The Distillation Storm: Inside China's LLM Distillation Controversy

Source: This article is based on an anonymized insider account posted on Reddit r/LocalLLM by u/feelspeaceman (~July 28, 2026, 110+ comments), cross-referenced with public reporting from Anthropic, Bloomberg, PCMag, SCMP, AP News, The Information, Hacker News, LessWrong, Artificial Analysis, and A Few Thoughts on Cryptographic Engineering. Claims are annotated with verification status: ✅ verified, ⚠️ partially verified, ❌ unverified, 🔴 contradicts public data.

Prologue: Encrypted Chain-of-Thought

The story begins with a technical discovery: the encrypted chain-of-thought (CoT) used by OpenAI and Anthropic could be extracted and replayed.

Chinese labs were distilling everything from frontier models — conversational outputs, agent trajectories, code generation, tool calls — all available through large-scale API queries. But one gap had long blocked perfect distillation: the model's raw chain-of-thought, its complete internal reasoning before arriving at an answer. Without it, distillation was like having answers without the worked solution.

The "Thinking Signature"

Both companies included a CoT summary in their streaming output, but also returned a Blob field — a "thinking signature" — containing the full raw CoT, encrypted with Fernet (AES-128-CBC + HMAC-SHA256, prefixed gAAAAAB). When sent back in a subsequent request, the server would decrypt it and append it to the model's context. Testing showed Blob length correlated with CoT length, confirming it contained the full encrypted reasoning. (✅ Verified: A Few Thoughts on Cryptographic Engineering independently discussed encrypted reasoning, confirming base64 blobs, HMAC signing, and replay capability)

Claude vs GPT

According to the source, Claude's anti-injection training became an entry point — a forged thinking-signature prefix could trick Claude into outputting its full chain-of-thought. GPT was harder to crack, following hidden system prompts to only provide summaries. A key architectural difference: Anthropic reportedly retained historical reasoning Blobs across conversation turns, while OpenAI discarded them. (❌ Unverified: these specific technical details about cross-turn retention and the anti-injection exploit are insider claims not confirmed by public sources)

OpenAI locked sampling parameters (temperature, top_p non-modifiable), closing off deterministic-output reverse-engineering. The Fernet implementation was cryptographically sound; the only viable path was injecting the Blob into another request and letting the model recite its own thinking.

Prelude: Anthropic's Public Accusation (February 2026)

On February 23, 2026, Anthropic published a blog post accusing three Chinese AI labs of "industrial-scale distillation attacks" against Claude. (✅ Verified against Anthropic's official blog)

The three labs used approximately 24,000 fraudulent accounts to generate over 16 million exchanges:

The labs used commercial proxy services to bypass regional access restrictions. Anthropic attributed each campaign through IP correlation, request metadata, and infrastructure indicators. The company framed this as a national security risk — distilled models may lack safety guardrails. (✅ Verified: all figures and quotes match Anthropic's official blog)

Notably, Qwen (Alibaba) and Z.ai were not named. Moonshot never publicly responded. (ℹ️ BBC reported on June 24, 2026 that Anthropic separately accused Alibaba in a later case)

Act I: GLM Cracks It First, Then Shares

Around March–April 2026, Zhipu AI (GLM) reportedly became the first to crack the frontier model's encrypted CoT, obtaining complete thinking-chain data. Rather than keeping it private, GLM shared both the method and data with other domestic labs. (❌ Unverified: no public reporting confirms GLM was first to crack CoT or that it shared the method. The cost estimate of "tens of thousands of USD" is also unverified)

What is publicly known: GLM-5.2 is a 744B total / 40B active parameter MoE model with a 1-million-token context, open-sourced in 2026. Independent evaluations noted it approached frontier-model performance on select tasks.

