Michael Kratsios, director of the White House Office of Science and Technology Policy, has sent a memo to government departments warning that “foreign entities, principally based in China” are running “deliberate, industrial-scale campaigns to distill US frontier AI systems,” using tens of thousands of proxy accounts and jailbreaking techniques to extract proprietary information. The administration will begin sharing threat intelligence with US AI companies. On the table: placing offending foreign entities on the US entity list, tighter chip export controls, sanctions.

Distillation Is Normal, But Also Maybe Bad?

Distillation is a perfectly respectable technique in machine learning. You have a big model and a small one. You train the small one to imitate the big one by having it learn from the big one’s outputs. Every lab does this with its own systems. Academics publish papers about it. Nobody argues it is theft when Anthropic does it to Anthropic.

What the memo is trying to do is draw a line. Specifically: distillation is fine when you do it to yourself. It becomes a problem when it is (1) cross-border, (2) at sufficient scale, and (3) directed from a country the US considers a strategic adversary. None of those factors alone makes distillation illegal. Together, per the administration, they make it industrial espionage.

What “Industrial Scale” Actually Means

Consider what you would have to do if you were running an AI lab that could not get API access to Claude or GPT-5 inside your country, because geofencing blocks it. Compute you have. What you lack is high-quality step-by-step reasoning traces of the kind only a handful of Western frontier labs produce, which is the training signal that teaches a model to think.

So you stand up 24,000 fraudulent accounts through proxy services that resell API access. You have those accounts ask the target model 16 million carefully designed questions over several months. You route the traffic across thousands of API keys and cloud providers so no single queue catches fire. You take the step-by-step answers and use them to train your own model.

This is, according to Anthropic’s February disclosure, what DeepSeek, Moonshot, and MiniMax collectively did to Claude. MiniMax drove 13 million exchanges; Moonshot drove 3.4 million targeting agentic reasoning and tool use; DeepSeek drove 150,000 focused on censorship-safe responses. The Kratsios memo picks up Anthropic’s framing almost word-for-word. A corporate characterization in February is federal policy by April. A three-month turnaround is fast for Washington.

The Memo Came From the Science Office, Which Matters

OSTP is the White House’s science and technology policy office. Commerce writes entity-list rules. Treasury writes sanctions. Defense writes procurement. OSTP does none of those things. What it does is decide how the administration thinks about emerging-tech competition at a conceptual level.

When OSTP sends a memo saying industrial-scale distillation belongs in the same bucket as semiconductor IP theft, it is not writing an export-control rule. It is telling the rest of the administration that this is how distillation will be categorized from here on, and the rule-writing offices can proceed on that basis. Category-level memos tend to precede concrete actions by a few months. This one probably does too.

The Three-Month Problem

The reason this matters is capability diffusion. As argued in a recent Control Plane newsletter, open-weight models currently lag the frontier by a median of about three months, per Epoch AI. DeepSeek R1 reached o1-class capability roughly five months after o1. Distillation from Western APIs is one of the mechanisms that keeps that lag tight. Close the channel, the lag widens. Widen the lag, and the period during which a frontier capability is controllable before proliferating meaningfully extends.

That is the policy logic. It is roughly the trajectory Leopold Aschenbrenner sketched in 2024, when he argued the US government would eventually treat frontier AI as a national-security category rather than a commercial one. The Kratsios memo is not a Manhattan Project. It is the clearest sign yet that the administration has made that category shift.

Two Bifurcations, Not One

For the Chinese frontier labs already named in the public record, the implications compound. DeepSeek, which just raised $10 billion from domestic capital only because US capital was effectively locked out, now faces the prospect of being locked out of US training data as well. MiniMax and Moonshot are in similar positions. The capital bifurcation that became visible last quarter is now joined by a training-data bifurcation. Each closure makes the next one easier, because the legal and infrastructural machinery only has to be built once.

The US government has decided, in a memo from the office that shapes how the White House thinks about science-and-technology competition, that distillation of US frontier AI models by foreign adversaries is a national-security issue. That sentence could not have been written twelve months ago. But here we are.

Sources: Financial Times (via Invezz), CNBC, Anthropic, Epoch AI

–
By the Control Plane Editorial Team