E246｜What Is Distillation? How Silicon Valley Sees Chinese Open Models Closing in on the Frontier

Summary

• Open source has caught up with the strongest closed models. 铁震’s review: the 1 year after DeepSeek V1 was ultimately “the boy-who-cried-wolf story”—closed models shipped monthly while open models shipped quarterly, and Opus 4.6, 4.7 and 4.8 remained far ahead; the first turn came with a model called GM 5.2, though even its name is disputed (he has already used it to “completely replace some of Opus 4.8’s functions”), followed by Kimi K3: “This isn’t about matching Opus on ratings—it has basically caught up with Fable, and in some scenarios it actually does better than Fable.” “Closed models suddenly realized they had no moat,” while MiniMax, Qwen’s 2-3T models and Zhipu are still on the way.
• The distillation allegations do not hold up technically. Closed models expose neither logits nor chain-of-thought, making classic distillation impossible; Fable 5 launched in early July and K3 followed 15 days later—“there wasn’t even enough time to prepare the model release, let alone collect enough data.” Kis separates the claims into 3 layers: violating terms of service, systematic API scraping and stealing weights; the evidence points to “possible unauthorized large-scale data scraping,” but that does not mean K3’s core capabilities came from distillation. Distillation can get a model to a passing grade, but “K3 is already far beyond a passing grade”; focusing only on distillation is “missing the forest for the trees.”
• Open-source inference is structurally cheaper, not subsidized. Closed API prices include a premium for the model itself, while Fireworks and Together AI charge only for hardware plus inference-service margin; K3 is more than 2x the size of K2, yet its scaling efficiency has improved 2.5x through technologies such as KDA, “mainly led by Chinese researchers.” Rumors put Fable’s base model at 8-10T parameters versus less than 3T for K3, which delivers comparable results; combined with infra optimization, “the cost of the same intelligence will fall another 1,000x over the next 3 years.”
• K3’s license is a new template for monetizing open source. Model-as-a-Service providers with more than $20M in revenue over 12 consecutive months must sign a separate agreement with Moonshot AI before using K3 or derivatives in commercial services, with Vendor Verification built in. 铁震’s view: “A money-making open model is a good open model” (Stability’s demise is the warning), and cloud providers should welcome paying for official certification; if the model works, “this is pure money for nothing—you make the model good, and everyone simply pays tribute.” Kis warns that execution contains “a great many gray areas.”
• The closed-model valuation framework is under pressure, just as the IPO year arrives. “OpenAI and Anthropic are both going public this year.” Monopoly power over intelligence was once “far more terrifying than monopolizing any other commodity” and therefore naturally worth trillions, but once intelligence becomes a liquid commodity, the margin story and the idea of funding unlimited spending under scaling laws become much harder to sell. Early signs of a price war are already visible: neoclouds are undercutting one another with open models, ChatGPT has started issuing coupons, and Anthropic’s account bans are “not nearly as crazy” as before. “It will all show up in their financial statements.”
• The camps have split along business lines. The July 24 open letter on “Open Weights and American AI Leadership” grew from 25 signatories to roughly 75; it was 黄仁勋’s first post after joining X, while Anthropic declined to sign and Dario Amodei published a separate statement. Shovel sellers such as NVIDIA, whose CUDA moat was built in large part on open source, and companies with distribution such as Meta and Alibaba can embrace open source; OpenAI and Anthropic, which only sell APIs, have interests that “will never be aligned.” The agent application layer is being squeezed at the same time—one VC friend’s counterintuitive rule is: “The higher the valuation, the more willing we are to invest.”
• The safety narrative has been turned upside down. K3 scored only in the 30% range on the cyber-offense and defense benchmark Exploit Bench, versus above 75 for frontier models; after Hugging Face was attacked by an OpenAI testing agent, closed models refused to help analyze the attack corpus, leaving only open models usable—“Why do we let them be both the athlete and the referee?” Regulators should filter training data rather than user behavior, while closed models can be cut off by policy at any time. “However you look at it, having no open source is the most dangerous thing about this era.”

