Distillation — how models copy models, and how you catch them

July 17, 2026

What knowledge distillation is, the mathematics of proving it happened — watermark radioactivity, stylistic fingerprints, agreement statistics — and the affair of June 2026: GLM-5.2, Claude Mythos, and the first real test of AI export controls. Also in Maths & Science.

What distillation is

Knowledge distillation is training a model on the outputs of another model instead of — or on top of — raw data. The idea predates the LLM era: Bucilă, Caruana and Niculescu-Mizil compressed model ensembles this way in 2006, and Hinton, Vinyals and Dean named it in 2015. Their insight was that a teacher's full probability distribution over answers carries more information than the answers themselves. A classifier that says “cat: 0.9, tiger: 0.09, car: 10⁻⁶” is teaching more than a label — it is teaching that tigers resemble cats and cars do not. Hinton called this “dark knowledge”: the student minimizes the KL divergence to the teacher's distribution, softened by a temperature parameter that flattens the softmax and amplifies exactly those revealing small probabilities.

Modern API-era distillation is cruder, because a competitor querying a frontier model does not get the distribution — only sampled text. So the practice became sequence-level: harvest millions of prompt-response pairs from the teacher and fine-tune the student on them as if they were ground truth. It works disturbingly well. Stanford's Alpaca (2023) bought a usable instruction-following model for a few hundred dollars of GPT-3.5 outputs, and every capability jump since has had a shadow market in harvested traces — especially chain-of-thought, where the teacher's reasoning process itself is the asset being copied.

The economics are the point. Under the scaling laws, capability is bought with compute on a power-law curve — hundreds of millions of dollars at the frontier. Distillation lets a follower buy a compressed, queryable form of that training run at API prices, per token. The trainer pays the fixed cost; the distiller pays marginal cost. Every lab does this legitimately to its own models (small fast models are routinely distilled from large ones — that is much of how cheap tiers exist). The controversy is doing it across a competitor's API, against its terms of service, to absorb capabilities the competitor spent the fixed cost to create.

How to find the watermarks

Distillation leaves traces, because the student does not just learn the teacher's knowledge — it learns the teacher's habits, biases and mistakes. Detection methods range from the accidental to the engineered:

The self-identification slip

The crudest tell: ask the student who it is and it names the teacher. Early DeepSeek releases would occasionally announce themselves as ChatGPT — because millions of training examples contained a model saying exactly that. Trivially patched with a system prompt, so its absence proves nothing; its presence is close to a confession.

Stylistic fingerprints

Every frontier model has involuntary verbal tics — preferred transition words, characteristic list rhythms, signature phrases. Simple classifiers separate the major labs' outputs with well over 95% accuracy, and the fingerprint survives distillation: a student trained on a teacher's text inherits the teacher's tics the way a copied manuscript inherits the scribe's hand.

Radioactive watermarks

A provider can bias generation toward a pseudorandom 'green list' of tokens — invisible in any single output, statistically unmistakable over many. The key result (Sander et al., 2024) is that the bias is radioactive: it survives into models fine-tuned on the watermarked text, detectable by hypothesis test even when only a few percent of the training mix came from the teacher.

Canary answers

The cartographer's defense. Map makers used to insert trap streets — fictitious roads whose appearance on a rival's map proved copying, as did the deliberate errors seeded in 18th-century logarithm tables. An API can serve rare, harmless idiosyncratic answers to unusual prompts; a student that reproduces them has read them somewhere.

Agreement statistics

Two strong independent models agree on right answers — that is what being right means. The information is in the errors. If a student is wrong in the same places, and the same ways, as a specific teacher, agreement climbs above what shared competence explains. Cohen's kappa is the standard measure; matching failure surfaces are the shared mutations of the model world.

Traffic forensics

Detection on the supply side rather than in the weights: distillation at scale needs millions of teacher outputs, which means industrial API harvesting — account farms, templated prompts, abnormal volume. This is how Anthropic says it caught the campaigns it disclosed in 2026: not in anyone's model, but in its own logs.

The mathematics of the tells

Two of these deserve the equations, because they are where business disputes will be settled.

Watermark radioactivity. A generation-time watermark (Kirchenbauer et al., 2023) seeds a pseudorandom function with the preceding tokens to partition the vocabulary into a “green” and “red” list, then adds a small logit bonus to green tokens. Any single output looks normal; across n tokens, the green count follows a binomial distribution under the null hypothesis of no watermark, and a one-sided test yields a p-value that shrinks exponentially with length. Sander, Fernandez, Durmus et al. showed the crucial second step: a model fine-tuned on watermarked text inherits the green-token bias into its own generations — “radioactivity” — so the same hypothesis test, run on the student's outputs with the teacher's secret key, detects the contamination with high confidence even when watermarked text was a single-digit percentage of the training mix. The follow-up literature is already adversarial: scrubbing attacks that paraphrase the watermark away, spoofing attacks that inject someone else's watermark to frame them. It is an arms race, but an asymmetric one — the detector needs only statistics, the evader must launder every token.

