A public compendium · updated daily
How frontier intelligence is compressed, priced, and contested.
Distillation moves capability from a large teacher model into a small, cheap student. It is the quiet engine behind most models people actually pay for, the subject of an open dispute between the largest labs, and a live regulatory question in three jurisdictions. This compendium tracks all of it.
Company · compiled 3 September 2026 · 75 sources
Company view of AI distillation: who uses it, who sells it, who polices it
Every major AI lab now uses knowledge distillation to build its small and mid-tier models: Google states in the Gemini 2.5 report that all models 'Flash size and below' are distilled, Meta co-distilled Llama 4 Maverick from the 2-trillion-parameter Behemoth, Qwen3's small models are 'strong-to-weak' distilled from Qwen3-235B, and Apple retrains its 3B on-device model with a distillation loss from a 64-expert MoE teacher. Three hyperscalers have shipped distillation as a product - OpenAI Model Distillation (Oct 2024), Azure OpenAI stored completions (2024) and Amazon Bedrock Model Distillation (GA May 2025) - while Google's Vertex Gemini distillation is so far documented only as a pre-GA, allowlist-only service that prohibits production use. Open-source toolkits from Hugging Face (TRL GKD, Open R1) and Arcee (DistillKit) commoditised the technique, and open-weight licenses from DeepSeek, Qwen, Mistral, Moonshot, MiniMax, Zhipu, NVIDIA and Hugging Face expressly permit derivative distillation. The same companies police distillation of their own outputs through terms-of-service clauses - OpenAI, Anthropic, Google, xAI and Cohere all bar training competing models - and the dispute escalated from OpenAI's January 2025 claims against DeepSeek to Anthropic's February 2026 report of 24,000 fraudulent accounts, its June 2026 letter to the Senate Banking Committee alleging a 28.8-million-interaction campaign by Alibaba, and White House memorandum NSTM-4 in April 2026. The split is not purely US-versus-China: in April 2026 Elon Musk conceded under oath that xAI had 'partly' used OpenAI's technology to train its own models.
Key figures · 8 figures
Fraudulent accounts in Anthropic's Feb 2026 report
24,000 accounts
16M+ exchanges
DeepSeek, Moonshot AI and MiniMax combined; MiniMax alone drove 13M+ exchanges
Largest single distillation attack reported (Alibaba/Qwen on Claude)
28,800,000 interactions
25,000 accounts in ~6 weeks
Per White House OSTP director Kratsios and Anthropic's June 2026 letter to the Senate; Alibaba banned Claude Code internally two weeks later
Companies profiled that publicly document a distilled model
11 of 18
7 undisclosed
Derived from the company-matrix table in this file: OpenAI, Anthropic, Amazon, xAI, Moonshot AI, MiniMax and Cohere do not publicly document a distilled model. Separately, OpenAI, Microsoft/Azure, Amazon, Google and NVIDIA sell distillation tooling.
Companies with explicit anti-distillation / anti-competing-model ToS clauses
5 companies
OpenAI, Anthropic, Google, xAI, Cohere
Versus 9 permissive open-weight licenses in the tos-clauses table of this file that allow derivative distillation (Meta, DeepSeek, Alibaba, Moonshot, MiniMax, Mistral, NVIDIA, Microsoft/Phi, Hugging Face); Cohere Labs' Command R7B is CC-BY-NC and permits non-commercial derivatives only, so it is not counted.
GPU-hour savings of on-policy distillation vs RL (Qwen3-8B)
10 x fewer
1,800 vs 17,920 GPU hours
Qwen3 technical report Table 21; distilled model also scored higher on AIME'24 (74.4 vs 67.6)
Training tokens saved by prune-and-distill (NVIDIA Minitron)
160 x fewer
94B tokens vs 15T for the Llama 3.1 8B teacher
Llama-3.1-Minitron 4B produced from Llama 3.1 8B. NVIDIA separately claims up to 40x fewer training tokens per additional model when producing a family from one trained parent, and a 1.8x total compute saving.
Output price gap, flagship vs nano tier (OpenAI GPT-6 Astra vs GPT-5-nano)
125 x cheaper
$50.00 vs $0.40 per 1M output tokens
Current flagship gpt-6-astra against the cheapest listed nano tier; the cheapest current-generation small tier is gpt-5.6-luna at $1.20 per 1M output. OpenAI does not disclose training method for mini/nano tiers.
Distillation-as-a-service products from hyperscalers
3 shipped (+1 pre-GA)
Oct 2024 to 2025
Shipped: OpenAI Model Distillation (Oct 2024), Azure OpenAI stored completions + distillation (2024), Amazon Bedrock Model Distillation (preview Dec 2024, GA May 2025). Google Vertex Gemini distillation is documented only as pre-GA, allowlist-only with production use prohibited, so it is not counted as shipped.
Key findings · 8 findings
Distillation is now the default way every lab builds its small models
Google's Gemini 2.5 report states plainly that 'the smaller models in the Gemini 2.5 series — Flash size and below — use distillation', and Gemma 2 and Gemma 3 are trained with knowledge distillation rather than plain next-token prediction. Meta pruned Llama 3.1 8B and distilled logits from 8B/70B to make Llama 3.2 1B/3B, then co-distilled Llama 4 Maverick from Behemoth. Qwen3, Ministral 3, Apple's on-device 3B, NVIDIA's Minitron/Nemotron Nano and DeepSeek's R1-Distill series all document the same pattern in their technical reports.
Labs report distillation beats RL on cost and often on quality
Qwen3's ablation shows on-policy distillation lifting Qwen3-8B to 74.4 on AIME'24 versus 67.6 for RL, using 1,800 rather than 17,920 GPU hours. DeepSeek reports that R1-Distill-Qwen-32B (72.6 AIME'24) beats OpenAI o1-mini (63.6) with SFT-only distillation and no RL stage. NVIDIA reports up to 40x fewer training tokens and Mistral reports Ministral 3 trained on 1-3T tokens versus 15-36T for comparable Qwen 3 / Llama 3 models.
Closed labs sell distillation, but only inside their own model family
OpenAI's Model Distillation (stored completions + evals + fine-tuning, Oct 2024) lets customers distill GPT-4o/o1-preview into GPT-4o mini; Azure mirrors it; Amazon Bedrock requires teacher and student to be from the same model family, so Nova Premier distills into Nova Pro/Lite/Micro, Claude 3.5 Sonnet v2 into Claude 3 Haiku, and Llama 3.3 70B / Llama 3.1 405B into Llama 3.2 1B/3B and Llama 3.1 70B/8B; Google's Vertex early-access service distills Gemini 3.1 Pro into Gemini 2.5 Flash. In every case the student must be a model the vendor hosts, so distillation revenue stays on-platform. Notably OpenAI's docs now say it is 'winding down the fine-tuning platform' for new users, and Azure retires stored completions on 2026-10-15.
Terms of service, not copyright, are the main legal lever against cross-lab distillation
OpenAI forbids using 'Output to develop models that compete with OpenAI'; Anthropic's commercial terms bar access 'to build a competing product or service, including to train competing AI models'; Google's Gemini API terms say 'You may not use the Services to develop models that compete with the Services'; xAI's terms list 'distilling' among prohibited acts; Cohere bars use 'for the purpose of building a similar or competitive product or service'. Meta's Llama 4 license takes the opposite approach: derivative models are allowed but must carry 'Llama' at the start of their name.
