Detecting and preventing distillation attacks

2026-02-23 · Source: Anthropic News · Field: Technology & Digital — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy · Depth: Intermediate, medium

Summary

Anthropic has identified industrial-scale distillation campaigns by three AI laboratories—DeepSeek, Moonshot, and MiniMax—to illicitly extract capabilities from its Claude models. These labs generated over 16 million exchanges using approximately 24,000 fraudulent accounts, violating Anthropic's terms of service and regional access restrictions. Distillation, a technique involving training a less capable model on a stronger one's outputs, is legitimate for internal use but illicit when used by competitors to acquire advanced capabilities rapidly and cheaply. These campaigns pose national security risks by creating models lacking safeguards, potentially enabling authoritarian governments to deploy frontier AI for offensive cyber operations and surveillance. The attacks also undermine export controls by allowing foreign labs, particularly those subject to Chinese Communist Party control, to circumvent restrictions and close competitive advantages.

Key takeaway

For CTOs and VPs of Engineering evaluating AI model security, these findings highlight the critical need for robust detection and prevention mechanisms against illicit distillation. Your teams should prioritize developing advanced behavioral fingerprinting and coordinated activity detection systems, alongside strengthening access controls for API usage. Proactive intelligence sharing with industry partners is also crucial to build a collective defense against these sophisticated, industrial-scale threats.

Key insights

Illicit AI model distillation poses significant national security risks and undermines export controls.

Principles

• Illicit distillation strips safeguards from AI models.
• Distillation attacks reinforce the need for chip export controls.

Method

Attackers use fraudulent accounts and proxy services to access frontier models, generating high-volume, repetitive prompts targeting specific capabilities like agentic reasoning, tool use, and coding.

In practice

• Implement behavioral fingerprinting for API traffic.
• Strengthen verification for new account pathways.

Topics

• Distillation Attacks
• AI Model Security
• Export Controls
• Large Language Models
• Fraud Detection

Best for: CTO, VP of Engineering/Data, Executive, AI Security Engineer, Policy Maker, Director of AI/ML

Related on AIssential

• Google and OpenAI complain about distillation attacks that clone their AI models on the cheap — AI model distillation poses a significant intellectual property theft risk, enabling cheap cloning by extracting reasoning steps.
• AI Weekly Issue #478: The machines are hacking back — and so is everyone else — AI agents are now active participants in cyberattacks, shifting the threat landscape from theoretical to operational.
• The Distillation Game: Adaptive Attacks & Efficient Defenses — Adaptive distillation attacks reveal significant vulnerabilities, necessitating defenses evaluated against such advanced adversaries.
• Claude got attacked — Alibaba conducted a massive distillation attack on Claude, using 28 million exchanges to train its own model, prompting government intervention and potential KYC for AI.
• Anthropic accuses Alibaba of illicitly accessing its AI — AI model access controls are vulnerable to circumvention for competitive training via "distillation attacks".
• Exploits of public-facing apps are surging. Why? — Cybersecurity threats are evolving with AI, yet basic hygiene and supply chain vulnerabilities remain critical attack vectors.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Anthropic News.