Anthropic Accuses Alibaba of Distillation Attack: The AI Arms Race Behind 28.8 Million Interactions

Anthropic has just submitted a strongly worded whistleblower letter to the U.S. Senate Banking Committee, accusing Alibaba and its Qwen (Tongyi Qianwen) team of launching 28.8 million interactions against Claude within 45 days using 25,000 fake accounts. According to Anthropic, this was the "largest known distillation attack to date" they have experienced — nearly double the combined scale of similar attacks by DeepSeek, MiniMax, and Dark Side of the Moon in February this year.

The timing is delicate. The letter was dated June 10 and addressed to Republican Senator Tim Scott and Democratic Senator Elizabeth Warren, but has only now been revealed through CNBC and Reuters. Just two weeks earlier, the U.S. Department of Commerce, citing "national security," had ordered Anthropic to stop providing its latest Fable 5 and Mythos 5 models to all foreigners — including its own non-U.S. employees. As a result, Anthropic had to pull the two models globally, and they have yet to be restored.

Caught between being throttled by its own government and appealing to Congress that "China is stealing our technology," Anthropic is in a rather twisted predicament.

What Is a Distillation Attack, and Why Is It So Sensitive?

Distillation is originally a neutral AI training technique: using the output of a large model (the teacher) to train a smaller model (the student), allowing the smaller model to approximate the larger model’s capabilities at lower cost. OpenAI’s GPT-3.5, for example, was distilled from GPT-4 — an open secret in the industry.

But adversarial distillation is another story. It refers to scraping someone’s top-tier model’s outputs without authorization and in violation of terms of service, bypassing restrictions by creating massive amounts of fake accounts — effectively using it as a free teacher. This can replicate 70-80% of the capabilities of a model that cost hundreds of millions of dollars to develop, with only tens of thousands of dollars in API costs.

In its letter, Anthropic emphasized that Alibaba’s attack had very specific targets: Claude’s core software engineering capabilities, agent reasoning ability, and long-horizon task processing skills. These are exactly the differentiating strengths Claude has compared to GPT-4 — and the core moat underpinning Anthropic’s $965 billion valuation.

The data shows the scale was indeed enormous:

• Attack period: April 22 to June 5, 2026 — 45 days
• Number of fake accounts: about 25,000
• Total interactions: 28,800,000
• Average per account: 1,152 interactions
• Average per day: 640,000 interactions

For comparison, in February this year, DeepSeek, MiniMax, and Dark Side of the Moon collectively used 24,000 accounts to generate 16 million interactions. Alibaba alone reached about 1.8 times that volume.

One detail is worth noting: Anthropic referred to “Alibaba-linked operators” rather than directly saying “Alibaba.” This phrasing is common in legal documents — it leaves room for proof while avoiding the litigation risks of a direct accusation. Alibaba has not commented on the matter so far.

Is Anthropic Itself Clean? Double-Standard Controversy Resurfaces

If this were about another company, the case might seem airtight. But Anthropic has its own baggage.

In May this year, shortly after Claude Opus 4.8 was launched, an embarrassing glitch emerged: multiple users testing via API found that when asked “Who are you?”, the model sometimes responded that it was Qwen (Tongyi Qianwen) or DeepSeek. Social media buzzed — how could a top U.S. model claim to be a Chinese model?

Industry observers had two interpretations. One saw it as evidence that Anthropic itself had distilled from Chinese models — with their outputs mixed into the training data, causing “identity confusion.” The other, more benign, explanation was that it was simply data contamination or prompt injection, not proof of direct distillation.

More damning was Elon Musk’s blunt accusation on X, stating: “Anthropic is guilty of large-scale theft of training data and has paid billions in settlements for this theft. That’s just a fact.”

When challenged that Grok’s training data was also obtained improperly, Musk was candid: “Yeah, but we’re not insanely smug, sanctimonious, and hypocritical about it like Anthropic.”

Rude as it sounds, it hit a sensitive spot. In the AI sector, almost every company uses various ways to acquire training data — scraping public web pages, buying licensed datasets, even engaging in grey-market data deals. The difference is that Anthropic does this while brandishing its “Constitutional AI” moral banner, which easily invites criticism.

Kai-Fu Lee also weighed in, calling Anthropic’s reaction an “overreaction,” and jokingly complained they still owed him $3,000 in article fees. Though in jest, it reflected a common industry perception: the technology is indeed strong, but the company’s attitude can be self-important.

Washington’s Calculus: Sanctions or Protection?

Despite suspicions of double standards, Washington’s stance on this matter has been surprisingly united.

Republican Senator Bill Hagerty and Democratic Senator Andy Kim plan to introduce an amendment to this year’s National Defense Authorization Act (NDAA) that would authorize the government to blacklist or sanction Chinese companies found to have illegally obtained outputs from U.S. AI models. As the NDAA passes every year, an amendment like this has a high probability of passing.

Notably, Anthropic, OpenAI, and Google have formed an intelligence-sharing mechanism specifically to identify and counter distillation attacks. This means if one detects a batch of fake accounts, the others will block them too. Such industry alliances are rare in Silicon Valley, signaling that distillation attacks are now seen as a shared threat.