Open-weight labs explicitly invite distillation in their licenses
DeepSeek-R1's model card states the series 'allow for any modifications and derivative works, including, but not limited to, distillation for training other LLMs' under MIT. Qwen3, Mistral 3/Ministral 3 and SmolLM3 ship under Apache 2.0; Kimi K2 and MiniMax M2 use a modified MIT that only adds an attribution requirement above 100M MAU or $20M monthly revenue; NVIDIA releases Nemotron under its Open Model License and even lists the teacher models (DeepSeek-R1, GPT-OSS-120B, Qwen) used to synthesise 3.5T of its 10.6T pre-training tokens.
The accusation cycle escalated from one lab to a US government policy in 15 months
OpenAI first alleged DeepSeek distillation in January 2025; the House Select Committee on the CCP's April 2025 report called it 'highly likely'. In February 2026 OpenAI told the committee DeepSeek used 'obfuscated third-party routers' and Anthropic published per-lab exchange counts (DeepSeek 150K, Moonshot 3.4M, MiniMax 13M). The framing is not purely US-versus-China: on 30 April 2026 Elon Musk conceded under oath in Musk v. OpenAI that xAI had 'partly' used OpenAI's technology to train its models. By April 2026 OpenAI, Anthropic and Google were also sharing threat intelligence through the Frontier Model Forum and the White House issued NSTM-4 calling the campaigns 'deliberate, industrial-scale'. In July 2026 OSTP director Kratsios accused Moonshot of distilling Anthropic's Fable model to build Kimi K3.
Defensive measures now shape products: ownership bans, hidden fingerprints, CoT hiding
Anthropic barred entities more than 50% owned by companies in unsupported regions in September 2025, citing that they 'could also potentially use our models to advance their own AI development through techniques like distillation'. OpenAI's memo describes classifiers for 'reinforcement learning-style grading behavior', models 'trained not to reveal reasoning traces', and account bans. Anthropic admitted a March 2026 Claude Code 'experiment' that embedded identifying markers to protect against distillation; Alibaba responded by banning Claude Code for staff from 10 July 2026.
Accused labs have not answered, and an illicit reseller market has emerged
As of the Feb 2026 reports, DeepSeek, Moonshot and MiniMax had not responded to Anthropic's allegations; Moonshot did not respond to the July 2026 K3 claim. OpenAI's memo says Chinese companies 'rely on networks of unauthorized resellers of OpenAI's services to evade our platform's controls', and on 3 September 2026 Anthropic's head of threat intelligence Jacob Klein described 'an entire illicit ecosystem' on the dark web spinning up accounts at scale. Meanwhile Qwen and Zhipu were conspicuously absent from Anthropic's February list, before Alibaba was named in June.
Charts · 7 charts
18 companies by distillation stance
companies| Stance | Companies |
|---|---|
| Restrictive (closed weights + ToS ban) | 5 |
| Permissive (open weights, distillation allowed) | 7 |
| Mixed | 6 |
Restrictive: OpenAI, Anthropic, Google, xAI, Cohere. Permissive: DeepSeek, Alibaba/Qwen, NVIDIA, Mistral, Hugging Face, Arcee, Zhipu. Mixed: Meta, Microsoft, Amazon, Moonshot, MiniMax, Apple. Classification from the company-matrix table.
Sources: ai.google.dev · huggingface.co · developer.meta.com
Documented distilled model families released per company per year
releases| Year | Google releases | NVIDIA releases | Meta releases | Microsoft releases | Hugging Face releases | DeepSeek releases | Alibaba (Qwen) releases | Apple releases | Mistral releases | Amazon (service) releases | OpenAI (service) releases | Arcee releases |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2024 | 2 | 2 | 1 | 1 | 0 | 0 | 0 | 0 | 0 | 0 | 1 | 1 |
| 2025 | 2 | 2 | 1 | 1 | 2 | 1 | 1 | 1 | 1 | 1 | 0 | 0 |
| 2026 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | 0 |
Counts are rows in the distilled-lineage table (one per teacher->student family, dated by release). 2026 is year-to-date through 3 September. Google's Vertex distillation service (Gemini 3.1 Pro -> 2.5 Flash) is excluded because it is pre-GA, allowlist-only and not a released distilled model family. Only company-documented distillations are counted, so OpenAI/Anthropic/xAI small tiers (undisclosed method) are excluded.
Distillation product and toolkit launches (scatter by date)
| Point | Series | Launch date | Launch order |
|---|---|---|---|
| Azure OpenAI stored completions & distillation (month not disclosed) | Launches | 2024 | 1 |
| Hugging Face TRL GKDTrainer (month not disclosed) | Launches | 2024 | 2 |
| Arcee DistillKit | Launches | 2024-08-01 | 3 |
| NVIDIA Minitron / NeMo recipes | Launches | 2024-08-14 | 4 |
| OpenAI Model Distillation | Launches | 2024-10-01 | 5 |
| Amazon Bedrock Model Distillation (preview) | Launches | 2024-12-03 | 6 |
| Hugging Face Open R1 | Launches | 2025-01-25 | 7 |
| Amazon Bedrock Model Distillation (GA) | Launches | 2025-05-01 | 8 |
| Google Vertex Gemini distillation (pre-GA docs, not launched) | Launches | 2026-07-23 | 9 |
| Azure stored completions retirement (scheduled) | Retirements | 2026-10-15 | 1 |
One point per row of the distillation-products table. Azure stored completions and TRL GKDTrainer are known only to year precision (month not disclosed) and are plotted at 2024. Open R1 dated to late January 2025 per the repository. The scheduled Azure retirement is a separate series because it is not a launch; its date is from Microsoft Learn.
Sources: arcee.ai · aws.amazon.com · huggingface.co · learn.microsoft.com
Exchanges attributed to each accused lab in Anthropic's reports
M exchanges| Accused lab | Exchanges (millions) M exchanges |
|---|---|
| DeepSeek (Feb 2026) | 0.15 |
| Moonshot AI (Feb 2026) | 3.4 |
| MiniMax (Feb 2026) | 13 |
| Alibaba / Qwen (Jun 2026) | 28.8 |
Feb 2026 figures from Anthropic's 'Detecting and preventing distillation attacks'; Alibaba figure from Anthropic's June 2026 Senate letter as reported by CNBC and CyberScoop (25,000 accounts over ~6 weeks).
Sources: anthropic.com · cyberscoop.com
Qwen3-8B: on-policy distillation vs reinforcement learning (Qwen3 report Table 21)
%| Benchmark | Off-policy distillation only % | + RL (17,920 GPU h) % | + On-policy distillation (1,800 GPU h) % |
|---|---|---|---|
| AIME'24 | 55 | 67.6 | 74.4 |
| AIME'25 | 42.8 | 55.5 | 65.5 |
| MATH500 | 92.4 | 94.8 | 97 |
| LiveCodeBench | 42 | 52.9 | 60.3 |
Alibaba's own ablation; teacher is Qwen3-32B / Qwen3-235B-A22B. The report concludes distillation needs 'approximately only 1/10 of the GPU hours'.
