How to tell whether an AI distillation accusation actually holds up

Two of the same week's headlines couldn't both be simply true. On July 21, 2026, Treasury Secretary Scott Bessent told Fox Business the U.S. had found "watermarks" of American AI models inside Chinese ones, and warned sanctions could follow within days or weeks. The next day, Nvidia CEO Jensen Huang told Axios a U.S. ban had "zero possibility," calling the underlying technique — distillation — "fundamental to intelligence." They aren't actually arguing about the same claim. One is describing a specific violation; the other is defending an ordinary research method that happens to share its name. Telling those two things apart, and knowing what real evidence for the violation looks like, is the actual skill — whether you're reading a Treasury threat, a rival lab's accusation, or the next one of these that lands.

Two different things share the word "distillation"

Distillation, the technique, is training a smaller or cheaper model to imitate a stronger one's outputs — routine, legal, and used internally by essentially every major lab, including OpenAI, Anthropic, and Google, to turn a flagship model into faster, cheaper tiers. The accusation, when one lab levels it at another, is something narrower: querying a rival's API at industrial scale, through fabricated accounts, in violation of its terms of service, to extract training signal without permission. Nvidia's own open-weights policy letter — signed by roughly 50 companies including Microsoft, OpenAI, and Google — draws exactly this line, calling distillation "a legitimate, longstanding research technique" while arguing that unlawful extraction of a competitor's outputs should be handled through targeted legal and commercial measures, not a blanket restriction on open weights. Conflating the two is the single easiest way to either wave off a real violation as normal research, or treat normal research as theft.

What real evidence for the violation actually looks like

The clearest example of documented evidence predates any of this week's claims. On February 23, 2026, Anthropic disclosed that three Chinese labs — DeepSeek, Moonshot, and MiniMax — had run what it called industrial-scale distillation campaigns against Claude: roughly 24,000 fraudulent accounts, one proxy network alone running more than 20,000 simultaneously, and more than 16 million logged exchanges combined, all in violation of Anthropic's terms of service. That's what a documented claim looks like — specific counts, from the company's own logs, describing an attack on its own system. What it is not is proof that any particular later model was built on that extracted data specifically; Anthropic's disclosure named the Kimi line generally, five months before Kimi K3 existed.

Compare that to Bessent's "watermarks" claim. A watermark, in the sense the AI industry actually uses the term, is a real and checkable thing — Google's SynthID and Anthropic's own text watermark both leave a machine-readable signal in a model's output that a detector can check for. If Treasury genuinely holds output samples carrying a traceable American-model signature, that would be close to the strongest evidence this kind of accusation can produce. But as of this writing, no methodology, sample, or supporting document behind the claim has been made public — it exists as a cabinet secretary's on-air assertion, not a filing. The same week, the White House's Michael Kratsios separately accused Moonshot by name of distilling Anthropic's Fable to build Kimi K3 specifically, and Treasury threatened Entity List action — also without releasing supporting documentation. Two officials, two claims, zero published evidence for either as of this writing.

Evidence can cut the other way too, and it's worth knowing what that looks like. Technical write-ups of Kimi K3's architecture — Kimi Delta Attention, a hybrid linear-attention mechanism; Stable LatentMoE's 896-expert routing; quantization built in from the fine-tuning stage rather than bolted on afterward — describe engineering choices that don't come from training on a rival's chat outputs. None of that disproves the accusation, but it's the kind of specific, checkable detail the accusation itself hasn't offered. Separately, Kimi K3 has been independently scored: Artificial Analysis, an evaluator with no commercial stake in either company, placed it at 57 on its Intelligence Index — third overall, just ahead of Claude Opus 4.8. That's a real, independently produced number, and it answers "is this model actually capable" — a different question from "how was it built," a distinction the accusation and its coverage both tend to collapse.

Run this before you credit — or dismiss — the next one

Run those five questions against the Moonshot case as it stands today, and the honest picture is narrower than either side's public framing.

Where this check gets skipped

The same instinct — separate the claim that's documented from the claim that's merely stated — is what checking a company's own AI claim and checking an open-weight model's actual license terms both teach, pointed at a different kind of dispute. Anthropic and Moonshot are both likely to be back in this position before the underlying policy questions resolve; the dictionary has a short entry for distillation itself if the term needs unpacking first.