Short answer: Is AI model distillation legal? Often, yes—but not automatically. It can be lawful engineering, a breach of contract, or part of a copyright, trade-secret, computer-access, competition, or export-control dispute. The answer depends less on the word distillation than on how the teacher model was accessed, what the student copied, which terms and licences governed, and what the resulting model can reproduce.
Last updated: July 22, 2026
Research cutoff: July 22, 2026
Legal-information disclaimer: This article provides general information, not legal advice. AI, copyright, contract, computer-access, competition, export-control, privacy, and trade-secret rules vary by jurisdiction and facts. Obtain advice from qualified counsel for a real project or dispute.
1. Direct answer: Is AI model distillation legal?
The answer depends on the project.
An engineer can lawfully teach a smaller model to imitate a larger model’s useful behaviour in many settings. The teacher may be the engineer’s own model. Its weights may be licensed for downstream training. Its outputs may contain only unprotected facts, ideas, methods, or functional patterns. A research exception, fair use, fair dealing, or permission from the rightsholder may cover necessary copying.
The same technical process can become much riskier when a company uses fake accounts, borrowed credentials, proxies, or other measures to defeat access limits; ignores a valid no-training clause; builds a corpus from leaked reasoning traces; copies protected expression or weights; or transfers controlled technology to a restricted destination or end user.
That produces the article’s central rule:
Distillation is a technique, not a legal category. A student model may learn unprotected facts or functionality without infringing copyright, while the way its developers acquired the training material may still breach a contract, misuse a trade secret, circumvent an access control, or violate another law.
A responsible legal review therefore asks at least six separate questions:
- Was access to the teacher authorized?
- Did the governing terms or licence permit this use?
- Is the provenance of every output, trace, dataset, and weight file documented?
- Was protected expression or secret material copied, and can the student reproduce it?
- Did anyone evade accounts, credentials, rate limits, or technical controls?
- Do export controls, sanctions, privacy rules, or competition rules change the result?
2. Why there is no universal yes or no
“Was the model distilled?” is the start of the analysis, not its conclusion. A real project is a chain of legally distinct acts:
- obtaining access to a model, API, chat product, public website, output corpus, or weight file;
- generating, scraping, purchasing, or receiving outputs;
- curating those materials into a dataset;
- making temporary or persistent copies during training;
- testing what the student memorized or can regenerate;
- releasing weights, an API, or a competing product; and
- transferring technology, services, or access across borders.
Different claims attach to different links. Copyright focuses on protected expression and restricted acts. Contract focuses on promises and assent. Trade-secret law focuses on secret information, reasonable protective measures, and improper acquisition or use. Computer-access law focuses on authorization boundaries and, in some regimes, bypassed security measures. Competition law asks about market power and exclusion. Export controls and sanctions ask what was transferred, to whom, where, and for what end use.
The governing law also changes the answer. The European Union has a commercial text-and-data-mining exception that can be reserved against. The United Kingdom’s specific mining exception is limited to non-commercial research. Canada relies on fair dealing without an express mining exception. China combines copyright with strong unfair-competition and data-acquisition rules. The United States relies heavily on fact-specific fair-use doctrine and contract law.
One slogan cannot resolve that map.
3. What model distillation means technically
Knowledge distillation is a training method in which a “student” model learns from signals produced by a “teacher” model. Buciluǎ, Caruana, and Niculescu-Mizil’s 2006 “Model Compression” paper showed how a compact model could approximate a larger ensemble using pseudo-data labelled by that ensemble. The term knowledge distillation was later popularized in the 2015 paper “Distilling the Knowledge in a Neural Network”.
For a broader engineering primer, see Kingy.ai’s existing guide to how AI model distillation works. This article focuses on the legal questions that technical primer does not answer.
In a white-box setting, the developer may have the teacher’s weights or internal probability distributions—often called logits. In a black-box setting, the developer may have only prompts and responses from an API or chat interface. Modern variants can use final answers, ranked choices, critiques, tool-use traces, synthetic examples, or hidden reasoning signals where those are available.
The objective is usually not to make a byte-for-byte copy. It is to transfer capabilities, decision boundaries, preferences, or patterns into a cheaper, smaller, faster, or more specialized system. The student may have a different architecture and training recipe.
Security researchers also use model extraction for methods that approximate a target model through queries. The classic 2016 USENIX study “Stealing Machine Learning Models via Prediction APIs” showed that an API can expose enough behaviour to reconstruct useful approximations. Black-box extraction is not the same as copying weight files: the resulting student can imitate some behaviour while using different parameters and architecture. The vocabulary is descriptive: calling an experiment “model stealing” in a paper does not establish the legal elements of theft, copyright infringement, or trade-secret misappropriation.
4. Copyright: outputs, facts, style, copying, and memorization
Copyright is important, but it does not protect every useful thing a model can teach.
Can model outputs be copyrighted?
Sometimes. The answer can depend on the human contribution and jurisdiction.
