Hours after Anthropic launched Claude Fable 5, a viral post on X joked about Chinese labs “liberating the knowledge” from the model and reselling it at 5% of the cost. The post drew over 240,000 views in a day.
The joke describes a documented practice. AI model distillation is both a legitimate machine learning technique and, in adversarial hands, a method for extracting the capabilities of frontier models without paying for the research behind them.
This article covers how the model distillation process works, where teams use it well, and why Anthropic now treats it as a safeguard trigger.
What is AI model distillation?
Model distillation, also called knowledge distillation, transfers the abilities of a large language model into a smaller model.
The large model acts as the teacher, and the smaller model as the student. Instead of training the student model on raw training data alone, engineers train it on the teacher model’s output.
The student often learns from more than final answers. A teacher model can produce probability distributions over possible outputs, known as soft targets, which carry richer information than hard targets (the final labels alone).
The student model mimics those distributions, absorbing the teacher’s learned behaviour at a fraction of the model size.
| Term | Plain meaning |
| Teacher model | The large complex model whose AI capabilities get copied |
| Student model | The smaller model trained to mimic the teacher |
| Soft targets | The teacher’s probability distributions, including its confidence |
| Hard targets | Final output labels only, with less information for training |
| Distilled model | The finished compact model after the distillation process |
How the AI model distillation process works
The classic approach trains the student neural network to minimise the distance between its probability distributions and the teacher’s, a measure known as distillation loss. The student adjusts until its outputs track the teacher’s closely on a shared prompt set.
Modern large AI models complicate this. Most frontier models are available only through an API, which hides their internal states.
In that setting, the teacher becomes a synthetic data engine instead: engineers send prompts, capture the completions, and use those completions as training data for the student.
The teacher’s reasoning style, prompt engineering responses, and task behaviour all transfer through its text output alone.
Legitimate uses of model distillation
Distillation solves a deployment problem for AI systems. A frontier model with hundreds of billions of parameters can’t run on a phone or a laptop, and serving it at scale through the cloud costs heavily per query.
Model compression through distillation produces efficient AI models with much better performance per unit of compute.
The technique has a long record in natural language processing. DistilBERT, released in 2019, cut a BERT model’s size by 40% while retaining 97% of its language understanding. More recent generative AI examples include GPT-4o mini, which some believe OpenAI distilled (or pruned) from the larger model GPT-4o.
Distillation differs from fine-tuning. A fine tuned model adapts an existing model to a specific task. A distilled model compresses general AI capabilities into a smaller package. Teams routinely combine both, distilling first for efficiency and fine-tuning model performance for the task at hand.
Open AI explicitly stated that GPT 4o was ideal for fine tuning.
When model distillation work becomes an attack
The same distillation techniques, run without permission at industrial scale against a rival’s API, becomes capability theft.
The attacker scripts millions of prompts, harvests the larger model output, and uses it to train a competing AI system in a fraction of the time and cost.
In February 2026, Anthropic disclosed three such campaigns by Chinese AI labs, run through roughly 24,000 fraudulent accounts in regions where Claude isn’t commercially offered.
| Lab | Exchanges captured | Primary targets |
| DeepSeek | 150,000+ | Reasoning, reward modelling, censorship-safe query generation |
| Moonshot AI | 3.4 million | Agentic reasoning, tool use, coding, computer vision |
| MiniMax | 13 million | Agentic coding, tool orchestration |
Anthropic detected the MiniMax campaign while it ran, before MiniMax released the model it was training. When Anthropic shipped a new model during that campaign, MiniMax pivoted within 24 hours and redirected nearly half its traffic toward the newer system.
The harm extends beyond commercial loss. Illicitly distilled models don’t inherit the safeguards built into the teacher. The dangerous capabilities survive the transfer, but the alignment work doesn’t.
Anthropic argues this lets advanced AI capabilities proliferate with the protections stripped out, undermining export controls along the way.
Why Claude’s Fable 5 blocks knowledge distillation attempts
Claude Fable 5 ships with classifiers covering three areas: cybersecurity, biology and chemistry, and knowledge distillation. When the classifiers flag a request as part of a distillation attempt, Claude Opus 4.8 handles the response instead, and the user gets notified.
The model’s position is the reason: Fable 5 is a Mythos-class model, a tier above Opus in capability. A richer teacher produces a stronger student, so the extractive value of every Fable 5 completion exceeds that of any previous Claude.
Anthropic stated that distillation of Fable 5’s abilities could indirectly spread near-frontier AI capabilities through language models released without appropriate safeguards.
How Anthropic detects distillation attempts
Detection rests on behavioural fingerprinting.
A single prompt asking a model to act as an expert data analyst looks benign. Tens of thousands of variations of that prompt, arriving across hundreds of coordinated accounts and all targeting one narrow capability, form a recognisable pattern: massive volume, repetitive structures, and content that maps onto what’s most valuable for training an AI model.
Anthropic’s defence runs in four layers:
- Detection classifiers and fingerprinting
- Tighter access controls on commonly abused account types (education, research, startups)
- Response shaping that reduces the extractive value of outputs while preserving utility
- Intelligence sharing with other providers and authorities
What this means for teams using frontier models
Legitimate knowledge distillation remains a valid strategy for cutting inference costs, provided the teacher’s terms permit it. Open-weight models like Llama and Mistral allow distillation under their licences.
Proprietary API models generally don’t: most terms of service bar using their output to train competing commercial models.
Using a model’s outputs to improve internal workflows, generate content, or build applications is within most terms of use. Harvesting outputs at scale to train a rival language model doesn’t.
As frontier models grow more capable, the value of distilling them grows in step, and so does the load on the classifiers built to stop it.