On April 6, 2026, three companies that compete fiercely in every other dimension - OpenAI, Anthropic, and Google - announced they are collaborating on a shared problem: stopping adversarial distillation of their AI models by foreign competitors. The collaboration runs through the Frontier Model Forum, an industry nonprofit the three companies founded with Microsoft in 2023, and it represents the first time these labs have shared operational intelligence about specific threat actors.

The numbers are striking. Anthropic alone documented 16 million suspicious API exchanges originating from three Chinese AI companies - DeepSeek, Moonshot AI, and MiniMax - running through approximately 24,000 fraudulently created accounts. These were not casual users pushing the limits of fair use. This was systematic, industrial-scale extraction of model capabilities.

For anyone working in AI, ML, or data engineering, this story matters beyond geopolitics. It reveals how frontier models can be reverse-engineered through their APIs, what that means for model security, and why the technical countermeasures are harder than they appear.

What Adversarial Distillation Actually Is

Knowledge distillation is a well-known technique in machine learning. A large, expensive "teacher" model generates outputs that are used to train a smaller, cheaper "student" model. The student learns to mimic the teacher's behavior without needing the teacher's full architecture, training data, or compute budget. This is how many efficient production models are built - it is a standard, legitimate technique.

Adversarial distillation takes this process and applies it without the teacher's consent. Instead of having access to the teacher model's internals, the attacker only has API access. They send millions of carefully crafted prompts, collect the responses, and use those input-output pairs to train a competing model. The resulting model does not copy the original's weights or architecture, but it replicates its capabilities - sometimes closely enough to be commercially competitive.

The process typically works in three phases:

Phase 1: Capability mapping

The attacker sends a diverse set of prompts to understand the target model's capabilities, strengths, and weaknesses. This is not random sampling - it is systematic exploration designed to map the model's behavior across different domains, difficulty levels, and instruction types. A well-designed mapping phase can characterize a model's capabilities with relatively few queries.

Phase 2: Data generation

Once the capability map exists, the attacker generates targeted training data. For each capability they want to replicate, they create prompts that elicit the model's best performance in that area. The goal is not just to collect outputs but to collect the kind of outputs that are most useful for training - diverse, high-quality, and covering edge cases.

This is the phase that generates the most API traffic. Anthropic's 16 million exchanges - from just three companies - gives a sense of the scale involved. To effectively distill a frontier model's capabilities, attackers may need millions or even tens of millions of input-output pairs.

Phase 3: Student training

The collected data is used to fine-tune a base model (often an open-weight model like LLaMA or Mistral) to replicate the target model's behavior. Modern fine-tuning techniques - LoRA, QLoRA, full fine-tuning with curriculum learning - can produce surprisingly capable student models from API-generated data alone.

Why It Is Harder to Detect Than It Sounds

At first glance, detecting adversarial distillation seems straightforward: look for accounts sending an unusual volume of queries. But in practice, the detection problem is much harder.

Distributed queries

Sophisticated attackers distribute their queries across thousands of accounts, each sending a volume that looks normal. Anthropic's discovery of 24,000 fraudulent accounts illustrates this approach. No single account triggers rate limits or volume alerts. The pattern is only visible when accounts are linked through payment methods, IP addresses, or query patterns.

Plausible query patterns

The most effective distillation queries look like legitimate usage. A prompt asking a model to "explain quantum computing to a five-year-old" could be a curious user or a distillation campaign collecting pedagogical capability data. Distinguishing between the two requires analyzing patterns across accounts, not individual queries.

Legitimate heavy usage

Many legitimate customers send millions of API queries. Enterprise customers building production applications, researchers running evaluations, and developers building agent systems all generate high-volume, diverse query patterns. Any detection system must avoid flagging legitimate power users.

Evolving techniques

Attackers adapt. When providers detect one pattern, attackers change their approach. They rotate accounts faster, vary their query styles, and use intermediate services to obscure the origin of requests. The detection problem is adversarial by nature - the attacker is actively trying to evade detection.

The Technical Countermeasures

The alliance between OpenAI, Anthropic, and Google focuses on sharing detection signals and coordinating responses. While the specific technical details have not been fully disclosed, the general categories of countermeasures are well understood.

Behavioral fingerprinting

Rather than looking at individual queries, detection systems analyze behavioral patterns across time. Distillation campaigns have distinctive signatures: systematic coverage of capability areas, specific prompt structures optimized for training data generation, and temporal patterns that reflect automated rather than human usage.