In the United States, copyright requires human authorship. The U.S. Copyright Office’s January 2025 report on the copyrightability of generative-AI outputs says purely AI-generated material is not protected, while human-authored expression, creative selection or arrangement, and sufficiently creative modifications can be. The D.C. Circuit likewise held in Thaler v. Perlmutter in March 2025 that the Copyright Act requires a human author.
That does not mean every AI output is in the public domain. An output may contain human-authored source material, a user’s protectable contribution, or a protectable compilation. Ownership terms may govern it even where copyright does not. Privacy, publicity, confidentiality, database, and contract rules can apply independently.
Other countries differ. The United Kingdom still has a statutory rule for certain “computer-generated” works, although the government proposed removing it in March 2026. Chinese courts have protected AI-assisted images where a person’s iterative choices supplied sufficient creativity. The EU and Canada continue to centre human creativity, with important questions unresolved.
What copyright does—and does not—protect
In the United States, 17 U.S.C. §102(b) excludes ideas, procedures, processes, systems, methods of operation, concepts, principles, and discoveries from copyright protection. Facts are not owned merely because someone discovered or collected them, though an original selection or arrangement can be protected. That distinction comes from decisions including Feist Publications v. Rural Telephone Service.
Copyright can protect the particular words, images, code, music, or other expression used to communicate those things. It does not generally protect an artistic style by itself, but a work that imitates “style” can still infringe if it copies protectable elements from identifiable works. Courts filter out unprotectable ideas, facts, stock elements, and functional features before asking whether protected expression is substantially similar.
Reasoning needs the same care. An abstract method, conclusion, or chain of logic may be unprotected. A particular written explanation can contain protected expression. Internal reasoning traces may also be confidential or secret even when copyright is weak.
Is training copying?
Training normally involves making copies at some stage. The harder question is whether those copies are authorized, exempt, or fair.
U.S. courts have found some intermediate or analytic copying fair when it was needed to reach unprotected functionality or create a non-substitutive tool. Examples include Sega v. Accolade for software interoperability, Authors Guild v. Google for book search, and Google v. Oracle for a limited functional software reuse in what the Supreme Court called an unusual context.
But “transformative” is not a magic word. Andy Warhol Foundation v. Goldsmith warns that new meaning or aesthetics do not automatically outweigh a similar commercial purpose and an established licensing market.
The AI cases already point in more than one direction:
- In Thomson Reuters v. ROSS Intelligence, a Delaware federal court held in February 2025 that copying protected Westlaw headnotes to train a competing legal-research product was not fair use. An appeal was argued in June 2026 and remained unresolved at this article’s research cutoff.
- In Bartz v. Anthropic, a California federal judge held in June 2025 that using books to train language models was fair use on the record before the court, while retaining millions of pirated books in a central library was not fair use and remained a separate alleged infringement. The court granted final approval to a settlement on July 20, 2026, without an appellate ruling on that fair-use analysis.
- In Kadrey v. Meta, Meta won summary judgment in June 2025 on the evidence those plaintiffs presented, but the judge stressed that evidence of market dilution or substitution could change the analysis in a stronger record.
The Copyright Office’s May 2025 training report similarly treats training as a fact-specific question. Source provenance, purpose, amount, market effect, licensing markets, and the risk of regurgitation all matter.
Memorization changes the risk
A student trained on otherwise lawful signals can still create liability if it reproduces protected material. Teams should test for long matching passages, code, images, personal information, system prompts, proprietary datasets, and other memorized content—not just average benchmark performance.
The legal question is not simply whether teacher and student “feel similar.” It is whether restricted copying occurred and whether the deployed system can reproduce protected expression or other legally protected material under the applicable test.
Copyright, contract, and trade secret are different claims
| Question | Copyright | Contract | Trade secret |
|---|---|---|---|
| What is protected? | Original human expression and qualifying compilations | Promises in an enforceable agreement | Valuable information that is not generally known and is reasonably protected |
| What usually triggers risk? | Unauthorized copying, distribution, adaptation, or substantially similar output | Use outside agreed limits, such as no-training, no-scraping, account, or rate clauses | Improper acquisition, use, or disclosure of secret information |
| Are facts or public behaviour protected? | Facts and ideas generally are not, though their expression or arrangement may be | A valid agreement may restrict use of otherwise unprotected material | Material that is generally known or readily ascertainable normally is not secret |
| Does reverse engineering help? | It can support a functional or fair-use argument; results vary | A contract may prohibit it | Proper reverse engineering is often lawful, but deceptive acquisition can defeat the defence |
| Typical remedies | Damages, injunctions, impoundment; statutory remedies where available | Expectation or reliance damages, injunctions, termination | Injunctions, damages, unjust-enrichment or royalty measures; criminal exposure in extreme cases |
5. Contract law and API terms
A terms-of-service violation is not automatically copyright infringement. It may still create contractual liability.
