Is there a difference between the rational use of AI and the distillation model? — The power to define "learning"

In September 2026, the US government presented two completely distinct stances in two separate AI data legal cases:

On September 1, the US Department of Justice submitted a "statement of interest" to the Federal Court for the Southern District of New York, to support OpenAI's claims in copyright lawsuits filed by publishers including *The New York Times* — OpenAI's training is "highly transformative". Given that the US has always cherished "technological innovation and national security", training large models with copyright-protected texts falls under the "highly transformative" fair use, and it may even be "unacceptable" to require AI companies to apply for authorization for the copyrighted content used in training.

However, on September 8, the National Security Agency, CISA, FBI and other institutions jointly released a "cybersecurity advisory report", stating that six Chinese enterprises use APIs to massively "distill" cutting-edge US models such as Claude and GPT, extracting "billions of tokens", which they defined as "malicious, targeted" capability theft.

With the exact same technical logic of "learning from others' outputs", when US companies apply it to train on human works, it is called "innovation", while when Chinese enterprises use it to learn outputs of US models, it is labeled a "security threat". This raises three key questions:

1. What exactly is the difference between training a model and distilling a model?

2. Both practices rely on using others' "achievements" without prior consent. Is there any legal, technical or other basis for treating them differently?

3. How should the law regulate large-scale data collection activities, including content written by humans or generated by machines?

I. Training and Distillation: Technologically Homologous

AI models generate corresponding outputs from user "inputs" through a huge architecture of numerical parameters (weights). Large language models have an extremely large number of parameters, sometimes up to trillions, so developers need to go through a "training" process to set these weights.

The essence of AI model training is to adjust its parameters using massive volumes of data, including raw texts, codes, images, videos and audios. However, the upper limit of an AI model's performance does not depend on the "quantity" of training data, but on the "quality" of training data. When building training corpora, cutting-edge labs do not randomly scrape all content on the Internet, but carefully select works that have been repeatedly polished through human intellectual labor, edited and reviewed, and recognized as valuable by society — namely copyright-protected books, news, academic papers and professional reports. In contrast, casual comments on social media, forum spam, short video bullet comments are huge in volume, but they have low information density, poor logical coherence and high factual error rate, contributing extremely limitedly to the model's reasoning capability.

In other words, the AI trained with copyrighted content has a far higher level of knowledge depth, logical capability and factual accuracy than the AI trained with non-copyrighted content. This is exactly why OpenAI would rather take the risk of infringement to transcribe YouTube videos — they are fully aware that high-quality copyrighted data is the real fuel for model intelligence.

"Distillation" also adopts a similar logic. Geoffrey Hinton, known as the Godfather of Artificial Intelligence, explains the "distillation" technology as an agile "student" model trained to imitate the behavior of a complex "teacher" model. Instead of re-learning everything about the universe from scratch, the student repeatedly listens to the master's performances and learns to imitate its responses. This approach can produce a more streamlined and faster model that captures much of the original genius, while significantly reducing latency and hosting costs.

Therefore, "distillation" is essentially a specialized form of training: it takes the output distribution, reasoning chains and answer samples of the "teacher model" as supervision signals, and trains a smaller "student model" to quickly approximate the teacher's capability. Its core is not to copy the code, nor to copy the entire copyrighted text, but to make the small model fit the behavioral statistics of the large model.

"Distillation" is by no means a niche practice, but a core skill of all artificial intelligence. Every major US lab has experience in developing models in this way, to train a generation of lighter, faster and more energy-efficient models. Stanford's Alpaca and Microsoft's Orca were trained on outputs of smaller models, and developers also publicly shared their methods with the research community. Elon Musk admitted under oath in April this year that xAI had trained Grok on OpenAI's outputs, calling it "a common practice among AI companies".

Therefore, model training and distillation have at least three points of homology in legal terms:

1. Both involve utilizing existing corpora "without individual authorization from the original right holders";

2. Both produce new parameters instead of simply replicating the original works;

3. Both may create substitution pressure on original market entities.

II. The Dual Nature of Law: Why Don't US AI Companies File Lawsuits?

The most fundamental difference between model training and distillation lies in the "learning object": "training" is mostly oriented to human works and public web pages, while "distillation" is oriented to machine-generated outputs.

In the OpenAI case, the US Department of Justice split training into three stages: "data acquisition - model training - output generation", and claimed that the training end is transformative as it learns statistical rules and does not directly substitute for news, so it tends to apply "fair use".

