Join War on the Rocks and gain access to content trusted by policymakers, military leaders, and strategic thinkers worldwide.
The release of the Chinese open-weight AI model Kimi K3 has compressed a year’s worth of unresolved AI policy debate into a single news cycle. On July 21, Treasury Secretary Scott Bessent threatened sanctions against Chinese labs found to have built their models on “theft,” reporting that the government is “finding watermarks of our U.S. large language models on many of the Chinese models.” The following day, White House science advisor Michael Kratsios clarified that the Chinese AI lab behind K3, Moonshot AI, had built a sophisticated platform to copy Anthropic’s Fable model while evading detection.
Industry has been vocal about its own views, with Nvidia’s Jensen Huang declaring that American companies should “absolutely” use Chinese models that outcompete American counterparts on price. In the Washington Post, investor Bill Gurley argued that treating open models as a danger to be licensed and contained runs afoul of the free-market principles that have long powered American innovation.
China’s open-source AI models are marching steadily into global markets, and now account for the majority of global AI workloads. The debate about what to do about them has polarized Washington into two camps. One group, alarmed by the legitimate security risks that accompany Chinese AI diffusion, would prefer to see Chinese AI models restricted or banned from American infrastructure outright. They point to the theft of American intellectual property as one of several reasons to clamp down on Chinese AI. The other camp, championed by software engineers and technologists who have come to rely on Chinese models, warns about undue costs from restricting software development, and maintains that nothing untoward has happened to American intellectual property.
Amid the frenzy, the Trump administration is walking a difficult tightrope. Officials have so far been supportive of open-source software while seeking to punish covert, industrial-scale extraction of American trade secrets. This principle is the right line to draw, and Washington already has the necessary legal machinery to enforce it. Stated plainly, the United States should be prepared to sanction Chinese AI labs engaged in industrial-scale fraud, not the underlying practice of “distillation” employed by much of the AI industry.
The policy conversation around AI distillation has diverged sharply from the technical reality of today’s AI industry. Before considering the direction of U.S. policy, it is worth understanding what distillation is, what role it has played in the progress made by Chinese AI labs, and how it is sometimes abused to infringe intellectual property.
First, distillation — the act of training a smaller, “student” language model on the outputs of a stronger “teacher” one — is an industry-standard method used by every AI lab, including American frontier labs distilling their own models and Chinese open-weight competitors. Banning distillation is not technically enforceable, as anyone with access to a model’s output, including legitimate customers, can rearrange those outputs back into training data. Even if it were possible to stop distillation outright, an American AI ecosystem confined to producing un-distillable models would artificially protect two or three frontier labs at the expense of every other AI developer seeking to adapt scientific innovation.
Second, distillation does not explain as much of recent Chinese model performance as many in Washington would like to believe. While distillation helps Chinese labs bootstrap reasoning behavior, these labs are still conducting serious engineering research of their own. DeepSeek R1’s efficiency breakthrough in January 2025 came primarily from a change in reinforcement learning rather than from copying American competitors. Moonshot’s focus on agent swarming earlier in 2026 was likewise a homegrown capability. While stopping distillation attacks against American frontier labs is still a noble policy objective, Washington should understand that doing so will slow, not stop, Chinese progress.
Third, the objectionable conduct of Chinese AI labs is not simply distillation, but the widespread and systematic fraud designed to steal American trade secrets. Grasping the difference requires differentiating between distillation as a legitimate model training technique and a distillation attack, in which a firm obtains access to a competitor’s product through deception to copy it. While breach of user agreement is usually a civil matter, a fraudulent scheme to gain and sustain unauthorized access —including the use of fabricated identities, purpose-built evasion infrastructure, and systematic circumvention of security controls — is the domain of the Computer Fraud and Abuse Act and wire fraud statutes.
By February 2026, Anthropic traced more than 3.4 million exchanges with its models to Moonshot. These were routed through hundreds of fake accounts, using an internal platform purpose-built to evade detection. Later in June, Anthropic told the Senate Banking Committee that Alibaba’s Qwen lab had conducted the “largest known distillation attack” against it to date.
The distinction between distillation-as-technique and distillation-as-attack helps justify which behavior the U.S. government can credibly punish but does not tell the full story about why the Trump administration is or should be concerned about Chinese models.
