Yep. 95% AI and 5% "mixed" analysis. Is it a good article? Well, I don't care to check because it doesn't feel like any effort was put into this. For all I know and guess, this was stolen from real humans.
Well the proper analogy would be that you write your programs in assembly. I think the more impressive thing here isn't the ray tracer, but the C (or was it C++?) to brainf** transpiler. That would be equivalent to you writing both C code and the C compiler. Pretty impressive, but depending on the complexity of the program not as impressive as writing whatever it is in assembly directly. A raytracer would be PAIN to write directly in brainf** - I think I'd want to use fixed precision everywhere rather than emulated floating point. (on second glance, it does look like the author of the article is also using fixed precision arithmetic, but confusing the label for the layout of the number with the type of number representation itself?)
Looks like I misunderstood what it meant to be a floating point, and this does match the description of a fixed-point representation.
> Pretty impressive, but depending on the complexity of the program not as impressive as writing whatever it is in assembly directly
I'd make the case assembly is easier here, given the DSL isn't much different in terms of it's experessiveness, and jumping around is easier in assembly too. Registers change the whole thing.
Isn't the entire deal with jev that it is fast? I'd be interested to know how the energy cost of the Qwen-based model compares with Jev. Of course, Jev is currently locked up so we don't know... "Trust me bro Jev is revolutionary and amazing, pay more money for our inferior product which costs more to run, and of which you need to access by sending us the data"
> Distillation attacks, in which attackers use thousands of fake accounts to extract a model’s capabilities at industrial scale, create safety and national security risks. Distillation allows bad actors to create highly capable models without the safeguards we build into Claude. Our September 2026 threat intelligence report details the illicit distillation activity we’ve detected and disrupted so far.
Such a negative tone they put on this. Distillation is amazing, because it means anthropic and openai fail to keep a monopoly. Who even are they who claim it's unethical? If it is truly unethical, then so is the mass data scraping they do on my personal website on a regular basis (without my consent), and all the unauthorized use of content produced by authors, blog writers, wikipedia contributors, and creators everywhere. If it is truly unethical, then anthropic, openai, meta, google... all these companies should have deleted their LLMs long ago. This wording disgusts me.
Heck, it would be amazing if we had more models without guardrails - some of the models that are produced via heretic[1] are actually quite nice to use - in particular, I've enjoyed investigating Chinese censorship by interacting with an abliterated model of Qwen3.8-27b. If security is really a concern, then secure your systems - don't attempt to dumb-down the tools we use. If someone breaks your window, then they are responsible, not the hammer they use to do so.
I'm confused how they have been able to create so much public negative perception around distillation. It seems pretty clear that they are the only ones who lose out, and everyone else benefits. I don't have any ethical issues with it, nor is it illegal: at worst it's a ToS violation.
IMO the biggest problem with distillation is that not enough people are openly doing it. I would love to see more small, competitive US labs instead of having the eggs in 2~4 baskets (depending on how you count).
The issue with distillation is: one lab spends $$$ on bleeding edge R&D and expensive RL runs to improve capabilities, and other labs just yoink the raw reasoning traces and mid-train/post-train on them to get 90% of the way there for a small fraction of the cost.
An even smaller fraction of the cost if they do it by buying AI access at as much of a discount as they can find, including black market resellers, and then reselling that access to paying users again with a proxy. As is common.
This gives ruthless "fast followers" an economic edge over the innovator that's putting in the real work.
The dynamics are very much alike to what patents and copyright law are supposed to prevent. Same type of "we took the products of your work and used them to undercut you". Except there are no laws against distillation - so most of the enforcement happens on model provider level.
There's an implication that other companies are improving because they're scraping Anthropic, not because they're investing in better architecture, compute efficiency, or their own synthetic data pipelines. I often see Chinese labs' progress dismissed as "they just distilled Anthropic" and I find it hard to reconcile that with all of the interesting research and open-source tooling that they release.
Is there actually that much capability transfer from non-logit-matched distillation, or is Anthropic just another unwilling source of data?
There is, in fact, "that much capability transfer from non-logit-matched distillation".
Even the early papers on distillation techniques found that surprisingly small distillation datasets can improve task performance noticeably on some specific task types - and that valuable adaptations like SFT/RLHF instruction following can be distilled from one-hot non-logit traces.