The paradox is that the U.S. government is restricting Anthropic’s ability to offer models abroad (even to allies) while wanting Anthropic to stay technically ahead to keep China from catching up. This kind of contradiction is typical of U.S.-China tech policy — wanting to block, but not so much that U.S. companies lose markets.

Anthropic is currently valued at $965 billion and has secretly filed for IPO this month, possibly going public this fall. For a company on the verge of an IPO, distillation attacks are more than a technical issue — they’re a business threat: if Chinese competitors can replicate a near-equivalent product at minimal cost, Anthropic’s valuation argument falters. This explains their intense reaction.

A New Battleground in the U.S.-China AI Game

Broadly speaking, this case reflects a new stage in U.S.-China AI competition.

In past years, U.S. restrictions on China’s AI industry focused mainly on hardware — limiting high-end GPU exports, blocking ASML lithography systems, banning NVIDIA’s A100/H100 sales to China. But these measures’ effectiveness is waning: Chinese firms either stockpile older chips, switch to domestic alternatives (inferior but usable), or bypass restrictions through cloud services.

Distillation attacks are a more covert way to acquire technology. They don’t require physical hardware or customs clearance — just internet access and some fake accounts. Since interactions happen via API, it’s technically hard to distinguish “normal use” from “malicious distillation” — unless, as in this case, the scale is abnormally huge.

From China’s perspective, this is also a reasonable catch-up strategy. If chips and models can’t be purchased, one can learn from the models via public APIs. Strictly speaking, this violates terms of service, but on the international stage, it’s hard to frame it as “theft” — after all, the API is publicly offered; only the usage is contested.

Interestingly, the controversy reveals U.S. AI companies’ anxiety: their technological edge is shrinking. If the gap were truly large, distillation attacks wouldn’t be a threat. It’s precisely because Chinese models (especially DeepSeek and Qwen) are close to or surpassing GPT-4 in certain tasks that distillation attacks are such a sensitive matter.

Alibaba was just added to the U.S. Department of Defense’s “Chinese military companies” blacklist on June 8, to which it has responded by suing in U.S. court. Now, with Anthropic’s public distillation accusation, Alibaba’s U.S. situation is worsening. But from another angle, it also shows Qwen’s technical prowess is attracting serious attention from U.S. peers — otherwise it wouldn’t be worth such a fuss.

What Do Developers Think?

For us developers, this issue is quite divisive.

Technically, distillation is a highly efficient training method. Many open-source projects (like Alpaca, Vicuna) are trained from GPT-3.5/4 outputs, and everyone takes it for granted. But when commercial companies do it — especially cross-border competitors — it’s a different matter entirely.

Practically, Chinese AI services are significantly cheaper than U.S. equivalents and perform well in code generation and Chinese language tasks. If Qwen really reached its level through distilling Claude, we as users actually benefit — at least we get cheaper alternatives.

But for the industry’s health, if distillation attacks become common, companies that invest heavily in original research lose motivation. Why spend hundreds of millions training a model if others can copy 80% of it for tens of thousands?

There’s no simple answer. AI isn’t like traditional software; it’s hard to protect a model’s “knowledge” with patents or copyright. Model outputs aren’t protected by copyright (the current legal consensus), so training new models on those outputs is legally a gray area.

Anthropic’s strategy now is to use political means to make up for technical shortcomings. They want laws banning distillation attacks or at least making perpetrators pay (via sanctions, blacklists). But the side effect is further intensifying U.S.-China AI confrontation and making tech exchange harder.

Where Will This Go?

In the short term, Alibaba will likely stay silent. Its U.S. position is already passive, and responding publicly would complicate matters. From an evidentiary standpoint, Anthropic only said “linked operators,” not directly “Alibaba,” leaving both sides an out.

In the medium term, Congress will likely pass some form of legislation explicitly banning or restricting distillation of U.S. AI models. This would give OpenAI, Anthropic, and others stronger legal tools, but enforcing it will be difficult — how do you prove a Chinese model was trained through distillation of yours?

In the long term, this will accelerate AI tech bifurcation. The U.S. side will consolidate around OpenAI, Anthropic, Google; the Chinese side around Qwen, DeepSeek, and Dark Side of the Moon. Cross-border technical interaction will dwindle, but competition will intensify.

For developers, this means adapting to switching between multiple models, picking services based on task needs and budget. The good news is, API aggregation platforms like OpenAI Hub make such switching easy — one key to call all major models, accessible directly from within China without access issues.

Ultimately, the core of this dispute isn’t technology, but trust. Anthropic doesn’t trust Chinese companies to follow its terms of service; Chinese firms don’t trust the U.S. to treat them fairly; the U.S. government doesn’t trust China to use AI for “legitimate purposes.” In this climate of mutual distrust, technical issues become politicized — and politicization often ends in lose-lose outcomes.

Is a distillation attack “theft”? There may never be consensus. But one thing is certain: this won’t be the last controversy of its kind. In an era where AI is a national strategic asset, every line of code and every model weight can become a bargaining chip.

References

• Double Standards Again? Anthropic Accuses Alibaba of “Largest Known Distillation Attack” to Date - IT Home — IT Home’s detailed coverage of the incident, including background and controversy analysis