In 2015, Geoffrey Hinton, Oriol Vinyals and Jeff Dean published a short paper about teaching.^[1] The idea was to move what a big neural network knows into a small one, the way a professor’s understanding passes into a student: less by dictation, more by watching how the teacher weighs each answer. They called it distillation, and the motive was friendly: a network that recognized speech well enough to be useful was too large to ship, so you let the large network tutor a smaller sibling that could live on a phone. The technique worked, the small networks shipped, and everyone went home. Eleven years later the same word appears in a White House accusation against a Chinese laboratory, in the enforcement pages of every frontier lab, and in a blog post from OpenAI describing a disrupted campaign of adversarial model distillation.^[2]

Model distillation is the cheapest known way to move capability from one model to another, and that is exactly why the attempt to stop it will fail. This essay is about the gap between those two sentences: between what distillation is, a loop you can run on a laptop, and what the most powerful companies on earth are asking their governments to do about it. I built the smallest possible version of the problem so we can watch the mechanism work, because the mechanism is the whole argument. You cannot police a lesson. You can only make teaching more expensive, and there is not enough money in the world to make it expensive enough.

What model distillation actually is

A language model at heart is a machine that looks at text and assigns probabilities to the next character or word. Train one the standard way and you show it the correct answer at every step: after the queen said , the target is w, full stop. The correct answer is a useful teacher but a narrow one. It does not tell the student that queen was far more plausible than qween, that a comma was nearly unthinkable, or that helicopter was a live possibility the teacher weighed and rejected. All of that earned judgment sits in the probabilities the teacher never shows anyone.

Distillation shows the probabilities. Instead of demanding the teacher’s answer, you ask for its distribution over answers, softened by a temperature so the near-misses stay visible. The student is trained on a blend: part the book’s hard answers, part the teacher’s soft ones. Hinton’s original paper reported the trick working on a commercial speech system and on MNIST, qualitatively and modestly; the effect at real scale is not modest, which is why every serious small model you have ever used has a big model somewhere in its family tree.^[1]

To make this concrete I added a sixth stage to the tiny language model series I have been building in Go.^[3] The code that matters is five lines:^[4]

teacherLogits := tiny.Detach(teacher.Forward(in))
loss := tiny.DistillLoss(student.Forward(in), teacherLogits, tgt, 4.0, 0.5)
opt.ZeroGrad()
loss.Backward()
opt.Step()

The teacher reads the batch and produces its probability table. Detach freezes it: the teacher is a forecast, not a participant, and no gradient flows back into it. DistillLoss blends two terms with weight 0.5: the ordinary cross-entropy against the book’s next characters, and a divergence between the student’s softened probabilities and the teacher’s, computed at temperature 4.0 so that the teacher’s second and third choices stay in the picture. Then the usual backward pass, and the student takes one step.

The experiment is deliberately symmetric. A teacher of 116,416 parameters learns a book. Two identical students of 7,488 parameters, same seed, same shape, then train on the same 3,000 batches, differing in one respect only. The control learns from the book alone. The distilled student learns from the book and from the teacher’s softened opinion of the book. On held-out text the models read only after training:

model	parameters	held-out loss, nats per character
teacher	116,416	2.4409
control student	7,488	2.5569
distilled student	7,488	2.5462

The distilled student is 15.6 times smaller than its teacher and beats the otherwise identical control. At this scale the edge is a rounding error, and I will not pretend otherwise; a seventy-character vocabulary and a single book are a toy, and at toy scale the control was already close behind the teacher. The honest reading is the direction, not the size: everything else equal, access to the teacher’s opinion buys generalization that the raw text does not. At frontier scale the same arithmetic, multiplied by a trillion parameters and every book ever written, is the difference between a product and a research demo. And notice what the exchange did not require. No encryption was broken, no database was breached, no weights were copied. One model was shown to another, and the showing was the stealing.

The summer distillation became a crime story

In February, Anthropic published an accusation: DeepSeek, Moonshot and MiniMax had extracted Claude’s capabilities through approximately 24,000 fraudulent accounts and over 16 million exchanges, in violation of its terms of service.^[5] In July, Moonshot released Kimi K3, an open-weights model that Washington’s science office promptly said had been built by distilling Anthropic’s Fable, a claim that independent experts immediately disputed: capability at that scale, they argued, does not come from copying a rival’s outputs, and the accusation fit the geopolitics better than the engineering.^[6] By late July more than twenty firms had signed a letter against restricting open weights, Washington debated a ban and declined it, and Anthropic published its position: it has “never advocated for a ban on open-weights models,” it wants chip export controls enforced, it wants the state to “crack down on industrial-scale distillation operations,” and it wants mandatory pre-release safety testing for all sufficiently capable models, open or closed.^[7]

