Two weeks isn't enough to copy a frontier AI model, researchers say

Anthropic released a new language model called Fable on July 1. By mid-July, a Chinese lab called Moonshot had released Kimi K3, an open-weight model (one whose trained parameters are released publicly rather than served only through an API) posting frontier-class benchmark scores. The White House's science advisor, Michael Kratsios, called the result "covert industrial distillation," the technical term for training a new model on outputs systematically harvested from a target model, in this case Fable, while routing the work through chips not cleared for export to China.

The accusation landed while Washington was reported to be weighing a ban on Chinese open-weight models. It came with a second, broader claim from Treasury Secretary Scott Bessent, who said U.S. LLMs have left "watermarks ... on many of the Chinese models." Bessent's office has not described what those watermarks are or how they would be detected, and the Treasury Department has not clarified the claim on the record.

Two researchers who study model training publicly pushed back on the mechanism named in the accusation, not on the policy concerns beside it. Their objection is empirical: distillation at the scale required to produce a frontier-class model cannot plausibly happen in two weeks of public access to the target.

Distillation, in plain terms, means querying a model thousands or millions of times, capturing its answers, and using those question-answer pairs to train a new model through supervised fine-tuning (SFT). A frontier-grade run requires enough high-quality data, including long chain-of-thought traces, to teach a new model the target's behavior, and a full post-training cycle to convert that into benchmark performance. Anthropic's own write-up of how it detects and prevents these attacks describes the scale of compute and data the technique demands (Anthropic: detecting and preventing distillation attacks).

Braden Hancock, who leads the Laude Institute and co-founded Snorkel AI, told TechCrunch that the timeline alone disqualifies the mechanism. Fable has been publicly available since July 1; Kimi K3 was already at frontier-level capability within roughly two weeks. "Strict distillation cannot explain K3's strength," Hancock said, because there has not been enough time to query, label, and train a frontier-class model from public access alone.

Nathan Lambert of the Allen Institute for AI, writing on his Interconnects podcast and quoted in the same TechCrunch piece, added a second-order point: the path to the frontier is shifting away from the kind of supervised fine-tuning that distillation enables. Chinese labs at the frontier, he argued, are increasingly getting there through reinforcement learning (RL), which trains a model on its own outputs against scored objectives rather than on harvested answers from another model. SFT on K3-style data alone would not let any lab catch up to a frontier release that fast.

Moonshot has not publicly described K3's training stack, compute path, or data sources. The Kimi K3 launch blog frames the model in capability terms, not provenance. Kratsios has not published underlying evidence for the distillation claim; his tweet is the primary on-the-record statement. The same-day SCMP coverage and Business Insider's report both carry the White House framing without resolving the technical question.

The export-control and intellectual-property questions that sit behind the accusation are not what the named experts are weighing in on, and they remain legitimate unresolved issues. If Moonshot had pre-release access to Fable, or if K3 training was already underway before July 1, the throughput math changes and the named mechanism becomes more plausible. Neither is on the record. A dated record of Fable access, K3 training compute logs, or a described watermark method would shift the empirical balance. Until one of those appears, the specific technical claim at the center of the policy argument is the part that does not yet hold up.