Anthropic, one of the most respected AI safety labs in the world, has recently taken a hard‑line public stance against several Chinese AI startups—DeepSeek, Moonshot, and MiniMax—accusing them of intellectual‑property (IP) theft through model distillation attacks. The accusations are not simply a whiff of corporate rivalry; they strike at the core of how we think about generative AI, competitive advantage, and the emergent geopolitical tug‑of‑war over AI chips and data.
The accusation in plain language
At a press conference on 23 February 2026, Anthropic announced that it had uncovered a systematic effort by the three Chinese labs to reverse‑engineer its own flagship model, Claude, using a technique called distillation. In a distillation attack, an adversary queries a target model (here Claude) many times, gathers the outputs, and trains a new model that mimics the original’s behavior. The result? A copycat that can produce Claude‑like text without ever having access to the original training data or architecture details.
Anthropic claims that DeepSeek, Moonshot, and MiniMax, in a coordinated campaign, generated over 24,000 fake user accounts to feed Claude a barrage of prompts, automatically harvesting the responses for a hidden data‑pipeline. The scale of the operation, Anthropic says, is unprecedented and suggests a deliberate, state‑backed strategy to industrialise distilled models that could undercut the competitive edge of western AI firms.
“We see a clear pattern of systematic abuse of our models,” said Dario Amodei, Anthropic’s co‑founder, in the company’s blog post. “These attacks are not just random curiosity; they are a concerted attempt to steal the intellectual property that we have spent years building.”
(The full statement can be read on Anthropic’s website: https://www.anthropic.com/news/detecting-and-preventing-distillation‑attacks)
A brief primer on model distillation
Distillation is a legitimate research technique. In academia, a teacher model is used to train a smaller student model, often for efficiency gains. The process typically involves a controlled dataset and explicit permission from the model owner. What Anthropic alleges is that the Chinese labs performed unauthorised distillation at massive scale, effectively stealing the “knowledge” baked into Claude.
Technically, the attack works like this:
- Query Generation – The attacker creates millions of diverse prompts that cover a wide variety of topics, styles, and domains.
- Data Harvesting – Each prompt is sent to the target model (Claude). The model’s response, which contains the distilled knowledge, is logged.
- Training the Clone – The harvested input‑output pairs become a massive synthetic dataset. A new model is then trained on this data, inheriting Claude’s capabilities without ever seeing the underlying proprietary data.
- Iterative Refinement – By repeating the process, the cloned model improves, eventually rivaling the original in fluency and factuality.
In a white‑paper released by Anthropic, the team stresses that such attacks are data‑centric: the more diverse and numerous the queries, the richer the distilled model becomes. This is why the creation of 24,000 fake accounts is a red flag—it signifies a sustained, high‑volume data‑harvesting operation.
Why the Chinese labs might care
The geopolitical backdrop cannot be ignored. The United States, Europe, and Japan are in the midst of a heated debate over AI‑chip export controls. The TechCrunch article (https://techcrunch.com/2026/02/23/anthropic-accuses-chinese-ai-labs-of‑mining‑claude‑as‑us‑debates‑ai‑chip‑exports/) points out that Chinese firms are racing to close the AI compute gap.
By reverse‑engineering a model like Claude, these labs can:
- Accelerate their own product road‑maps without the heavy cost of collecting trillions of tokens for training.
- Circumvent export restrictions on advanced chips; a distilled model can be run on less‑powerful, domestically‑produced hardware.
- Boost market credibility by offering a “Claude‑like” experience, thereby gaining users and funding.
MiniMax, for example, has positioned itself as a budget alternative to GPT‑4, touting comparable performance at a fraction of the cost. If they can cheat their way to that performance via distillation, the incentive to do so becomes massive.
The ethical and legal grey area
At first blush, one might argue that knowledge is hard to own; after all, the model’s responses are public outputs. However, the ft.com piece (https://www.ft.com/content/0afa7bb5-7da3-4175-80e6-e38faf52e867) frames the issue as “IP infringement”, akin to copying a patented algorithm.