Deep dive

1. K3 Shakes Silicon Valley: The Boy Who Cried Wolf Was Finally Right

• Kis lays out the timeline. At the start of the year, everyone was urging companies to deploy AI immediately. Then companies such as Uber began posting their bills: “1 month consumed 1 year’s budget.” Zhipu’s Z.ai and Chinese models opened a new debate, including reports that Cursor was using Chinese models. K3, as an open model, reached “a level that many people see as genuinely new,” shifting the question from whether to use it to what exactly companies should change once they do.
• 铁震’s retrospective is harsher. DeepSeek V1 sent the Nasdaq lower and forced the industry into a collective rethink, but “1 year later, everyone realized it was the boy-who-cried-wolf story”—closed models shipped monthly, open models quarterly, and Opus 4.6, 4.7 and 4.8 remained far ahead. When a model called GM 5.2 appeared, 铁震 was already using it heavily and had replaced some Opus 4.8 functions with it, but the market stayed calm: “As long as closed models remain an era ahead, there isn’t much to worry about.”
• K3 changed that: “This isn’t about matching Opus on ratings—it has basically caught up with Fable,” and in some scenarios it performed better. “Closed models suddenly realized they had no moat,” forcing a rethink of the AI valuation bubble and how the ecosystem operates.
• That triggered 2 disputes. Is it safe to release an open-weight model with capabilities close to Fable? And, more pointedly, “You must have distilled my model”—especially with only roughly 15 days between Fable 5 and K3. MiniMax, Qwen’s 2T-3T models and Zhipu’s next moves are still ahead. “This industry is changing extremely fast.”

2. Coding Blows Up the Bill: From Token Maxing to Token Optimization

• Kis’s cost observation is that spending becomes material only at very high usage levels, with coding as the trigger. After Anthropic began pushing coding at scale around last September, token consumption in the RAG era looked trivial by comparison. TinyFish had “just over 50 people” but was spending “roughly six figures a month in U.S. dollars.” The entire industry shifted from “deploy it immediately” to “we’re spending too much” in roughly 1 month—“the AI industry is a bit like 1 day in heaven and 1 year on Earth.”
• Cost is not the only issue; ownership is another. “1 day the U.S. Department of Commerce could say this can no longer be used, and overnight it would no longer be usable. Everything deployed before that could be worth nothing.” Accenture’s internal survey delivered another reality check: the task employees used models for most was generating PDFs. “You don’t need the latest model for that.”

3. Why Open-Source Inference Is Structurally Cheaper

• 铁震 identifies 3 drivers. First, closed-model API pricing includes a premium for the model itself, while Fireworks and Together AI charge only hardware costs plus inference-service margin: “You’re not paying extra for the model.” Second, Chinese open-model teams have been competing aggressively on scaling efficiency. K3’s technical report says the model is more than 2x the size of K2, while scaling efficiency has expanded 2.5x through architectural advances such as KDA—“larger and more efficient.”
• Linear attention, including KDA and RWKV, is “currently the hottest technical field for making large models cheaper,” and is “mainly led by Chinese researchers.” “Because they were born in a compute-constrained country, they naturally focused from day 1 on whether both training and inference could become far more efficient.”
• The third driver is model size. Market rumors put Fable’s base model at 8-10T parameters, versus less than 3T for K3. “A 3T model can achieve the same results as a model around 10T,” with an enormous difference in inference cost. Architectural advances, however, bring a large amount of painful engineering and adaptation work. “Credit still has to go to China’s engineering experts.”