Model providers increasingly state this directly. Anthropic’s Commercial Terms, effective June 17, 2025, restrict using its services to build a competing product or service or train a competing AI model, subject to the text and exceptions in the agreement. Its Consumer Terms also restrict scraping outside permitted interfaces, safeguards bypass, and competitive model development. OpenAI’s Services Agreement, effective January 1, 2026, and Google’s Gemini API Additional Terms, effective March 23, 2026, contain their own restrictions on competitive model development, extraction, reverse engineering, and safeguards or usage limits.
The exact service, account type, date, incorporated policy, and governing-law clause matter. “The provider says users own their output” does not necessarily answer whether the same user promised not to use that output to train a competitor. Ownership and permitted use are separate questions.
Contract enforceability is not automatic. A claimant may need to show reasonable notice, assent, an identifiable counterparty, definite terms, breach, causation, and recoverable harm. Courts also distinguish conditions on a copyright licence from contractual covenants, and some state-law contract theories can be pre-empted by federal copyright law.
U.S. decisions illustrate the range. ProCD v. Zeidenberg enforced shrinkwrap terms restricting database use. Bowers v. Baystate Technologies enforced a no-reverse-engineering clause. By contrast, ML Genius v. Google held a lyrics-scraping contract claim pre-empted on its particular facts. Those decisions do not yield a universal rule for AI terms.
The usual contract remedies are account termination, damages, and sometimes an injunction—not a declaration that the training technique itself is forbidden to the world. Choice-of-law, forum, arbitration, audit, confidentiality, and limitation-of-liability clauses can be as important as the no-training provision.
Multiple accounts and rate-limit evasion
Ordinary overuse of a paid allowance is different from a planned system of fake identities, credential sharing, rotating proxies, platform switching, or renewed access after revocation. The latter facts can strengthen contract claims and create separate computer-access, fraud, or unfair-competition arguments.
Teams should record which account made each query, who controlled it, what region and endpoint applied, whether automation was allowed, whether access had been revoked, and whether any control was bypassed. A provider’s label—“distillation attack,” for example—is evidence of its position, not a court’s legal conclusion.
6. Trade secrets: secrecy and improper acquisition
Trade-secret law protects information, not merely expression. In the United States, the Defend Trade Secrets Act requires information that derives economic value from not being generally known or readily ascertainable and that the owner has taken reasonable measures to keep secret.
Internal system prompts, hidden reasoning traces, proprietary training data, weight files, unreleased evaluations, routing methods, and confidential safety techniques can qualify if those conditions are met. Ordinary public API behaviour is harder to characterize as secret because it is intentionally exposed to users, though a carefully selected combination of responses or hidden functionality can raise closer questions.
Misappropriation also requires improper acquisition, disclosure, or use. U.S. law expressly says proper reverse engineering and independent derivation are not “improper means.” The Supreme Court has long recognized reverse engineering as a lawful way to discover a trade secret in Kewanee Oil v. Bicron.
But “reverse engineering” is not a talisman. In Compulife Software v. Newman, the Eleventh Circuit allowed a trade-secret theory involving millions of deceptive website queries used to reconstruct a hidden insurance-rate compilation. The case shows why courts may examine acquisition conduct as a whole even when each public query, viewed alone, looks ordinary.
The practical dividing line is often between observing a product under the permissions actually granted and acquiring confidential material through deception, leaks, breached duties, or circumvented controls. Someone who knows that a dataset was stolen or disclosed in breach of confidence may face downstream exposure even if they did not perform the original taking.
7. Computer-access and anti-circumvention rules
Computer-access law is narrower than “the website owner dislikes the use,” but risk rises sharply when technical or credential boundaries are crossed.
The U.S. Computer Fraud and Abuse Act, 18 U.S.C. §1030, covers specified unauthorized access and related conduct. In Van Buren v. United States, the Supreme Court rejected an interpretation that would turn ordinary policy misuse into a federal hacking offence: the key question is whether a person entered parts of a computer system they were not entitled to access, not merely whether they used available information for an improper purpose.
The Ninth Circuit’s hiQ v. LinkedIn decision likewise treated scraping publicly available profiles differently from crossing a permission gate. But Facebook v. Power Ventures found greater risk where authenticated access continued after express revocation and technical measures were evaded.
Those cases do not establish that every multiple-account scheme violates the CFAA. They do show why facts such as credential ownership, access revocation, IP blocks, authentication, regional restrictions, and technical evasion must be separated from a mere use restriction. The U.S. Justice Department’s CFAA charging policy also says prosecutors should not bring cases based solely on violating a public website’s terms of service.
The anti-circumvention provisions in 17 U.S.C. §1201 can apply when a person bypasses an effective technological measure controlling access to a copyrighted work. Courts disagree about how closely circumvention must connect to copyright infringement, and not every rate limit or API key is necessarily such a measure. The analysis is technical as well as legal.
Other jurisdictions use different tests. UK law criminalizes knowingly unauthorized access. Canadian law emphasizes fraudulent acquisition of computer services without colour of right. EU member states implement a directive focused on intentional access “without right” where security measures are infringed. Chinese law and unfair-competition rules can be especially important when technical management measures or platform rules are evaded.
