Artificial-intelligence debates increasingly use the phrase “IP theft” to describe model distillation. The phrase is rhetorically powerful, but legally imprecise and technically misleading.
Distillation is not a stolen model hidden inside another model. It is a training technique. A developer asks one model to produce examples, explanations, classifications, code, tool-use trajectories or other responses, and then uses some of those responses to improve another model. The second model does not receive the first model’s source code, architecture, parameters or internal state. It observes outputs and learns statistical patterns from them.
The technique can be used responsibly or irresponsibly, just as web crawling, reverse engineering, benchmarking and data collection can. But calling the technique itself “IP theft” skips the essential legal question:
What legally protected right was actually taken or infringed?
That question matters because “intellectual property” is not a single property right. It is an umbrella term covering distinct legal regimes—principally copyright, patent, trademark and trade-secret law, along with database rights in jurisdictions that recognize them. Each protects different subject matter, requires different evidence and provides different defenses.
Distillation should therefore be judged according to the conduct involved, not condemned as an inherently unlawful category of research.
What distillation actually is
A large language model is generally developed in several stages.
During pretraining, a model processes enormous amounts of text, code, images or other data and learns to predict patterns within that material. Pretraining is where a model acquires most of its broad linguistic competence, factual associations, representations and general problem-solving foundation.
During post-training, developers shape the pretrained model into a useful assistant. They may use supervised fine-tuning, preference optimization, reinforcement learning, tool-use training, safety training and synthetic data. Distillation is one way of producing or labeling some of that post-training data.
A simplified pipeline looks like this:
PRETRAINING
Trillions of tokens from diverse sources
│
▼
Broadly capable base model
│
│ POST-TRAINING
▼
Human examples ───────────────┐
Model-generated examples ─────┤
Verifiable tasks and tests ───┼──► Fine-tuning / reinforcement learning
Simulated tool environments ──┤
Preference and safety data ───┘
│
▼
Useful assistant model
In a basic form of output distillation:
Prompt or task
│
▼
Teacher model
│
response / label /
explanation / trajectory
│
▼
Curated dataset
│
filtering, verification,
deduplication and balancing
│
▼
Student model
The word “teacher” can also be misleading. It does not mean that the teacher’s complete knowledge has been transmitted. A teacher model exposes only a narrow response to each particular prompt. The student receives no direct access to the teacher’s weights, latent representations, full probability distribution, private training data or general internal computation unless the teacher’s operator deliberately supplies such information.
Distillation is therefore closer to learning from worked examples than copying a machine.
How much data does distillation require?
There is no universal threshold.
Small, narrowly targeted projects may obtain useful improvements from thousands or tens of thousands of examples. Self-Instruct demonstrated that a relatively small seed collection could be expanded into roughly 52,000 synthetic instructions. The Alpaca project subsequently used 52,000 instruction-following demonstrations generated by a larger model. At the other end of the scale, Microsoft’s Orca research collected five million ChatGPT responses and obtained GPT-4 responses for one million selected prompts.
These numbers describe very different objectives. Fifty thousand examples may be sufficient to teach a capable base model how to follow common instructions. Millions of examples may be used to broaden task coverage, expose the student to reasoning traces or build specialized agent behavior. Neither quantity transfers a teacher model wholesale.
Recent post-training research makes the limitations especially clear. In experiments using subsets of the 939,000-example Tulu 3 dataset, distillation produced its largest advantage in low-data settings. At 10,000 examples, the largest measured improvement was about five percentage points. As the dataset grew, the difference between ordinary supervised fine-tuning and distillation narrowed; in some settings, supervised fine-tuning matched or exceeded distillation. Using a substantially stronger teacher restored an average improvement of approximately four percentage points across the evaluated benchmarks, but it still did not transform the student into a copy of the teacher.
The same research found that adding synthetic examples eventually produced diminishing returns:
Performance gain
▲
│ ─────────
│ ───
│ ───
│ ───
│ ───
└──────────────────────────► Synthetic data volume
Early gains Saturation
Smaller models benefited more than larger students, and gains quickly saturated as synthetic-data volume increased.
The lesson is not that distillation is ineffective. It is that distillation is usually a post-training multiplier, not a substitute for the enormous investment required to build a frontier base model.
Distillation cannot explain an entire frontier model
The public discussion often implies that a laboratory can query a closed API, collect enough answers and emerge with the API provider’s complete capabilities. That is not how modern model development works.
A frontier model depends on an interacting system of ingredients:
the scale and quality of pretraining data;
model architecture;
parameter count and active parameter capacity;
optimization algorithms;
compute infrastructure;
numerical stability;
data filtering and curriculum design;
reinforcement learning;
synthetic environments;
tool-use training;
inference-time reasoning;
evaluation and error analysis;
serving infrastructure and systems engineering.
Distilled examples may improve instruction following, coding style, tool selection or performance on targeted reasoning distributions. They cannot, by themselves, manufacture trillions of pretrained parameters, recreate an unknown training corpus or disclose a teacher’s internal representations.