Sources: arxiv.org
Output price: flagship vs small tier at OpenAI and Anthropic
USD| Model | USD per 1M output tokens USD |
|---|---|
| GPT-6 Astra | 50 |
| GPT-5.5 | 30 |
| GPT-5.6 Sol | 20 |
| GPT-5.6 Terra | 12 |
| GPT-5.6 Luna | 1.2 |
| GPT-5 | 10 |
| GPT-5 mini | 2 |
| GPT-5 nano | 0.4 |
| GPT-4o | 10 |
| GPT-4o mini | 0.6 |
| o3 | 8 |
| o4-mini | 4.4 |
| Claude Haiku 4.5 | 5 |
| Grok 4 Fast | 0.5 |
Prices from the OpenAI pricing page on 2026-09-03; gpt-6-astra is the current flagship. OpenAI and Anthropic do not disclose whether mini/nano/Haiku tiers are distilled; OpenAI's own Distillation API positions GPT-4o mini as the student of GPT-4o. xAI says Grok 4 Fast was built with RL rather than distillation.
Sources: developers.openai.com · anthropic.com · x.ai
Pre-training tokens: distilled student vs from-scratch teacher or peer
T tokens| Model | Distilled student T tokens | Teacher / from-scratch peer T tokens |
|---|---|---|
| Llama-3.1-Minitron 4B | 0.094 | 15 |
| Ministral 3 (low end) | 1 | 15 |
| Ministral 3 (high end) | 3 | 36 |
| Gemma 3 1B | 2 | 14 |
| Gemma 3 4B | 4 | 14 |
| Apple on-device 3B (distill phase) | 1.4 | 14 |
Gemma 3 comparison uses the 27B sibling's 14T tokens. Apple: dense model trained ~14T, then last 10% (~1.4T) retrained with distillation loss. Ministral peers are Qwen 3 / Llama 3 models of similar size per Mistral (15-36T).
Sources: developer.nvidia.com · deeplearning.ai · arxiv.org · arxiv.org
Tables · 7 tables
Company distillation matrix: uses, sells, bans, accused, accuser
18 rows| Company | HQ | Uses distillation (documented) | Sells distillation tooling | Bans distillation of its outputs | Publicly accused | Public accuser | Open weights | Stance |
|---|---|---|---|---|---|---|---|---|
| OpenAI | US | Undisclosed (mini/nano tiers presumed; sells GPT-4o->4o-mini distillation) | Yes (Model Distillation, Oct 2024) | Yes | No | Yes (DeepSeek, Jan 2025 and Feb 2026) | gpt-oss only | restrictive assets.bwbx.io |
| Anthropic | US | Undisclosed (Haiku lineage) | Via Amazon Bedrock (Claude 3.5 Sonnet v2 as teacher) | Yes | No | Yes (DeepSeek, Moonshot, MiniMax, Alibaba) | No | restrictive anthropic.com |
| Google DeepMind | US | Yes (Gemini Flash/Flash-Lite, Gemma 2/3) | Yes (Vertex distillation, early access 2026) | Yes | No | Partial (reported 'distillation attacks' on Gemini; joined FMF intel sharing) | Gemma | restrictive arxiv.org |
| Meta | US | Yes (Llama 3.2 1B/3B, Llama 4 Maverick/Scout) | No (teacher on Bedrock) | No, but derivative must be named 'Llama...' | No | No | Yes (Llama license) | mixed developer.meta.com |
| DeepSeek | China | Yes (R1-Distill-Qwen/Llama, six models) | No | No (MIT, distillation expressly allowed) | Yes (OpenAI 2025/2026, House report 2025, Anthropic 2026, Gemini-similarity claims 2025) | No | Yes (MIT) | permissive huggingface.co |
| Alibaba (Qwen) | China | Yes (Qwen3 strong-to-weak distillation) | No | No (Apache 2.0) | Yes (Anthropic, June 2026: 'largest known distillation attack') | No (banned Claude Code internally July 2026) | Yes (Apache 2.0) | permissive arxiv.org |
| Microsoft | US | Yes (Phi family distilled from GPT-4; Phi-4-reasoning from o3-mini traces) | Yes (Azure OpenAI stored completions + distillation) | Azure OpenAI inherits OpenAI-style restrictions; Phi is MIT | No | No (FMF founding member) | Phi (MIT) | mixed arxiv.org |
| NVIDIA | US | Yes (Minitron, Nemotron Nano 2, Nemotron 3 Nano) | Yes (NeMo pruning/distillation recipes, TensorRT-LLM) | No (Nemotron Open Model License) | No | No | Yes | permissive arxiv.org |
| Amazon (AWS) | US | Undisclosed for Nova tiers | Yes (Bedrock Model Distillation, GA May 2025) | Undisclosed (AWS service terms) | No | No | No | mixed aws.amazon.com |
| Mistral AI | France | Yes (Ministral 3 via cascade distillation from Mistral Small 3.1) | No | No (Apache 2.0 for Mistral 3 family) | No | No | Yes | permissive arxiv.org |
| Hugging Face | US/France | Yes (SmolLM3 synthetic traces from Qwen3-32B; OpenR1-Distill-7B from DeepSeek-R1) | Open-source tooling (TRL GKDTrainer, open-r1) | No (Apache 2.0) | No | No | Yes | permissive github.com |
| Arcee AI | US | Yes (1.5B student from 7B Arcee-Agent; AFM-4.5B) | Open-source DistillKit (Apache 2.0) | No | No | No | Yes | permissive github.com |
| xAI | US | Undisclosed (Grok mini/fast tiers; Grok 4 Fast described as RL, not distillation) | No | Yes ('distilling' listed as prohibited) | Yes (admitted under oath, 2026-04-30) | No | Older Grok-1 only | restrictive x.ai |
| Moonshot AI (Kimi) | China | Undisclosed | No | No (modified MIT) | Yes (Anthropic Feb 2026: 3.4M exchanges; White House July 2026: K3 distilled from Anthropic) | No | Yes | mixed cyberscoop.com |
| MiniMax | China | Undisclosed | No | No (modified MIT) | Yes (Anthropic Feb 2026: 13M+ exchanges, largest of the three) | No | Yes | mixed anthropic.com |
| Zhipu AI (Z.ai) | China | Partial (GLM-4.5 'expert model iteration' post-training) | No | No (MIT) | No (explicitly not named by Anthropic) | No | Yes | permissive latent.space |
| Apple | US | Yes (3B on-device model distilled from 64-expert MoE teacher) | No | N/A (no public API for its foundation models) | No | No | No | mixed arxiv.org |
| Cohere | Canada | Not publicly described (Command A uses self-refinement and model merging) | No | Yes ('building a similar or competitive product or service') | No | No | Command R7B (CC-BY-NC) | restrictive cohere.com |
Stance: restrictive = closed weights plus ToS ban on training competing models; permissive = open weights with license expressly allowing derivatives; mixed = open weights with conditions, or closed weights without a public ban, or an accused open-weight lab.
