Washington Accuses Moonshot of Distillation, Experts Push Back

How do you prove that one AI model was trained on another model's output?

That question sits underneath a fight that broke into the open last week, and nobody involved has answered it in public yet. White House Office of Science and Technology Policy Director Michael Kratsios alleged that Chinese lab Moonshot AI copied Anthropic's Fable model to train its Kimi K3 release, using chips obtained illegally for China. His wording left little room: "Large-scale, covert industrial distillation aimed at stealing proprietary U.S. technology and undermining American research is unacceptable."

Treasury Secretary Scott Bessent went further and raised the prospect of sanctions, saying "we are finding watermarks of our U.S. large language models on many of the Chinese models, and that that's unacceptable."

Where the evidence thins out

No details about those watermarks have been made public: not what they are, not how they were detected, not which models carry them. Moonshot did not respond to questions about its training process.

Researchers who work on this problem are unconvinced by the timeline. Braden Hancock, a co-founder of Snorkel AI, questioned whether the arithmetic works at all: "I don't think you get a model this strong and this quickly on the heels of Fable doing strictly distillation." Nathan Lambert of the Allen Institute for AI argues that distillation's returns are shrinking as Chinese models close the gap on their own, and that supervised fine-tuning alone cannot account for what K3 does.

Worth separating two things here. Distillation, in the ordinary sense of using one model's outputs to help train or improve another, is a standard and widely used technique. The accusation is not that Moonshot used the method; it is that it did so covertly and at scale against a competitor's model. That is a claim about conduct, and so far it rests on assertion rather than published evidence.

Six companies write back

On July 24, Hugging Face, Meta, Microsoft, Mistral, Nvidia and Replit sent a joint letter to policymakers in Washington. Their argument runs on two tracks. First, distillation is a widely used technique and should not be conflated with intellectual property theft. Second, and more pointedly, "the right response to this risk is not to prohibit open weights," because open models broaden defensive capability, increase transparency, and let vulnerabilities be found rather than hidden.

The letter is best read as a pre-emptive move. Its target is not the Moonshot investigation itself but the possibility that a single case becomes the justification for restricting open-weight releases across the board.

What this could mean for open-weight deployments

Plenty of organisations run open-weight models on their own infrastructure because regulation or data residency rules leave them no realistic alternative. Healthcare, financial services and public sector suppliers rarely have the option of shipping their data to someone else's API. For those teams, a policy argument in Washington is a supply chain question, not a geopolitical one.

There is one reassuring fact: published weights cannot be recalled. A model you downloaded today does not stop working because a rule changes next year. The exposure sits with future releases, where restrictions would slow the pace and narrow the availability of new open models.

The sensible response is unglamorous and happens to be good engineering regardless of how this resolves. Keep your own copies of the weights you depend on, avoid locking your architecture to a single model family, and build the integration layer so a model can be swapped without rewriting the system around it. Teams that did this two years ago are not reading this story with any particular anxiety.

Sources: TechCrunch, TechCrunch, CyberScoop