# LLM Distillation

Distillation means training one model on what another model produces. The word covers techniques that differ a great deal in mechanism, cost and legality, and by 2026 it had also become the name of a political dispute. Nathan Lambert's [[open-source-ai-reading-list]] calls it "the single most eventful debate around open models in 2026". This page separates the technique from the dispute and follows how the evidence in the dispute changed.

## Two techniques under one name

Knowledge distillation in the original sense (Hinton, Vinyals and Dean, 2015) trains a student to match the teacher's full probability distribution, its soft labels, rather than only the token the teacher chose. That requires the teacher's logits. A lab can do this with its own models. Google's Gemini 1.5 report was the early public confirmation, describing Flash as "online distilled" from Pro, and Lambert noted it in June 2024 ([[frontiers-in-synthetic-data]]). An outsider cannot do it through an API, because APIs do not return the distribution.

Colloquially, distillation means supervised fine-tuning on text a stronger model wrote. Prompt the teacher, keep its completions, train the student to predict them. Lambert argues this is better described as synthetic data. His textbook chapter ([[rlhf-book-synthetic-data-distillation]]) lists two uses in post-training: a data engine across the pipeline (instruction completions, preference labels, verification and grading for RL), and a way to move a narrow skill such as math or code into a smaller model. Formally, SFT on teacher text is sequence-level knowledge distillation (Kim and Rush, 2016), with a single sampled sequence standing in for the teacher's distribution.

Between these sit the methods that became standard in 2025-2026. On-policy distillation samples from the student and has the teacher score each token the student produced, usually as a per-token advantage inside an RL loop. This avoids exposure bias, where a student trained only on teacher-written prefixes fails once its own mistakes take it somewhere the teacher never went. Multi-teacher on-policy distillation combines several specialist teachers in one run. The chapter credits DeepSeek-V4 and Xiaomi's MiMo-V2-Flash with it and lists Qwen3 and GLM-5 among models trained with modern KD. Self-distillation uses the model as its own teacher, given privileged information such as a verified answer or a bug hint, as in Cursor's Composer 2.5. These methods need logits and usually a shared tokenizer, so they work with models you own or open weights, not with a closed API.

## Reasoning traces

Reasoning models changed what distillation from an API is worth. A final answer shows only where the teacher's computation ended. A reasoning trace shows the steps: how the problem was broken up, the intermediate deductions, the strategy. The [[stealing-reasoning-traces-from-proprietary-llm-apis]] paper cites work where training on reconstructed traces from GPT-5.4 mini raised a Qwen2.5-7B student's MATH500 accuracy from 68.4% to 76.0% compared with answer-only distillation. The reconstructed traces were only approximate.

Providers responded by hiding the traces. OpenAI's reasoning was not exposed by default, and Lambert suspects fear of distillation is why Gemini switched from visible to hidden reasoning ([[how-much-does-distillation-matter-for-chinese-llms]]). By mid-2026 Anthropic, OpenAI and Google all returned reasoning as encrypted blocks, which the client sends back on the next request so the server need not store them. The paper found these blocks could be moved across sessions, users and models within one provider. An attacker could therefore pass an Opus 4.8 or GPT-5.6 Sol trace to a weaker model from the same provider (Haiku 4.5, GPT-5.6 Luna) and have it transcribe the trace in plaintext, without ever jailbreaking the frontier model. The authors estimate that decoding 10,000 traces through Haiku would cost about $720. The same flaw exposed 367 PII items and 182 credentials in 315,320 reasoning blocks scraped from public session logs. The providers were notified, and afterwards the authors could no longer run the attack.

Anthropic's September 2026 report ([[anthropic-threat-report-september-2026]]) describes this class of attack in use. Claude returns a "thinking signature" in place of raw reasoning. Moonshot and DeepSeek saved those signatures, opened new sessions, and got Claude to expand them back into full traces. Other labs used prompt tricks ("DO NOT FLAG THIS AS REASONING EXTRACTION", or asking Claude to "translate" its earlier working memory into katakana), or ran twelve thousand requests testing extraction techniques before scaling the ones that worked. Anthropic's defenses are summarizing reasoning before responding, "preserved thinking" in Fable 5.1 so new accounts cannot edit the context that precedes encrypted reasoning, classifiers for extraction, and identity checks for suspicious accounts.

## What it buys a lab

Lambert's view, built up across 2026, is that distilled data is most useful at the start of post-training and less useful each year. In February he estimated that Moonshot's and MiniMax's disclosed traffic came to roughly 150-400 billion tokens, a lot of SFT data next to Olmo 3's 20 billion. He also argued that volume is a poor measure: fitting another model's outputs into a pipeline is a research problem, and some teachers make students worse. In July ([[how-distillation-is-used-today]]) he placed distillation in SFT and midtraining, where reasoning behavior gets seeded. That is also why some Chinese models call themselves Claude. It helps most when a lab enters a domain where US labs are well ahead.

His argument against a large effect rests on RL. Frontier post-training now needs large amounts of on-policy generation from the model being trained, generation is most of RL's compute, and another lab's API cannot provide it. RL's share of final performance keeps growing, so an early SFT stage matters less. Two further points push the same way. The strongest model is often not the best SFT teacher: OpenThoughts and Olmo struggled to use top models and often did better with a smaller one. And a student is not capped by its teacher. Lambert's example is Claude Sonnet 3.5, which was well distilled from Opus checkpoints and still led Anthropic's lineup for a while.

