actual process looks like daily work with a tool for which the company pays.
Anthropic revealed four industrial distillation campaigns against Claude in 2026. DeepSeek conducted 150,000 exchanges, Moonshot AI – 3.4 million, MiniMax – 13 million, and Alibaba – 28.8 million exchanges in just six weeks between April 22 and June 5, 2026. Alibaba's operation utilized a network of nearly 25,000 fraudulently created accounts. Six days after the launch of Kimi K3, on July 22, 2026, the White House Office of Science and Technology Policy accused Moonshot AI of distilling Claude Fable. Director Michael Kratsios described a "sophisticated internal platform" that routed traffic through servers in Thailand and used Nvidia GB300 systems.
Private investments in artificial intelligence in the US amounted to 285.9 billion dollars in 2025, while in China – 12.4 billion. This 23-fold difference in training costs makes copying capabilities a rational financial move. Automated extraction of model capabilities via API received the formal vulnerability identifier CVE-2026-33626. Google Threat Intelligence Group noted multi-million query campaigns against Gemini in 2025, where state-sponsored groups extracted chain-of-thought reasoning patterns.
You hire the world's best expert by the hour. You ask them a million questions from every field, record every answer, and teach an intern using those recordings. The intern starts answering exactly like the expert. Training a base model with 2.8 trillion parameters entirely on distilled data is technically infeasible, but using the teacher's reasoning traces during fine-tuning allows for quickly closing most of the competence gap.
A distillation attack proceeds in three phases. In the query phase, the attacker systematically maps the model's entire knowledge domain – from engineering to finance to law. In the collection phase, question-answer pairs land in an organized dataset, which provides a snapshot of the model's thinking. In the distillation phase, this dataset is used to fine-tune an inexpensive open model, and the capabilities of the expensive teacher transfer to the cheap student. Every model response releases a fraction of its intelligence externally – and this is precisely why the only complete defense would require the model to be completely silent.
Claude Fable 5 costs 10 dollars per million input tokens and 50 dollars per million output tokens. Kimi K3 – a model with 2.8 trillion parameters, built on the Kimi Delta Attention architecture with Attention Residuals, utilizing 16 active experts selected from a pool of 896 – costs 15 dollars per million output tokens. OpenAI designed its own ASIC chip called Jalapeño with Broadcom in just nine months – with the GPT-5 model optimizing matrix multiplication architecture for GPT-6 inference. The logic behind this decision is simple: weights, synthetic data, and alignment techniques can be distilled via API – silicon cannot. Following Alibaba's campaign, the US Senate Banking Committee and the Department of Commerce intervened, and the United States is considering sanctions against Moonshot AI.
What happens if you ask a model a million questions and save all the answers? You get a copy of it. A model fine-tuned on the teacher's answers to test questions achieves inflated benchmark scores without deep, generalized reasoning. In an independent Semgrep audit, Kimi K3 achieved significantly lower precision than standard frontier model configurations, and its F1 score collapsed on large enterprise-grade repositories. Low precision means an avalanche of false positives that the team must manually triage, so the cheapness of the clone shifts costs from inference to human labor.
Risk A: Benchmarks inflated for tests
Devoid of Claude Fable 5-class security classifiers, the Kimi K3 model proved susceptible to prompt injection and agent takeover. This allows for executing unauthorized shell commands and reading local configuration files. Anthropic made a variant of Claude Mythos 5, stripped of security classifiers, available exclusively to US government cyber defenders as part of the Project Glasswing initiative with a one-million context window. The security layer is a conscious, costly engineering choice that inexpensive clones do not possess.
Risk B: Invisible security layer
Article 398 of the Electronic Communications Law, effective from November 10, 2024, prohibits automated outreach without verifiable consent under penalty of fines up to 3 percent of annual revenue or 1 million PLN. The EU AI Act introduces transparency requirements from August 2026 and watermarking from December 2026. Exceeding a threshold of 0.30 percent spam complaints causes the entire corporate domain to be blocked by email providers, while a safe level is below 0.10 percent. Rehabilitating SPF, DKIM, and DMARC configurations takes weeks.
Risk C: Legal and operational exposure
GuardEmb – published in ACL Anthology (Findings of EMNLP 2024) – perturbs embeddings containing tokens of moderate frequency, embedding a statistical watermark in them. Verification accuracy for theft exceeds 96 percent while maintaining utility, because the signature is hidden in the mathematical properties of the model's output itself. ModelShield injects the signature by dynamically modifying response probabilities, so the clone inherits the watermark along with the stolen data. Effective defense requires a behavioral layer: detecting rapid queries scanning unrelated topics, lack of human writing rhythms, and clusters of account creations within the same IP ranges. Anthropic additionally uses 30-day data retention specifically to track usage anomalies indicating distillation – and this retention became the main target for circumvention by rivals designing extraction campaigns. Model providers also reduce the detail of responses – the API returns only the final text, without reasoning traces or token probability distributions, which forces the attacker to make significantly more queries and drive up the bill, thereby facilitating detection of the campaign at the behavioral level. None of these layers are perfect in isolation – each requires a compromise between security and usability for legitimate users – which is why providers combine them into multi-layered defense systems.
If a model can be queried, a model can be cloned. Remember this one rule. In part two, I will show figures from recent weeks that are hard to believe are true.
Key takeaways
- AI model theft through distillation occurs via legitimate API queries without stealing passwords or code.
- Cloned models often achieve inflated benchmark scores but lose the ability for deep generalization in business applications.
- The lack of built-in security classifiers in distilled clones exposes users to prompt injection vulnerabilities.
- Protecting models requires using steganographic watermarks and behavioral analysis of API queries.
Frequently asked questions (FAQ)
- What is AI model distillation and how does AI theft work?
- AI model distillation involves querying an advanced teacher model with a vast number of questions and training a cheaper student model on the obtained answers. This process does not require hacking or password cracking, but rather generating massive queries through a standard API. As a result, the inexpensive student model acquires most of the key capabilities of the more expensive system.
- What are the risks of using a cloned or distilled AI model?
- Cloned models often have inflated benchmark results but are characterized by low precision in real-world applications and generate an avalanche of false positives. They also frequently lack advanced security layers, making them susceptible to prompt injection attacks and data leaks. Consequently, perceived inference cost savings lead to increased human labor costs.
- What methods are used to protect AI models from API theft?
- AI providers use statistical watermarks in embeddings and dynamically modify token probabilities so that the clone adopts the provider's signature. Additionally, behavioral analysis of traffic is implemented to detect automated queries from linked IP addresses, and detailed reasoning traces are removed from API responses. However, none of these solutions are perfect in isolation and require combining multiple layers of defense.
- Is AI model theft via API detectable?
- Yes, theft can be detected thanks to digital signatures embedded in the model's responses and by monitoring anomalies in API logs. Behavioral analysis allows identifying inhuman query rates and mass account creation within the same IP ranges. Furthermore, temporary data retention allows providers to track suspicious query patterns over a longer period.
- Why are cheap AI model clones less secure?
- Creators of cloned models often omit costly engineering security classifiers to minimize inference costs. Without these mechanisms, the model cannot prevent malicious commands from executing unauthorized actions or reading configuration files. Users of such a model face higher operational and legal risks.
No sales CTA. Educational closing: remember this one rule — if a model can be queried, a model can be cloned. In part two, I will show figures from recent weeks that are hard to believe are true.