American agencies are accusing Chinese labs of extracting the capabilities of American models on an industrial scale. The technique in question is nothing exotic: it consists of querying a model en masse and using its answers to train another one. It is banned by the terms of use of most providers, and very difficult to detect.
We explained the mechanism in our article on distillation, noting that its use on a model one does not own was a recurring subject of dispute. Here it is at the diplomatic level.
The technique, plainly
The principle is that of the teacher and the pupil. A high-performing model is queried on a very large number of questions, its answers are collected, and a smaller model is trained to reproduce them.
What makes the operation effective, as we detailed: the pupil does not only learn the right answers, it learns the teacher's way of reasoning, its way of organising an explanation, its trade-offs.
Applied to a competing model, this makes it possible to recover a considerable part of the training work — which costs hundreds of millions — for the price of the queries.
Why it is very difficult to prevent
Three structural reasons, and they explain why the accusation is going through the diplomatic channel rather than the courts.
It is indistinguishable from normal use. A lab that queries a model a million times looks like a company that uses it a lot. Spotting the intent requires analysing the distribution of the questions, which is possible and imperfect.
Intermediaries muddy the trail. Queries can go through resellers, routing platforms, multiple accounts. We described the routing ecosystem in relation to Ox Alpha: it is designed to make the provider interchangeable, which also makes the customer difficult to identify.
The result cannot be demonstrated. Proving that a model was trained on another's outputs is extremely difficult. There are clues — characteristic turns of phrase, shared errors — but they do not constitute proof in the legal sense.
This accusation makes everyone uncomfortable, for a simple reason. The same companies that denounce the extraction of their models built those models on corpora whose origin is the subject of ongoing lawsuits, as we document every week. It is difficult to argue that taking someone else's work without authorisation is unacceptable when you are yourself being sued for it. This symmetry excuses nothing: it explains why the case is advancing through diplomatic channels rather than before a court, where the question of data origin would arise in both directions.
What it says about the moment
This accusation comes in a sequence we have been following for a month: a Chinese five-year plan worth 532 billion, a cluster of 100,000 accelerators on domestic silicon, and a leading model running on that hardware.
It offers an alternative explanation for that progress: it would not only be investment, it would also be capture.
The two explanations are not mutually exclusive, and neither is verifiable from the outside. What can be said is that the gap has narrowed, as we quantified in our comparison: three points between the best American and the best Chinese model.
What to take away
This affair illustrates a problem the industry has not solved: a model's capabilities leak through its very use.
A model that can be queried is a model from which part of the knowledge can be extracted. It is a property of what these systems are, not a security flaw that could be fixed.
It reinforces an argument we raised about open models: in a world where capabilities spread anyway, the strategy of deliberately publishing is not merely ideological. It captures influence and ecosystem rather than trying to hold on to what escapes. That calculation, as much as values, may explain some labs' publication choices.