Calling API abuse distillation makes policy miss its target

Nathan Lambert is challenging the broad use of model distillation to describe conduct that also includes stolen API keys, fraudulent accounts, jailbreaks and evasion of regional restrictions. Distillation itself is a standard way to teach a smaller model from the outputs of a stronger one.

One label now covers several different attacks

Lambert was responding to the US debate about Chinese AI companies. A joint NSA, CISA and FBI advisory from September 2026 alleges that six China-based companies obtained billions of tokens through millions of requests to Claude, GPT, Gemini and Grok models since late 2024. It names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.

The agencies describe native APIs, cloud services, aggregators and a gray market of proxies called transfer stations. They also cite fraudulent accounts, prompt injection, jailbreaks and attempts to extract hidden chain-of-thought output. Lambert’s objection is taxonomic: stealing credentials and bypassing safeguards are access attacks, while distillation describes how acquired outputs may later be used in training.

Precise language decides who pays for the defense

Large labs, startups and researchers all use model distillation. A stronger model generates data or transfers a particular skill to a smaller one. The same technique can support an internal product, public research or a competitor violating API terms. The risk therefore depends on data provenance, authorization and the means of access rather than the training method alone.

A broad label can shift rules from conduct to technology. That would favor companies with their own models and large legal teams. Smaller research groups would bear the cost of proving that they used a standard method legitimately. API providers can more directly target coordinated accounts, nonstop activity and new subscriptions that immediately consume maximum quotas.

A flawed label does not erase the reported abuse

CISA explicitly acknowledges that distillation is a legitimate and useful technique. Its advisory uses the narrower phrase industrial-scale distillation campaigns and documents specific behavior. Lambert is not disproving the existence of large campaigns. He is warning against turning a technical term into one shorthand for cyberattack, contract violation and industrial policy at once.

The public advisory makes detailed claims about particular companies and models, but it does not give independent readers the underlying logs. The figures of billions of tokens and millions of requests come from a government assessment. Distinguishing legitimate use, breach of terms and criminal conduct will require more disclosed evidence.

Effective rules must target access, identity and traffic volume

The next US measures will show whether policy targets specific practices, including stolen keys, fraudulent accounts, regional-block evasion and coordinated API extraction. Another important signal will be whether providers publish measurable indicators and preserve exceptions for security research.

If laws or contracts penalize distillation regardless of consent and data provenance, Lambert’s concern will be justified. If defenses separate the training method from the way data was obtained, they can protect models without closing the path for smaller teams.

Lilith's verdict

When a customs officer stamps a stolen passport, a textbook and a truck with the same label, the queue grows while the smuggler gains ground. Model defense must name the conduct instead of banning the whole category.