8. Open-weight models and downstream licences
Using open weights can remove black-box access problems, but it does not remove licence analysis.
“Open-weight” means the parameters are available. It does not necessarily mean the model is public domain, approved by the Open Source Initiative, free of acceptable-use restrictions, or licensed for every kind of output training. Kingy.ai’s open-model comparison is a useful technical starting point, but legal review still requires the actual licence. Read the definitions of “model,” “materials,” “derivative,” and “output.” Check attribution, naming, distribution, monthly-user, field-of-use, and acceptable-use conditions.
Current licences illustrate the variation:
- Kimi K2’s modified MIT licence broadly permits use and modification, with an attribution condition for products above a stated monthly-active-user threshold.
- Google’s Gemma terms expressly define model derivatives to include models created by transferring patterns from Gemma outputs, including distillation and synthetic-data methods.
- Meta’s Llama 4 licence permits broad use subject to naming, attribution, large-user, and acceptable-use conditions.
- OpenAI releases its gpt-oss weights under Apache 2.0, alongside a separate use policy.
A restriction aimed only at copied weights may not reach independently generated output data. A licence that expressly defines output-trained students as derivatives may. Some obligations bind redistribution rather than private training. Others condition all use.
As of this article’s July 22, 2026 cutoff, Moonshot had announced Kimi K3 but had not yet released its weights; the company said a weight release would follow. It would therefore be inaccurate to call K3 downloadable or open-weight on that date.
9. Public outputs and public datasets
Public access is not the same as public domain.
A person manually saving a few publicly displayed answers for criticism, research, or testing presents different facts from a company harvesting millions of responses to build a substitute product. Relevant questions include who authored the material, whether the poster had the right to share it, whether the collection preserves protected expression or only extracts facts, what terms applied to the collector, whether personal data is involved, and whether the source reserved text-and-data-mining rights.
Publicly posted model outputs can also have broken provenance. A post may contain copyrighted text reproduced by the model, confidential data pasted by a user, personal information, or an output obtained under terms that limit redistribution. Later visibility does not cleanse the source.
In the EU and UK, systematic extraction can implicate a sui generis database right even where individual facts are unprotected. In the United States and Canada, an original selection or arrangement may be protected even though facts themselves are not. Privacy and consumer-protection laws can create additional duties in every jurisdiction.
Scenario matrix
The following is a screening aid, not a legal conclusion:
| Scenario | Main legal concerns | Illustrative risk | Questions that can change the answer |
|---|---|---|---|
| A user manually saves public outputs | Copyright, terms, privacy | Context dependent | Is the output protected? What terms and reuse purpose apply? |
| A company queries an API at scale using authorized accounts | Contract, copyright, database/extraction | Moderate to high | Do the terms prohibit training or competition? Was automation allowed? What was copied? |
| Accounts, credentials, proxies, or regions are manipulated to evade limits | Contract, computer access, fraud, unfair competition | High | Was access revoked? Which technical barriers were crossed? What was the intent? |
| Publicly posted outputs are collected | Copyright, provenance, privacy, database rights | Context dependent | Did posters have authority? Were mining rights reserved? Is personal or confidential data present? |
| An open-weight model is used as teacher | Copyright and licence compliance | Depends on licence | Does the licence define output-trained models as derivatives? Which distribution and use conditions apply? |
| Internal reasoning traces or system materials are leaked | Trade secret, confidence, contract, privacy | High | Was the information secret? How was it obtained? Did the user know about the breach? |
| Weight files are copied directly | Copyright, trade secret, contract, access controls, export controls | Very high absent permission | Who owns them? Were they licensed? Were controls bypassed or cross-border restrictions triggered? |
10. Leaked outputs, hidden reasoning, and stolen datasets
A leak changes the analysis because availability and authorization diverge.
If an employee, contractor, researcher, or attacker discloses internal reasoning traces, system prompts, evaluation sets, model weights, or proprietary source data without permission, that material may remain a trade secret or confidential information. A downstream user’s knowledge matters: continuing after being told the provenance is suspect can be worse than receiving a file with no reason to know of a breach.
Copyright can apply to expressive material in the leak. Contract can apply to the person who disclosed it and sometimes to recipients with their own duties. Privacy, data-protection, anti-circumvention, computer-access, export-control, and criminal laws may also apply. A public GitHub link, forum post, or file-sharing URL does not itself grant a licence.
The safest practice is to quarantine suspect material, preserve provenance evidence without redistributing the contents, stop training that depends on it, identify applicable duties and jurisdictions, and obtain legal advice. “It was already online” is not a reliable defence.