A big part of what distillation really gets you is: paving over the mismatch between pre-training and final performance. A base model is trained to spit out fitting text, but not to instruction follow, reason autoregressively, self-check or use tool calls - like an AI has to. There is transfer straight from the "text prediction" pre-training objective, and pre-training sets the foundation for all that follows - but the capabilities you get "out of the box" with it are often unrefined and fragile. Which makes some sense - internet text doesn't often include raw chain-of-thought autoregressive reasoning. It's not the kind of thing humans tend to write.
Reasoning traces? They let an AI learn proven techniques and adaptations directly, from an AI that was already taught "how to be an AI" in other ways.
It's why this kind of distillation typically plugs into mid-training and post-training, not pre-training.
Now, I'm not saying that all Chinese companies do is eat tokens, distill and lie. That just isn't the case. They developed or refined numerous training techniques and architectural adaptations - like deep fusion for high performance visual input, RLVR with GRPO, trunked MoE, storage-efficient and bandwidth-efficient attention formulations, or residual routing techniques like AttnRes. Some of those are used widely now, and some are still on the uptake but show good promise.
But Chinese labs are enjoying massive efficiency gains from being able to distill from the frontier instead of doing things the hard way. It's a leg up. It lets them put their supply of R&D effort and RL compute elsewhere. They wouldn't be nearly as advanced if they couldn't do it.
> one lab spends $$$ on bleeding edge R&D and expensive RL runs to improve capabilities, and other labs just yoink the raw reasoning traces and mid-train/post-train on them to get 90% of the way there for a small fraction of the cost.
"You're trying to kidnap what I've rightfully stolen."
This is a great post and I agree with you on the issues with distillation. I do still feel it's ironic for an AI lab.
As long as labs do not heavily kneecap model outputs, practically all this applies to the training corpus as well.
AI gives ruthless users of AI a leg up over the people who's data it was trained on. "We took the products of your work and used them to undercut you". It's all the same.
The only way I'd be against distilling would be if AI models became owned by the public who's work is used to create them. Of course the AI labs should be paid well, but these models are a product of the entire world's efforts, not only the labs.
I'm fine if they put preventative measures in place to protect their work. They already do so. I am NOT fine with their mass manipulation of public opinion to fuel an entirely hypocritical viewpoint. Like, any argument here is hypocritical - but they aren't saying what is REALLY HAPPENING ("distillation steals our work and reduces our profits"), and are actually saying words that make other people fight their battle ("national security", etc).
The workarounds used to bypass Anthropic's security measures are quite illegal. They use stolen credit cards, API keys, and accounts. That is only possible in China because any other US/EU lab doing the same would get into massive legal trouble.
That's the moat. Mistral has the capability but not the legal protections.
Yes but Claude is filtered by the Great Firewall. Anthropic also restricts Chinese access. Their security measures aren't bulletproof but they do catch a substantial amount of those accounts and ban them. That's why PRC labs that distill from Claude need thousands.
Hah. Anthropic and OpenAI used plenty of similarly illegal workarounds to obtain data to create their first models. If a Chinese company had done that first you'd be here saying
> That is only possible in China because any other US/EU lab doing the same would get into massive legal trouble.
Let’s not kid ourselves, Anthropic would be running their own distillation “attacks” too if _they_ were the ones playing catch-up. They’ve already shown as much with their illegal scraping of pirated books ($1.5B settlement).
I say just let them duke it out. After a decade of regulatory capture and enshittification, it’s nice to see some actual competition again.
> Anthropic would be running their own distillation “attacks” too if _they_ were the ones playing catch-up
Probably. But if OpenAI or Anthropic stole your credit card to purchase tokens you could sue them. You won't get a cent from any Chinese labs.
> it’s nice to see some actual competition again.
Competition benefits everyone. But this isn't fair competition. A German startup cannot legally do any of these tactics required to bypass Anthropic/OAI's counter-measures. Which makes EU less competitive and therefore less investment in European AI.
I said it in my original comment. That is the moat. The reason frontier AI is a two horse race. European labs cannot gain ground because the only way to do it is illegally.
