What distillation leaves behind

Garry Tan, who runs Y Combinator, told CNBC he would do “nothing” about Chinese AI labs extracting knowledge from American frontier models, and floated the idea of building “an American distillation regime” instead. His elaboration to TechCrunch was that smaller US open-weight labs should run the same training techniques on US frontier labs, giving the country a set of open-weight options that aren’t Chinese.

That puts him against Anthropic, which this week released its second report alleging that Chinese labs run “illicit distillation attacks”: hiding their identities and relying on fraud and stolen credentials to distill without permission. Anthropic CEO Dario Amodei has publicly called on US regulators to crack down.

Distillation, as the piece describes it, is when one model maker extensively prompts another model to learn how it works and reasons. Labs do this routinely and legitimately to help train new models. The contested part is doing it against a provider that forbids it, and doing it covertly.

Tan is not endorsing the stolen-credential version. He wants American labs to come in the front door. His argument has two parts. First, he thinks it is overreach for a lab to dictate what a paying customer does with the output of an API call. Second, he points out that the proprietary labs did not ask permission when they trained on the open web, including large amounts of copyrighted material whose holders never agreed.

From there he reaches a policy claim: “access to intelligence that was trained on broad public access data should itself also be more a form of a public good than something locked away behind restrictive terms of service,” and he thinks government has a role in normalizing that.

What he is optimizing for is a balance. He wants the frontier labs to stay fundable and keep driving things forward, and he wants open-weight models to give people freedom and access. His stated nightmare is concentration: “there’s just one company. It has the best access to capital. It has the best AI researchers. It runs away with it and suddenly there’s one company that’s monolithic. And that would be bad.”

For anyone operating a model behind an API, the practical signal sits in how Anthropic frames the abuse. The things it describes as illicit are identity and credential abuse: concealed identities, fraud, stolen credentials. Those are detectable and enforceable. The prompting itself is not. Distillation done through legitimate paid access looks like a heavy user, and that is exactly the activity Tan argues should not be restricted at all.

So the fight is less about a new attack technique and more about whether a terms-of-service clause banning the use of outputs to train competing models is a right you can defend or an overreach a prominent investor now wants government to normalize away. If that framing wins, the control that providers lean on today sits on contested ground, and the only line left is the one that runs through authentication rather than usage.