US-based AI company Anthropic has accused China’s Alibaba of systematically extracting the capabilities of its Claude AI models through a technique known as ‘adversarial distillation’.
According to Anthropic, operators linked to Alibaba allegedly created thousands of fake accounts and generated millions of interactions with Claude to reproduce its reasoning abilities and improve Alibaba’s own AI systems at a fraction of the cost of building a frontier model from scratch. Alibaba has denied wrongdoing and the allegations have not been independently verified.
The dispute has brought AI distillation into the spotlight. While the technique has long been used to build smaller and more efficient AI models, companies now worry that using rival AI models without permission could amount to intellectual property theft.
What is AI distillation
AI distillation is a technique through which knowledge from a large and highly capable AI model is transferred to a smaller one specialised in a particular genre. In machine learning, the larger system is commonly referred to as the ‘teacher model’, while the smaller one is known as the ‘student model’.
Instead of learning only from raw training data such as books, websites or source code, the student model also learns from the responses generated by the teacher model. Those responses capture years of optimisation, complex reasoning patterns and language understanding that would otherwise require enormous amounts of computing power to recreate.
The objective is not to create an identical copy but to preserve as much of the teacher model’s capability as possible while reducing the computational resources needed to run it. The result is a model that is faster, cheaper and easier to deploy on devices such as smartphones, laptops or enterprise applications.
Distillation has been a widely accepted machine-learning technique for years, and almost every major AI developer, including OpenAI, Google, Anthropic and Meta, uses some form of knowledge distillation internally to create lighter versions of their own models.
Several leading AI companies use knowledge distillation to improve efficiency. Meta has applied it to Llama models, Google to compact Gemini and Gemma models, while OpenAI and Anthropic use similar optimisation techniques to make their AI models faster and more efficient.
How does AI distillation work
The process begins with a powerful AI model generating responses to thousands or even millions of carefully designed prompts. These prompts are intended to test different capabilities, ranging from coding and mathematical reasoning to language understanding and problem-solving.
The responses are then collected and organised into a new training dataset. Rather than relying solely on raw internet data, the student model learns by imitating how the teacher responds to similar questions. Over time, it begins to reproduce many of the same behaviours and reasoning patterns.
Why is the Anthropic-Alibaba dispute different
Anthropic says the Alibaba incident was not an example of ordinary knowledge distillation but a coordinated “brazen campaign” to extract Claude’s capabilities. As explained in a Financial Times report, Anthropic argues that the Alibaba case represents what it calls ‘adversarial distillation,’ which is a process in which another company’s AI model is systematically queried without permission to reproduce its capabilities.
According to a Reuters report, Anthropic alleged that operators linked to Alibaba conducted the campaign between April 22 and June 5, 2026, creating nearly 25,000 fraudulent Claude accounts and generating more than 28.8 million interactions with the chatbot.
Rather than using Claude for ordinary conversations, the company claims these interactions were carefully designed to expose the model’s strongest capabilities, including software engineering, complex reasoning and autonomous task execution.
Anthropic alleges that these responses were then used to improve Alibaba’s own Qwen AI models. The company argues that such activity bypasses years of research and billions of dollars of investment by allowing competitors to learn directly from the outputs of frontier AI systems instead of independently developing comparable capabilities.
Alibaba has denied the allegations, stating that it does not use outputs from proprietary AI models to train its own models and that its AI development complies with applicable intellectual property laws.
Anthropic’s allegations against Alibaba are not an isolated case. According to a Reuters report, the company said in a February blog post that it had identified what it described as coordinated efforts by Chinese AI startup DeepSeek, along with Moonshot AI and MiniMax, to extract capabilities from its Claude AI models without authorisation.
Anthropic reportedly said DeepSeek’s campaign involved more than 150,000 interactions with Claude, while Moonshot AI generated over 3.4 million exchanges and MiniMax more than 13 million. The company also claimed the campaigns were becoming increasingly “intense and sophisticated”, arguing that addressing such activity would require “rapid, coordinated action” from AI companies, policymakers and the broader AI community.
The broader security debate
Beyond intellectual property concerns, the issue also has become a spotlight for national security implications. The company says its advanced AI models, Mythos and Fable, possess enhanced cybersecurity capabilities, raising concerns that unauthorised access could allow rival developers to replicate or benefit from those capabilities.
The issue gained further significance after the US Commerce Department imposed restrictions on Anthropic’s latest Mythos and Fable models on June 12, two days after the company sent its letter to US lawmakers. According to reports, the restrictions were introduced over concerns that the models could be deployed by military and intelligence users in China and other countries of concern, prompting Anthropic to disable access to the models globally.
As mentioned by the Financial Times, in September 2025, it became the first US AI company to stop selling AI services to organisations majority-owned by Chinese entities, saying the move was aimed at limiting the risk of its technology being used to support China’s military and intelligence services.
Adversarial distillation versus traditional distillation
Although both techniques involve transferring knowledge from one AI model to another, the key difference lies in ownership and permission.
In traditional distillation, developers use their own teacher model to build a smaller version for commercial deployment. The model owner controls both the teacher and the student systems, making the process an accepted engineering practice.
Adversarial distillation, however, involves learning from another company’s AI model without authorisation. Instead of accessing internal model weights or source code, developers repeatedly interact with the public-facing chatbot and use its responses as training material. The goal is to reproduce valuable capabilities without bearing the full cost of developing them independently.
For AI companies, the distinction is similar to the difference between optimising one’s own technology and reverse-engineering a competitor’s proprietary product.
The rising value of AI models
The economics of AI development have shifted significantly in recent years. Training a frontier AI model now demands enormous computing power, access to vast datasets, and years of research and engineering. As a result, developing the most advanced AI systems can cost hundreds of millions, and in some cases, billions of dollars.
Distillation offers a much cheaper alternative. Instead of repeating the entire training process, developers can potentially acquire many useful capabilities simply by studying how an existing frontier model responds to carefully crafted prompts. This makes AI outputs increasingly valuable. Every answer generated by a chatbot reveals something about how the underlying model reasons, solves problems or writes code. At scale, those responses can become a rich source of training data for competing AI systems.
As a result, leading AI companies are beginning to treat their models less like conventional software products and more like valuable intellectual property that requires protection from extraction attempts.
What’s next
The Anthropic case is about more than one company’s allegations against another. It reflects a broader shift in the economics of AI development. During the first phase of the generative AI boom, success depended largely on building the biggest and most capable foundation models. As those models become increasingly expensive to develop, protecting them from imitation is becoming just as important as creating them in the first place.
Whether regulators and courts ultimately classify adversarial distillation as an intellectual property violation, a cybersecurity threat or simply aggressive competition could shape how future AI models are built, commercialised and shared.
As the AI race enters its next phase, the battle may no longer be only about who builds the smartest model but also about who can prevent others from learning too much from it.
