Treasury Secretary Scott Bessent posted a warning on X that reads like a border being drawn in real time. The United States supports open-source AI, he wrote, but open source is not open season on American IP, and when PRC firms conduct covert, industrial-scale distillation attacks that cross into IP theft, sanctions and Entity List designations will be on the table. It is a clean sentence. The trouble starts when you ask what distillation is and who actually does it.
Distillation is old and boring engineering. A smaller student model learns from the outputs of a larger teacher model, matching its behavior rather than copying its weights or its training data. The idea traces to a 2015 paper by Hinton, Vinyals, and Dean, and it has been standard practice since. What it transfers is behavior, output distributions, patterns of reasoning. It does not lift the underlying files. That distinction matters more than the political language wants it to.
Here is the part the warning skips over. The frontier labs do this constantly, to themselves and to each other. Google sells it as a product. The Gemini Distillation Service lets a customer train a smaller student model on the outputs and reasoning of a larger teacher. The Llama and Gemma families were built by distilling from bigger models. And Elon Musk has admitted that xAI "partly" used OpenAI's technology to train its own models, which happens to violate OpenAI's own terms of service. So the technique is not the crime. Everyone in the room uses it. The accusation is really about scale, secrecy, and whose paperwork got broken.
The evidence that started this is thin
Bessent's stated proof is that the administration keeps finding watermarks of US large language models on Chinese models, which he called unacceptable. Read that again, because it is doing a lot of work. He did not name the companies. He did not name the legal authority Treasury would use. He did not explain how officials detect these watermarks, and no independent party has been shown the method. When a government official asserts a technical finding and provides nothing you can check, the finding is a claim, not a fact. BankInfoSecurity flagged exactly this gap. I would hold the watermark story at arm's length until someone shows the work.
The trigger underneath the sanctions talk is a specific charge. A White House official, OSTP Director Michael Kratsios, accused Moonshot AI of distilling an Anthropic model to build Kimi K3, which beat some OpenAI and Anthropic benchmarks after release. The exact model name and timeline in that accusation are contested, and some of the sharpest details floating around, model code names and query counts, appear only in aggregator posts I could not confirm against primary reporting. Strong benchmark numbers from a Chinese lab set off the alarm. That is worth naming plainly. The panic tracks the ranking, not the evidence.
The lawyers do not agree that this is theft
The most useful thing I read across all of this came from the people paid to win these cases, and they are not confident. If AI-generated outputs are not themselves copyrightable, then training on those outputs does not infringe copyright under traditional doctrine, because copyright protects expression, not ideas, methods, or functional processes. A UC Law SF journal paper reaches the same conclusion: distillation is unlikely to be copyright infringement under existing law. Patents on model outputs alone are unlikely. Trade secret claims need proof of illegal access that has not been made public.
What is left is contract. OpenAI, Anthropic, Mistral, and xAI all write anti-competitive distillation clauses into their terms of use, banning customers from using outputs to build rival models. Breaking those terms is a real and fairly clean legal claim, far cleaner than IP theft. But enforcing a terms-of-service violation against entities operating through proxy services and fake accounts in a foreign jurisdiction is close to hopeless in practice. So the honest version of the story is that the strongest legal hook is a contract most people never read, and even that hook is hard to set in a foreign court. The political language calls it theft because theft sounds like something the state can punish.
Glass houses
The labs raising the alarm made their own case for learning from other people's work. In Bartz v. Anthropic last June, a Northern California court held it was fair use to copy books to train Claude, on the reasoning that generative AI is quintessentially transformative. Copy the entire written output of human authors, and that is transformation worth protecting. Let another lab learn from your model's outputs, and that is an industrial-scale attack. Both cannot be principled at once. One of them is just about who owns the bigger position.
Not everyone on the American side is playing along. Nvidia's Jensen Huang said US companies should absolutely use Chinese AI models and called distillation fundamental to intelligence, which is a striking thing to say while your government drafts sanctions over it. Representative Ted Lieu asked the obvious question about why the administration threatens sanctions over alleged AI IP theft while still selling high-end AI chips to China. Nathan Lambert, who follows the Chinese labs closely, made the practical point that once you expose an API for your best model, other people will train on it, that this is the natural path, and that treating models as too precious to distill just pushes labs to lock everything behind first-party products. He also flagged the real open question nobody has answered: how much of the Chinese gains came from abusing APIs versus legitimately paying as customers.
Strip away the language of attack and you get a familiar shape. A general-purpose technique gets reframed as a weapon the moment a competitor from the wrong country uses it well. The commons feeds every lab that now wants to wall it off, and the wall is always described as protection rather than capture. I have watched this pattern run in older forms, where a country takes freely and then writes the law that makes taking back a crime. The technology is new. The move is not.