11. How the law differs internationally
There is no global AI-distillation rule. The following table highlights the most decision-relevant differences without attempting to summarize every national implementation or exception.
| Jurisdiction | Copyright and data mining | Contracts, secrecy, and access | AI outputs | Distinctive issue |
|---|---|---|---|---|
| United States | No express TDM exception; fair use is fact specific | Contract terms can be enforceable; DTSA excludes proper reverse engineering from improper means; CFAA focuses on unauthorized access | Human authorship required | Cases point in different directions on competitive training and source provenance |
| European Union | DSM Article 4 can permit commercial TDM with lawful access unless rights are appropriately reserved; Article 3 separately protects qualifying research | Contracts can restrict Article 4 mining; Trade Secrets Directive protects proper observation/testing in defined circumstances; member-state computer laws apply | Human creativity remains central; autonomous output status unresolved | Sui generis database right and AI Act copyright-policy/training-summary duties |
| United Kingdom | CDPA §29A permits computational analysis for non-commercial research with lawful access; no broad commercial TDM exception | Contract, confidence, Computer Misuse Act, and retained database right matter | Computer-generated-work provision remains in force as of cutoff, though repeal was proposed | Government abandoned its former preferred broad opt-out approach; reform remains unsettled |
| Canada | No express TDM exception; fair dealing can cover research and is assessed on purpose, character, amount, alternatives, nature, and effect | Provincial confidentiality law, Criminal Code trade-secret and computer-use offences, and anti-circumvention rules can apply | No special computer-generated-work rule; autonomous output status unsettled | No EU-style sui generis database right |
| China | No broad commercial TDM exception; copyright exceptions are enumerated and narrower | Contract, trade secret, platform, data, and anti-unfair-competition rules can reach deceptive acquisition or evasion of technical measures | AI-assisted works can qualify where human creative choices are sufficient | 2025 unfair-competition revisions and 2026 platform guidance are unusually specific about data, models, and platform access |
European Union
Articles 3 and 4 of the 2019 Digital Single Market Copyright Directive create text-and-data-mining exceptions. Article 3 covers qualifying research and cultural institutions with lawful access. Article 4 can cover commercial mining with lawful access, but only where the rightsholder has not appropriately reserved the use. For public online content, the directive points toward machine-readable reservations. Contract terms contrary to Article 3 are unenforceable; that override does not extend to Article 4.
Whether a particular output-distillation pipeline is “text and data mining” depends on what it does. The exception does not authorize credential abuse, leaked data, or every downstream reproduction. It also sits beside the EU Database Directive, whose sui generis right can reach substantial extraction or repeated systematic extraction of insubstantial portions.
General-purpose AI providers covered by Article 53 of the EU AI Act must maintain a copyright-compliance policy, including respect for Article 4 reservations, and publish a sufficiently detailed summary of training content. Those duties promote compliance and transparency; they do not decide that any particular item was lawful to copy.
United Kingdom
Section 29A of the Copyright, Designs and Patents Act 1988 permits computational analysis for non-commercial research where the researcher has lawful access. A contract cannot override that exception. It is not a general commercial-distillation privilege.
The UK government’s March 2026 copyright-and-AI report said the current specific mining exception remains limited to non-commercial research and proposed a different reform path. No broad commercial TDM exception had been enacted by July 22, 2026. The retained database right, law of confidence, Trade Secrets Regulations, Computer Misuse Act, and platform terms can independently apply.
Canada
Canada has no express TDM exception. Section 29 of the Copyright Act permits fair dealing for research, private study, education, parody, and satire. In CCH Canadian v. Law Society of Upper Canada, the Supreme Court called fair dealing a users’ right and set out six fairness factors. SOCAN v. Bell Canada confirms that a commercial context does not by itself defeat a research purpose.
No reported Canadian decision squarely resolves commercial LLM distillation. Canada has no EU-style database right, but compilation copyright, contract, confidence, privacy, technological-protection-measure rules, and Criminal Code provisions on trade secrets and fraudulent computer use may apply.
China
China’s copyright exceptions are enumerated and do not provide a broad commercial TDM rule. The Interim Measures for Generative AI Services, effective in August 2023, require covered providers serving the Chinese public to use lawfully sourced training data and foundation models and to avoid infringing intellectual-property rights.
The revised Anti-Unfair Competition Law, effective October 15, 2025, adds important rules for data and platform conduct. It can reach acquiring or using another operator’s lawfully held data through fraud, coercion, avoidance or destruction of technical management measures, or abuse of platform rules. Ordinary, contract-compliant observation is therefore different from deceptive account farming or technical bypass.
Competition, interoperability, and market power
Competition law can limit an incumbent’s restrictions in exceptional circumstances, but it is not a free pass to ignore terms.
EU Article 102, the UK Competition Act and digital-markets regime, Canada’s Competition Act, U.S. antitrust law, and China’s Anti-Monopoly Law all examine exclusionary conduct by firms with sufficient market power. The EU Digital Markets Act creates specific portability and interoperability duties for designated gatekeepers. China’s 2026 internet-platform antitrust guidance expressly discusses access to essential data, models, and platforms.