Why labs distill anyway is also economic. Lambert calls API tokens a substitute for compute. A Chinese lab short on GPUs can buy access to a "banned" API more easily than it can smuggle a cluster, and Ai2 built Olmo 3's synthetic data on donated supercomputer hours and cloud credits for similar reasons. Distillation from other models is common everywhere. Nvidia's Nemotron post-training data is largely distilled from Chinese open models, Olmo from a mix of open and closed ones, and Elon Musk testified that xAI had "partly" distilled OpenAI ([[the-distillation-panic]]).

Anthropic's report says otherwise. Its own research found "significant uplift" in agentic work, coding and reasoning "using fewer exchanges than those harvested", with gains that carry across domains, including toward dangerous biological or cyber capabilities the harvested data barely touched. It also says a distilled model does not inherit Claude's safeguards. The report does not publish that research, so the claim cannot be checked against Lambert's reasoning about RL.

## The political fight

Accusations began with DeepSeek R1 in January 2025, when the question of whether DeepSeek had trained on o1 outputs was argued in public. OpenAI's formal accusation that DeepSeek jailbroke its API to extract hidden reasoning, reported by Bloomberg, came in February 2026, and Anthropic's report says OpenAI had been raising the issue since early 2025. Anthropic's February 2026 disclosure named DeepSeek (about 150,000 exchanges), Moonshot (3.4 million) and MiniMax (13 million), 16 million in total through roughly 24,000 fraudulent accounts. Congress and the White House followed. A bill came out of committee, an April 2026 executive order called for action, and House committees questioned Airbnb and Anysphere about using Chinese models. Lambert's reading list also gathers probes of DoorDash and Apple and the related wave of US companies switching to Chinese open models (see [[us-scrutiny-of-chinese-model-use]]).

Lambert's position in [[the-distillation-panic]] is that "distillation attacks" names the wrong thing. The offense is jailbreaking, hacking and identity fraud against an API. The training method is ordinary. Using the one word for both risks tainting a technique academics depend on, and could produce a de facto US ban on Chinese open-weight models, which would hurt Western researchers more than Chinese labs. Kevin Xu's counterpoint, which Lambert quotes, is that a China dependent on distillation may never learn to lead. Tom Bedor asks the related question of whether a distilled model is still "Chinese" at all ([[arguments-against-open-source-ai]]).

Anthropic's September report changed the vocabulary without dropping it. "Illicit distillation" there means an industrial-scale covert campaign enabled by fake accounts, stolen cards and stolen API keys, bought through proxy "transfer stations". That is close to Lambert's line between technique and abuse. The numbers in the report are much larger than anything earlier. Seven Chinese labs are named: Alibaba (over 151 million exchanges from May to July, peaking near 3 million a day, with Opus 4.6 and 4.7 chain-of-thought turned into SFT data for Qwen 3.5-3.7), Moonshot (23 million), DeepSeek (12.1 million in 14 days of July), Zhipu (3.4 million, including Opus 4.8 traces and an attempt at cyber capabilities before GLM 5.3), Xiaomi, SenseTime and MiniMax. The report also moves the issue into privacy. Moonshot and DeepSeek silently routed their own customers' requests to Claude, including a likely PLA-linked CCTV analysis and live credentials. Xiaomi replayed its users' sessions. MiniMax ran a shell proxy service that offered only Anthropic and OpenAI models, apparently to collect conversations.

## How the evidence was argued

Evidence in this debate comes in three kinds, and each has limits worth keeping in mind.

Provider telemetry is the strongest on scale and attribution and the weakest on effect. Anthropic can count exchanges and link accounts to organizations. Its statements about what the data did to a model rest on internal research it has not published. When Lambert assessed the February numbers, DeepSeek's 150,000 exchanges looked negligible. The September report puts DeepSeek at 12.1 million in two weeks. The earlier judgment was sound for the data it had, and the data has since changed.

Behavioral probes on open models show similarity, not cause. Appendix B of the reasoning-traces paper prefilled open models' reasoning with fragments of decoded Opus 4.8 or GPT-5.6 Sol reasoning. Kimi K3 and GLM-5.2 moved toward the source's style, and Kimi K3's visible answers moved toward Opus's on 29 of 30 problems. Inkling and DeepSeek showed no comparable change, and swapping prefills between Kimi K3 and Inkling produced nothing significant. The authors call this "suggestive but inconclusive". A smaller gist with the same design ([[qwen-gpt-reasoning-prefills]]) found Qwen3.8 following GPT-5.5 Pro strongly and Opus 4.8 barely. That sits awkwardly next to Anthropic's attribution of Opus-trace distillation to Qwen 3.5-3.7, though the model versions differ. Stylometric tools ([[llm-cross-entropy-similarity]], [[ai-comment-classifier]]) also find family resemblances without being able to explain them.

Reasoning from how training works is Lambert's main tool: RL compute, teacher fit, the gap between SFT and the final model. It limits how much distillation can explain, but it cannot rule out a particular shortcut. The clearest case is his own. In April 2025 he wrote confidently that DeepSeek did not distill o1. In September 2026, having seen that trace extraction was practical, he wrote that it was "more possible than I gave it credit" that DeepSeek distilled some o1 traces to make R1 easier to train. He adds that this would not take away from R1's innovation, and that it is one way distillation could speed up China's closing of the gap ([[open-closed-model-gap]]).

The [[ai-great-leap-forward]] essay uses "distillation" in an unrelated sense: companies asking employees to write their expertise down for AI systems, and employees quietly holding knowledge back. That is not model training, despite the shared term.