The US-China AI fight escalated in rhetoric on July 21, but not in enacted policy. Reports say Treasury Secretary Scott Bessent suggested Washington could sanction Chinese labs if they are found to have "stolen" American AI models, landing the same week that Anthropic published a detailed allegation of large-scale scraping of its models' outputs. The verified record, though, supports a narrower story than the headlines: provider allegations of unauthorized API use, plus a proposed sanctions bill, not any sanction, rule, or proof that model weights were copied.
Key facts
- Anthropic alleges campaigns it attributes to DeepSeek, Moonshot, and MiniMax totaling more than 16 million exchanges through about 24,000 fraudulent accounts. Anthropic disclosure
- OpenAI's memo to a House committee makes a parallel allegation about obfuscated access tied to DeepSeek. OpenAI memorandum
- The proposed sanctions bill, H.R. 8283, is listed as "Introduced in House" and referred to committee, not enacted. Official bill status
- OFAC's current actions list contains no AI-model designation. OFAC recent actions
The term at the center of this is distillation, and it is worth getting right because the whole dispute hinges on it. Distillation, in its ordinary sense, is training a smaller student model on a larger teacher model's outputs. Both Anthropic and OpenAI acknowledge that authorized distillation is a normal, everyday technique, and both offer sanctioned pathways for it. What they allege is the concealed, industrial version: routing traffic through fraudulent accounts and proxy services to harvest millions of responses in violation of terms and regional restrictions, then using those input-output pairs as synthetic training data or to generate reinforcement-learning tasks.
That distinction is the technical heart of the story. A public API necessarily exposes a model's behavior; it does not expose its weights, architecture, internal probabilities, or training data. So even if the allegations are fully true, they describe black-box behavioral copying, not weight theft. As Lawfare argues, calling all output-based training "theft" collapses important distinctions; the stronger case is against fraud, false identities, and evasion of access controls, and a terms-of-service violation is not automatically computer intrusion or trade-secret theft.
There is a real academic backdrop to the fear. The paper Stealing Part of a Production Language Model showed that API access alone could recover part of a model, specifically the final embedding-projection layer of OpenAI's Ada and Babbage, for under 20 dollars. But that recovers a defined component of a black-box model; it does not establish the provenance of any Chinese model or amount to full-weight extraction. It is proof the surface is leaky, not proof anyone drained the tank.
Why it matters: the policy machinery is real even if the sanctions are not. H.R. 8283, the proposed Deterring American AI Model Theft Act, would define a "model extraction attack" around evasion of technical, contractual, identity, or geographic controls, require a Commerce-led assessment, then open a path to Entity List additions and presidential blocking sanctions. April's White House science-and-technology memorandum already frames foreign, principally China-based, industrial-scale distillation as a security concern. These are future authorities and coordination documents, not an AI-model sanctions order.
The strongest counter-take runs deeper than the politics. Even Anthropic's own account demonstrates alleged access and intent, not a measurement of how much any released Chinese model's quality actually came from Claude. And community reaction on r/LocalLLaMA sharpens the irony: closed labs trained on the broad internet, then seek unusually strong intellectual-property protection for their own outputs. The honest caveat is that these are company representations from their own telemetry, not independent audits or court findings. The most durable angle may be structural: if an API response can become training material, frontier firms face a permanent tension between offering scalable access and creating an extractable capability surface, and sanctions could accelerate the exact demand for open, locally run models they aim to contain.
Originally published on Ground Truth, where every claim is checked against the primary source.
Top comments (0)