A no-distillation term is not invalid merely because it limits a competitor. The challenger generally must establish the applicable market-power, necessity, effects, and procedural elements. Security, privacy, intellectual property, safety, and investment can be legitimate justifications. Conversely, an incumbent cannot assume intellectual-property ownership immunizes a broader exclusionary scheme.
Export controls and sanctions
Model access and weight transfers can also be national-security transactions.
An April 23, 2026 White House memorandum, NSTM-4, “Adversarial Distillation of American AI Models”, treats covert capability extraction as a U.S. national-security and technology-protection issue. It is executive-branch policy, not a statute creating a general private-law ban on all model distillation.
In the United States, the Export Administration Regulations can control specified model weights, software, technology, chips, cloud-enabled access, end users, and end uses. Current rules include an ECCN for certain advanced AI model weights and a licence exception with security conditions. Separate sanctions can prohibit dealings with named persons, entities, governments, or regions. The Department of Commerce also revised its semiconductor licence-review policy for China in January 2026.
The EU Dual-Use Regulation, UK strategic export controls, Canada’s Export Control List guide, and China’s Export Control Law and technology catalogues use different lists and catch-all rules. A general-purpose model is not controlled merely because it is AI, but digital delivery does not take weights or technical assistance outside export law.
Screen classification, destination, beneficial ownership, end user, end use, cloud access, sanctions, and any hardware dependency separately. “Open” is not an export-control classification.
12. Case study: Kimi K3 and Claude Fable 5
The 2026 dispute involving Moonshot AI’s Kimi K3 and Anthropic’s Claude Fable 5 shows why public allegations, technical inference, and legal proof must be kept separate.
What has been alleged
On February 23, 2026, Anthropic said it had detected a large-scale campaign by three China-based AI labs, including Moonshot AI. Anthropic alleged that Moonshot generated more than 3.4 million Claude exchanges through hundreds of fraudulent accounts and multiple access paths, targeting capabilities such as reasoning, coding, computer use, and vision. Anthropic characterized the activity as prohibited distillation and described platform-switching and account-evasion methods.
That February campaign must not be conflated with the later Fable 5 allegation. Fable 5 launched on June 9, 2026, was made unavailable on June 12 after a U.S. government directive, and was restored on July 1. Moonshot announced Kimi K3 on July 16, describing a 2.8-trillion-parameter multimodal mixture-of-experts architecture.
On July 22, White House science adviser Michael Kratsios said publicly that the U.S. government had information that Moonshot distilled Fable 5 to develop K3, using sophisticated techniques to switch among platforms. His statement was an official allegation. It did not publish the underlying technical evidence.
Moonshot executives disputed the “distilled copy” characterization in Chinese media reports, pointing to architecture and training innovations including Kimi Delta Attention, Attention Residuals, and a mixture-of-experts design. That is a reported company denial, not an adjudication either.
What has not been established
As of July 22, 2026, no publicly identified court, regulator, arbitral tribunal, or criminal proceeding had ruled that Moonshot illegally distilled Fable 5 or that Kimi K3 infringes Anthropic’s rights. No public record had established which K3 capabilities came from which teacher, what material was retained, what accounts and terms governed the alleged Fable access, whether protected expression or secrets were copied, or what measurable market harm resulted.
Claims that a model calls itself “Claude,” gives similar answers, or resembles a teacher on selected tasks are weak provenance evidence on their own. Such behaviour can result from synthetic data, public examples, mixed teachers, prompt artifacts, common benchmarks, or memorization. A different architecture also does not disprove output distillation; architecture and training provenance are separate questions.
The most accurate summary is:
U.S. officials and Anthropic allege that Moonshot used covert, terms-violating access to Claude outputs in developing Kimi K3. Moonshot disputes the characterization. No court or regulator has yet ruled that Moonshot illegally distilled Fable 5, and the government has not publicly released the evidence supporting the specific Fable-to-K3 claim.
Which legal theories would matter if evidence supported them?
Contract is the most direct theory if valid Anthropic terms bound the relevant accounts and prohibited competing-model training, automation, credential misuse, or safeguards evasion. Computer-access, fraud, and unfair-competition theories would become more plausible if evidence showed fake identities, access after revocation, or technical bypass. Trade-secret claims would require identification of information that was actually secret, reasonably protected, and improperly acquired or used.
Copyright would require proof of protected expression or other restricted copying, not merely capability transfer. Facts, methods, functional behaviour, and general style are not protected as such under U.S. copyright law. A market-substitution theory could matter to fair use, but it would not eliminate the need to identify copyrighted works and acts of copying.
Export-control or sanctions claims would require a separate analysis of controlled items, access, end users, destinations, and applicable rules. Allegations about advanced chips or cloud access should not be treated as proof that model distillation itself violated export law.
The case study therefore supports a modest conclusion: the alleged acquisition conduct could create serious legal risk if proven, but “distillation” remains a technical description rather than a legal verdict.
13. U.S. AI companies and copyrighted training data
The legal principles should apply consistently to incumbents and challengers.