Under U.S. law, model outputs alone are not copyrightable as they require human authorship, which makes “intellectual property theft” a legally dubious description. Trade secret law is the better fit.
Skeptics will object that model outputs served through commercial interfaces cannot remain “secret,” but proprietary access to frontier models is not exactly public. It is authenticated, paid, rate-limited, and restricted under terms of service. Moreover, the trade secret at issue is not Claude or ChatGPT’s response to a single query, but the underlying model behavior collectively encoded across millions of conversations — which can only be extracted systematically at scale.
Critics of American frontier labs have already noted that Anthropic itself trained on pirated books and paid a $1.5 billion settlement for doing so. Ironically, this comparison illustrates the exact problem: Anthropic was sued in an American court and paid the largest copyright settlement in history. There is no forum in which Moonshot will pay anything for its successful extraction and replication of Anthropic’s trade secrets. Reconciling this asymmetry is an important part of what the administration should address.
Setting aside the fraud itself, the more persuasive argument for taking punitive action against Chinese AI labs rests on national security grounds. By converting billions in American research and development expenditure on compute and machine reasoning research and then releasing the results for free, Chinese labs are undercutting American firms in price-sensitive markets worldwide.
The economic displacement of American AI compounds other national security risks from these models: supply chains vulnerable to poisoned weights that cannot be reliably surfaced in security audits, intelligence collection through user traffic routed to servers subject to China’s National Intelligence Law, and capability uplift for malicious actors. Foundational software today is being written by software engineers in San Francisco using Chinese models answerable to state security services.
Whether open competition in the AI market is desirable is a separate question from whether the United States should tolerate China’s expanding influence over AI. A competition in which one side pays to advance the frontier while the other harvests it through fraud, then leverages state-subsidized diffusion to lock in global market share, is not the open competition free marketeers champion. It is free-riding backed by industrial policy, the same playbook China has deployed in countless other industries. The United States did not accept this arrangement in steel, solar, or shipbuilding, and should not for AI.
The Trump administration is now attempting to draw a line between “legitimate” AI distillation, which plays a vital role in machine learning as a scientific enterprise, and large-scale, covert distillation attacks aimed at extracting proprietary U.S. technology. Four steps would help operationalize this position.
First, the U.S. Center for AI Standards and Innovation or an equivalent independent oversight body should develop the capability to independently verify a distillation attack, and to distinguish this from a firm that has merely trained on openly available data. The evidence for attribution of distillation attacks has so far come from victim labs’ own forensics. Sanctioning a foreign firm on the strength of an accuser’s internal analysis raises adjudication and due-process questions, and risks ad-hoc statist intervention in the AI market. A first step should involve developing criteria that describe what has happened, and what constitutes activity that poses an unacceptable national security risk.
Second, the administration should sanction the labs caught conducting extraction campaigns, not necessarily to constrain model availability — open model weights cannot be unreleased — but to deter future distillation attacks. Peter Harrell has catalogued several instruments up to the task, which could variously include Commerce Department Entity List designations, sanctions under the International Emergency Economic Powers Act, or restrictions on deployment via U.S. cloud infrastructure. Depending on the instrument, U.S. government action could sever Chinese labs’ access to U.S. cloud infrastructure, American capital, and critically, Western enterprise customers, whom Chinese open-weight labs are most actively courting. In any case, the trigger should be based firmly on an entity’s theft of American trade secrets, not technical achievement. A lab that stands up networks of fake accounts and infrastructure to evade detection while extracting a competitor’s outputs merits targeting. Those that train on the open internet or distill from deliberately open models should be considered fair competition.
To be sure, adopting a punitive posture toward extraction campaigns will not sufficiently stop a determined lab from laundering its efforts through Application Programming Interface aggregators or labeling firms in third countries — just as export controls have not stopped Chinese labs from routing compute purchases through shell companies in Southeast Asia. Still, punitive sanctions exist to raise the cost and lower the scale of prohibited activities. The Commerce Department could adapt its existing practice of designating transshipment intermediaries on the Entity List to distillation middlemen, forcing offenders to use slower, costlier, smaller-scale channels.