# Simplified example: behavioral pattern detection
from collections import defaultdict
from datetime import timedelta

class DistillationDetector:
    """Detects potential distillation patterns in API usage."""

    def __init__(self):
        self.account_patterns = defaultdict(lambda: {
            "domain_coverage": set(),
            "prompt_diversity_score": 0.0,
            "timing_regularity": 0.0,
            "response_usage_pattern": "unknown",
        })

    def analyze_account(self, account_id: str, queries: list) -> dict:
        pattern = self.account_patterns[account_id]

        # Distillation campaigns systematically cover capability areas
        domains = self.classify_query_domains(queries)
        pattern["domain_coverage"] = domains
        coverage_score = len(domains) / self.total_domains

        # Human users show natural variation in timing
        # Automated systems show regular intervals
        intervals = self.calculate_query_intervals(queries)
        pattern["timing_regularity"] = self.regularity_score(intervals)

        # Distillation queries tend to request long, detailed responses
        avg_response_length = sum(q.response_length for q in queries) / len(queries)

        risk_score = (
            0.3 * coverage_score +
            0.3 * pattern["timing_regularity"] +
            0.2 * self.prompt_structure_score(queries) +
            0.2 * min(avg_response_length / 2000, 1.0)
        )

        return {
            "account_id": account_id,
            "risk_score": risk_score,
            "flag": risk_score > 0.7,
            "indicators": self.get_indicators(pattern)
        }

Output perturbation

One category of defense involves subtly modifying model outputs in ways that are invisible to normal users but degrade the quality of distilled models. This can include introducing carefully designed variations in outputs that, when used as training data, create specific failure modes in the student model. This is sometimes called "model watermarking" or "radioactive data."

The challenge is balancing perturbation effectiveness against output quality. Any modification visible enough to effectively poison distillation data risks degrading the experience for legitimate users.

Account linking and network analysis

The most effective detection combines behavioral analysis with network analysis. Fraudulent accounts often share signals: payment methods, IP address ranges, API key creation patterns, or usage timing that correlates across accounts. By sharing these signals across providers, the alliance can identify coordinated campaigns that would be invisible to any single provider.

This is the primary value of the collaboration. DeepSeek might use different accounts for OpenAI and Anthropic, but if the behavioral patterns and network signals correlate, the combined intelligence makes detection far more effective.

Rate limiting with capability awareness

Traditional rate limiting counts queries per minute. Capability-aware rate limiting counts the diversity and depth of queries. An account that sends 1,000 queries all about Python programming is likely a developer. An account that sends 1,000 queries systematically covering mathematics, coding, creative writing, analysis, and instruction following in equal proportion looks like a distillation campaign.

The Geopolitical Dimension

The three named companies - DeepSeek, Moonshot AI, and MiniMax - are among China's most prominent AI startups. DeepSeek in particular has attracted attention for producing models that rival frontier Western models at a fraction of the apparent training cost. The question of how much of that capability comes from original research versus distillation of Western models is exactly what this alliance aims to answer.

The geopolitical context matters for data engineers and ML practitioners because it shapes the regulatory environment they work in. Export controls on AI chips (ongoing since 2022) have already affected GPU availability and pricing. If adversarial distillation becomes a major policy issue, it could lead to restrictions on API access, mandatory KYC (know your customer) requirements for AI services, or new intellectual property frameworks for model capabilities.

It also matters because the same distillation techniques used across borders are available to domestic competitors, corporate espionage operations, and even internal teams within large organizations. The security patterns being developed to counter nation-state-level distillation campaigns will eventually become standard practice for protecting any proprietary model.

What This Means for Model Providers

For companies offering AI models through APIs - whether frontier labs or organizations serving internal models - the distillation threat changes the economics of model serving. Every API call is potentially a training sample for a competitor. This does not mean APIs should be restricted, but it does mean that model security needs to be designed into the serving infrastructure, not bolted on after the fact.

Practical implications include:

Usage analytics become security infrastructure. The same systems that track API usage for billing and capacity planning need to support anomaly detection and behavioral analysis. This is an area where data engineering directly supports model security.

Terms of service enforcement gets technical. Prohibiting distillation in terms of service is meaningless without technical detection capabilities. Legal protections and technical countermeasures must develop in parallel.

Model versioning and fingerprinting. If a distilled model can be traced back to the specific model version it was trained on, providers gain both legal evidence and technical intelligence. Embedding detectable signals in model outputs - without degrading quality - is an active area of research.

The Broader Picture

The OpenAI-Anthropic-Google alliance is notable not just for what it does but for what it signals about the AI industry's maturation. Three years ago, these companies viewed each other primarily as competitors. Today, they recognize that some threats are more effectively addressed through collaboration.

This pattern - fierce competition on products, collaboration on security and safety - mirrors how other industries have evolved. Banks compete on services but collaborate on fraud detection through shared networks. Cybersecurity companies compete on products but share threat intelligence through ISACs (Information Sharing and Analysis Centers). The AI industry is developing its own version of these cooperative security mechanisms.

For data and ML engineers, the practical takeaway is that model security is becoming a first-class concern, not an afterthought. The techniques for detecting distillation - behavioral analysis, network analysis, anomaly detection at scale - are fundamentally data engineering problems. The organizations that solve them will need the same skills used to build fraud detection systems, security monitoring pipelines, and real-time analytics platforms.

The 16 million exchanges documented by Anthropic are likely a fraction of the total activity across all providers. As frontier models become more capable and more commercially valuable, the incentive for adversarial distillation only grows. The alliance announced this week is the beginning of an industry-wide response, not the end of one.