CSET explains how black-box distillation works and how Chinese labs may use it

What black-box distillation is

According to CSET, black-box distillation improves a weaker student model by using a stronger teacher model's outputs as training material. "Black-box" means the teacher is closed-source and can only be prompted online through a web or software interface. White-box distillation, by contrast, uses information about the teacher's internal processes and requires access to its weights. CSET says that approach is outside the scope of the explainer.

CSET describes the technique as common among AI developers and researchers. It has traditionally been used to compress knowledge and capabilities into smaller student models, cutting their compute and memory overhead. Increasingly, it is also used to elicit synthetic data and transfer capabilities from teachers to students regardless of size.

The five steps

CSET breaks the process into five steps:

• Define the objective and select the student and teacher models.
• Collect seed data to feed into the teacher.
• Steer the teacher toward the desired outputs.
• Elicit synthetic data from the steered teacher by prompting it with the seed data.
• Train the student on that synthetic data using various techniques.

In step one, distillers decide which capabilities to distill and whether the goal is compression or transfer. CSET notes that most published research compresses capabilities from large teachers such as ChatGPT into much smaller students such as Llama-2-13B. Distillers need access to the student's weights, while the teacher only has to respond to prompts, often through paid accounts that let automated programs connect in structured ways.

Step two concerns seed data, which represents the capability (for example agentic tool use), domain (coding) or behavior (instruction following) the student should learn. CSET says simply asking a teacher to generate certain data can yield poor outputs, so seeds help guide it. In the published research CSET reviewed, seeds ranged from as few as 175 human-curated instruction-output pairs to as many as 210 thousand math problem examples drawn from several datasets. They were typically taken from public benchmarks and existing datasets, likely because those are readily available.

The adversarial case

CSET says distillation was relatively uncontroversial until early 2025, when OpenAI accused DeepSeek of breaking its terms of service by distilling from ChatGPT. Several Chinese labs have since been accused of adversarial distillation. A U.S. government joint cybersecurity advisory in September 2026 said Chinese labs are "conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies' models through industrial-scale knowledge distillation campaigns." CSET also points out that U.S. companies such as SpaceXAI have distilled from other closed-source American models.

CSET's key takeaways are that Chinese labs do distill from proprietary U.S. models, accessing them through third parties to obscure their origin, and that the objective is not compression. It cites DeepSeek's R1, which has more than 670 billion parameters, as larger than some teachers it is accused of distilling from, such as GPT-4o. The goal, CSET says, is to improve models further during post-training.

The think tank also stresses uncertainty. It says the amount of synthetic data produced with U.S. models is significant and represents a sizable fraction of the data used to post-train some Chinese models, but the quantity remains ambiguous. Anthropic, OpenAI and Google do not specify how many tokens their models generated during the campaigns, which CSET says they should. CSET adds that it is hard to judge how much Chinese labs rely on distillation because the final training step is not visible.

Why it matters for detection and policy

CSET argues that detection depends on the seeds used. If distillers rely on pre-existing datasets, U.S. companies can more feasibly build classifiers to spot them. Detection is harder if labs use custom seeds or collect exchanges from third-party users. CSET cites accusations that DeepSeek and Moonshot AI rerouted their users' traffic to Claude instead of their own models.

The explainer says this technical grounding is needed to assess the benefits Chinese labs may gain, the feasibility of defenses, whether claims of theft are warranted, and the potential for policy intervention. It also calls on U.S. labs to be more transparent about their internal research into how distillation affects student models.