However, if the same logic is applied to distillation: the student model learns the output distribution of the teacher model, and does not copy the teacher's code word for word, so it should have received similar treatment according to the "transformative" standard. Nevertheless, US security agencies added extra behavioral labels such as "fraudulent accounts, circumvention proxies, metadata cleaning, and extraction of thought chains" to the "distillation" by Chinese enterprises, thus elevating it from an intellectual property issue to a cybersecurity and national security issue.

But this distinction does not answer an essential question: why can training from human outputs without consent be called "fair use", while learning from model outputs without consent is regarded as "theft"?

US security agencies attempt to define the Chinese enterprises' invocation of model outputs through APIs as "trade secret theft", but there is a fundamental legal contradiction here: If a piece of information is publicly sold to paying users through API keys, it can hardly maintain the "confidentiality" required by trade secrets. Because the core element of trade secrets is "not known to the public", and commercialization itself means disclosure to external parties. US courts have not yet issued a clear ruling on such scenarios.

Therefore, calling distillation "theft" is more of an ideological statement than a factual description of the law.

However, distillation clearly violates the terms of service of the labs. OpenAI, Meta and Anthropic have explicitly written clauses in their user agreements that prohibit such practices. These clauses explicitly prohibit using platform outputs, APIs or services to train competing models through any form of distillation or reverse engineering.

Then, why don't US labs sue Chinese labs for distillation?

OpenAI, Anthropic, and Microsoft have all accused Chinese models of "distillation", but none of them have filed lawsuits. They are not afraid to assert their legal rights, but suing for distillation is also risky for them. If the court rules that "distillation" is unacceptable and sets rules on model training, those rules will theoretically also restrict the "distillation" operations that US labs themselves often carry out, and this is exactly the ruling that publishers currently suing US AI companies most hope to see, which is no different from reaping the whirlwind.

Because although they complained to the US Congress as "victims", they are also "defendants" in countless copyright cases: OpenAI has transcribed more than one million hours of YouTube videos to train GPT-4, which clearly violates YouTube's terms that prohibit automatic scraping; under a confidential project called "Project Panama", Anthropic purchased and destroyed millions of ancient and second-hand books to train its model, and downloaded millions of e-books from shadow libraries such as LibGen, which are usually locked behind paywalls and subject to copyright restrictions.

III. The Double Standard Legal Loophole

The US government insists that training AI models with others' works without permission is extremely fair, so much so that licensing requirements will destroy innovation; at the same time, it also believes that training AI models based on other models' outputs without permission is an act of industrial plunder, posing a serious threat to national security.

But these two propositions cannot be true at the same time.

Either AI system training corpora should be protected by law, in which case writers, musicians, artists and programmers that US models rely on can file the claims that the Department of Justice has rejected; or in the name of supporting "innovation", such AI training corpora themselves are not protected by law, then the "malicious and targeted" "distillation" carried out by the accused Chinese labs is acceptable and will not face any consequences.

The US adopts two sets of asymmetric "lenient or tightening" logics for AI data. On the one hand, facing human copyrighted works at the training end, the Department of Justice advocates applying fair use with transformation and non-substitution as the core, and tends to liberate "learning the statistical rules of human expression" from authorized reproduction; on the other hand, facing the outputs of its own models at the distillation end, since pure AI-generated content is usually not eligible for copyright, the US side turns to use API contracts to prohibit re-training, use trade secrets to protect undisclosed capabilities and alignment information, use CFAA-style access rules to crack down on fake accounts and circumvention measures, and define batch distillation as malicious extraction under the pretext of national security.

In other words, while pushing human works into fair use, it pushes machine outputs into contract/secret protection. The protection intensity at the two ends is misaligned with the attributes of the objects, but the policy benefits all flow to the same group of US AI labs, which also reflects the trend of the US allocating data rights according to industrial interests.

It is worth noting that the US government has not proposed any new laws or regulations to prohibit distillation. The most specific suggestion it put forward is: cutting-edge US labs can "quietly degrade output quality" — return deliberately degraded responses to APIs called by Chinese companies, instead of directly blocking suspicious accounts, so as not to let the other party know that they have been detected.

This practice of "secretly modifying outputs" precisely exposes the fundamental problem that the US government is unwilling to face: what kind of model outputs should be protected by law? Under what conditions can they be used legally? Without answering these questions, all accusations are nothing more than makeshift excuses.

The significance of analyzing this distillation paradox is not only to expose the hypocrisy of US labs that train their models using the world's research achievements while accusing others of plagiarism. It further exposes that the US government itself has not thought clearly: should distillation be banned for national security reasons, or should distillation be allowed to encourage innovation?

【Original Link:

https://www.lawfaremedia.org/article/the-ai-model-distillation-paradox】

This article is from the WeChat Official Account "Internet Law Review", Author: Lisa Klaassen, Published with authorization from 36Kr.