The DeepSeek “Distillation” Allegation
On this page
An allegation, not a verdict — but the clearest public flashpoint over stealing a model by querying it.
| When | January 2025 (activity alleged fall 2024) |
|---|---|
| Target | OpenAI's API / models |
| Alleged actor | A group possibly linked to DeepSeek (disputed) |
| Technique | High-volume API querying to harvest outputs (distillation) |
| Status | Unproven allegation, repeated by OpenAI and Anthropic in Feb 2026 — no independent proof or legal finding |
- 1A group allegedly queries a frontier model's API at high volume
- 2The harvested outputs are allegedly used to train a competing model (distillation)
- 3The provider detects the pattern and alleges terms-violating extraction
What happened
In early 2025, Microsoft researchers alleged that a group possibly linked to DeepSeek had “exfiltrated a large amount of data” via OpenAI's API, and OpenAI said it had evidence of distillation attempts. In February 2026 OpenAI repeated the accusation in a memo to US lawmakers, and Anthropic named DeepSeek as one of three Chinese labs running distillation campaigns against Claude, attributing over 150,000 exchanges to it. It remains an unproven, disputed allegation — no independently verifiable proof, no legal adjudication, and DeepSeek has not admitted it.
The alleged mechanism
Model extraction by consumption: querying a model's API at scale to harvest its outputs, then using those outputs to train a competing model (“distillation”) — a use these APIs' terms prohibit.
Root cause
A public API that returns high-quality outputs is inherently extractable at volume; without rate/anomaly controls, large-scale harvesting is hard to prevent.
What a control would catch
Rate limiting, per-account volume anomaly detection, and query-pattern analysis flag extraction-shaped usage — the controls at issue in the dispute.
How to defend
- Rate-limit and monitor for extraction-shaped query volume.
- Watermark or constrain outputs where feasible.
- Treat the API as an extraction surface, not just a product.
Feel it yourselfThe replay lab extracts model behaviour/data through repeated, crafted queries — the model-extraction class.
FAQ
What is distillation in this context?
Using one model's outputs — harvested by querying its API at scale — to train another model. Done against terms and at volume, it's a model-extraction / unbounded-consumption concern.
Is the allegation proven?
No. OpenAI (in a February 2026 memo to US lawmakers) and Anthropic (February 2026) repeated it with more detail, but it remains unproven: no independently verifiable evidence, no legal adjudication, and DeepSeek has not admitted it. We include it explicitly labelled “alleged.”
Why include a disputed case?
Because it's the highest-profile real-world example of the model-theft-via-excessive-querying facet of LLM06 — with the honest caveat that it is contested.
Sources
- Microsoft probing whether DeepSeek improperly used OpenAI's API — TechCrunch
- OpenAI Accuses China's DeepSeek of Distilling US AI Models to Gain an Edge — Bloomberg
- Anthropic joins OpenAI in flagging 'industrial-scale' distillation campaigns — CNBC
- Detecting and preventing distillation attacks — Anthropic