In August 2026, ByteDance founder Zhang Yiming told the company’s Seed AI research team something almost nobody in the industry says out loud: do not distill rival models, even if it costs us the leaderboard. “Long-termism and delayed gratification, rather than using others’ output to achieve short-term leaderboard rankings,” he said, according to China’s state-backed The Paper. Within weeks, the US government had named six Chinese AI companies in a joint CISA-NSA-FBI advisory for doing exactly what Zhang told his people to avoid. The message from both capitals was the same: distillation — training your model on a competitor’s outputs — has become the central flashpoint of the US-China AI race.
This post unpacks what industrial-scale distillation actually is, who has been accused of it and on what evidence, which Chinese labs have the strongest case for genuine independence, and how to weigh all of this when you pick a model for your next project. Everything here is sourced from company disclosures, government advisories, and peer-reviewed research — and the honest answer at the end is more nuanced than any listicle would suggest.
Distillation Is Legitimate. The Way It Was Done Was Not.
First, the technique itself. Distillation trains a smaller or cheaper model on the outputs of a stronger one — a “teacher” and a “student.” It is one of the standard tools of modern ML. Frontier labs routinely distill their own models to ship cheaper, faster variants; every “mini” and “flash” model you use is a distillation product. Nobody accuses anyone of wrongdoing for that.
The accusation is different: using a competitor’s model as the teacher, at scale, through fraudulent accounts, in violation of the provider’s terms of service. At that point distillation stops being a training technique and becomes capability extraction — acquiring in months what took the target lab years and hundreds of millions of dollars. The US national security establishment has an additional concern: models built this way don’t inherit the safety training of the original, so frontier capabilities can proliferate with the safeguards stripped out.
Detection is the hard part. You generally cannot prove distillation by inspecting a finished model — the evidence lives in usage patterns: account fraud, IP correlation, synchronized traffic, and request structures that look like deliberate capability harvesting rather than human use. That is why every allegation in this post should carry an implicit asterisk: they are attributions by the companies and agencies that operated the detection systems, not audits of the training data.
The Timeline of Accusations
- December 2023 — The Verge reveals ByteDance was using OpenAI’s API to build a competing model; OpenAI suspends its account. ByteDance acknowledges early GPT-generated training annotations, says they were removed, and disputes continuing improper use. The episode now reads as a preview of everything that followed.
- July 2025 — Huawei’s AI lab publicly denies that one of its Pangu models was derived from Alibaba’s Qwen, after an internal-document leak suggested otherwise. The dispute fractures the “Chinese AI unity” narrative.
- February 2026 — OpenAI accuses DeepSeek of distilling US models, per Reuters. Anthropic publishes its distillation-attacks disclosure: DeepSeek, Moonshot, and MiniMax ran coordinated campaigns through roughly 24,000 fraudulent accounts, generating over 16 million exchanges with Claude targeting reasoning, tool use, and coding capabilities.
- June–July 2026 — Anthropic attributes the largest campaign it has measured to operators affiliated with Alibaba: more than 151 million exchanges with Claude between May and July, peaking near 3 million per day across 3,500+ fraudulent accounts, used to train Qwen models.
- August 2026 — Zhang Yiming’s internal directive against distillation at ByteDance. The Information reports the policy actually dates back to 2023 — meaning it predates the sanction threats that now make abstention politically convenient.
- September 2026 — Anthropic’s threat-intelligence report details Moonshot silently routing ~300,000 customer Kimi requests to Claude in one 10-day window (through 5,380 accounts), extracting reasoning transcripts as training data, and attributes 23+ million exchanges to Moonshot and 12+ million to DeepSeek over 14 days. Days later, CISA, NSA, and the FBI jointly name DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as conducting industrial-scale distillation “likely with Chinese government awareness.” Treasury Secretary Bessent has threatened sanctions and Entity List blacklisting.
The Evidence Landscape, Lab by Lab
Ranking companies by “who is least likely to distill” requires separating three tiers of evidence: companies with a leadership policy plus favorable independent research (ByteDance), companies with substantial in-house research but no major public allegation (Baidu), and companies named in official attributions (everyone else). Note that the named group is ordered by scale of allegations, not by guilt — the advisory groups them together for a reason.
| Lab / model family | Assessment | Key evidence |
|---|---|---|
| ByteDance (Doubao / Seed) | Strongest independence case | 2023-era anti-distillation policy, reaffirmed August 2026; favorable academic findings; absent from all attribution lists despite being the largest Chinese AI operation |
| Baidu (ERNIE) | Uncertain, plausibly independent | 2.4-trillion-parameter ERNIE 5.0 trained with published technical report; no comparable public allegation found |
| Tencent (Hunyuan) | Mixed | The Information reported employees used Claude Code as an evaluation reference for Hunyuan 3 — a reliance on a frontier system, but distinct from teacher-student distillation |
| Huawei (Pangu) | Mixed | Claims independent development; disputed internal-document allegations that one model derived from Qwen; not named in the US advisory |
| DeepSeek (V / R) | Named by everyone | OpenAI (Feb 2026), Anthropic (16M+ exchanges, then 12M+ in 14 days), CISA advisory |
| Alibaba (Qwen) | Named, largest scale | Anthropic: 151M+ Claude exchanges May–July 2026, 3,500+ fraudulent accounts |
| Moonshot (Kimi) | Named, distinctive method | Silent routing of customer requests to Claude; reasoning-transcript extraction; 23M+ exchanges |
| MiniMax (M series) | Named | Anthropic February disclosure; CISA advisory |
| Zhipu / Z.ai (GLM) | Named | CISA advisory; reported targeting of Claude reasoning and coding capabilities |
| StepFun (Step) | Named | CISA advisory |
| Xiaomi (MiMo) | Accused, smaller scale | Anthropic reported a Claude-based training-data extraction campaign |
Why ByteDance Stands Out
The case for ByteDance rests on more than an absence of accusations. There are four pillars:
The policy predates the pressure. The anti-distillation directive dates to 2023, per The Information — three years before Washington made abstention commercially advisable. A 2023 decision cannot have been designed to dodge 2026 sanctions. Either someone inside ByteDance genuinely believed distillation stunts long-term research capability, or they foresaw exactly where the political winds were blowing. Both are interesting; the second is more cynical but more plausible.