A useful conceptual decomposition is:
Frontier performance
│
├── Pretrained representations and knowledge
├── Model scale and architecture
├── Optimization and training stability
├── High-quality post-training data
│ ├── human-generated data
│ ├── self-generated data
│ ├── open-model teacher data
│ └── possible closed-model teacher data
├── Reinforcement learning and environments
├── Tool-use and agent training
└── Inference and systems engineering
Without controlled ablation studies, outsiders cannot reliably assign a percentage of a model’s overall performance to distillation. Benchmark similarity, answer style or performance on overlapping tasks is not proof that one model’s capabilities were extracted from another. Models trained on similar internet material, public benchmarks, mathematical methods, code repositories and post-training conventions will naturally exhibit some convergent behavior.
Even the most publicized allegations do not establish that distillation accounts for most of the accused models’ capabilities. In February 2026, Anthropic stated that DeepSeek, Moonshot and MiniMax had generated more than 16 million Claude exchanges through approximately 24,000 allegedly fraudulent accounts. Anthropic characterized the conduct as capability extraction in violation of its terms and regional restrictions. Significantly, however, Anthropic also expressly acknowledged that distillation is a “widely used and legitimate training method.”
The dispute is therefore not really about whether distillation is a valid machine-learning technique. It concerns authorization, contractual access restrictions, account conduct and geopolitical competition.
Kimi K3 illustrates why architecture and scale matter
Moonshot AI’s Kimi K3 is an important example of the danger of attributing frontier performance primarily to alleged API distillation.
Moonshot describes Kimi K3 as a 2.8-trillion-parameter mixture-of-experts model. According to its July 2026 technical materials, K3 introduces Kimi Delta Attention, a hybrid linear-attention mechanism; Attention Residuals; a Stable LatentMoE framework; native visual understanding; and a one-million-token context window. It activates 16 of 896 experts and is claimed to achieve roughly 2.5 times Kimi K2’s scaling efficiency.
These are substantive engineering choices. They affect information flow, memory, training stability, computational efficiency and the amount of capacity available to the model. They are not consequences of collecting answers from an API.
Kimi K3’s announced scale is also approximately 2.7 times the total parameter count of Kimi K2, which contained about 1.04 trillion total parameters and 32 billion active parameters. Kimi K2’s published work documented MuonClip optimization, 15.5 trillion pretraining tokens, large-scale agentic data synthesis and joint reinforcement learning in real and synthetic environments.
As of July 23, 2026, Kimi K3’s complete technical report and public weights had not yet been released; Moonshot stated that the weights would be released by July 27. Its detailed claims must therefore remain subject to independent verification. But the publicly described architecture alone makes an essential point: a 2.8-trillion-parameter frontier system is not adequately explained as a bundle of answers copied from a U.S. API.
“IP theft” is not a legal cause of action
When critics call distillation IP theft, they often combine several legally distinct arguments.
Copyright
Copyright protects original human expression—not facts, ideas, methods, systems or general capabilities. Purely machine-generated material is not copyrightable in the United States unless sufficient human authorship is present. Human selection, arrangement, editing or expressive input may be protected, but protection extends only to the human-authored elements.
That means it is too broad to say either that all model outputs are protected or that no output can ever carry copyright. A particular output might reproduce protected expression from training material, incorporate a user’s copyrighted input or contain sufficiently identifiable human-authored material. But an API provider does not automatically obtain a copyright monopoly over every fact, answer, reasoning pattern, style or capability expressed through its system.
A contract may assign whatever rights exist in an output or regulate how a customer may use it. Contractual restrictions, however, do not create a copyright against the entire world where copyright law supplies none.
Model weights
The copyright status of model weights remains unsettled. Weights are machine-generated numerical parameters, which creates serious obstacles to claims of human authorship and expressive originality. It is therefore reasonable to question whether ordinary copyright applies.
But it is premature to state as settled U.S. law that weights categorically cannot be copyrighted. Courts have not definitively resolved that question. The U.S. Copyright Office has also observed that weights could implicate copyright where a model has retained substantial protectable expression from training works, although that is a different theory from saying the numerical parameters themselves are conventionally authored software.
For that reason, model releases commonly rely on a combination of copyright licenses, patent grants, trade-secret permissions, database provisions and contractual conditions.
Contract
A service provider can prohibit using its API outputs to train a competing model. It can restrict automated collection, account sharing, circumvention or access from unsupported regions. A customer who agreed to those terms may face a contract claim for violating them.
That is potentially significant—but it is breach of contract, not proof that distillation itself infringes intellectual property.
Contract claims also depend on questions such as assent, notice, enforceability, jurisdiction, preemption, damages and the identity of the party bound by the agreement. Contract obligations ordinarily bind the contracting parties, not everyone who later encounters the information.
Trade secrets
A model’s hidden weights, source code, training recipes or confidential system information may qualify as trade secrets when they derive economic value from secrecy and are protected through reasonable measures.
Ordinary public API outputs are less straightforward. A trade-secret claim would normally require identifying secret information that was improperly acquired or disclosed—not merely showing that someone learned from publicly returned answers. Circumvention, deceptive access or extraction of confidential system material could change the analysis.