Sources: anthropic.com · assets.bwbx.io · cnbc.com
Distilled model lineage: teacher to student, as documented by the companies
22 rows| Company | Teacher | Student | Student params (B) B | Method | Release |
|---|---|---|---|---|---|
| Gemini 1.5 Pro | Gemini 1.5 Flash | — | Distillation ('trained by 1.5 Pro through a process called distillation') | 2024-05 blog.google | |
| Larger Gemma 2 / undisclosed | Gemma 2 2B, 9B | 9 | KD instead of next-token prediction (Hinton et al.) | 2024-07 arxiv.org | |
| Arcee AI | Arcee-Agent 7B | 1.5B-Distilled | 1.5 | Logit + hidden-state distillation (DistillKit v0.1) | 2024-08 arcee.ai |
| NVIDIA | Llama 3.1 8B | Llama-3.1-Minitron 4B (width / depth) | 4 | Structured pruning + logit KD on 94B tokens | 2024-08 developer.nvidia.com |
| NVIDIA | Mistral NeMo 12B | Mistral-NeMo-Minitron 8B | 8 | Pruning + KD (Minitron) | 2024-08 arxiv.org |
| Meta | Llama 3.1 8B and 70B (logits) | Llama 3.2 1B, 3B | 3 | Single-shot structured pruning from 8B + logit KD in pre-training | 2024-09 ai.meta.com |
| OpenAI (customer-run) | GPT-4o, o1-preview | GPT-4o mini (fine-tuned) | — | Stored completions -> evals -> SFT (Model Distillation API) | 2024-10 infoworld.com |
| Microsoft | GPT-4 | Phi-1 / Phi-2 / Phi-3 family | 14 | Synthetic 'textbook' data ('largely distill the capabilities of a teacher model (specifically GPT-4)') | 2023-2024 arxiv.org |
| DeepSeek | DeepSeek-R1 (671B MoE) | R1-Distill-Qwen 1.5B/7B/14B/32B; R1-Distill-Llama 8B/70B | 70 | SFT on ~800K R1 reasoning samples, 2-3 epochs, no RL | 2025-01 arxiv.org |
| Undisclosed large teacher; 'large IT teacher' for post-training | Gemma 3 1B/4B/12B/27B | 27 | KD sampling 256 logits per token; 2T/4T/12T/14T tokens | 2025-03 arxiv.org | |
| Meta | Llama 4 Behemoth (~2T total, 288B active) | Llama 4 Maverick (400B total, 17B active); Scout | 400 | Codistillation with dynamically weighted soft/hard targets | 2025-04 ai.meta.com |
| Microsoft | OpenAI o3-mini (reasoning traces) | Phi-4-reasoning 14B | 14 | SFT on o3-mini demonstrations + RL | 2025-04 arxiv.org |
| Hugging Face | DeepSeek-R1 | OpenR1-Distill-7B | 7 | SFT on Mixture-of-Thoughts (350K traces) | 2025-05 github.com |
| Alibaba | Qwen3-235B-A22B and Qwen3-32B | Qwen3 0.6B/1.7B/4B/8B/14B, 30B-A3B | 30 | Strong-to-weak: off-policy response distillation, then on-policy logit KL | 2025-05 arxiv.org |
| Larger Gemini 2.5 models | Gemini 2.5 Flash, Flash-Lite | — | Distillation with k-sparse teacher distribution | 2025-06 arxiv.org | |
| Hugging Face | Qwen3-32B (synthetic reasoning traces) | SmolLM3 3B | 3 | Synthetic data generation + SFT + APO | 2025-07 huggingface.co |
| Apple | 64-expert sparse-upcycled MoE (from 14T-token dense model) | On-device ~3B model | 3 | Distillation loss for last 10% (~1.4T) of tokens; teacher cost cut 90% | 2025-07 arxiv.org |
| NVIDIA | Nemotron-Nano-12B-v2-Base (20T tokens) | Nemotron-Nano-9B-v2 | 9 | Minitron pruning + distillation | 2025-08 arxiv.org |
| Mistral AI | Mistral Small 3.1 (24B) | Ministral 3 3B/8B/14B | 14 | Cascade distillation: iterative pruning + continued training with distillation (1-3T tokens) | 2025-12 arxiv.org |
| NVIDIA | DeepSeek-R1, GPT-OSS-120B, Qwen models (synthetic) | Nemotron 3 Nano 30B-A3B | 30 | ~3.5T of 10.6T pre-training tokens synthesised from teachers | 2025-12 huggingface.co |
| Amazon (customer-run) | Nova Premier; Claude 3.5 Sonnet v2; Llama 3.3 70B / Llama 3.1 405B | Nova Pro/Lite/Micro; Claude 3 Haiku; Llama 3.2 1B/3B, Llama 3.1 70B/8B | 3 | Bedrock synthetic data generation + fine-tuning (teacher and student must be from the same model family) | 2025-05 aws.amazon.com |
| Google (customer-run) | Gemini 3.1 Pro | Gemini 2.5 Flash (custom) | — | Vertex distillation service (pre-GA, allowlist) | 2026-07 runtimewire.com |
Parameter counts for Gemini and GPT tiers are undisclosed. Phi row uses Phi-4's 14B as representative size; the Phi-4 report says phi-4 itself 'substantially surpasses its teacher model'. Amazon Bedrock Model Distillation only permits same-family teacher/student pairs (AWS: 'The teacher and the student model must be from the same family'), so each Amazon teacher is paired with a student of its own family.
Terms-of-service and license clauses governing distillation
18 rows| Company | Document | Clause (quoted) | Effect on distillation | Date |
|---|---|---|---|---|
| OpenAI | Terms of Use (ROW) | "use Output to develop models that compete with OpenAI" (listed under what you cannot do) | Prohibited for competing models; OpenAI's own Distillation API is the sanctioned path | current openai.com |
| Anthropic | Commercial Terms of Service, D.4 | "access the Services to build a competing product or service, including to train competing AI models or resell the Services" | Prohibited | 2025-06-17 anthropic.com |
| Anthropic | Consumer Terms of Service, s.3 | "To develop any products or services that compete with our Services, including to develop or train any artificial intelligence or machine learning algorithms or models" | Prohibited | 2025-10-08 anthropic.com |
| Gemini API Additional Terms, Use Restrictions | "You may not use the Services to develop models that compete with the Services (e.g., Gemini API or Google AI Studio)" | Prohibited; also bars extracting 'parameter weights' | 2026-04-28 ai.google.dev | |
| xAI | Terms of Service - Consumer; Acceptable Use Policy | Prohibits "distilling" the Service and using "the Service or Output to develop models or services that compete with xAI" | Prohibited (distillation named explicitly) | undisclosed (page not fetchable) x.ai |
| Cohere | Terms of Use, s.14(12) | "for the purpose of building a similar or competitive product or service" | Prohibited | 2022-09-07 cohere.com |
| Meta | Llama 4 Community License | "If you use the Llama Materials or any outputs ... to create, train, fine tune, or otherwise improve an AI model ... you shall also include 'Llama' at the beginning of any such AI model name" | Allowed with naming + 'Built with Llama' attribution; >700M MAU needs a license | 2025-04-05 developer.meta.com |
| DeepSeek | DeepSeek-R1 model card (MIT) | "allow for any modifications and derivative works, including, but not limited to, distillation for training other LLMs" | Expressly allowed | 2025-01 huggingface.co |
| Alibaba (Qwen) | Qwen3 model cards | Apache 2.0 | Allowed | 2025-05 huggingface.co |
| Moonshot AI | Kimi K2 Modified MIT License | "more than 100 million monthly active users, or more than 20 million US dollars ... in monthly revenue, you shall prominently display 'Kimi K2'" | Allowed with attribution above thresholds | 2025-07 huggingface.co |
| MiniMax | MiniMax-M2 model card | License: modified-mit | Allowed | 2025 huggingface.co |
| Mistral AI | Mistral 3 release | "All models are released under the Apache 2.0 license" | Allowed | 2025-12-02 mistral.ai |
| NVIDIA | NVIDIA Nemotron Open Model License | Open model license; model card lists teacher models used for synthetic data | Allowed | 2025-12-15 huggingface.co |
| Microsoft | Phi-4-mini model card | MIT license | Allowed for Phi weights; Azure OpenAI service outputs governed separately | 2025-02 huggingface.co |
| Hugging Face | SmolLM3 / TRL | Apache 2.0 | Allowed; TRL ships GKDTrainer for on-policy distillation | 2025-07-08 huggingface.co |
| Zhipu AI (Z.ai) | GLM-4.5 model card | MIT license | Allowed | 2025-07 huggingface.co |
| Cohere Labs | Command R7B model card | CC-BY-NC plus Acceptable Use Policy | Non-commercial derivatives only | 2024-12 huggingface.co |
| Amazon | AWS Service Terms (Bedrock) | undisclosed | Distillation sold in-platform; cross-platform terms not verified | undisclosed aws.amazon.com |
OpenAI's and xAI's ToS pages returned HTTP 403 to automated fetching; OpenAI's clause is corroborated by third-party legal commentary and xAI's by search-index text. The effective date of xAI's terms could not be verified and is recorded as undisclosed; the 'distilling' prohibition also appears in xAI's separate Acceptable Use Policy. Quotes are kept under 25 words.