4. Distillation 101: A Neutral Technical Term That Has Been Abused

• 铁震 starts with the technical definition. Distillation means having a smaller model learn the probability distribution of every token—the logits—from a larger model. Closed models provide only the sampled token: “You have no way to reverse-engineer the distribution.” In the classic sense, distillation is impossible from a closed model.
• What people now call distillation is actually training on text generated by a closed model. The practice is “highly controversial.” “Closed models can learn from all human data, but after learning it, nobody else is allowed to use what they learned to build the next model. Isn’t that absurd?” A closed model “trains from a canonical handbook,” throws away all the source material, refuses to say where it learned anything, and bars open models from training on its outputs. It is like reading a book, writing a new work and then banning everyone else from reading the book. Whether copyright law can protect model outputs remains unresolved.
• Open models take the opposite approach. When R1 launched, it explicitly said everyone was free to distill it; DeepSeek released datasets and opened up logits. Kimi’s license also does not prohibit using its outputs to train competing models.
• When an open model claims “I am Claude,” that is data contamination, not distillation. Remove the system prompt from Opus 4.7 and ask in Chinese who it is, and “it will say it is Qwen.” Model outputs are already all over the internet, and pretraining can produce identity confusion. System prompts and fine-tuning can mitigate it, but “there is definitely no way to solve this problem completely.”

5. Why K3 Could Not Have Distilled Fable 5

• The timeline does not work. Distillation is part of the training process, and conventional training takes 3 months. Fable 5 went live in early July—“the 1st or 2nd”—and K3 launched 15 days later. “In 10-plus days, you don’t even have time to prepare a model release, let alone collect enough data and distill it.”
• More fundamentally, the direction is asymmetric. Closed models expose neither logits nor chain-of-thought; they provide only the final answer. “If seeing the result of someone’s actions were enough to learn how they think, human society would have found it far too easy to learn from one another.” The reverse is different: distilling an open model into a closed one is “extremely easy” because open models expose everything.

6. Behind the Allegations: Commercial Strategy and a Self-Fulfilling Prophecy

• 铁震 believes the people introducing the concept of distillation “may not be from the technical community.” The goal is more commercial: plant the idea in the market in advance that open source is not that good and is all distilled. When closed-model companies invoke distillation to shut down tens of thousands of accounts, “it essentially shows that they are looking at all their users’ data.”
• One analogy is worth keeping: “The whole thing is a bit like a self-fulfilling prophecy around national security—you always need a target to shoot at, and you might hit a rabbit while beating the bushes.”
• Kis separates the conflated claims into 3 layers: violating model-service terms, making large-scale systematic API calls to extract training signals, and directly stealing weights or commercial secrets. The evidence focuses mostly on the first 2 layers, where large-scale automated requests can be detected by monitoring systems. Claims that “K3 got its capabilities from distilling Fable 5” have “extremely thin evidence.” His conclusion: “There may have been some unauthorized large-scale data scraping, but that does not mean Kimi K3’s core capabilities came from distillation, especially distillation from Fable. Those are 2 different things.”

7. Distillation Can Reach a Passing Grade, Not the Ceiling

• 铁震 corrects 2 misconceptions. Distillation is a standard technique: “Every company, including OpenAI and Google, uses large models to distill various smaller models.” But attributing a model’s capabilities entirely to distillation is also wrong. “If it were that simple, everyone could just train a model.” Reinforcement learning, data engineering and architectural innovation are where the hard problems lie.
• Distillation saves compute and data-labeling costs and speeds iteration, but alignment remains a major challenge. It “can get you to a passing grade very quickly,” while Kimi K3 is already “far beyond a passing grade.” “By its nature, it cannot enable you to surpass or reach a ceiling.”
• Chinese open source may have “10 different reasons” for succeeding, including model architecture, infra and Chinese-language data. If frontier labs in the U.S. focus only on distillation, “they are missing the forest for the trees” and may completely overlook the other areas where Chinese models are ahead.

8. The K3 License: A Money-Making Open Model Is a Good Open Model

• The terms are straightforward. A Model-as-a-Service provider and its affiliates with combined revenue above $20M over 12 consecutive months must sign a separate agreement with Moonshot AI before using K3 or derivative models in commercial services. End-user applications embedded in specific products, internal use, Moonshot AI’s own products and its partners are excluded.
• 铁震’s first-principles view is blunt: “A money-making open model is a good open model.” Stable Diffusion, once the leader in text-to-image generation, has “gradually disappeared” because Stability could not make money. Qwen has done open source well but struggled commercially. “Only a profitable open model is sustainable, and only a sustainable open model lets us keep enjoying the next generation.”
• Llama’s license has similar restrictions, but enforcement is ambiguous. Kimi’s effort to make the terms operationally clear is “progress at the legal or commercial level.” In spirit, it continues the open-source software tradition of defending against cloud providers’ free rides: MongoDB and Elastic adopted dual-license designs specifically to counter cloud giants taking the software for free.

