Chinese artificial intelligence developers DeepSeek and Moonshot AI reportedly relied heavily on OpenAI’s GPT-6 Astra to train their latest models, according to a report citing people with direct knowledge of the matter. The models in question are Moonshot’s Kimi K3.1 Pro, released last week, and an updated version of DeepSeek’s V4.1-Flash, which launched on 17 October. The report has not been independently verified.
The process, known as distillation, allows AI developers to learn from a more capable model without having to build all its capabilities from scratch. They send it large numbers of prompts, collect its answers, and use those responses to train their own systems. Done at scale, it can help a smaller model reproduce some of a more advanced system’s abilities at a fraction of the cost.
Key Facts at a Glance
- DeepSeek and Moonshot AI reportedly used OpenAI’s GPT-6 Astra to train their latest models.
- The models are Moonshot’s Kimi K3.1 Pro and an updated DeepSeek V4.1-Flash.
- The technique used is called distillation, where a model learns from another model’s outputs.
- OpenAI previously accused Moonshot of using similar methods, including a coordinated campaign in July to extract hidden reasoning.
- OpenAI said it detected activity involving more than 15,000 users and shut down the campaign by 28 July.
- US AI labs and agencies have raised concerns about distillation and Chinese firms targeting American models.
- Anthropic recently said new safeguards reduced data collected from its Claude models in distillation attacks by around 90% to 99%.
- Both Chinese models have posted strong results in their developers’ own evaluations, but these have not been independently verified.
OpenAI has already accused Moonshot of using similar methods. On 30 September, the company said people linked to the Kimi developer had run a coordinated campaign in July to extract the hidden reasoning behind its models’ answers. OpenAI said it detected related activity involving more than 15,000 users. It shut down the campaign by 28 July, banned the accounts involved, and shared its findings with other AI labs.
The latest report adds to tensions over how Chinese AI companies develop models that can compete with those built by US labs. OpenAI, Anthropic, and Google have argued that distillation can allow rivals to replicate advanced capabilities without making comparable investments in training. US agencies have also identified Chinese firms they say targeted American AI models.
The labs are trying to make that harder. Earlier this month, Anthropic said new safeguards had reduced the amount of data collected from its Claude models in distillation attacks by around 90% to 99%. This suggests that AI companies are increasingly focused on protecting their models from being used as training material for competitors.
Both Chinese models have posted strong results in their developers’ own evaluations. Moonshot said Kimi K3.1 Pro outperformed GPT-6 Astra on a coding benchmark. DeepSeek introduced V4.1-Flash in September as a lower-cost alternative to US models. Neither company’s results have been independently verified.
The reported use of Astra highlights a difficult problem for leading AI labs: the same models they offer to users can also serve as training material for competitors looking to catch up. This dynamic is likely to intensify as AI capabilities advance and the cost of training frontier models continues to rise.
Understanding Distillation and Its Implications
Distillation is a technique that has been used in machine learning for years, but its application to large language models has become a contentious issue. In traditional model distillation, a smaller “student” model is trained to mimic the outputs of a larger “teacher” model. The student model learns to generalize from the teacher’s responses, often achieving comparable performance on specific tasks while being more efficient to run. However, when the teacher model is a proprietary system like GPT-6 Astra, and the student model is developed by a competing company, the practice raises questions about intellectual property, terms of service, and fair competition.
The process described in the report involves sending large numbers of prompts to GPT-6 Astra and collecting its answers. These answers are then used to train the Chinese models. This can be done through APIs or other access methods. While OpenAI’s terms of service likely prohibit using its outputs to train competing models, enforcing such restrictions is challenging, especially when the activity is carried out by many users or through obfuscated means. The reported campaign involving more than 15,000 users suggests a coordinated effort to circumvent these restrictions.
Distillation can be a powerful shortcut for AI developers. Training a frontier model from scratch requires massive computational resources, vast datasets, and significant time. By leveraging the outputs of an already advanced model, a competitor can potentially achieve similar capabilities with far less investment. This is particularly attractive for companies that are trying to catch up with leading US labs. However, it also means that the original model developer bears the cost of research and development while the competitor free-rides on its outputs.
The Broader AI Competition Landscape
The rivalry between US and Chinese AI companies has been intensifying. US labs like OpenAI, Anthropic, and Google have been at the forefront of developing large language models, while Chinese companies such as DeepSeek and Moonshot AI have made rapid progress. DeepSeek, in particular, has gained attention for releasing models that are competitive with US offerings at lower costs. Moonshot AI’s Kimi series has also made a mark, with the company claiming strong performance on benchmarks.
