According to a copy of the letter obtained by Bloomberg on June 24, Anthropic sent a letter to multiple U.S. senators and White House officials, accusing entities related to Alibaba's Qwen Lab of using nearly 25,000 fake accounts to initiate a total of 28.8 million conversations with Claude between April and June, systematically extracting training data on Claude's software engineering and core capabilities, and characterizing this as an "adversarial distillation attack."
Anthropic Accuses Qwen of 28.8 Million Conversations Targeting Software Engineering
The attack pattern: a large number of fake accounts posed questions to Claude, collected the answers, and then used them to train the Qwen series models. Anthropic explained in the letter that the attack targets were not random queries but precisely aimed at Claude's two most competitive capabilities: software engineering and agentic reasoning (the ability for AI to autonomously plan multi-step tasks and execute complex tasks like an agent).
Anthropic stated that this method is exactly the same as that of DeepSeek and MiniMax, which it named in a blog post, constituting a "systematic, large-scale, industrial" distillation attack. The letter clearly characterized it as: "this type of attack illegally, systematically, and on an industrial scale steals AI capabilities from U.S. frontier labs and repackages them as their own products, without bearing the costs of training and R&D."
Anthropic, OpenAI, and Google Establish Three-Party Intelligence Sharing, Request Government to Clarify Antitrust Guidelines
Anthropic, OpenAI, and Google have formed a three-party alliance to share intelligence on detected distillation violations, marking a shift from individual incidents to a collective defense posture among U.S. industry players. Anthropic also requested in the letter that the U.S. government help clarify relevant antitrust guidelines so that major U.S. companies can more freely share intelligence on distillation attacks.
Anthropic acknowledged in the letter that it has also distilled its own earlier models when training Claude. The boundary between "distilling oneself" and "distilling others" remains legally unclear; distillation itself is widely used in the industry, and whether it is illegal depends on scale and intent, not the technical method itself.
Senate Plans to Introduce Amendment, House Has Pushed Bipartisan Bill
Lawmakers in both chambers of the U.S. Congress have taken action. In the Senate, Republican Senator Bill Hagerty and Democratic Senator Andy Kim plan to introduce an amendment calling for blacklisting or sanctions on Chinese companies that illegally distill U.S. AI outputs; in the House, Bill Huizenga and Sydney Kamlager-Dove have pushed a similar bipartisan bill. Both proposals are planned to be included in the annual National Defense Authorization Act (NDAA).
Frequently Asked Questions
What is an "adversarial distillation attack" and how is it different from general model distillation?
Model distillation is a technique that allows a smaller model to learn capabilities from a larger model, and is widely used in the AI research community. The issue lies in scale and intent: the behavior Anthropic accuses involves using nearly 25,000 fake accounts to conduct 28.8 million industrialized queries over three months, precisely targeting core competitive capabilities, exceeding the scope permitted by the terms of service of major AI labs.
What are the specific demands of Anthropic's letter to the U.S. Congress?
Anthropic requested in the letter that the U.S. government take two actions: impose sanctions or blacklist Chinese companies that illegally distill U.S. AI outputs; and help clarify antitrust guidelines so that major U.S. AI companies can more freely share intelligence on distillation attacks to establish a more effective collective defense mechanism.
Is the legal status of distillation attacks currently clear in the United States?
Currently, it remains unclear at the legal level. Distillation itself is not entirely illegal; the industry generally permits its use on a smaller scale and for non-competitive development purposes. Anthropic also acknowledged in the letter that it has distilled its own earlier models, and has explicitly requested the U.S. government to help clarify the relevant legal boundaries.
