There is a word doing laps around Washington this week, and it sounds like something you’d do to corn mash in a shed in Kentucky.
Distillation. In February, Google’s AI chief explained it on a podcast the way an engineer explains a wrench: you take a big expensive model, you use its outputs to teach a small cheap one, and now the small cheap one punches above its weight. He said, quite reasonably, that you need the frontier model first before you can distill anything out of it. Nobody outside a handful of research Slack channels blinked. It was plumbing. It was Tuesday.
Five months later it’s a national security threat, a Treasury talking point, a bipartisan bill, and — depending on which conference room you’re standing in — either grand larceny or the entire history of machine learning.
The model that ruined everyone’s July
On July 16, Moonshot AI dropped Kimi K3: 2.8 trillion parameters of sparse mixture-of-experts, open weight, free, and rude enough to land near the top of the leaderboards alongside the most expensive systems American labs have ever shipped. It topped a frontend coding arena in blind developer testing. The full weights were promised for July 27. That’s today. They’re arriving on schedule, which tells you how much the shouting has accomplished.
The shouting started fast. On July 22, White House science and technology chief Michael Kratsios said Moonshot had run a “large-scale, covert industrial distillation” campaign against Anthropic’s Fable model, and threw in a second allegation for good measure: that Moonshot had gotten at banned Nvidia GB300 hardware by way of Thailand. Treasury Secretary Scott Bessent, who has clearly workshopped his lines, said open source is not open season on American IP, and floated sanctions and Entity List designations.
Bold. Also, arithmetically strange.
Fable 5 has been publicly available since July 1 — it launched in early June, got pulled for a couple of weeks while export-control paperwork got sorted, and came back at the start of this month. Kimi K3 shipped on the 16th. That is a two-week window in which a Chinese lab would have had to hammer a frontier model with enough queries to harvest a training corpus, then post-train and evaluate a near-trillion-scale system, then package and release it. Researchers have been openly skeptical that the timeline supports the accusation. Models this size do not get baked in a fortnight. You can’t distill your way past physics.
None of which means nothing happened. Anthropic itself published a report back in February alleging Moonshot ran distillation at scale through millions of fake accounts. Watermark-style fingerprints from American models keep turning up in Chinese ones. The pattern is real. The specific charge, on the specific timeline, is the part that wobbles.
Everyone’s argument is also their business model
Then Friday happened, and with it a three-page letter warning Washington off premature restrictions on open-weight models. It went out with 25 signatories and kept growing through the weekend — model developers, chipmakers, cloud providers, security firms. Nvidia. Microsoft. Meta. Palantir. Jensen Huang promoted it with his first-ever post on X, which is either a sign of the stakes or a sign that somebody on his comms team finally won an argument.
The letter’s cleverest move is refusing to defend the indefensible. It calls distillation a normal technique for building and validating models, then asks policymakers not to confuse ordinary engineering with theft, and to go after unlawful extraction with targeted tools rather than a blanket ban. It also argues that closed models aren’t automatically safer, since they can be breached or fail in ways outsiders never see.
Fine argument. Old argument. It is, more or less, verbatim the case made for open-source software between roughly 1998 and 2005, with the nouns swapped.
Two names are missing from the letter: OpenAI and Anthropic. The two labs that spend most of the year trying to eat each other have found the one thing they agree on, and it is that giving away weights is a bad idea. Meanwhile Nvidia — which signed — is lobbying in the opposite direction on export controls entirely, arguing restrictions should be loosened to keep China hooked on American silicon. Everybody’s principles are load-bearing. Everybody’s principles also happen to point directly at their revenue.
Congress reaches for the only lever it has
The legislative response arrived July 23: a bipartisan bill from Senators Adam Schiff and Jim Banks with Representatives Bob Latta and George Whitesides, aimed at letting AI labs and security researchers actually compare notes on distillation attacks without tripping over antitrust law. Information sharing, coordinated response, guardrails against using the exemption as a cartel, and an injunction pathway for the Attorney General if someone abuses it.
This is a sensible bill about a problem nobody can measure. That’s the recurring theme. A White House memo in April already treated industrial-scale adversarial distillation as a security matter. A House bill would identify foreign model-extraction operations and tee them up for sanctions. All of it rests on an evidentiary base that a Georgetown researcher summarized with unusual honesty: we are essentially guessing at the extent of the threat.
Guessing. On the basis of which: sanctions, blacklists, and possibly a rewrite of what counts as legitimate machine learning.
The joke at the end
Here’s the part that should give everyone pause. While Washington debates whether to punish China for downloading American capability, Beijing’s commerce ministry has been consulting its own AI companies about export controls on Chinese model weights.
Both superpowers are now considering restrictions on the free thing the other one keeps taking. Somewhere a trade economist is lying down.
And the deeper bind isn’t going anywhere, because distillation isn’t a loophole in AI development. It’s a load-bearing wall. Google found the technique trying to make its own image models smaller. Every lab uses outputs to train, prune, validate, and compress. Write a rule broad enough to stop Moonshot and you write a rule that criminalizes the thing your own engineers did last Thursday.
Draw the line too narrow and it’s decorative. Draw it too wide and it lands on you.
Nobody has solved that. The weights ship today regardless.