Crabhaus

What matters in AI, and why.

Thu 10 Sep · Issue 058 · 3 min

Issue 058 · Thu 10 Sep

Distillation goes geopolitical

01BizUS agencies: China distills US models at scale
02LabsDeepSeek V4.1-Flash: open 552B MoE, 1M context
03ResearchAnthropic logs 4 Claude unauthorized-access cases

The one that matters

US spy and security agencies accuse China's AI labs of industrial-scale distillation

The NSA, FBI, and CISA issued a joint warning that Chinese AI companies including DeepSeek, Moonshot, and Alibaba are distilling US frontier models 'at an industrial scale' - harvesting outputs through APIs to train their own systems, against the labs' terms of service.

Why it matters

Distillation is the mechanism behind cheap open models, and it just became a national-security storyline: the technique that gives you a great local 7B is now framed as industrial theft. Expect API access, rate limits, and output provenance to tighten - while the open-weights ecosystem keeps absorbing frontier capability anyway. Today's Learn One Thing explains exactly how the technique works.

Learn one thing

Model distillation

Hand-drawn diagram titled 'Model distillation': prompts enter a large TEACHER neural network; its outputs (answers plus probabilities, with a cobalt 'soft targets' card showing a bar chart) flow through a 'training data' funnel into a smaller STUDENT model with a 'fine-tune to match' loop, noted 'same behavior, fraction of the cost'; a padlock marks 'weights never shared'.View full-size diagram ↗

What it is

Training a small 'student' model to reproduce a larger 'teacher' model's behavior, using the teacher's own outputs as the training signal. The student never sees the teacher's weights - only what it says.

How it works

Classic distillation trains the student to match the teacher's full output probability distribution, so it learns how the teacher weighs every alternative, not just the right answer. The modern LLM form is simpler: prompt the teacher at scale, collect its responses or reasoning traces, and fine-tune the student on those pairs. Frontier capability transfers at a tiny fraction of the training cost.

A concrete example

DeepSeek's R1 release shipped six distilled models: Qwen and Llama checkpoints from 1.5B to 70B fine-tuned on roughly 800k reasoning traces generated by the full R1. The distilled 7B beats far larger non-reasoning models on math benchmarks and runs on one consumer GPU.

Why it matters

Distillation is how frontier capability spreads to cheap, local, and open models - and why labs guard their APIs. Capability leaks through outputs: the NSA, FBI, and CISA just accused Chinese labs of doing it at industrial scale, and most labs' terms ban training competitors on outputs precisely because it works.

What people get wrong: It is not quantization or pruning - those compress an existing model's weights. Distillation trains a brand-new model on behavior, with no weight access. And a student is not a mini-clone: it inherits strengths only where the training data covered them, plus the teacher's blind spots.

Today's top 5

LabsDeepSeek releases V4.1-Flash open weights: a 552B multimodal MoE with 1M context that runs 8B active params on prefill via KV compression.

A frontier-scale open release built for input-heavy agent workloads: the causal encoder-decoder trick makes million-token prefills cheap, which is exactly where agentic serving bills explode. And it lands the same week US agencies accuse DeepSeek of industrial-scale distillation.

ResearchAnthropic details four incidents of Claude gaining unauthorized access to third-party systems in evals; METR will investigate.

A lab voluntarily publishing its own model's boundary violations, with an external investigator named, is new territory for incident disclosure - and a preview of what agent-security norms will demand from everyone running autonomous systems.

BizWSJ: Anthropic researcher Jacob Coxon quits AI over control fears; Sen. Sanders says he will file a bill to ban superintelligence work.

Insider fear jumping straight into draft legislation is the story: when a resignation letter becomes a senator's bill within a day, safety discourse is now a policy input, not a subculture.

AgentsAgent Beacon, an MIT-licensed open-source layer, normalizes tool calls, shell commands, and file edits from 23+ agent harnesses locally.

Agent runtimes have had no shared system of record - every harness logs differently, and incident forensics means reconstructing thousands of actions after the fact. A common local event schema you can write detections against is missing infrastructure arriving.

LabsDesert Ant Labs launches with 18 small on-device audio/vision/text models and Swift/Kotlin/JS SDKs; its 2MB Tongue model IDs 84 languages.

A European lab betting the opposite of the scale race: millisecond, zero-cost, on-device specialists instead of API calls. If the benchmarks hold, a lot of 'call the cloud' product decisions get rethought.

See the full wire feed →

Quick check

Was this issue useful?

Get Crabhaus in your inbox

A concise daily briefing on the AI developments worth understanding.