The distillation panic

Nathan Lambert's May 2026 post on interconnects is the policy follow-up to how-much-does-distillation-matter-for-chinese-llms. That post estimated the technical payoff of Chinese labs distilling American models. This one is about the words used for it and the laws that might follow. He agrees that some Chinese labs are jailbreaking or hacking APIs to pull out more signal, and that stopping it matters for the US lead. His objection is to calling it "distillation attacks", a label he expects to attach to every use of the technique.

The terminology problem

He compares it to open source versus open weights. The distinction mattered, most people outside the field never learned it, and the terms collapsed into "open models". The people who influence AI policy without knowing the technology then work from those collapsed terms. If "distillation" comes to mean something between corporate manipulation and crime, a technique that academics and small companies rely on to spread capabilities becomes suspect.

Anthropic's February post is his example. It calls distillation "a widely used and legitimate training method" and then describes a few actors using it illicitly. Lambert calls the paragraph clever, because it normalizes the technique while leaving out that the illicit cases involved jailbreaking, hacking or identity spoofing. In his view those actions are the problem, not the training method. What the labs did should be called jailbreaking or abuse.

How ordinary distillation is

He quotes his forthcoming book (see rlhf-book-synthetic-data-distillation). There, distillation colloquially means training on a stronger model's outputs, and in post-training it takes two forms: a data engine across the whole pipeline (instruction completions, preference data, verification for RL), or a way to move a specific skill such as math or coding into a weaker model.

Many pipelines are several steps removed from the teacher. A team might use a GPT API to make seed data for a small specialist model like olmOCR, which converts PDFs to text, use that model to produce a large corpus, and then train a new model from scratch on the corpus. Lambert asks whether that final model is "distilled from GPT", and the question has no clean answer.

Nearly everyone does this in some form. Nvidia's latest Nemotron models, which are among the few with open post-training data, are in large part distilled from Chinese open-weight models. Ai2's Olmo models are distilled from a mix of open and closed models. Most startups and research groups have very likely distilled from Claude, GPT or Gemini to some degree. In the Musk v. OpenAI trial, OpenAI's counsel asked whether xAI had distilled OpenAI's technology, and Musk answered "Generally AI companies distill other AI companies" and then "Partly". Lambert calls xAI probably the largest and most successful company willing to work in that grey area.

Terms of service for closed APIs forbid building competing products, and they have mostly gone unenforced. Before the Chinese cases, the one prominent restriction was ByteDance losing OpenAI access in December 2023.

The policy risk

The discussion moved quickly into government. A bill (H.R. 8283) came out of committee, an April 2026 executive order called for action, and a House committee began questioning US companies (the reading list names Airbnb and Anysphere, Cursor's parent) about building on Chinese models, which are themselves downstream of distillation. Lambert's worry is the combined effect: some mechanism that in practice bans Chinese open-weight models in the US on the grounds that their makers abused American APIs. No bill will literally ban open models, he says. It can create legal grey areas or compliance requirements that small open-source contributors cannot meet. six-months-to-live-for-open-models develops that fear further.

The cost would fall on Western academics and smaller companies building for the long tail of uses. There is no immediate substitute for the Chinese open models, and a new model takes six months or more to reach meaningful adoption. In that time researchers would move to closed platforms or other fields. A ban would probably not stop the Chinese labs either. He points to Chinese multimedia models, which take a loose view of copyrighted material that no US company will risk.

He wants two things avoided: a lasting negative meaning for the word distillation, and a domestic ban on open-weight models from organizations that did some distillation. He also wants US labs to be able to offer APIs without their IP leaking, and asks them to explain why that is hard to secure, which he says is outside his expertise.

Kevin Xu's counterpoint

The post ends with an argument from Kevin Xu. If Chinese labs depend on distillation to stay near the frontier, they may never learn what it takes to lead outright. Cutting them off would give the US a short-term lead and possibly push China onto a stronger long-term path. Lambert compares this to the export-control debate over advanced semiconductors. He says he understands the trade-off and still does not want a crackdown on distillation in general.

How the next months answered it

Two later documents bear on his claims. The stealing-reasoning-traces-from-proprietary-llm-apis paper showed that encrypted reasoning blocks from Anthropic, OpenAI and Google could be decoded by a weaker model from the same provider, which is the kind of API abuse Lambert distinguishes from distillation. Anthropic's September report (anthropic-threat-report-september-2026) kept the word but narrowed it to "illicit distillation": an industrial-scale, covert campaign enabled by fraudulent accounts, stolen cards and stolen keys. That definition goes some way toward his distinction. The report's case studies, however, still describe the training method and the fraud together. The broader story is on llm-distillation.