The Great Model Theft: How AI Labs Are Fighting Back Against Intelligence Harvesting
In early 2026, OpenAI, Anthropic, and Google took a step that would have been unthinkable two years earlier: they began sharing proprietary threat intelligence with each other through the Frontier Model Forum. The reason? A coordinated campaign by several AI labs: reportedly based in China: to systematically harvest the intelligence of Western frontier AI models through a technique called unauthorized model distillation. The scale of the operation was staggering: millions of automated API queries designed to extract the knowledge and reasoning patterns of models like Claude, GPT-4, and Gemini into smaller, cheaper models that could be deployed independently.
Model distillation is a legitimate and widely-used machine learning technique. A smaller “student” model is trained to replicate the outputs of a larger “teacher” model, learning to produce similar responses at a fraction of the computational cost. Google uses it to create Gemma from Gemini. Microsoft uses it for Phi models. It’s how the AI industry makes large model capabilities accessible in smaller, deployable packages.
The problem arises when distillation is performed without authorization: using API access to a proprietary model as the teacher without the model owner’s consent. By sending millions of carefully designed queries to Claude or GPT-4 and recording the responses, an attacker can build a training dataset that captures a significant portion of the model’s reasoning capability. The resulting distilled model doesn’t contain the original model’s weights: so it doesn’t violate traditional software copyright in an obvious way: but it reproduces the model’s behavior in ways that required hundreds of millions of dollars and years of research to develop.
Reports suggest that certain organizations generated millions of automated exchanges with systems like Claude and GPT-4, systematically covering different domains: coding, mathematics, science, reasoning, creative writing: to build comprehensive training datasets. The queries were designed to elicit the models’ most sophisticated reasoning behaviors: chain-of-thought explanations, step-by-step problem solving, nuanced analysis of complex scenarios.
The cost to the attackers was minimal: API access fees of perhaps a few hundred thousand dollars. The value extracted was potentially billions of dollars worth of research and development. It’s one of the most asymmetric forms of intellectual property theft in history.
The Frontier Model Forum, originally established for AI safety coordination, has become the vehicle for the industry’s response. Member companies are now sharing data on suspicious API usage patterns, coordinating detection of automated distillation attempts, developing technical countermeasures including query fingerprinting and output perturbation that degrade distillation quality without affecting legitimate users, and working with governments on legal frameworks that explicitly address unauthorized model distillation.
Please enable JavaScript to read the full article.