Sources: ospo.co · anthropic.com · ai.google.dev · x.ai
Distillation products and toolkits offered by companies
9 rows| Product | Vendor | Launched | Teachers | Students | Status (2026-09) |
|---|---|---|---|---|---|
| Model Distillation (Stored Completions + Evals + Fine-tuning) | OpenAI | 2024-10-01 | GPT-4o, o1-preview, later gpt-4.1 | GPT-4o mini, gpt-4.1-mini | Docs state fine-tuning platform is 'winding down' for new users developers.openai.com |
| Stored completions & distillation (Azure OpenAI / Foundry classic) | Microsoft | 2024 | Any Azure OpenAI chat model (e.g. gpt-4o) | Azure OpenAI fine-tunable models | Stored completions retire 2026-10-15 learn.microsoft.com |
| Amazon Bedrock Model Distillation (preview) | Amazon | 2024-12-03 | Nova Premier; Claude 3.5 Sonnet v2; Llama 3.1 405B / 70B | Nova Lite/Micro; Claude 3 Haiku; Llama 3.1 70B/8B, Llama 3.2 1B/3B | Superseded by GA; preview promised 'up to 500% faster and 75% less expensive' aws.amazon.com |
| Amazon Bedrock Model Distillation (GA) | Amazon | 2025-05-01 | Nova Premier, Claude 3.5 Sonnet v2, Llama 3.3 70B | Nova Pro, Llama 3.2 1B/3B | GA; 'up to 500% faster and 75% less expensive ... less than 2% accuracy loss' aws.amazon.com |
| Gemini distillation (Vertex AI / Gemini Enterprise Agent Platform) | 2026-07 (docs) | Gemini 3.1 Pro | Gemini 2.5 Flash | Pre-GA, allowlist only, no production use runtimewire.com | |
| NeMo pruning + distillation (Minitron recipes), TensorRT-LLM | NVIDIA | 2024-08-14 | Llama 3.1 8B, Mistral NeMo 12B, Nemotron 12B | 4B-9B pruned students | Open recipes; Nemotron Nano 2/3 built with them developer.nvidia.com |
| TRL GKDTrainer (Generalized Knowledge Distillation) | Hugging Face | 2024 | Any HF causal LM | Any HF causal LM | Experimental module in TRL v1.12; lmbda/beta/seq_kd controls huggingface.co |
| Open R1 (open reproduction of DeepSeek-R1 distillation) | Hugging Face | 2025-01 | DeepSeek-R1 | Qwen2.5-based 1.5B-7B | OpenR1-Math-220k (Feb 2025), Mixture-of-Thoughts 350K (May 2025) github.com |
| DistillKit | Arcee AI | 2024-08-01 | Any (online or offline logits) | Any (cross-architecture via hidden-state loss) | Apache 2.0; logit compression via polynomial approximation + quantization github.com |
Every commercial service restricts the student to a model hosted on the same platform. Amazon Bedrock additionally requires the teacher and student to be from the same model family, and its row is split because the preview and GA announcements list different teacher/student sets.
Sources: infoworld.com · aws.amazon.com
Public distillation accusations between companies
11 rows| Date | Accuser | Accused | Exchanges / queries claimed | Accounts claimed | Claim | Outcome |
|---|---|---|---|---|---|---|
| 2025-01 | OpenAI | DeepSeek | — | — | DeepSeek distilled OpenAI outputs in violation of ToS; Microsoft flagged API exfiltration | House Select Committee report (April 2025) found it 'highly likely'; no lawsuit sites.law.berkeley.edu |
| 2025-06-03 | Independent researchers (EQ-Bench, SpeechMap) | DeepSeek (R1-0528) | — | — | Outputs stylistically resemble Gemini 2.5 Pro | Suggestive only; Google did not comment winbuzzer.com |
| 2026-02-12 | OpenAI (memo to House Select Committee) | DeepSeek | — | — | 'obfuscated third-party routers', programmatic extraction code, unauthorized reseller networks | Closed-door briefing offered; DeepSeek V4 shipped April-August 2026 regardless assets.bwbx.io |
| 2026-02-23 | Anthropic | DeepSeek | 150,000 | — | Targeted agentic reasoning, reward modeling and censorship-safe alternatives | No response from DeepSeek anthropic.com |
| 2026-02-23 | Anthropic | Moonshot AI | 3,400,000 | — | Targeted computer-use agents and vision | No response; later named by White House over Kimi K3 anthropic.com |
| 2026-02-23 | Anthropic | MiniMax | 13,000,000 | — | Agentic coding and tool orchestration; redirected nearly half of traffic to a new Claude model within 24h | No response anthropic.com |
| 2026-02-23 | Anthropic (aggregate) | DeepSeek + Moonshot + MiniMax | 16,000,000 | 24,000 | 'industrial-scale distillation attacks' | Intel shared with industry and authorities cyberscoop.com |
| 2026-02 | Google (Threat Intelligence Group) | Suspected state-aligned actors (China, Russia, North Korea) plus commercial firms and researchers | 100,000 | — | Gemini hit with 100,000+ structured prompts in an apparent cloning attempt; Google classifies model extraction as IP theft | Google joined FMF intel sharing (April 2026) nbcnews.com |
| 2026-04-30 | OpenAI litigation / sworn testimony (Musk v. OpenAI) | xAI | — | — | Musk conceded under cross-examination that xAI had 'partly' used OpenAI's technology: 'Generally A.I. companies distill other A.I. companies.' | On-the-record admission by a company whose own terms prohibit distilling; litigation ongoing forbesafrica.com |
| 2026-06-10 | Anthropic (letter to US Senate Banking Committee: Chair Tim Scott, Ranking Member Elizabeth Warren) | Alibaba (Qwen) | 28,800,000 | 25,000 | 'the largest known distillation attack' on Anthropic; ~6 weeks (22 April - 5 June) | Reported by CNBC 2026-06-24; Alibaba banned Claude Code for staff from 2026-07-10 cnbc.com |
| 2026-07-22 | White House OSTP (Kratsios) | Moonshot AI | — | — | Distilled Anthropic's Fable model to build Kimi K3 ('first open 2.8 trillion parameter model') using an internal platform and GB300 servers | Moonshot did not respond cyberscoop.com |
Exchange counts are the accusers' figures and have not been independently verified. The Google figure is a count of structured prompts reported by Google Threat Intelligence Group (via NBC News), not a per-lab exchange total comparable to Anthropic's.
