Chinese labs shift AI distillation targets to OpenAI GPT-6 Astra

The shift in distillation targets

Chinese artificial intelligence laboratories are reportedly changing their strategy for training smaller models. According to a report by The Information, relayed by The Decoder, these labs are moving away from Anthropic's Claude and toward OpenAI's GPT-6 Astra. This shift comes as a direct response to security updates made by Anthropic.

The report suggests that major players like DeepSeek and Moonshot AI have been active in this space. Specifically, these labs are said to have relied on outputs from Astra to train their own models, including Kimi K3.1 Pro and V4.1-Flash 1017. This process is known as distillation, where a smaller model learns to mimic the behavior or logic of a much larger, more capable one.

This transition indicates that the landscape of AI development is becoming increasingly competitive. When one company successfully secures its proprietary data, competitors look for the next available source. The move toward OpenAI's infrastructure suggests that Astra is currently seen as a more accessible or less defended target for these specific training techniques.

How distillation works

Distillation is a method used to create efficient AI models by using the outputs of high-performing models as a teacher. By feeding a smaller model the results of a larger one, developers can help the smaller version achieve higher accuracy with fewer computing resources. However, the specific technique being used here is more complex than just copying final answers.

The report notes that this process depends on getting a model to reveal its hidden reasoning steps. Reasoning traces are the internal logic paths a model takes to arrive at a conclusion. Both OpenAI and Anthropic have strict policies against allowing users to see or extract these internal steps because they contain the core 'intelligence' of the system.

By extracting these traces, a lab can essentially download the logic of a multi-billion dollar model. This allows them to build a version of the model that thinks in a similar way without having to perform the massive amounts of original research and compute. It is a shortcut that allows for rapid development of competing products.

Security responses and failures

Anthropic has taken aggressive steps to prevent this type of data theft. The company claims that its new defenses have successfully cut the amount of data attackers can extract by 90 to 99 percent. This represents a significant hurdle for labs looking to use Claude as a primary source for their training data.

Despite these improvements, OpenAI recently reported a coordinated campaign aimed at their own systems. In late September, they identified a distillation effort linked to individuals associated with Moonshot AI. This suggests that even with active monitoring, it is difficult to stop determined actors from finding ways to bypass safety protocols.

An OpenAI spokesperson noted that attackers have shown a high degree of adaptability. They stated that attackers have adapted to each new defense, implying that security is a moving target. As soon as one door is locked, the community finds a window or a different building to enter.

The limitations of current defenses

The current situation reveals a fundamental problem in AI security: the weakest link determines the overall safety of the technology. If a defense only succeeds in moving an attacker from one lab to another, the underlying risk of model leakage remains. It suggests that protecting reasoning traces may not be a durable long-term solution if the methods for extraction continue to evolve.

Furthermore, the metrics used by companies to measure their success may be misleading. A lab might claim to have blocked a high percentage of data, but that percentage does not necessarily reflect the total amount of information that actually leaked. If the remaining data contains the most critical reasoning steps, the defense could still be considered insufficient.

The report does not provide specific numbers on how many Astra outputs were used or how much the distilled models actually improved. Without these metrics, it is difficult to know the true scale of the impact. However, the shift in focus by major Chinese labs suggests that the distillation of high-end models is a primary goal for the next generation of AI products.

What comes next for the industry

The ongoing battle over model distillation will likely force AI labs to develop more sophisticated detection signals. As labs become aware of the specific techniques used by competitors, they may start sharing information on how to identify and block these coordinated campaigns. This could lead to a more standardized approach to protecting internal reasoning.

For developers and researchers, this means that the cost of distillation may continue to rise. If it becomes harder to extract data, labs will have to spend more on creative engineering to find workarounds. This creates a cycle where the most capable models become increasingly expensive to protect from theft.

The industry faces a fundamental question regarding whether hiding reasoning traces is a durable defense or simply a way to raise the price of distillation. As labs continue to pivot between targets, the race to secure proprietary logic will remain a central conflict in the development of large-scale artificial intelligence.