US Treasury threatens sanctions over Chinese AI model distillation

Treasury Secretary Scott Bessent's own language reveals the fault line at the center of this dispute: the U.S. will investigate 'if' theft can be established, and only then would sanctions follow ^[1]. That conditional framing matters because Bessent has also said officials are finding 'watermarks of our U.S. large language models' embedded in Chinese models ^[2]- a claim that, according to technical observers debating the issue online, conflates two very different things: pure logit-level distillation, which would require access to a teacher model's raw output probabilities that a closed commercial API doesn't expose, versus fine-tuning on synthetic data harvested from ordinary API completions, a technique critics argue sits in much murkier legal territory. That distinction remains contested rather than officially settled, but it highlights how imprecise the government's own language has been so far. President Trump's own comments have done little to sharpen it - asked directly whether China is stealing American AI IP, he deflected rather than confirming or denying the theft claim, saying only 'we're leading China substantially,' a hedge that echoes Bessent's conditional framing rather than resolving it.

That distinction is exactly why AI researchers pushed back hard on the highest-profile individual case, Moonshot AI's Kimi K3. Braden Hancock of the Laude Institute argued the model's capability jump doesn't square with 'strictly distillation' given how little time elapsed, and Nathan Lambert of the Allen Institute for AI went further, arguing distillation's marginal value keeps shrinking as Chinese models close in on the frontier ^[4]. Beijing's Ministry of Commerce, for its part, has simply asserted the accusations have 'no legal basis' without engaging the technical distinction at all ^[3].

The two sides aren't just disagreeing on interpretation - they're working from wildly different evidentiary standards. Anthropic's complaint to the Senate Banking Committee names names and numbers: roughly 25,000 fraudulent accounts linked to Alibaba's Qwen lab, generating 28.8 million conversations with Claude in a six-week window between April 22 and June 5, 2026, concentrated on agentic reasoning and coding capability ^[5]. That followed an earlier, similarly granular disclosure in February 2026, when Anthropic and OpenAI jointly flagged more than 24,000 fraudulent accounts and over 16 million exchanges tied to DeepSeek, Moonshot, and MiniMax ^[6][7].

Against that level of detail, China's Ministry of Commerce response on July 27 offers no counter-data at all - just a categorical denial that the accusations have 'no legal basis' and a description of distillation as 'a technique widely used across the industry' ^[3]. Moonshot AI did offer one specific rebuttal of its own: an employee publicly stated Kimi K3 was trained from scratch in 15 days after Anthropic's frontier model went public, calling it 'Guinness World Record stuff' ^[8]. That claim addresses the timeline objection but not the underlying question of whether Anthropic's API was used as a training-data source at all.

Beijing isn't the only party arguing distillation outrage is selective. Hugging Face CEO Clem Delangue has pushed back publicly that distillation is a minor factor in China's AI progress and a practice used industry-wide, including by U.S. firms themselves ^[9]. Microsoft CEO Satya Nadella made a related point from the other direction, criticizing frontier labs for leaning on 'fair use' to train their own models on public data while simultaneously imposing restrictive anti-distillation terms on others ^[10]- a hypocrisy charge that lands given the IP disputes U.S. labs have themselves faced over training data.

China's Ministry of Commerce has leaned into this framing too, casting the U.S. campaign as 'AI hegemony' rather than a genuine IP dispute ^[3]. A Chinese government spokesperson pushed the same argument further and more bluntly, telling NBC News the U.S. accusations amount to an unfounded 'smear' rooted in 'prejudice' - sharper language than the Ministry's own formal statement. The result is a rhetorical stalemate where neither side's moral high ground survives contact with its own industry's practices - distillation-adjacent techniques are, by multiple accounts, standard practice on both sides of the Pacific, which makes the selective outrage as much a story here as the underlying technical claims.

The dispute's real-world stakes go beyond any single company's training pipeline. Bessent's sanctions threat, if acted on, could cut Chinese AI firms off from Western cloud infrastructure, capital, and compute ^[1]- and China's Commerce Ministry has already promised to 'take all necessary measures in response to any action that causes material harm to its interests' ^[3], raising the prospect of a tit-for-tat trade escalation layered on top of an already fraught chip-export relationship. Officials including Michael Kratsios have tied the distillation accusations directly to that export-control fight, alleging Moonshot combined industrial-scale distillation with use of export-restricted chips ^[11].

The timing raises the diplomatic temperature further. Paul Triolo of DGA-Albright Stonebridge Group warned that depending on how many firms are targeted and how harsh the penalties are, retaliation 'has the potential to scuttle both the AI dialog and the September 24 meeting between Presidents Trump and Xi' ^[10]. Yoshua Bengio, the AI researcher often called a 'godfather of AI,' frames the stakes in starker terms still: open-weight deployment and sharing decisions are irreversible, and 'their safeguards are easier to remove' once a model has been distilled or shared further ^[10]- precisely the mechanism at the center of this dispute. Kristy Loke, who studies China's AI governance, offered the counter-scenario: rather than escalating, the two countries could use this moment to negotiate shared pre-release testing standards and red lines for advanced open models ^[10]- a path that looks narrower the longer both sides trade accusations instead of evidence.