Sources: anthropic.com · assets.bwbx.io · cyberscoop.com
Distillation efficiency claims made in company reports
17 rows| Company | Model | Metric | Distilled | Baseline | Unit |
|---|---|---|---|---|---|
| Alibaba | Qwen3-8B | GPU hours (on-policy distillation vs RL) | 1,800 | 17,920 | GPU hours arxiv.org |
| Alibaba | Qwen3-8B | AIME'24 (on-policy distillation vs RL) | 74.4 | 67.6 | % arxiv.org |
| Alibaba | Qwen3-8B | LiveCodeBench (on-policy distillation vs RL) | 60.3 | 52.9 | % arxiv.org |
| NVIDIA | Llama-3.1-Minitron 4B | Training tokens (student vs Llama 3.1 8B teacher) | 94 | 15,000 | B tokens developer.nvidia.com |
| NVIDIA | Llama-3.1-Minitron 4B (width) | MMLU (student vs 8B teacher) | 60.5 | 65.3 | % developer.nvidia.com |
| NVIDIA | Llama-3.1-Minitron 4B (depth) | Throughput vs Llama 3.1 8B (TensorRT-LLM, H100) | 2.7 | 1 | x developer.nvidia.com |
| Mistral AI | Ministral 3 (3B-14B) | Training tokens vs Qwen 3 / Llama 3 peers (low end) | 1,000 | 15,000 | B tokens deeplearning.ai |
| Mistral AI | Ministral 3 14B reasoning | AIME 2025 vs Qwen 3 14B Thinking | 85 | 73.7 | % deeplearning.ai |
| Apple | On-device ~3B | Teacher training cost reduction from new pipeline | 90 | 0 | % saved arxiv.org |
| Amazon | Bedrock distilled students | Latency (AWS: 'up to 500% faster' than the original model) | 600 | 100 | % of baseline speed aws.amazon.com |
| Amazon | Bedrock distilled students | Cost reduction (up to), accuracy loss <2% for RAG | 75 | 0 | % cheaper aws.amazon.com |
| DeepSeek | R1-Distill-Qwen-32B vs OpenAI o1-mini | AIME 2024 | 72.6 | 63.6 | % huggingface.co |
| DeepSeek | R1-Distill-Llama-70B vs OpenAI o1-mini | MATH-500 | 94.5 | 90 | % huggingface.co |
| Hugging Face | OpenR1-Distill-7B vs DeepSeek-R1-Distill-Qwen-7B (reproduction) | AIME 2024 | 52.7 | 51.3 | % github.com |
| Hugging Face | OpenR1-Distill-7B vs DeepSeek-R1-Distill-Qwen-7B (reproduction) | MATH-500 | 89 | 93.5 | % github.com |
| Gemma 3 4B-IT vs Gemma 2 27B-IT | Competitive per report (distillation-trained 4B matches prior 27B) | 4 | 27 | B params for similar IT quality arxiv.org | |
| NVIDIA | Nemotron-Nano-9B-v2 vs Qwen3-8B | Inference throughput in reasoning settings (up to) | 6 | 1 | x arxiv.org |
Open R1 rows use Open R1's own like-for-like re-evaluation of both models under one harness (AIME'24 52.7 vs 51.3; MATH-500 89.0 vs 93.5); DeepSeek's self-reported AIME'24 figure for DeepSeek-R1-Distill-Qwen-7B is 55.5, measured under a different setup. Gemma 3 row is qualitative from the report's claim that Gemma3-4B-IT is competitive with Gemma2-27B-IT.
Sources: arxiv.org · developer.nvidia.com · huggingface.co
Flagship vs small-tier API pricing at companies that build small tiers by distillation (or undisclosed)
16 rows| Vendor | Model | Tier | Input $/1M USD | Output $/1M USD | Distilled? |
|---|---|---|---|---|---|
| OpenAI | GPT-6 Astra (gpt-6-astra) | flagship | 10 | 50 | n/a developers.openai.com |
| OpenAI | GPT-5.6 Sol (gpt-5.6-sol) | mid | 4 | 20 | undisclosed developers.openai.com |
| OpenAI | GPT-5.6 Terra (gpt-5.6-terra) | mid | 2 | 12 | undisclosed developers.openai.com |
| OpenAI | GPT-5.6 Luna (gpt-5.6-luna) | small | 0.2 | 1.2 | undisclosed developers.openai.com |
| OpenAI | GPT-5.5 | prior flagship | 5 | 30 | n/a developers.openai.com |
| OpenAI | GPT-5 | prior flagship | 1.25 | 10 | n/a developers.openai.com |
| OpenAI | GPT-5 mini | small | 0.25 | 2 | undisclosed developers.openai.com |
| OpenAI | GPT-5 nano | small | 0.05 | 0.4 | undisclosed developers.openai.com |
| OpenAI | GPT-5.4 mini | small | 0.75 | 4.5 | undisclosed developers.openai.com |
| OpenAI | GPT-5.4 nano | small | 0.2 | 1.25 | undisclosed developers.openai.com |
| OpenAI | GPT-4o | flagship (2024) | 2.5 | 10 | n/a (teacher in Distillation API) developers.openai.com |
| OpenAI | GPT-4o mini | small | 0.15 | 0.6 | undisclosed (student in Distillation API) developers.openai.com |
| OpenAI | o4-mini | small reasoning | 1.1 | 4.4 | undisclosed developers.openai.com |
| OpenAI | o3 | flagship reasoning | 2 | 8 | n/a developers.openai.com |
| Anthropic | Claude Haiku 4.5 | small | 1 | 5 | undisclosed ('one-third the cost' of Sonnet 4) anthropic.com |
| xAI | Grok 4 Fast (<128k) | small | 0.2 | 0.5 | No per xAI (RL; '98% reduction in price' vs Grok 4) x.ai |
gpt-6-astra is OpenAI's current flagship (listed as 'rolling out today' on the pricing page on 2026-09-03); GPT-5.5 and GPT-5 are prior flagships kept for comparison. Google Gemini Flash prices are covered in the customer/financial perspectives; Google does confirm Flash tiers are distilled.
Sources: developers.openai.com · anthropic.com · x.ai
Timeline · 40 events
Google says Gemini 1.5 Flash was distilled from 1.5 Pro
Google I/O blog: Flash was 'trained by 1.5 Pro through a process called distillation'. First frontier lab to publicly label a production tier as distilled.
Source: blog.googleGemma 2 2B/9B trained with knowledge distillation
Gemma 2 report: 'We also train the 2B and 9B models with knowledge distillation (Hinton et al., 2015) instead of next token prediction.'
Source: arxiv.orgArcee AI open-sources DistillKit
Logit-based and hidden-state distillation toolkit; 1.5B student taught by 7B Arcee-Agent.
Source: arcee.aiNVIDIA publishes Minitron prune-and-distill recipe
Llama-3.1-Minitron 4B from Llama 3.1 8B using 94B tokens; up to 40x fewer training tokens, 2.7x throughput with TensorRT-LLM.
Source: developer.nvidia.comMeta releases Llama 3.2 1B/3B via pruning + logit distillation
Logits from Llama 3.1 8B and 70B 'were used as token-level targets' after single-shot structured pruning of the 8B.
Source: ai.meta.comOpenAI launches Model Distillation in the API
Stored Completions, Evals (beta) and fine-tuning to distill GPT-4o / o1-preview into GPT-4o mini; available to all developers.