Patent
Patents can protect particular technical inventions, including some training, architecture or inference methods. Distillation could theoretically infringe a valid patent if it practices every required element of a patented claim.
That possibility does not make all distillation patent infringement. Patent liability must be established patent by patent and claim by claim.
Trademark and database rights
Trademark law protects source identifiers and guards against consumer confusion. Training a model from outputs generally does not implicate trademark law unless branding, passing off or confusion is involved.
The United States does not have the European Union’s broad sui generis database right. Database protection therefore varies considerably by jurisdiction. In the EU and certain other markets, systematic extraction or reuse may raise additional questions independent of copyright.
OpenMDW demonstrates the right licensing approach
Traditional software licenses do not map neatly onto modern model distributions. A released model may include architecture code, parameters, configuration files, tokenizers, documentation, datasets and other artifacts with different legal characteristics.
OpenMDW was designed to address that problem directly.
Rather than pretending that every component is conventional copyrighted software, the OpenMDW agreement grants permission across any applicable copyright, patent, database and trade-secret rights embodied in the distributed model materials. It expressly covers model architecture, parameters and related artifacts. It also states that it imposes no restrictions on the use, modification or sharing of outputs.
That structure reflects a mature understanding of model licensing: the agreement grants broad permissions under any relevant rights that may exist, while using contract formation to provide clarity where the boundaries of those rights remain uncertain.
Open licensing should encourage experimentation with model outputs, synthetic data and distillation—not create downstream control over every future model that learns from them.
The asymmetry in the current debate
The largest language models were pretrained on immense collections of human-created material, much of it copyrighted and not individually licensed for model training.
The legality of that practice remains contested. The U.S. Copyright Office concluded in 2025 that some uses of copyrighted works in generative-AI training may qualify as fair use and others may not. It emphasized that outcomes depend on the particular use, the source of the material, the purpose of copying and the effect on relevant markets. Dozens of lawsuits were still pending.
Against that background, it is difficult to defend a principle under which a model developer may learn statistical patterns from billions of human works without individualized licenses, but another researcher commits “theft” merely by learning from that developer’s machine-generated responses.
The two situations are not legally identical. Access contracts may apply to APIs, and particular outputs may contain protected material. Nevertheless, the policy asymmetry is striking.
AI developers cannot persuasively argue that learning from observable information is transformative and socially valuable when they perform it, but becomes ownership of “capabilities” when a competitor does the same.
Capabilities are not a recognized class of intellectual property.
A better rule for distillation
The AI community should adopt a more precise framework:
Was protected expression reproduced?
│
yes / no
│
Was a binding access contract breached?
│
yes / no
│
Were access controls or accounts circumvented?
│
yes / no
│
Was a trade secret improperly acquired?
│
yes / no
│
Was a valid patent practiced?
│
yes / no
▼
Evaluate the specific conduct and remedy
—not the scientific technique in the abstract.
Under this framework:
Distillation from lawfully accessible, non-infringing outputs should generally be permitted.
Research using open models, self-generated data and voluntarily shared outputs should be strongly protected.
Contract disputes should be described as contract disputes, not converted into claims of ownership over abstract model capabilities.
Liability for circumvention, fraud, trade-secret acquisition or reproduction of protected expression should be assessed under the laws that actually govern those acts.
Policymakers should resist creating a new exclusive right in model behavior, style, benchmark performance or capabilities.
Open-model developers should document their data-generation and post-training methods where feasible, enabling credible analysis rather than speculation based on nationality or competitive anxiety.
Open science requires the freedom to learn
Distillation is part of a long scientific tradition: observe a system, produce experiments, collect results, learn from those results and publish something better.
It can reduce the cost of useful models. It can make research reproducible. It can transfer capabilities into smaller systems that universities, startups and independent developers can operate. It can preserve knowledge when commercial services disappear. It can support multilingual, scientific, medical and accessibility applications that may never be priorities for proprietary providers.
Most importantly, open models do not need to be explained as imperfect copies of closed American APIs. Their competitiveness increasingly comes from independent research in mixture-of-experts systems, attention mechanisms, optimization, reinforcement learning, synthetic environments, data engineering and deployment efficiency.
Some developers may incorporate teacher-generated outputs. So do major proprietary laboratories. That fact alone says little about the origin of a model’s overall performance—and nothing about whether theft occurred.
The right question is not, “Was distillation used?”
The right questions are:
What information was used? How was it accessed? What right protected it? Who was bound by what agreement? What measurable contribution did it make?
Unless those questions are answered, “IP theft” is not legal analysis. It becomes a baseless allegation.
Distillation should remain an accepted tool of open science and competitive innovation. Where misconduct occurs, it should be addressed precisely. But no company should be granted an implied property right over the knowledge, reasoning methods or capabilities that the broader scientific community can learn from observable model behavior.
The future of AI should be built through more experimentation, more disclosure and more exchange—not through the invention of ownership rights broad enough to prevent machines from learning from other machines.