Then, at the end of September, OpenAI supplied the season’s finale. It had disrupted a coordinated campaign, it said, that manipulated model conversations to reproduce “protected reasoning” in forms visible to the requester. Activity began on July 1; on July 24 and 25 a cluster of over 4,000 accounts fired 16,000 extraction-patterned requests; a wider cluster of more than 15,000 accounts was fully disrupted by July 28. The operators “did not break our encryption, compromise a database, or gain direct access to stored user conversations.” OpenAI attributed a core cluster to “individuals associated with Moonshot AI, the developer of Kimi,” an attribution softened by every lawyer who touched it, and shared the details with other labs through the Frontier Model Forum.^[2]

Read the OpenAI post as an engineering document and it is a security team doing its job. Read it as an economics document and it is a confession. The manipulation worked, at scale, through the front door, using the product as shipped. And in the middle of the post sits the sentence that ends the policy debate: this manipulation “is not a vulnerability unique to OpenAI’s models.”

You cannot subpoena a lesson

Three arguments against distillation as a policy target, and none of them survive contact with the mechanism.

The technical argument fails because the leak is the product. A capability you sell through an interface is a capability exposed through an interface: every output, every reasoning trace, every latency curve is a teaching signal. You can refuse to show chain-of-thought, you can watermark outputs, you can detect extraction patterns, and each defense raises the cost of the next campaign by some factor. The campaign resumes at factor-plus-one, because the student does not need the teacher’s cooperation the way a burglar needs a key. It needs only exposure, and exposure is what selling is.

The legal argument fails because nobody can say what crime occurred. A terms-of-service violation is a contract dispute, and the frontier labs are already litigating on both sides of that line: the same industry that paid authors a reported $1.5 billion for learning from books^[8] asks the state to declare that learning from models is theft. The asymmetry gets sharper. Distilled outputs are probably not protectable property at all, since machine outputs without human authorship do not clear the copyright bar. And at least one frontier-adjacent model family, DeepSeek’s, is published under an MIT licence that expressly permits distillation.^[9] The industry wants one law for its own teachers and another for everyone else’s students.

The geopolitical argument fails on arithmetic, and here Anthropic itself is the best witness: “once weights are released they cannot be withdrawn.”^[7] Export controls stop chips at the border. They do not stop files, and weights are files; as I have argued before, enforcement lives where the invoices are, and distillation is precisely the transaction that does not need one.^[10] A power that cannot recall a torrent cannot criminalize a lesson. It can only criminalize being taught, which is a different thing, and a much older mistake.

The moat was only a head start

Why, then, the panic? Because the frontier’s real asset was never secrecy. It was time. Open models trail closed ones by a few points of capability index, a gap Mozilla pegs at roughly eight index points and watches close in about four months per generation; open models trail on benchmarks but reach production within twelve points of their closed rivals; and in August 2026 an open model topped OpenRouter’s usage charts for the first time, eight of the top ten models by tokens were open, and Kimi K3 became the first open three-trillion-parameter release.^[7] Mozilla’s summary of the summer is blunt: a major American lab returned to open weights, and Washington debated a ban and declined it.

Distillation is how the tail of that cycle gets compressed. It does not steal next month’s discovery; it industrializes last year’s. This is why the frontier can lose the argument and still win the quarter: the moat is a head start, and head starts are real. It is also why the frontier cannot win the decade by litigation: you do not extend a head start by prosecuting the runners behind you, you extend it by running. Meanwhile the thing that actually made the frontier defensible, the ability to switch a model off, dark-period the weights, deprecate an API, applies with decreasing force to every copy already running. You can switch off a model. You cannot switch off a student.

The case for the prosecution

The opposing case deserves better than a strawman, because part of it is correct. Twenty-four thousand fraudulent accounts is not research, it is industrial deception, and the labs’ anger about it is legitimate: fake accounts at that scale poison the trust that makes API access cheap for everyone, including the academics and startups who will pay for the crackdown’s side effects. Open weights genuinely cannot be recalled, which means a genuinely dangerous open model is a permanent fact about the world rather than a patchable one, and Anthropic concedes the other half honestly: open-weights models without dangerous capabilities “are a public good.”^[7] The dispute is not about whether open models can be dangerous. It is about which instrument addresses the danger.

And there the prosecution reaches for the wrong tool. Mandatory pre-release testing for all models, open and closed, is a coherent policy: it is testable, auditable, and aimed at capabilities rather than provenance. “Crack down on industrial-scale distillation operations” is not coherent, because the operation it describes is indistinguishable, at the mechanism level, from the standard practice of the entire open ecosystem, where labs distill their own large models into deployable ones as a matter of routine, Nvidia among them. Enforce the crackdown and it will bind exactly the parties an enforcement action can reach: domestic, visible, invoice-paying. The 24,000 accounts route around it the way the last campaign routed around detection, because an adversary who has already accepted contract violation does not stop at statute. A law that only binds the obedient is not a law about distillation. It is a subsidy to incumbency, and the open ecosystem would pay it on behalf of the closed.