Independent academic evidence agrees. A peer-reviewed framework presented at ACL 2025 (“Quantification of Large Language Model Distillation”) measured two signals: identity-cognition contradictions (does a model claim to be made by someone else when prompted?) and multi-granularity response similarity to frontier models. Most evaluated LLMs — closed and open — scored high on distillation indicators. The low-distillation outliers were Claude, Gemini, and Doubao. DeepSeek, Qwen, and GLM models showed the high-distillation patterns. The study tested older model versions and behavioral similarity cannot prove what was in anyone’s training data — but it is independent of both governments and vendors.
The company has the most to lose. No Chinese tech firm is more exposed to US regulatory action than ByteDance. TikTok has spent years under American political pressure; a distillation accusation against ByteDance would be existential in a way it wouldn’t be for a private lab like Moonshot. Incentives and behavior align here.
Abstention visibly cost them. ByteDance’s coding models have been surpassed by smaller Chinese rivals that were named in the attributions — Moonshot’s Kimi models and Zhipu’s GLM line outperform Doubao’s coding efforts on public leaderboards. This is the strongest circumstantial evidence of all: the company that refused to distill fell behind on the benchmarks that distilled models win. Doubao’s commercial numbers remain enormous (345 million monthly active users as of March, second globally among AI apps behind ChatGPT), but the frontier-capability gap is real.
The historical caveat stays on the record: December 2023. ByteDance did use GPT outputs in early development, took a temporary API suspension for it, and cleaned house. The current policy appears to be the institutionalized lesson from that incident.
The Tencent Distinction Worth Understanding
Tencent deserves its own category, because what The Information described is not distillation in the strict sense. Tencent employees used Claude Code as an evaluation reference while developing Hunyuan 3 — comparing their model’s outputs against Claude’s to judge quality. The reporting indicates Claude’s responses were not fed into Hunyuan’s training pipeline.
This is a genuine gray zone. Using a frontier model as a benchmark is what every serious lab does, openly, in every evaluation harness. But it still means your development loop is calibrated against a competitor’s system — you know what “good” looks like because you can see Claude’s answers. It is reliance without theft. As attribution technology improves, expect this middle category — evaluation-referencing, synthetic data purchased legitimately, output comparison — to matter as much as the binary distilled-or-not question.
What This Means When You Pick a Model
If your objective is choosing a capable model — particularly for coding — separate two dimensions that usually get conflated:
- How independently was it developed? This is about provenance, provenance risk, and long-term trajectory. A lab that distills borrows capability; a lab that doesn’t builds research depth. If your vendor’s model lineage becomes subject to sanctions, export controls, or forced access restrictions, independence matters to your supply chain.
- How capable is it actually? This is what your product ships. The strongest model on one dimension is not the strongest on the other — 2026’s clearest lesson is that distilling labs are shipping top-ranked coding models while the most independent lab sits below them.
Also resist the inference that an accused lab’s work is entirely copied. A lab can run substantial original pretraining — novel architectures, real data pipelines, genuine research — and still use extracted competitor outputs extensively for post-training and alignment. The allegations describe a shortcut layered on top of real engineering, not a photocopy of a model. GLM and Qwen do things every day that no amount of distillation explains. The honest framing is “accelerated by extraction,” not “built on theft alone.”
And note the economics that keep the pressure on. Export controls mean Chinese labs face a compute ceiling; distillation is the obvious escape hatch from that ceiling; Beijing’s own response — export licensing for model weights — tightens the screws from the other side. Every incentive in the system pushes toward more of the behavior the advisories condemn, which is why enforcement via usage-pattern detection and account fraud prosecution has become the front line.
The Caveats That Matter
Three things to hold in mind as this story develops:
- Accusations are attributions, not audits. Anthropic and the US agencies operate the detection systems and publish what they observed with stated confidence levels, but no external party has independently audited any lab’s training corpus. The named labs deny the allegations; Huawei and Alibaba have publicly disputed specific claims.
- Detection only catches sloppy distillation. The campaigns described used fraudulent accounts and observable infrastructure. A careful actor querying APIs within normal-looking usage patterns would be nearly invisible. Absence from an attribution list is evidence of absence of detected campaigns, not proof of purity.
- Academic quantification is young. The ACL 2025 framework measures behavioral fingerprints — identity confusion and response similarity — which are suggestive, not forensic. Older models were tested; today’s flagships may behave differently.
Bottom Line
If you weight independence highest, ByteDance is the clearest case among Chinese labs — a policy that predates the pressure, independent academic corroboration, enforced at visible commercial cost. Baidu is the plausible second, with a large published technical report and no major attribution, though the evidence bar for a firm ranking hasn’t been met. Everyone else is in various states of officially attributed trouble, with Alibaba (scale), Moonshot (the customer-traffic routing), and DeepSeek (repeat appearances across two years of accusations) carrying the heaviest documented cases.
If you weight capability highest, judge the models on the leaderboards you care about and use the independence question as a risk factor, not a purity test. The market has already made its choice — distilled models are winning coding benchmarks — and the interesting question for 2027 is whether ByteDance’s long-termism bet starts paying compound interest, or whether the entire industry converges on the same few frontier teachers and the distinction stops mattering.