U.S. AI companies have argued that training on copyrighted works can be fair use because models learn statistical relationships and create new tools rather than distributing the source works. Authors, publishers, news organizations, artists, and software owners respond that developers make commercial copies at enormous scale, sometimes from unauthorized sources, can compete in the same markets, and may produce substitutive or memorized outputs.
The first major rulings do not reduce that dispute to “AI training is fair” or “AI training infringes.” Bartz separated transformative model training from an unauthorized retained library. Kadrey turned on the plaintiffs’ evidentiary record while emphasizing possible market-dilution proof. ROSS rejected fair use where a competitor trained from protected headnotes to build a substitute legal-research tool.
That symmetry matters for output distillation. A provider that relies on fair use for its own training can still have valid contract, access-control, trade-secret, or security claims against deceptive querying. But it should not recast every learning of facts or functionality as copyright infringement merely because the learner is a competitor. Conversely, a distiller cannot assume that broad public debate about fair use overrides a no-training promise it accepted or cleanses a pirated or leaked corpus.
A principled position distinguishes rights by source and conduct instead of by company nationality or market position.
14. The strongest argument for restrictions
Frontier models can cost billions of dollars to train and secure. Unrestricted automated extraction could let a rival externalize those costs, reproduce costly capabilities, overwhelm infrastructure, probe safeguards, collect user or proprietary data, and undermine licensing markets. Account farms and platform switching can deprive a provider of the ability to enforce regional, safety, capacity, and national-security controls.
Restrictions can therefore protect legitimate interests: contract expectations, cybersecurity, service reliability, user privacy, trade secrets, safety research, export compliance, and incentives to invest. They may be especially defensible when narrowly tailored to deceptive access, high-volume competitive extraction, secret reasoning traces, or copied weights.
The strongest version of this argument does not depend on owning facts or ideas. It says a provider may set reasonable conditions for a costly private service and prevent users from defeating the mechanisms that implement those conditions.
15. The strongest argument against restrictions
Overbroad restrictions can turn access to facts, functional behaviour, interfaces, and general methods into a private perpetual right that copyright law never granted. They can entrench dominant firms, block interoperability and independent safety testing, suppress research, prevent smaller developers from building efficient alternatives, and make “ownership” of outputs hollow in practice.
Reverse engineering has long supported compatibility, competition, and technical progress. Models also learn from prior human expression and public knowledge; incumbents should not receive broader control over downstream learning than they recognize for upstream creators. A blanket ban on training from any output, regardless of authorization, scale, purpose, or what the student reproduces, can be difficult to justify as a matter of policy.
The strongest version of this argument still does not justify stolen credentials, leaked secrets, or bypassed controls. It asks for proportionate rules: protect genuine expression, secrecy, safety, and authorized access without converting observable behaviour into an unlimited monopoly.
16. Practical risk checklist
Before training on another model’s outputs or weights, ask:
- Authority: Who owns or controls the account, dataset, and weights? Did the actual operator have permission?
- Terms: Which version of which agreement applied on each query date? Does it restrict competitive training, automation, scraping, transfer, reverse engineering, or limit evasion?
- Licence: For open weights, how does the licence define model materials, derivatives, and outputs? What triggers attribution, naming, redistribution, or acceptable-use duties?
- Provenance: Can every training example be traced to a lawful source? Were public posts, user data, and vendor-supplied corpora screened?
- Content: Does the corpus contain protected expression, confidential data, personal information, hidden prompts, reasoning traces, or copied weights?
- Conduct: Were multiple accounts, shared credentials, proxies, regional routing, or technical workarounds used? Was access ever revoked?
- Purpose and market: Is the work research, evaluation, interoperability, compression, safety testing, or a substitute commercial service? What licensing or product market may be affected?
- Memorization: Can the student reproduce long passages, code, images, personal data, prompts, benchmarks, or other source-specific material?
- Jurisdiction: Where were access, training, developers, servers, users, and rightsholders located? Which choice-of-law and forum clauses apply?
- Cross-border controls: Are weights, chips, software, cloud access, technical assistance, destinations, end users, or end uses controlled or sanctioned?
- Competition: Does a restriction involve a dominant firm, gatekeeper duty, essential input, discrimination, or a credible security or investment justification?
- Incident plan: What happens if provenance fails, a provider objects, a leak is discovered, or memorized content appears?
The higher-risk answers should trigger written legal review before—not after—training or deployment.
17. What companies should document
Good documentation cannot make unlawful conduct lawful. It can prevent mistakes, support a defence, and show that the team addressed foreseeable risks.
Maintain a dated record of:
- the business and technical purpose of the distillation project;
- the teacher model, version, endpoint, region, and access method;
- the account owner, operator, credentials policy, and authorization chain;
- every applicable term, policy, licence, reservation, and amendment as it existed when data was collected;
- dataset provenance, hashes, acquisition dates, filtering, exclusions, and retention periods;
- copyright, privacy, confidentiality, database, and trade-secret screening;
- rate limits, automation permissions, blocks, revocations, and responses to them;
- the training method, amount used, alternatives considered, and source-weighting choices;
- memorization, similarity, privacy, safety, and regurgitation test results;
- model cards, release gates, output filters, attribution, and licence notices;
- jurisdiction, choice-of-law, competition, export-control, sanctions, and end-user reviews; and
- approvals, objections, remediation, deletion, and incident decisions.