Third, to address the legitimate national security risks posed by Chinese open-weight models, the federal government should require disclosure about their use. Instead of attempting to ban its way out of open-weight diffusion, Washington should ensure that American businesses know what platforms they are building on, and price in the underlying security risk. As previewed by Bessent, the Federal Trade Commission should require AI services operating in the United States to disclose the provenance of their base models and where user data is processed — a “nutrition label” for the AI supply chain. Of course, disclosure will catch the negligent rather than the indifferent, and price-sensitive startups are bound to keep making price-sensitive choices. But when elite American startups are routing proprietary code through Chinese models without their customers’ knowledge, the market failure is informational and can be easily corrected to protect enterprise customers, insurers, and federal procurement authorities, who may care about potential backdoors. Moreover, labeling the use of Chinese models is foundational to enforcing acquisition rules that bar agencies and defense contractors from using services built on top of them.
Finally, both the U.S. government and U.S. frontier labs should back American open-weight alternatives. Defenders of open-source AI are right that the best answer to China’s growing open-weight dominance is to build a more attractive competitor. Developers are not choosing Qwen or Kimi out of ignorance or ideology. They are choosing them because the models are free, permissively licensed, easy to fine-tune, and cheap to serve. Any American alternative that honestly hopes to displace Chinese AI should match these qualities.
In off-the-cuff comments in July, Bessent named Meta, Nvidia, and Reflection AI as American open-model efforts worth supporting. The government has instruments available to support them, most requiring no new authorities. Congress could pass the long-pending CREATE AI Act, which cleared the House Science Committee unanimously in June. In addition, it could stand up a dedicated open-weights track within the National Artificial Intelligence Research Resource, with compute allocations conditioned on permissive licensing of the resulting models.
The Pentagon could likewise adapt a tool from its own history: Just as Defense Department purchasing agreements built the early semiconductor industry by guaranteeing a market for the first expensive chips, an advance commitment from the Chief Digital and Artificial Intelligence Office to purchase inference and support services for American open-weight models would de-risk the private capital those efforts require. And the National Science Foundation, extending existing programs like Pathways to Enable Open-Source Ecosystems, could fund what many open labs lack by default — a permissively licensed commons of training data and related evaluation harnesses. Such compute offerings and advance purchase commitments should include conditions that keep resulting models genuinely open, such as documented training data provenance and permissive licensing terms. None of this comes cheap, nor should it be oversold. The National AI Research Resource Task Force estimated the cost of its full implementation at $2.6 billion over six years, before adding an open-weights track. An advance purchase commitment from the Chief Digital and AI Office would likewise further strain the defense budget. But when a technology is worth more to the country than the market will pay its producers, the answer the United States has reached before is for its largest customer to guarantee a market for trailing-edge capability.
While protecting Anthropic and OpenAI from theft is a U.S. national security interest, protecting them from competition is not. Prudently crafted policy will acknowledge the difference by establishing a common set of rules designed to protect American trade secrets and promote the industry’s development.
Critics of government intervention in the AI industry are right that the primary responsibility for resisting distillation ultimately lies with America’s frontier labs. So far, China’s extraction campaigns have succeeded in part because model Application Programming Interfaces remain embarrassingly porous. Anthropic’s most restricted model was accessed by Discord hobbyists before its public release, during which time hundreds of fake accounts managed to run millions of queries. A company that wants the U.S. government to treat its outputs as strategic assets should be expected to secure them like strategic assets, with customer verification and behavioral detection that make industrial extraction technically expensive to conduct. Sanctions are a backstop for fraud, not the first line of defense against it. The labs should also resist the temptation to stretch the concept of a “distillation attack” into a verbal cudgel against the open AI ecosystem in general.
As with every other technology before, the United States is not going to litigate China out of copying its AI systems. What it can decide, clearly and enforceably, is whether American firms will continue to fund a frontier that Chinese firms harvest through fraud, or whether it will enforce a system of rules to underpin a truly free and open market for the intelligence economy.
Ryan Fedasiuk is a fellow for China and Technology at the American Enterprise Institute and an adjunct professor at Georgetown University’s Security Studies Program. He previously served as an advisor for U.S.-China Bilateral Affairs at the U.S. Department of State.