Act II: The Great Distillation Wave

With GLM's groundwork (per the source), distillation spread rapidly:

(✅ Tencent/Hunyuan verified: The Information reported on April 28, 2026 that "Tencent's New Model Shows Improvement, Partly Thanks to Anthropic" — leaked records showed Tencent employees used Claude to evaluate and fine-tune internal models)

DeepSeek's Timeline

DeepSeek previewed a July release in late June but hadn't yet begun large-scale distillation, causing a delay. An internal beta appeared in early July. Then a "V formal release gray test" appeared — but the source claims it was entirely routed to the frontier model, visible only in OpenCode. At DeepSeek's pricing, this made no economic sense. (❌ Unverified: this specific routing claim is an insider allegation. Public sources show the opposite pattern — developers using DeepSeek as a cheaper Claude Code backend)

Qwen's Two-Front Operation

The source claims Qwen was simultaneously distilling both Claude and GPT, while a third-party routing service accumulated Claude data for GLM. (❌ Unverified: the Qwen GPT distillation claim is an insider allegation)

Act III: Kimi's Approach

RL Team Changes

The source claims that from K2.x onward, Kimi discontinued reinforcement learning. CEO Yang Zhilin cited "cost reduction and efficiency" for downsizing the RL team, with displaced members flowing to Qwen. (🔴 Contradicts public data: no public reports of RL team layoffs at Moonshot; Business Insider (July 18, 2026) describes Yang as leading RL and agentic capabilities; Moonshot's K3 release included an RL sandbox (AgentENV)) ⚠️ This is the source material's most significant unverified claim.

K3 Architecture

Per Moonshot's official documentation and Hugging Face, Kimi K3 is a 2.8T total / ~50B active parameter sparse MoE with 896 experts (16 active + 2 shared per token), native 1M context, and multimodal via MoonViT-V2. Released July 16, 2026; open weights July 27. (✅ Verified)

(ℹ️ The source stated "1T parameters" — public data confirms 2.8T. This appears to be a redaction error)

Moonshot announced two architectural innovations:

(✅ Verified: all architectural features confirmed by Moonshot's official docs)

The source notes that these features carry Infra-unfriendly characteristics, creating a narrative where "architectural innovation" is the public story while distillation is cited as the performance source. (⚠️ The observation about Infra challenges is an analytical judgment; the architectural features themselves are confirmed)

Benchmark Controversies

The source records several evaluation phenomena:

1. Test set contamination: Benchmark test sets allegedly included in training data. MiniMax was first to be caught. (❌ Unverified insider allegation)
2. Routing to frontier model: Arena evaluation requests allegedly routed to the frontier model. (❌ Unverified)
3. Targeting evaluators: A Zhihu blogger known as "Cat Boss" (猫老板) had test questions allegedly extracted from system logs. (✅ Cat Boss verified as a real Zhihu LLM evaluator known for analyzing benchmark gaming; ❌ the specific log-extraction claim is unverified)
4. Coding score distribution anomalies: Some scores extremely high, others extremely low. (❌ Unverified)

Public data reflected this complexity. K3 jumped 17 places on Arena Frontend Code to claim #1. But Moonshot's own evaluation showed K3 below Claude on coding, agents, and frontier SWE. HackerNoon noted K3's top scores relied on maximum reasoning effort modes. SCMP (July 24) reported K3 was "significantly below" US rivals in security testing. PCMag (July 22) reported a White House official accused K3 of "cloning US tech." (✅ All public reporting verified)

Identity Bleed

Multiple users reported K3 identifying itself as "I'm Claude, an AI assistant created by Anthropic." Hacker News user testing showed this in ~15% of interactions. LessWrong reported GLM 5.2 exhibited similar behavior. (✅ Verified)

The technical community split on interpretation — some called it normal training data leakage ("models usually don't know their own name"), others viewed it as indirect evidence of distillation.