Source: infoworld.comAmazon announces Bedrock Model Distillation (preview) alongside Nova
Teacher-student pairs within the Nova, Claude and Llama families (teacher and student must be from the same family); promises up to 500% faster, 75% cheaper, <2% accuracy loss.
Source: aws.amazon.comMicrosoft Phi-4 report: earlier Phi models 'largely distill' GPT-4
14B model on synthetic data; 'phi-4 substantially surpasses its teacher model on STEM-focused QA'.
Source: arxiv.orgOpenAI alleges DeepSeek distilled its models
OpenAI says it has evidence DeepSeek queried its models at scale to train competitors in breach of ToS; Microsoft investigates API exfiltration.
Source: sites.law.berkeley.eduHugging Face launches Open R1
Fully open reproduction of the R1 distillation pipeline; OpenR1-Math-220k released Feb 2025.
Source: github.comDeepSeek releases R1 plus six R1-Distill models under MIT
~800K R1 samples SFT'd into Qwen 1.5B-32B and Llama 8B/70B; license expressly allows 'distillation for training other LLMs'. Released 20 January 2025; the accompanying paper (arXiv 2501.12948) was submitted 22 January 2025.
Source: arxiv.orgGemma 3: all sizes trained with distillation
256 sampled logits per token; 1B/4B/12B/27B on 2T/4T/12T/14T tokens; post-training distills from 'a large IT teacher'.
Source: arxiv.orgHouse Select Committee report: DeepSeek 'highly likely' used unlawful distillation
Committee report on DeepSeek cites OpenAI's account of DeepSeek employee accounts; R1 base model often self-identifies as ChatGPT.
Source: fdd.orgMeta codistills Llama 4 Maverick from Behemoth; license requires 'Llama' naming
Behemoth ~2T total / 288B active; 'novel distillation loss function that dynamically weights the soft and hard targets'.
Source: ai.meta.comPhi-4-reasoning trained on o3-mini reasoning traces
Microsoft's 14B reasoning model uses SFT on demonstrations generated by OpenAI's o3-mini.
Source: arxiv.orgAmazon Bedrock Model Distillation reaches GA
Adds Nova Premier (teacher) -> Nova Pro, Claude 3.5 Sonnet v2 and Llama 3.3 70B teachers, Llama 3.2 1B/3B students.
Source: aws.amazon.comQwen3 report formalises 'strong-to-weak distillation'
Off-policy then on-policy distillation from Qwen3-235B-A22B/32B; beats RL with 1/10 the GPU hours.
Source: arxiv.orgResearchers claim DeepSeek R1-0528 resembles Gemini 2.5 Pro
Stylistic and trace similarities flagged by EQ-Bench and SpeechMap developers; not conclusive.
Source: winbuzzer.comGemini 2.5 Flash / Flash-Lite ship; report confirms distillation
'The smaller models in the Gemini 2.5 series — Flash size and below — use distillation' with a k-sparse teacher distribution.
Source: arxiv.orgApple reports distilling its on-device 3B model from a 64-expert MoE
Last 10% of tokens (~1.4T) retrained with a distillation loss; teacher training cost cut 90%; no structural pruning needed.
Source: arxiv.orgHugging Face SmolLM3 uses Qwen3-32B synthetic reasoning traces
3B model, 11.2T tokens; reasoning SFT data generated by prompting Qwen3-32B.
Source: huggingface.coNVIDIA Nemotron Nano 2: 12B pruned and distilled to 9B
Minitron strategy on a 20T-token hybrid Mamba-Transformer; up to 6x throughput vs Qwen3-8B.
Source: arxiv.orgAnthropic bars Chinese-controlled entities, citing distillation risk
Entities >50% owned by companies in unsupported regions blocked worldwide; 'could also potentially use our models to advance their own AI development through techniques like distillation'.
Source: anthropic.comxAI ships Grok 4 Fast, framed as RL not distillation
$0.20/$0.50 per 1M tokens; '98% reduction in price' vs Grok 4; '40% fewer thinking tokens'.
Source: x.aiAnthropic releases Claude Haiku 4.5 at $1/$5
'one-third the cost and more than twice the speed' of Sonnet 4; training method undisclosed.
Source: anthropic.comMistral 3: Ministral 3 built by cascade distillation from Mistral Small 3.1
3B/8B/14B under Apache 2.0; 1-3T training tokens vs 15-36T for Qwen 3 / Llama 3 peers.
Source: mistral.aiNVIDIA Nemotron 3 Nano lists DeepSeek-R1, GPT-OSS-120B and Qwen as synthetic-data teachers
~3.5T of 10.6T pre-training tokens distilled from other labs' open models.
Source: huggingface.coOpenAI memo to House Select Committee on DeepSeek's 'obfuscated' distillation
Alleges DeepSeek employee accounts used 'obfuscated third-party routers' and 'code to access US AI models and obtain outputs for distillation'; describes CoT-hiding and RL-grading classifiers.
Source: assets.bwbx.ioAnthropic: 24,000 fraudulent accounts, 16M+ exchanges by DeepSeek, Moonshot, MiniMax
DeepSeek 150K+, Moonshot 3.4M+, MiniMax 13M+ exchanges; MiniMax pivoted half its traffic to a new Claude model within 24h.
Source: anthropic.comOpenAI, Anthropic and Google agree to share distillation threat intel via Frontier Model Forum
Bloomberg reports US officials estimate unauthorised distillation costs labs 'billions of dollars' annually.
Source: techbrew.comWhite House memorandum NSTM-4 on 'industrial-scale' distillation
OSTP director Kratsios: foreign entities 'principally based in China' run 'deliberate, industrial-scale campaigns'; commits to intel sharing and accountability measures.
Source: nextgov.comDeepSeek V4 preview released despite allegations
V4-Flash followed 2026-07-31 and V4-Pro 2026-08-13 (per Wikipedia summary; primary release notes not fetched).
Source: en.wikipedia.orgMusk concedes under oath that xAI 'partly' used OpenAI technology
Cross-examined in Musk v. OpenAI, Elon Musk said xAI had partly used OpenAI's technology to train its models and that 'Generally A.I. companies distill other A.I. companies' - the first sworn distillation admission by a US lab.
Source: forbesafrica.comAnthropic tells US Senate Alibaba ran 'the largest known distillation attack'
Letter of 10 June 2026 to Senate Banking Committee Chair Tim Scott and Ranking Member Elizabeth Warren: ~25,000 fraudulent accounts and 28.8M interactions between 22 April and 5 June 2026 attributed to Alibaba's Qwen effort; first reported by CNBC on 2026-06-24.
Source: cnbc.comAnthropic admits Claude Code anti-distillation fingerprinting 'experiment'
Engineer Thariq Shihipar: markers added in March 'to prevent account abuse from unauthorized resellers and protect against distillation'.
Source: techcrunch.comAlibaba bans employees from Claude Code
Classified as high-risk software; staff told to uninstall Anthropic models and use Alibaba's Qoder.
Source: techcrunch.comWhite House accuses Moonshot of distilling Anthropic's Fable into Kimi K3
Kratsios says Moonshot used 'a sophisticated internal platform to conduct large scale distillation' and GB300 servers; K3 billed as 'first open 2.8 trillion parameter model'.
