Introduction
It has been reported that the U.S. Department of State instructed its overseas diplomatic missions to raise awareness among foreign governments about concerns that Chinese companies, including the AI startup DeepSeek, have been improperly using U.S. AI models. According to Reuters, a diplomatic cable dated April 24 reportedly instructed U.S. embassies and consulates to discuss concerns with foreign officials regarding the “extraction” and “distillation” of U.S. AI models. Prior to this, a White House official had also released a document accusing China of stealing the intellectual property of U.S. AI research institutions on an “industrial scale.” Meanwhile, the Chinese Embassy has reiterated its position that these accusations are baseless.
This issue is not merely one episode in the broader U.S.–China confrontation. It shows that, in the age of AI, the boundary between “use of technology” and “improper acquisition of intellectual property” is rapidly becoming blurred.
Is “Distillation” Innovation or Free-Riding?
In the context of AI, “distillation” generally refers to a method of using the outputs of an existing high-performance model to train another model to acquire similar capabilities. Technically, it is an effective way to create a smaller, cheaper, and more manageable model. In research and development, it has also been used as a means of model compression and performance transfer.
The problem arises, however, when the original model used for distillation is a commercial AI model developed through massive investment by another company. If a party obtains large volumes of outputs through an API or chat interface, uses them as training data, and builds a competing model in a short period of time, that may go beyond the scope of ordinary use.
Traditional intellectual property rights have primarily protected relatively “tangible information,” such as code, papers, databases, and trade secrets. By contrast, the value of an AI model resides in elements that are difficult to see directly from the outside, such as weights, training processes, response tendencies, reasoning capabilities, and guardrail design. Distillation can become an act of indirectly copying such invisible value through the model’s outputs.
Why the United States Has Turned This into a Diplomatic Issue
What deserves attention here is that the United States has begun treating this issue not merely as a dispute between companies or a violation of terms of use, but as a diplomatic matter. The State Department cable was reportedly intended to encourage foreign officials to share concerns about the extraction and distillation of U.S. AI models. This reflects a movement to position the improper use of AI models as an issue of economic security and national competitiveness.
Behind this is the recognition that AI models are no longer simply software products, but foundational technologies that affect many strategic fields, including the military, cybersecurity, drug discovery, semiconductor design, and industrial automation. If the capabilities of advanced AI can be replicated at low cost, the research and development investments of leading companies and leading countries may be overtaken in a short period of time.
In generative AI in particular, differences in model performance are directly linked to market share and the formation of industry standards. If the capabilities of advanced models are transferred to competing models through distillation, later entrants may be able to approach a comparable level in a short time, even if there are major gaps in R&D spending, computing resources, and talent investment. The reason the U.S. side views this so seriously is that it feels a sense of crisis that the source of AI dominance is being eroded.
However, Proving It Is Not Easy
That said, the issue of AI model distillation is not simple even for the side making the accusation. This is because it is difficult to clearly prove from the outside whether one model was trained using the outputs of another model.
In traditional copyright infringement cases, one can compare the similarity of text or images. In trade secret infringement cases, the issue is often the route of access to confidential information or evidence of unauthorized removal. In the case of AI models, however, the outward evidence may be limited to the fact that a model “gives similar responses” or “shows similar capabilities.” That alone is not enough to conclusively determine that improper distillation has occurred.
For this reason, access logs, patterns of large-scale acquisition, abnormal API usage, repetitive prompting behavior, and traces of reused output data will become important evidence going forward. Intellectual property protection in the AI era requires not only the design of rights themselves, but also mechanisms for recording usage and enabling later verification.
Terms of Use Alone Are Not Enough
Many AI services prohibit the use of their outputs to train competing models through their terms of use. However, terms of use are contractual rules, and they have limitations when dealing with large-scale cross-border use or use conducted through disguised accounts.
Protecting the intellectual property of AI models requires multilayered defenses that combine contracts, technology, operations, diplomacy, and regulation. Possible measures include monitoring API usage volume, detecting unnatural queries, applying watermarking technology to outputs, fingerprinting model responses, strengthening user authentication, and clarifying contractual provisions prohibiting use for retraining purposes.
However, if defenses are strengthened too much, they may hinder legitimate research use and developer ecosystems. For AI companies, striking the right balance between openness and defensibility will become a major management challenge.
Implications for Japanese Companies
This issue is also relevant to Japanese companies. When Japanese companies use generative AI, they need to pay attention not only to the management of input data, but also to how AI outputs are reused.
For example, if a company accumulates large volumes of outputs from an external AI service and uses them to train its own model, it may violate the terms of use of that service. In addition, if a company develops its own products using the outputs of another company’s AI, it may later face intellectual property or contractual issues.
On the other hand, if Japanese companies have their own proprietary AI models or data assets, they also need to prepare for the risk that those assets may be distilled by third parties. What matters is to regard AI models not merely as “completed programs,” but as intellectual property in which the capabilities themselves have value.
The Center of AI Intellectual Property Is Shifting from “Code” to “Capability”
The essence of this news is that the center of AI intellectual property is shifting from source code and training data themselves to the capabilities acquired by the model.
Traditionally, typical forms of intellectual property infringement involved stealing code, stealing blueprints, or copying databases. In generative AI, however, it may be possible to indirectly extract a model’s internal capabilities by submitting questions to the model from the outside and collecting its responses. This fundamentally changes both the object and the means of intellectual property protection.
Of course, not all distillation is problematic. Distillation conducted with proper rights clearance, or distillation performed to improve the efficiency of a company’s own model, is important for the development of AI technology. What becomes problematic is the unauthorized, systematic incorporation, for competitive purposes, of capabilities built through another company’s non-public investment.
Conclusion
The recent reporting on DeepSeek indicates that the competition in AI development has entered a new phase. Until now, competition has centered on building larger models, securing more computing resources, and attracting better talent. From now on, in addition to those factors, it will become important to prevent the capabilities of one’s own models from being taken by others and to ensure that one’s own AI use does not infringe the intellectual property of others.
AI distillation is useful as a technology. Depending on how it is used, however, it can become either a tool for accelerating innovation or a means of eroding intellectual property. The recent U.S. move indicates that the formation of international rules to protect the capabilities of AI models themselves has begun.
Intellectual property protection in the AI era can no longer be discussed only in terms of patents and copyrights. It has become an area where contracts, technical defenses, evidence preservation, international politics, and economic security intersect. What companies need is not only the convenience of using AI, but also a strategic perspective as actors responsible for protecting AI.