In 2026, the most renowned house in the western reaches had two numbers sitting side by side in its ledger.
The first was money paid out: $1.5 billion. Its disciples, upon entering the school, had "borrowed" more than seven million books from several pirate libraries, and the authors of 482,460 of them took the matter to court.
The second was money taken in: $1.6 to $2.3 billion. By its own account in its IPO filing, that revenue came from customers who "violated its terms" — mostly rival schools feeding its martial arts to their own disciples.
A thief on one side of the ledger, a thief-catcher on the other. It paid for what it took, and it profited from being taken.
This is not a secret. This is the daily weather of the AI jianghu in 2026.
And all of it runs through one craft. It appears on no school's list of techniques, yet it decides who survives.
Its name is distillation.
By the end, you will see that what this craft exposes is not merely a few companies' moats — it is the whole jianghu's misunderstanding of what counts as real skill.
1. The position: distillation transmits, it does not create
The jianghu has always judged a martial art by two things: can it invent a new move, and can it pass the old ones down.
Distillation is the second kind.
In 2015, Hinton and two colleagues at Google Brain gathered the scattered folk methods of "compressing inner force" into a formal school and named it knowledge distillation.
Put plainly:
A grandmaster is expensive — every gesture costs money. So someone devised a shortcut: have a promising disciple imitate the master's every motion and every instruction, compressing the master's "feel" into a lighter body.
The disciple skips the decades of hard practice. By imitation alone, he acquires seven or eight tenths of the master's skill in a fraction of the time. Never the full ten — but he is cheap, light, and available on demand.
Three properties define this craft. Remember them; they are the skeleton of everything below:
- It transports, it does not create. What the master knows today, the disciple can learn; what the master cannot do, no amount of distillation will produce.
- It always loses something. The harder the skill — long-horizon reasoning, complex tool use — the greater the loss.
- It depends on what cannot be written down. The valuable part is not the manual, but the oral transmission.
Together these explain why it works, why it is dangerous, and why it can only bring a follower close — never past.
2. The secret: dark knowledge hidden in "feel"
Here is a counterintuitive fact: when learning from a master, the least useful thing is the standard answer.
Traditional training hands you hard labels — this is a cat, everything else is wrong. Crisp, and almost information-free.
A master does not teach that way. Ask what it sees, and you get a whole distribution: cat 70%, dog 20%, car 5%.
The jianghu calls this a soft label. Its value lies in the dark knowledge the master never states outright — that a cat is more like a dog than like a car.
The disciple learns not the answer, but how the master decides.
To make that visible, the master turns a knob called temperature, puffing the flattened distribution back up. Too low, the teaching stays hidden; too high, it dissolves into noise.
This is why the defender guards exactly that layer. Anthropic now summarizes its models' chain of thought before showing it. By its own published numbers, a model trained on those summaries scored 71.8% on SWE-bench Verified, versus 80.4% on full reasoning traces.
One summary cut, nearly nine points gone. That is the weight of "feel".
3. Three paths: white-box, black-box, on-policy
How much you can learn depends on your relationship with the master.
| Path | What you get | Examples |
|---|---|---|
| White-box | Full anatomy: weights and per-token logits | TinyBERT, MiniLM |
| Black-box | Only API answers, heard through a wall | Alpaca, Vicuna |
| On-policy | Live critique: student answers, teacher corrects | GKD, R1-distilled family |
White-box is the most precise — if you can get inside the gate. Black-box gives you no weights, only an API, so the only route is to ask in bulk and copy the answers into a manual. Stanford's Alpaca did exactly that in 2023: 52,000 instructions, under $1,000, and a model that could hold a conversation.
On-policy is the most demanding: the disciple moves first, the master watches, corrects the errors, nods at the rest. It is the best fix for a student that is strong in one area and weak in another.
The finest demonstration came in early 2025, with DeepSeek-R1.
It condensed its own reasoning method into roughly 800,000 samples and passed them to six lighter disciples — from 1.5B to 70B parameters, built on Qwen2.5 and Llama3 bases. The small models stunned observers on math reasoning, outperforming peers of similar size.
That is the power of transmission: inference costs fall by one to two orders of magnitude.
The art comes down the mountain. It fits on a phone, runs offline, and gives poorer schools a fighting chance.
Distillation itself, then, is not a crime.
4. The feud, part one: a chain of accusations
What may be a crime is something else: copying the manual without ever becoming a student.
In September 2025, Anthropic publicly alleged for the first time that laboratories were distilling Claude at scale. Over the next year the accusations escalated into a chain.
- February 2026 — it named DeepSeek, Moonshot AI and MiniMax, alleging roughly 24,000 fraudulent accounts and more than 16 million exchanges.
- June 2026 — it wrote to US members of Congress, alleging that operators linked to Alibaba's Qwen lab ran "the largest distillation campaign to date" — about 25,000 accounts and 28.8 million exchanges.
- 10 September 2026 — a threat-intelligence report expanded the list to seven Chinese firms: Alibaba, Moonshot AI, DeepSeek, Zhipu, Xiaomi, SenseTime and MiniMax; nearly 200 million exchanges over three months, about 151 million of them attributed to Alibaba alone.
Its defenses escalated too: first summarizing reasoning, then a two-layer classifier, and from 24 September, blocking suspected distillation requests while still charging for them.
By its account, these measures cut the volume of harvested data by 90% to 99%.
It sounds like a righteous house guarding its gates, with evidence stacked to the rafters.
But pause here.
Every one of those numbers comes from Anthropic's own monitoring. There has been no independent verification, no full forensic chain published; Alibaba has explicitly denied wrongdoing and several other named firms have not responded. And in a full year, not one day of this "largest campaign in history" has been argued in a courtroom.
It sent its rivals to a hearing, not to a tribunal.