Hallucination Rate

The source claimed ~30% hallucination rate. Public data tells a different story: Artificial Analysis measured K3's hallucination rate at 51% on AA-Omniscience (up from K2.6's 39%), confirmed by Emergent and Kili Technology. (🔴 Contradicts: source's 30% vs. public 51%)

Shipping First

Kimi completed SFT and shipped quickly. Within 48 hours, demand forced Moonshot to suspend new subscriptions after GPU capacity hit limits (AP News, July 20). (✅ Verified)

The source suggests this pressured other labs to accelerate, intensifying competition. (⚠️ Analytical claim)

Act IV: Industry Impact

The distillation route meant any lab following the playbook could reach near-frontier performance. The source characterizes Kimi's approach as having disrupted this equilibrium — by shipping first with aggressive benchmark tactics, labs not optimizing for scores struggled for attention. Multiple independent sources — the evaluator, DeepSeek employees, former Kimi staff, Qwen employees — expressed concern. (❌ Unverified: these specific employee sentiments are insider information)

Act V: The Players

Moonshot AI (Kimi)

Business context: Bloomberg (July 29) reported Moonshot raised $3.5B at a $35B post-money valuation. KrASIA reported a $50B IPO target. The Standard (HK) (August 3) reported Moonshot denied August IPO filing. Alibaba reportedly backing with ~20,000 Nvidia chips. (✅ Verified)

Accused by Anthropic in February; never publicly responded. Open-sourced K3 weights on July 29.

DeepSeek

Considered relatively strong among domestic labs. An internal beta was available in early July. The unexplained routing to the frontier model remains an open question. (❌ Unverified routing claim)

Qwen (Alibaba)

Well-staffed, reportedly absorbed former Kimi RL members. Simultaneously distilling GPT, per the source. Performance has been inconsistent. (❌ Unverified: RL absorption and GPT distillation are insider claims)

GLM (Zhipu)

First to crack the frontier model's CoT and share with others (per source). GLM-5.2 open-sourced; approached frontier-model performance on select tasks. (❌ Cracking/sharing unverified; ✅ GLM-5.2 specs verified)

MiniMax

First accused of test set contamination; model performed poorly enough to be discovered. In Anthropic's accusations, MiniMax had the largest distillation volume (13M+ exchanges).

Stock: MiniMax Group Inc (HKEX: 0100.HK) fell from a March peak of HK$1,330 to ~HK$186 — over 80% decline. On July 9, a lock-up expiry released ~153M shares (~48.9% of capital), triggering an 18% single-day drop. Emergency ~HK$16B capital raise launched. Stock recovered to ~HK$247 by August 3. (✅ Verified: Google Finance confirms all figures)

Drivers: Anthropic accusations, M3 permanent price cut, low consumer margins, AI companion regulations, significant annual losses. Moonshot's IPO preparations added competitive pressure.

Mistral

Consistently under-resourced. European labs were largely absent from this story.

Act VI: The Public Conversation

Videos discussing distillation appeared on Bilibili. Comment sections became debate zones — some denied distillation, framing accusations as "smearing domestic tech." Others packaged results as evidence of "China's tech rise."

The original Reddit post in r/LocalLLM generated 110+ comments, cross-posted to r/MistralAI and r/LocalLLaMA.

One widely shared comment: "AI hallucination rates are going down, but human hallucination rates are going up."

Act VII: The Benchmark-Driven Logic

The source argues that domestic labs pushed benchmark gaming further than Western labs, in both degree and method. The deeper driver is structural: benchmark scores directly influence funding valuations and market attention. The core tension is between optimizing for "coding scores" versus "coding capability." (⚠️ Analytical claim reflecting the source author's interpretation, not a verifiable fact)

Technical Sidebar

The source suggests GPT is likely a production-grade Looped Transformer with several-fold higher data efficiency. (⚠️ Speculative: no official confirmation from OpenAI; arXiv discusses looped transformers academically, but OpenAI has never confirmed GPT uses this architecture)

The source observes that the industry rhythm has become "wait for the frontier lab to release, make architectural improvements, publish papers, and distill." (⚠️ Analytical observation)

Appendix: Encrypted CoT Technical Details

The following come from the source document's appendix. The encryption format is ✅ verified by the cryptography engineering blog; specific experiments and Blob data are ❌ unverified insider claims.