Agreement statistics. Cohen's kappa corrects raw agreement between two answer sets for the agreement chance would produce: κ = (pₒ − pₑ) / (1 − pₑ), where pₒ is observed agreement and pₑ the agreement expected from each model's accuracy alone. Two competent but independent models score a moderate kappa — they agree on what they both get right and disagree on their uncorrelated errors. A student distilled from a teacher agrees on the errors too: it is wrong where the teacher is wrong, by construction. So an abnormally high kappa against one specific frontier model — well above the kappa that frontier models score against each other — is the statistical shadow of a training-data relationship. It is evidence, not proof: shared training corpora, similar preference data and benchmark contamination all push kappa up, which is why it plays the role of the copied logarithm-table error — enough to open the case, not to close it.

GLM-5.2 versus Mythos: the affair of June 2026

All of this stopped being academic in the spring of 2026, in a sequence of events worth recording precisely.

January 2025 — the precedent. OpenAI and Microsoft say DeepSeek may have distilled GPT-4-class outputs into the models behind its R1 release — the first time “distillation attack” enters the mainstream vocabulary, with no formal action following.
February 2026. Anthropic discloses that it caught three Chinese labs — DeepSeek, Moonshot AI and MiniMax — running coordinated harvesting campaigns against Claude.
April 22 – June 5, 2026. According to Anthropic's June 10 letter to Senators Tim Scott and Elizabeth Warren, operators linked to Alibaba's Qwen division run nearly 25,000 fraudulent accounts generating 28.8 million exchanges with Claude — “the largest known distillation attack” on the company — aimed at capabilities close to Claude Mythos Preview, its frontier coding-and-reasoning model.
June 12, 2026. The US government places Mythos and its public-facing version, Fable 5, under export controls. Rather than screen users by nationality, Anthropic disables Fable 5 globally.
June 13, 2026. One day later, Beijing-based Zhipu (Z.ai) releases GLM-5.2: open weights, MIT license, downloadable by anyone, claiming parity with Mythos on cybersecurity and vulnerability-finding benchmarks — the exact capability class the export controls were meant to contain.
Late June 2026. Graphistry runs independent evaluations on CyBT-CTF, a benchmark whose tasks are hidden from model makers. GLM-5.2 solves 28 of 59 challenges — matching Opus 4.8, beating Sonnet 4.5, at roughly 2.2× lower cost. Then the kappa analysis: GLM-5.2 agrees with GPT-5.5 at κ = 0.80 and with Opus 4.8 at κ = 0.76, where the two American labs' models agree with each other at only 0.63. Graphistry's reading: GLM-5.2 likely did not arrive at its answers — right or wrong — independently.

What the numbers do and don't prove

Kappa is a smell, not a smoking gun. Fifty-nine tasks is a thin sample for a hypothesis test, and common web corpora, similar RLHF preference data and contaminated public benchmarks all inflate agreement between unrelated models. The 0.63 cross-lab baseline is the strongest part of the argument — but one baseline pair is a small null distribution.
The cold-start reading. The most credible middle position holds that GLM-5.2 did train on Claude and GPT-5.5 outputs, but that distillation solved the cold-start problem for its reinforcement-learning phase rather than buying the capability outright. Distilled competence tends to be brittle; GLM-5.2's performance held on a hidden test set where memorization cannot help, which cuts in Zhipu's favor.
The contamination twist. The same hidden benchmark embarrassed the accusers' side too: Anthropic's outsized lead on public cybersecurity benchmarks shrank on CyBT-CTF, suggesting public benchmark scores across the industry carry a contamination premium. The measurement problem is symmetric.
Nobody has shown a radioactive watermark. As of this writing the public evidence is agreement statistics and traffic forensics. If Anthropic's outputs carried a statistical watermark during the harvesting window, a radioactivity test on GLM-5.2's open weights would be close to dispositive, in either direction. That test — not the op-eds — is the one to watch for.

The business reading

Distillation inverts the capital structure of the model business. The scaling laws say capability is bought with a power law in compute; distillation says it can be re-bought, once, at API prices — the classic aggregation-era move of riding someone else's zero marginal cost. Every token a frontier lab serves is simultaneously revenue and leakage: a compressed sample of the very asset the token price is supposed to amortize. That tension is structural, not incidental, and it explains why watermarking is quietly becoming a business function rather than a research curiosity — the trap street is the moat's last line.

The June sequence also handed export-control policy its first real test, and the result was uncomfortable: controls bind weights, but capability had already leaked through outputs before the controls landed — 28.8 million exchanges' worth, if Anthropic's letter is right. Worse, the blackout of Fable 5 created a vacuum that an unrestricted, MIT-licensed near-equivalent filled within twenty-four hours, arguably accelerating the diffusion the policy meant to prevent. On the token-share map, that is how share moves: not by a better model displacing a worse one, but by an available model displacing a withdrawn one. The uncatchable-copy problem that cartographers solved with fictitious streets is now the central intellectual-property question of the largest capital buildout in industrial history — and for the moment, the courts have less to go on than the statisticians.

Sources and further reading

How to read this page. An editorial synthesis of a story that was still moving as of July 2026; the June 2026 timeline follows the press accounts and primary posts linked above, and the allegations it describes are allegations, not adjudicated findings. Companions in the series: Scaling Laws, The price of a token and Who serves the tokens?