Source: cyberscoop.comGoogle Cloud documents Gemini 3.1 Pro -> 2.5 Flash distillation service (pre-GA)
Allowlist-only, no production use, 30-day initial access; conflicting model IDs suggest not yet a shippable product.
Source: runtimewire.comAnthropic: distillation fight moves to the dark web
Head of threat intelligence Jacob Klein describes 'an entire illicit ecosystem' spinning up accounts at extreme scale to resell Claude access.
Source: cnbc.comAzure OpenAI stored completions (distillation input) scheduled to retire
Microsoft Learn directs users to migrate to the Responses API and Agent Traces.
Source: learn.microsoft.com
Glossary · 14 terms
- Knowledge distillation (KD)
- Training a smaller student model to match a larger teacher's output distribution (soft targets / logits) rather than only ground-truth labels; introduced by Hinton et al. 2015 and cited by Gemma 2, Gemma 3 and Llama 3.2 reports.
- Strong-to-weak distillation
- Qwen3's term for training its 0.6B-30B models from Qwen3-235B-A22B / Qwen3-32B teachers, first off-policy (on teacher outputs) then on-policy (student samples scored by teacher logits).
- On-policy distillation
- The student generates its own sequences and is corrected by the teacher's token-level distribution, fixing train/inference mismatch (Agarwal et al. GKD; implemented in Hugging Face TRL's GKDTrainer).
- Codistillation
- Meta's term for training Llama 4 Maverick and Scout concurrently with the Behemoth teacher, using a loss that dynamically weights soft and hard targets.
- Cascade distillation
- Mistral's iterative loop of pruning a parent model (Mistral Small 3.1) and continuing training with a distillation loss to produce Ministral 3 3B/8B/14B.
- Prune-and-distill (Minitron)
- NVIDIA's recipe: structured width/depth pruning of a trained model followed by KD to recover accuracy with far fewer tokens (e.g. 94B vs 15T).
- k-sparse teacher distribution
- Google's approximation in Gemini 2.5 that stores only the top-k teacher probabilities per token to make distillation storage tractable.
- Stored completions
- OpenAI / Azure feature that logs production prompt-response pairs (store=true) so they can be filtered into a fine-tuning dataset for a smaller model.
- Distillation attack
- Industry term (Anthropic, OpenAI, Google, White House) for unauthorised large-scale querying of a proprietary model, often via fraudulent accounts or proxies, to harvest outputs for training a competitor.
- Chain-of-thought (CoT) extraction
- Eliciting a model's reasoning traces to use as training targets; OpenAI now trains models 'not to reveal reasoning traces' and Google summarises them to blunt this.
- Anti-competing-model clause
- ToS language (OpenAI, Anthropic, Google, xAI, Cohere) forbidding use of outputs or services to build competing models; the primary legal basis for distillation disputes.
- Modified MIT license
- Open-weight license used by Moonshot (Kimi K2) and MiniMax that keeps MIT permissions but adds an attribution requirement above 100M MAU or $20M monthly revenue.
- Frontier Model Forum (FMF)
- Non-profit founded by OpenAI, Anthropic, Google and Microsoft in 2023, used from April 2026 to share distillation-attack intelligence.
- NSTM-4
- April 2026 White House national security memorandum committing the US government to share intelligence on foreign distillation campaigns and explore accountability measures.
Sources · 75 sources
Every figure on this page comes from one of these primary sources. Compiled 3 September 2026.
- Model Distillation in the API
- OpenAI updates API with model distillation, prompt caching abilities
- OpenAI Terms of Use (Rest of World)
- Be Careful With OpenAI's Terms of Use
- OpenAI API pricing
- Supervised fine-tuning: distilling from a larger model
- Memo to US House Select Committee: Updated Stakes for American-Led, Democratic AI
- OpenAI Accuses China's DeepSeek of Distilling US AI Models to Gain an Edge
- OpenAI accuses DeepSeek of malpractice ahead of AI launch
- The Innovation Dilemma: AI Distillation in OpenAI v. DeepSeek
- OpenAI Alleges China's DeepSeek Stole its IP to Train its Own Models
- Detecting and preventing distillation attacks
- Anthropic accuses Chinese labs of trying to illicitly take Claude's capabilities
- Updating restrictions of sales to unsupported regions
- Anthropic tightens AI access rules, targeting Chinese-controlled entities
- Anthropic Commercial Terms of Service
- Anthropic Consumer Terms of Service
- Introducing Claude Haiku 4.5
- Anthropic accuses Alibaba of campaign to 'brazenly' and 'illicitly' distill Claude
- Alibaba reportedly bans employees from using Claude Code
- White House official accuses Chinese startup of distilling Anthropic's model
- Anthropic's distillation battle turns to the dark web as China concerns swell
- White House accuses China of 'deliberate, industrial-scale' campaigns to steal US AI models
- White House accuses China of industrial-scale theft of US AI frontier models
- OpenAI, Anthropic, Google join forces against China
- Gemini 2.5: Pushing the Frontier with Advanced Reasoning
- Gemini 1.5 Flash announcement (Google I/O 2024)
- Gemma 2: Improving Open Language Models at a Practical Size
- Gemma 3 Technical Report
- Gemini API Additional Terms of Service
- Google Cloud page describes Gemini distillation service, but its release status is unclear
- Google says Gemini was hit with 100,000 prompts in apparent cloning attempt
- Is DeepSeek Training its AI with Data from Google Gemini?
- Llama 3.2: Revolutionizing edge AI and vision with open, customizable models
- The Llama 4 herd: The beginning of a new era of natively multimodal AI innovation
- Llama 4 Community License Agreement
- DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning
- DeepSeek-R1 model card and license
- DeepSeek (Wikipedia) - V4 release dates
- Qwen3 Technical Report
- Qwen3-235B-A22B model card
- Phi-4 Technical Report
- Phi-4-reasoning Technical Report
- Phi-4-mini-instruct model card
- How to use Azure OpenAI stored completions & distillation
- Introducing Model Distillation in Azure OpenAI Service
- How to Prune and Distill Llama-3.1 8B to an NVIDIA Llama-3.1-Minitron 4B Model
- LLM Pruning and Distillation in Practice: The Minitron Approach
- NVIDIA Nemotron Nano 2
- NVIDIA-Nemotron-3-Nano-30B-A3B model card
- Amazon Bedrock Model Distillation (preview)
- Amazon Bedrock Model Distillation is now generally available
- The Amazon Nova Family of Models: Technical Report and Model Card
- Introducing Mistral 3
- Ministral 3 (paper)
- Mistral Uses Cascade Distillation on Mistral 3 To Build Ministral Family
- Generalized Knowledge Distillation Trainer
- Open R1: fully open reproduction of DeepSeek-R1
- SmolLM3: smol, multilingual, long-context reasoner
- Announcing DistillKit
- arcee-ai/DistillKit
- Grok 4 Fast
- xAI Terms of Service - Consumer
- xAI Acceptable Use Policy
- Musk admits distilling OpenAI data for his xAI
- Kimi-K2-Instruct model card
- Kimi K2 Modified MIT License
- MiniMax-M2 model card
- GLM-4.5: Agentic, Reasoning, and Coding (ARC) Foundation Models
- GLM-4.5 model card and license
- AINews: Anthropic accuses DeepSeek, Moonshot, and MiniMax
- Apple Intelligence Foundation Language Models: Tech Report 2025
- Command A: An Enterprise-Ready Large Language Model
- Cohere Terms of Use
- C4AI Command R7B model card