Model distillation is a transformative technique in AI that enables smaller, more efficient models to mimic the behavior of larger, more powerful ones. It’s widely used to reduce costs, improve latency, and enable deployment on edge devices—making advanced AI accessible to organizations without massive infrastructure. The process involves using a large, high-performing model—the teacher—to generate high-quality responses to a range of prompts. These prompt-completion pairs are then used to train a smaller, cheaper model—the student—so it can replicate the teacher’s reasoning, style, and accuracy for specific tasks. This approach has become essential in real-world AI deployment. Companies use distillation to cut inference costs by 10 to 100 times, speed up response times, run models locally for privacy, and customize AI for their unique workflows. It’s especially valuable for applications requiring real-time interaction, such as customer service bots, mobile assistants, and on-device AI tools. However, a recent revelation from Anthropic has cast a shadow over the technique. The company accused three Chinese AI labs of launching large-scale model distillation attacks on its Claude models. Instead of using distillation for legitimate optimization, these labs allegedly exploited public APIs to make millions of synthetic queries, systematically harvesting high-quality responses. They then used this data to train their own models, effectively stealing the most valuable part of AI development: the alignment, instruction-following, and polished behavior that takes immense time and resources to build. What makes this attack particularly insidious is that it targets the “last mile” of AI training—the refinement that turns a capable model into a safe, useful, and reliable assistant. Attackers don’t need to retrain from scratch. They simply collect prompt-response pairs from a powerful model like Claude and use them as supervised fine-tuning data. The result? A model that mimics the behavior of the original, but without any of the ethical safeguards or training investment. Anthropic detected the attack through several red flags. Behavioral fingerprinting revealed that the API usage patterns were unnatural—lacking the organic variation of real users. Statistical analysis showed uniform distribution across prompts, unlike the power-law distribution seen in normal usage. IP correlation uncovered shared infrastructure and synchronized timing, indicating coordinated activity. Chain-of-thought queries were overused in suspicious accounts, suggesting systematic probing of reasoning capabilities. This shift transforms distillation from a tool of democratization into a weapon of intellectual property theft. While the technique itself remains valuable and ethically sound when used responsibly, the risk of abuse is now clear. For practitioners, the takeaway is simple: continue using distillation—but only with models that explicitly permit it, such as open-weight models or those with proper licensing. Avoid using proprietary models for distillation without authorization, and be vigilant about monitoring API usage for signs of extraction attacks. The future of AI depends on balancing innovation with integrity. Distillation will remain a cornerstone of efficient AI, but its power must be protected from exploitation.