This does not mean the allegations are false. It means a dispute that belonged before a judge was carried into a legislative chamber instead.
5. The feud, part two: the accuser's own ledger
At almost the same moment, the accuser's own books were pried open.
In August 2024, three authors sued Anthropic: you trained on our books — did you pay?
On 23 June 2025, Judge Alsup produced a remarkably clean ruling that separated three acts:
- Training a model on books — fair use. The model learned a way of writing, not a copy of the text.
- Buying print books and scanning them — fair use.
- Downloading seven million volumes from pirate sites to build a permanent library — not fair use.
The logic was blunt: you may buy it, but you may not steal it.
According to unsealed filings, the house went further in pursuit of "clean" material: it bought used physical books in bulk, ran them through a hydraulic guillotine to cut off the spines, scanned them at speed, and sent the paper for recycling. An internal document described the effort as "destructively scanning all the books in the world".
On 20 July 2026, the court gave final approval to the settlement: $1.5 billion for 482,460 works, roughly $3,000 per book, with all pirated copies to be destroyed.
The same IPO filing contains another line: anti-distillation measures cut its quarter-on-quarter growth from about 140% to 45%.
Which yields the sharpest contrast in this whole story:
Whether a house accepts neutral judgment is the hardest evidence of its moral standing. Using law where law works, and state machinery where law does not, is not hypocrisy — it is a choice.
6. "Everyone copies everyone": three different acts
The line now circulating in the jianghu is: everyone copies, so why single me out?
There is truth in it — but it lumps three separate things together.
First: training on grey-zone data. This is the industry's shared original sin; nobody's hands are clean — the book guillotine proves it. It is a rule vacuum the whole field faces, not one school's private stain.
Second: imitating methods. Reading papers, running rivals' models, learning their approaches. This is ordinary exchange, how innovation spreads, and every generation of the jianghu has done it. Calling it competition is fair.
Third: systematically circumventing defenses to extract outputs. Tens of thousands of fake accounts, hundreds of millions of exchanges — if true, that is no longer copying. It is industrial-scale theft of teaching.
The first two are competition; the third is trespass. Yet both sides deliberately refuse the distinction — the accuser merges all three to inflate the threat, the accused merges all three to dilute responsibility.
And the hardest part: distillation can be neither proven nor disproven. No company today can demonstrate that it was distilled, and none can prove it has never distilled anyone.
With no rules and no evidence, the jianghu survives on mutual deterrence and reputation — a fragile balance at best.
7. The mirror: four layers of a moat
This should be the coldest section of the piece.
Distillation compresses existing capability; it does not create new capability. So it can only breach the shallowest layer of a moat. And a moat is never one uniform ditch — it is layered.
Layer one: the art itself (model weights) — shallow
This layer barely holds. Weights can be distilled, open-sourced, or leaked. Any pure model company whose moat is "our model is the best" is defending paper.
Layer two: the private library (training data) — medium
Distillation cannot reach it. You cannot reverse-engineer a model's corpus from its answers. The real barrier is exclusive, lawful, well-cleaned data. The $1.5 billion bought exactly this layer.
Layer three: inner foundation (compute and engineering) — deep
Distillation saves the cost of training, but training is only part of the spend. The real barrier is operating ten-thousand-GPU clusters, securing continuous chip supply, and having the density of engineers to build it. None of that can be distilled, bought quickly, or legislated into existence.
Layer four: standing in the jianghu (product and ecosystem) — deepest
This is the endgame. User scale, distribution, enterprise trust, data flywheels — distillation can drive the price of capability toward zero, and none of this comes with it.
Once you see the four layers, a counterintuitive conclusion surfaces:
Capability is becoming a commodity, and the moat is migrating from "what the model can do" to "what surrounds it".
The internet ran this playbook already: search technology was once a moat; distribution and ecosystem became one. Large models are simply running it on fast-forward.
But there is a survivorship bias to name: distillation lets a follower approach, never arrive. It closes the gap between second tier and first — and cannot let anyone pass the leader, because you are always copying what has already been built.
What shrank was never the moat. It was the belief that weights are a moat.
Closing
Pull the whole board together, and it comes down to a few lines:
- Distillation transports; it does not create. Transport without creation, inevitable loss, dependence on the unstated — these set its ceiling.
- It steals judgment, not answers. Dark knowledge in soft labels is the real target.
- Transmission is lawful; theft is not — and the two are separated only by a terms-of-service clause. A contract, not a law.
- "Everyone copies everyone" is three acts, not one. Rule vacuum, ordinary exchange, industrial trespass — the first two are competition, the third is not.
- It handed itself to a court and its rivals to Congress. Choice of forum is the hardest evidence of character.
- Four layers of moat, and distillation reaches only the first. Weights do not hold; data, compute and ecosystem do.
- Distillation brings followers close, and lets no one pass. The frontier is still built the slow way.
One last thought: the book with its spine cut off and the $1.6 billion revenue line are two drafts of the same story.
A school's real moat was never in the move it can perform, but in what it paid to learn that move — the part nobody can steal.
Sources: Hinton, Vinyals & Dean, "Distilling the Knowledge in a Neural Network" (2015); DeepSeek-R1 technical report (Jan 2025); Stanford Alpaca paper (2023); GKD, "On-Policy Distillation of Language Models" (2023); Anthropic, "Strengthening our defenses against distillation attacks", and its September 2025, February 2026 and September 2026 disclosures; Observer (Guancha) reporting, June 2026; Bartz v. Anthropic, court order (23 June 2025) and final settlement approval (20 July 2026); Anthropic Form S-1; Washington Post reporting on unsealed filings.
Note: allegations concerning specific companies are Anthropic's unilateral statements, reported here as such and not as findings of fact.