The report that these companies used GPT-6 Astra for training suggests that even as they develop their own capabilities, they may still rely on US technology to some extent. This creates a complex dependency. On one hand, Chinese companies are investing heavily in their own research and development. On the other hand, they may be using distillation to accelerate their progress. This dynamic is not unique to China; AI developers around the world have been accused of using similar methods.
US agencies have been monitoring the situation. The report mentions that US agencies have identified Chinese firms they say targeted American AI models. This has led to increased scrutiny and efforts to protect proprietary models. For example, OpenAI has implemented measures to detect and prevent distillation attacks. Anthropic’s recent announcement about reducing data collection in distillation attacks by 90% to 99% is another example of labs hardening their defenses.
These defenses can include rate limiting, monitoring for suspicious activity, and watermarking outputs. However, determined actors can often find ways around them. The cat-and-mouse game between model developers and those seeking to distill their models is likely to continue.
Technical and Ethical Considerations
From a technical standpoint, distillation can be seen as a form of knowledge transfer. It is not inherently malicious; in fact, it is a common technique used in research and industry to create smaller, more efficient models. However, when used to replicate a competitor’s model without permission, it becomes an ethical and legal issue. The terms of service of most AI labs prohibit using their models to train competing systems. OpenAI’s accusation against Moonshot in September specifically mentioned extracting hidden reasoning, which suggests attempts to go beyond simple input-output mimicry and capture the model’s internal reasoning processes.
The hidden reasoning behind a model’s answers is often considered a key competitive advantage. If a competitor can extract that reasoning, they can potentially build a model that not only matches the outputs but also understands the underlying logic. This is why OpenAI’s accusations are significant. The campaign allegedly involved more than 15,000 users, which indicates a large-scale effort to gather data. OpenAI shut it down and banned the accounts, but the fact that it happened at all highlights the vulnerability of API-based access.
Ethically, the use of distillation raises questions about fairness and innovation. If companies can simply copy the outputs of others, the incentive to invest in original research may diminish. This is a concern for the entire AI ecosystem. At the same time, some argue that distillation can democratize access to AI, allowing smaller players to build on the advances of larger ones. The debate is far from settled.
Performance Claims and Independent Verification
Both DeepSeek and Moonshot AI have made bold claims about the performance of their models. Moonshot said Kimi K3.1 Pro outperformed GPT-6 Astra on a coding benchmark. DeepSeek introduced V4.1-Flash as a lower-cost alternative to US models. These claims are significant because they suggest that Chinese models are closing the gap with their US counterparts. However, neither company’s results have been independently verified. This is a common issue in the AI industry, where companies often report benchmark scores that are difficult to reproduce or that are cherry-picked to favor their models.
Independent verification is crucial for establishing the true capabilities of AI models. Without it, claims of superiority should be taken with a grain of salt. The fact that the models were reportedly trained using distillation from GPT-6 Astra adds another layer of complexity. If the models are indeed distilled from Astra, their performance may be partly attributable to OpenAI’s technology. This could undermine the narrative of Chinese innovation and raise questions about the sustainability of such approaches.
The Future of AI Model Development
The reported use of GPT-6 Astra highlights a difficult problem for leading AI labs: the same models they offer to users can also serve as training material for competitors looking to catch up. This is a fundamental tension in the AI industry. On one hand, companies want to make their models widely available to generate revenue and gather feedback. On the other hand, widespread access increases the risk of distillation and other forms of misuse.
To address this, labs are likely to continue investing in safeguards. These may include more sophisticated monitoring, stricter terms of service, and technical measures like watermarking or output perturbation. However, no system is foolproof. As models become more capable, the value of distilling them increases, and so does the incentive for competitors to find ways around protections.
The competitive dynamics between US and Chinese AI companies are also shaped by geopolitical factors. Export controls, data privacy regulations, and national security concerns all play a role. The report of distillation is just one piece of a larger puzzle. As AI continues to advance, the lines between collaboration and competition, and between learning and copying, will become increasingly blurred.
For now, the AI community is watching closely. The outcome of this particular report and any responses from the companies involved will be telling. Whether it leads to new regulations, technical innovations, or simply more accusations remains to be seen. What is clear is that the race to build advanced AI is not just about who has the best algorithms or the most data; it is also about who can protect their innovations and who can find ways to learn from others without crossing ethical and legal boundaries.