Intellectual‑property law traditionally protects source code and training datasets, not the behaviour of a black‑box model. Yet, court scholars are already debating whether a distilled model constitutes a derivative work. If the cloned model replicates Claude’s unique conversational style, safety mitigations, or even hidden alignment tricks, that could be considered a trade secret violation.
Anthropic’s claim also raises privacy concerns. The fake accounts used to harvest Claude’s outputs were likely tied to real user data (email addresses, phone numbers) to bypass rate‑limits. This mass creation of synthetic identities blurs the line between adversarial research and malicious botnet activity.
Technical counter‑measures: Anthropic’s playbook
In response, Anthropic has deployed a multi‑layered defence strategy, detailed in their own blog:
- Watermarking – Embedding subtle, statistical signatures in generated text that can be detected downstream.
- Rate‑limit tightening – Reducing the number of queries per API key and introducing tighter captcha challenges for suspicious traffic.
- Noise Injection – Randomly perturbing the model’s output to make it less useful as a training set for a student model.
- Legal Action – Preparing cease‑and‑desist letters for accounts that violate the terms of service, and potentially filing lawsuits under Computer Fraud and Abuse Act (CFAA) statutes.
The effectiveness of these measures remains to be seen. Watermark detection, for instance, can be bypassed with clever post‑processing, while rate‑limits can be circumvented by scaling the number of accounts—exactly what Anthropic alleges the Chinese labs have done.
The broader implications for the AI ecosystem
If the allegations hold water, we may be witnessing the first large‑scale industrial‑strength distillation campaign. This could trigger a cascade of consequences:
- Erosion of trust – Users may lose confidence that a model’s outputs are original and not a re‑packaged copy of a competitor’s work.
- Arms race in defensive AI – Companies will invest heavily in watermarking, adversarial training, and legal frameworks.
- Regulatory scrutiny – Governments may draft new rules on model‑output usage, akin to data‑usage regulations for training sets.
- Market consolidation – Smaller players without the resources to defend their models could be forced out, leaving the field dominated by giants that can afford robust defences.
The VentureBeat report (https://venturebeat.com/technology/anthropic-says-deepseek-moonshot-and‑minimax‑used‑24‑000‑fake‑accounts‑to) emphasizes the operational side: the creation of fake accounts is a low‑cost, high‑impact method for data harvesting. This suggests a future where AI‑model theft becomes a service—a black‑market where malicious actors sell distilled models trained on proprietary APIs.
What should the industry do?
- Standardise watermarking – An open‑source, auditable watermark could become the industry norm, making it easier to prove ownership.
- Create a “model‑IP” registry – Similar to software patents, a public registry of model architectures and training‑set provenance could provide legal footing.
- Collaborative defence – Companies could share threat intelligence about suspicious query patterns, much like the cyber‑security community does with indicator‑of‑compromise (IoC) feeds.
- Policy alignment – Nations should coordinate on export controls that also consider model‑output abuse, not just hardware.
- Public awareness – Users need to understand that the AI they interact with may be repurposed without consent, influencing everything from content moderation to personal assistants.
Closing thoughts
Anthropic’s bold accusation shines a light on a hidden battlefield that has, until now, been largely invisible to the public: the war over knowledge encoded in language models. Whether this is a singular episode or the opening salvo of a broader, ongoing campaign will depend on how quickly the AI community can adapt its defensive playbook.
If the industry fails to respond, we risk a future where the value of AI research is no longer tied to the ingenuity of the scientists who built the models, but to the sneakiness of those who can steal them. That would be a profound shift—one that could undermine the very incentives that have driven rapid progress over the past decade.
Anthropic’s fight, therefore, is not just about protecting Claude. It is about setting a precedent that AI models, like any other form of creative work, deserve respect, ownership, and defence against theft. The outcome will shape the competitive landscape of AI for years to come.
Leave a Reply