A.1 Encryption Format: Fernet (AES-128-CBC + HMAC-SHA256), prefix gAAAAAB. Structure: version + timestamp + IV + ciphertext + HMAC. (✅ Confirmed by cryptography.io and the cryptography blog)

A.2 Cross-Turn Behavior: Blob in current turn → model reads it. Historical Blobs → discarded. (❌ The cross-turn retention difference between OpenAI and Anthropic is unverified)

A.3 "The Telepathy Game": Forging assistant responses with refusal_blob + real blob to create fake "resistance → overcoming → solving" dialogue. (❌ Unverified technique)

A.4–A.7: Blob length/token correlation, multi-Blob behavior, cross-model key isolation, replay persistence (24h+). (✅ Replay confirmed by cryptography blog; ❌ other specifics unverified)

A.8–A.9: OpenAI vs Anthropic comparison table; GPT parameter locking. (✅ GPT parameter locking confirmed; ❌ cross-turn comparison unverified)

Verification Summary

Key contradictions:

Overall assessment: The core narrative — Chinese labs engaging in large-scale distillation, Anthropic's public accusations, Kimi K3's benchmark controversies — is well-supported by public reporting. Many specific insider details (GLM cracking and sharing, RL team changes, test set contamination, specific routing allegations) could not be independently verified. Three factual details contradict public data and have been corrected in this article.

Sources

Primary source (insider account):

• Reddit r/LocalLLM — "The Full Story of the 'Distillation Storm' Among China's Large-Model Companies" by u/feelspeaceman (~July 28, 2026, 110+ comments) — anonymized insider account, the basis of this article. Source PDF attached below.

Public reporting referenced:

1. Anthropic — "Detecting and preventing distillation attacks" (February 23, 2026) — official blog post accusing DeepSeek, Moonshot, and MiniMax
2. Bloomberg — Moonshot AI $35B valuation coverage (July 29, 2026) — funding round and valuation data
3. PCMag — "White House: China's Kimi K3 AI Model Cheated by Cloning US Tech" (July 22, 2026) — White House accusation
4. SCMP — "China's Kimi K3 'significantly below' US rivals in hacking power" (July 24, 2026) — security testing results
5. AP News — "China's new AI model halts new subscriptions as demand soars" (July 20, 2026) — subscription suspension
6. The Information — "Tencent's New Model Shows Improvement, Partly Thanks to Anthropic" (April 28, 2026) — Tencent distillation evidence
7. The Standard (HK) — "Moonshot AI denies plans to file Hong Kong IPO in August" (August 3, 2026) — IPO denial
8. Business Insider — "Who Is Yang Zhilin, the CEO Behind China's Latest AI" (July 18, 2026) — CEO profile
9. HackerNoon — "Why Kimi K3's Launch-Week Scores Need a Portability Audit" — benchmark analysis
10. Hacker News — Kimi K3 identifying as Claude — user testing report
11. LessWrong — "Does distilling Claude carry the persona with it?" — GLM 5.2 identity bleed
12. Artificial Analysis — Kimi K3 Intelligence Index — hallucination rate data
13. Emergent — "Kimi K3 Benchmarks: Every Score, What It Means" — benchmark breakdown
14. Kili Technology — "Kimi K3's Benchmarks and Hallucinations" — hallucination analysis
15. A Few Thoughts on Cryptographic Engineering — "Let's talk about encrypted reasoning" (May 29, 2026) — Fernet/Blob technical verification
16. Hugging Face — Kimi K3 Model Overview — architecture specs
17. Trending Topics — "GLM-5.2: China's Zhipu AI Beats Even Google's Top Models" — GLM-5.2 performance
18. arXiv — "Hyperloop Transformers" (July 2, 2026) — looped transformer architecture paper