Do not write “public data” as a substitute for provenance. Record which public source, who posted it, under what terms, and why the proposed use is permitted.
18. Frequently asked questions
Is AI model distillation inherently illegal?
No. It is a technical method. Legality depends on access, terms, licences, source material, copying, secrecy, conduct, jurisdiction, and deployment.
Can a company legally train on another model’s outputs?
Sometimes. Permission, an applicable licence, unprotected material, or a copyright exception can support the use. A valid no-training clause, deceptive access, leaked material, or protected expression can change the answer.
Are AI outputs copyrighted?
Some can be. In the United States, copyright requires human authorship, but an output may incorporate human-authored expression or creative human selection and modification. Other countries apply different rules.
Are facts, ideas, style, and reasoning protected by copyright?
Facts, ideas, methods, and general style are not protected as such under U.S. copyright law. Particular wording, images, code, or other expression can be. A written reasoning trace can also be confidential or secret even where copyright is limited.
Can API terms prohibit output training or model distillation?
Yes, and many major providers include such restrictions. Enforceability depends on notice, assent, wording, governing law, pre-emption, breach, and remedies. Owning an output does not necessarily cancel a separate use restriction.
Is using multiple accounts to avoid rate limits illegal?
It can create high risk, but there is no universal rule that every extra account is a crime. Fake identities, credential sharing, continued access after revocation, and technical bypass make contract, computer-access, fraud, and unfair-competition claims more plausible.
Can publicly visible model outputs be reused?
Visibility alone is not permission. Check authorship, terms, provenance, privacy, database rights, mining reservations, and whether the proposed use copies expression or extracts facts and functionality.
What if model outputs or reasoning traces were leaked?
Public availability does not cure an unauthorized disclosure. Leaked traces, prompts, datasets, and weights can remain protected by trade-secret, confidence, copyright, privacy, contract, access, or export rules.
Does using an open-weight model solve the legal problem?
It can solve some access issues, not all legal issues. The licence may regulate derivatives, output-trained models, attribution, distribution, acceptable uses, or large deployments. Open weights are not automatically public domain.
What is the difference between distillation and model extraction?
Distillation is a broad training method for transferring teacher knowledge to a student. Model extraction usually describes reconstructing or approximating a model through queries. They can overlap. Neither label alone establishes a legal violation.
Can export controls or sanctions apply to model distillation?
Yes. Weight files, chips, software, technical assistance, cloud access, destinations, end users, and end uses may be regulated. General-purpose AI is not automatically controlled, and digital delivery is not automatically exempt.
19. Sources and methodology
This article was researched from primary and near-primary materials current through July 22, 2026: statutory text, regulations, court opinions and orders, government reports and guidance, official provider terms and model licences, company announcements, and attributed statements about the Kimi K3 controversy. Secondary reporting was used where it preserved a public statement or company response that was not otherwise available in an accessible first-party archive.
Key source groups include:
- Technical: Buciluǎ, Caruana, and Niculescu-Mizil’s model-compression paper; Hinton, Vinyals, and Dean’s knowledge-distillation paper; Tramèr and co-authors’ model-extraction study; NIST’s Adversarial Machine Learning taxonomy.
- U.S. copyright: 17 U.S.C. §§102 and 107; the Copyright Office’s AI initiative and reports; Feist, Sega, Authors Guild, Google v. Oracle, Warhol, ROSS, Bartz, and Kadrey.
- U.S. contract, secrecy, and access: the Defend Trade Secrets Act definitions, Computer Fraud and Abuse Act, DMCA §1201, and decisions discussed above.
- Provider terms and licences: Anthropic Commercial Terms, OpenAI Services Agreement, Gemini API terms, Gemma terms, Llama 4 licence, and Kimi K2 licence.
- International: the EU DSM Directive, Trade Secrets Directive, Database Directive, and AI Act; the UK CDPA; Canada’s Copyright Act and Criminal Code; and China’s Interim Measures for Generative AI Services and revised Anti-Unfair Competition Law.
- Kimi K3/Fable 5: Anthropic’s February distillation report, Fable 5 announcement and redeployment notice; Moonshot’s Kimi K3 announcement; and the dated public allegation and denial linked in the case-study section.
Legal conclusions were limited to what those materials support. Allegations were identified as allegations. Technical similarity was not treated as proof of provenance. Proposed laws were not described as enacted. Provider terms were dated where material. The jurisdiction table is a screening comparison, not a substitute for country-specific advice.
Final legal reminder: Do not rely on this guide as legal advice. A real distillation project should be reviewed using its actual accounts, terms, licences, sources, model behaviour, jurisdictions, destinations, and end users.