Your original comment painted it as a China moat against US/EU labs. Completely different from instead being a unique disadvantage to EU labs by which the US labs, among others, aren't really affected.
Spymarks just seem like another word for https://en.wikipedia.org/wiki/Steganography. On that note, one way we can prevent it is to assert that all our content is byte-for-byte identical with the last known trusted stage of what we have produced (for example: a camera we are certain does not watermark, an image editor we are certain doesn't watermark, an image compressor we are certain can't watermark, etc). One vector that I am particularly concerned about is social media. Most images and videos uploaded to most social media is re-compressed by the target platform. This is a door to tracking that is far too easy for social media platforms to open. They might rationalize it (if discovered/announced) by saying that our memes won't be reposted, images or work stolen, etc... but honestly I'd rather my work be stolen than tracking information inserted in there. Oh, we also have stuff which is way more secure, like time-stamped cryptographic signatures.
Spymarks an application of steganography, not a different name for it.
> On that note, one way we can prevent it is to assert that all our content is byte-for-byte identical with the last known trusted stage of what we have produced
That doesn't help with things like the typical use of SynthID where the spymarking is done by the same process generating the content, so there is never a clean comparator. (It also wouldn't be useful anytime it is inplemented as part of a transformation—compression, etc. —step, for the same reason.)
You can verify the absence of any particular mark if you have sufficient information about the mark, but, you are right, the whole reason spymarks are steganographic is so that they can escape detection absent that information, which is important for the spying-on-the-user use case.
When someone else controls distribution, they also control the spark, each request could serve up a different payload. So innocuous images could encode ids, tracking receivers as well as originators.
> ... particularly concerned about is social media. Most images and videos uploaded to most social media is re-compressed by the target platform. This is a door to tracking that is far too easy for social media platforms to open.
This has been going on for a while with Facebook. They seem to embed custom metadata tags so that images shared outside the platform can be traced back:
I actually wrote a library to do stego with LLM outputs last year and it turned out to be an almost exact implementation of the Anthropic watermark algo.
Repo here https://github.com/sutt/innocuous. It works with last year's llama.cpp. Check out the "Use Cases" and "How it works" sections in the readme if you're interested.
This is a straightforward example of how the positive or negative valence of a piece of tech depends entirely on how it's used.
You just need to address three questions:
- who controls what information is going in? (that is, what is the process by which the tech companies who control all the tech are using it)
- who controls what information is coming out? (that is, is the steganographic format open enough that anyone can read it, or does it depend on having a key)
- what legal regulation is this subject to? (does sneaking individuals name and address into their photographs incur you massive GDPR liabilities when it is discovered?)
The vulnerability of steganography is that is has to pretend that signal is noise. Remove the noise - and the signal is gone. I'm pretty sure that the simplest gaussian blur will remove the spymark from any picture.
Or... add some noise. Just align the last bit of every pixel channel with a random bit sequence - and Bob's your uncle.
"just" yes, you "just" have to do it every time. and so does everyone else.
sadly we live in a society of comfort, where people do not even remove the trackers from links, so why would you expect they add a blur to images...
I tried both options, and both options visibly* degraded quality while failing to remove my hidden message. Consider that good schemes are already designed to be resilient in the face of lossy image compression, which is a lot more disruptive than the things you suggested.
* the 7-bit quantization + 1-bit noise option not by much, but still, visible
Does it even matter if it distills other models? ethically no, because the information was originally stolen from us users... it is indirectly harming anthropic if it is happening, but who cares? It is better for everyone except anthropic that anthropic doesn't have a monopoly.
A very cool project, but of course not perfect. I'd rather have 30 megabytes of phrases mapped to the perfect and correct control changes in a home, rather than a heuristic built around 30 megabytes. I tried to "warm the house" (increase the temperature of the thermostat), but the model actually turned the lights to a "warm brightness" - reasoninig being `"'warm the house' -> set_lights to warm brightness. No specific room given, so use default 'living room' as default."`
Thank you fr this. "warm the house" now goes to the thermostat. It's fair that a more deterministic system with just action phrases would be easier to debug/interpret, but I think there is room for both a model that is trained to understand meaning as well as deterministic logic aiding it. To this end, we just started exploring the idea of triggers, and are working towards expanding this even more.