Jevons teaches too

There is a final irony, and it has a name. When DeepSeek’s R1 landed in January 2025 and Nvidia briefly erased roughly $600 billion of market value in a single day, Microsoft’s chief executive answered with an economics citation: “Jevons paradox strikes again!” The market read it as cope. It was a forecast. In the forty-five months covered by Mozilla’s data, the cost of inference fell by a factor of roughly sixty, and demand grew faster than the savings, because agents consume what chatbots merely sampled; by August, DeepSeek, the great price disruptor, became the first open provider to raise prices.^[7] Efficiency did not shrink the market. Efficiency was the market’s food.

Distillation is Jevons applied to intelligence itself. Every capability that leaks becomes cheaper to possess, and every cheaper capability is exercised at larger scale, by more people, in more products, until the exercise of it is ordinary. That is not a market failure; it is the entire history of technology, from the printing press to the music file. A crackdown on distillation is an attempt to tax this arithmetic, and arithmetic does not have a treasury to seize.

My teacher model has 116,416 parameters, and a 7,488-parameter student that follows it around like a duckling because I let it listen. A frontier laboratory is the same classroom with a trillion times the furniture. The teacher can encrypt its scratch paper, ban the student from campus, and ask a superpower for a restraining order; the student only needs to be shown, and showing is the business model. You cannot forbid the future from doing its homework.

---

1. Geoffrey Hinton, Oriol Vinyals, Jeff Dean, Distilling the Knowledge in a Neural Network (2015). The abstract claims qualitative improvements on a commercial speech system and on MNIST; the mechanism described above is the paper’s soft-target transfer at temperature.
2. OpenAI, Disrupting a coordinated model-distillation campaign (September 30, 2026). Quotes: “systematic and unauthorized use of one model’s outputs or reasoning”; activity from July 1, spikes of 16,000 requests from over 4,000 users on July 24 and 25, a cluster of more than 15,000 users disrupted by July 28; “did not break our encryption, compromise a database, or gain direct access to stored user conversations”; attribution to “individuals associated with Moonshot AI, the developer of Kimi”; “not a vulnerability unique to OpenAI’s models”; details shared through the Frontier Model Forum.
3. Build a Tiny LLM in Go, Part 5: Putting It Together and Watching It Learn, the stage this article’s code extends.
4. erubboli/go-tiny-llm, stage cmd/stage6_distill. Teacher: 116,416 parameters. Students: 7,488 parameters each, identical seed and batches. Held-out cross-entropy over 32 fixed windows: teacher 2.4409, control 2.5569, distilled 2.5462 nats per character. DistillLoss blends hard cross-entropy (weight 0.5) with a temperature-4.0 KL divergence against the teacher’s softened logits.
5. Anthropic, Detecting and preventing distillation attacks (February 23, 2026): DeepSeek, Moonshot and MiniMax accused of campaigns using “approximately 24,000 fraudulent accounts” and “over 16 million exchanges with Claude,” described as violations of terms of service and regional access restrictions.
6. Tim Fernholz, Experts say exploiting Anthropic’s Fable isn’t how Kimi K3 got so good, TechCrunch (July 23, 2026). White House science advisor Michael Kratsios alleged large-scale covert distillation of Anthropic’s Fable in the development of Kimi K3; experts disputed that distillation explains K3’s capability.
7. Anthropic, Our position on open-weights models (July 2026): “Anthropic has never advocated for a ban on open-weights models”; “We should crack down on industrial-scale distillation operations”; “All sufficiently capable models, open and closed, should go through mandatory safety testing”; open-weights models without dangerous capabilities “are a public good”; “once weights are released they cannot be withdrawn.” Mozilla Foundation, The State of Open Source AI, v1.1 (September 2026): open models within a few index points of closed at lower price, an 8-point capability gap closing in roughly 4 months per cycle, open models reaching production within 12 points of closed rivals, the first open model topping OpenRouter usage in August 2026 with 8 of the top 10 models by tokens open, Kimi K3 as the first open three-trillion-parameter release, a roughly 60-fold fall in inference cost in 45 months, DeepSeek’s August price increase, “a major US lab returned to open weights and Washington debated a ban and declined it.” The open letter Open Weights and American AI Leadership (July 24, 2026), signed by Microsoft, Nvidia, Meta and more than twenty other companies and groups, calls distillation “a widely used technique.”
8. Blake Brittain, US judge approves Anthropic’s $1.5 billion settlement of copyright lawsuit, Reuters (July 20, 2026); the largest known copyright settlement in the United States at time of approval.
9. DeepSeek, DeepSeek-R1 model repository (January 2025): weights under the MIT Licence, which permits use, modification and redistribution, including for distillation.
10. The AI Act Regulates Invoices. Open Weights Don’t Send Any. on enforcement living where the invoices are; MiCA and the AI Act: Europe Exports Process, Imports the Frontier on why the AI Act’s provider-centred machinery grasps services, not files.