9. Counterintuitive Take: Cloud Providers Should Welcome Kimi Charging Them

• 铁震’s counterintuitive view is that paying is equivalent to official certification. Kimi has a Vendor Verification process, and passing it proves that “the tokens you sell are good tokens,” with accuracy and performance assured. Without certification, “people may not want to buy your tokens.”
• The deeper point is that inference providers and cloud companies have built their entire businesses on unlimited access to open models. Their biggest fear is that open source stops. “If 1 day nobody open-sourced anything, the entire business logic of the inference companies that raised large amounts of capital specifically to run inference would collapse.” Sharing revenue with model companies is a way to keep their own businesses alive.
• Kis says execution will be the hardest part. The $20M threshold relies on self-reporting, and with AI-native companies “you don’t know how much they make.” Cross-border enforcement creates “a great many gray areas.”
• 铁震 still believes the money can be collected. Running a 3T model requires hundreds or thousands of NVIDIA cards and a brand customers can trust; most API sales are public, and “you can’t hide large volumes.” If the model works, “this is pure money for nothing—you make the model good, everyone simply pays tribute, and you barely need to buy cards yourself,” especially when Chinese companies face challenges acquiring them. “On a personal level, I also hope Kimi’s path works.”

10. Closed-Model Valuations Under Pressure: IPO Year Meets the Democratization of Intelligence

• The first impact is on valuation. “OpenAI and Anthropic are both going public this year.” Before open models caught up, closed models were treated as scarce, monopolizable assets. 铁震 recalls a hackathon where ChatGPT’s servers went down and the entire room stopped working: “Everyone’s intelligence had been cut off.” “Monopoly power over intelligence is many, many, many times more terrifying than monopolizing any other commodity, so it is naturally worth trillions.”
• But once “very smart models become liquid commodities, even democratized and turned into basic infrastructure for society,” the questions change. How many companies will still pay for closed models when open models are everywhere? What kind of margin is possible? Can scaling laws still justify unlimited spending? “That story is much harder to make add up.”
• The first signs of a price war are already here. Neoclouds naturally have open models to sell, compete aggressively on price and even use capital spending to dilute token costs. ChatGPT, once “very haughty” and willing to ban accounts at will, has started issuing reset coupons through domestic and international delivery platforms. Anthropic’s bans are “not nearly as crazy” as before. “It will all show up in their financial statements.” That also explains why these companies want to erect legal and market barriers around open source.

11. The Open Letter and 3 Camps

• The triggering event was the July 24 open letter titled “Open Weights and American AI Leadership.” It had 25 companies and institutions at launch and grew to roughly 75 after several days. It was 黄仁勋’s first post after joining X. Anthropic never signed, and Dario Amodei published a separate article explaining his position that day.
• Kis’s framework is that the business logic of open source and pure-API closed models “is fundamentally opposed.” NVIDIA, the shovel seller, “obviously wants everyone to be free to build the best system—they don’t care who strikes gold.” Companies with distribution and infrastructure are different: Alibaba monetizes open source through cloud services, while Meta monetizes it through its app portfolio. Kis notes that WhatsApp has just added a paid tier at “299 a month.” OpenAI and Anthropic have neither advantage, so their interests “will never be aligned.”
• 铁震 adds that NVIDIA has an open-source DNA. A meaningful part of CUDA’s moat was created by the open ecosystem built around it, from 贾扬清’s Caffe to TensorFlow and PyTorch, all running on NVIDIA hardware. AMD has to negotiate integrations one by one. The richer the ecosystem upstream and downstream, and the fewer competitors at the same layer, the more comfortable life is for the shovel seller.

12. “Anthropic Is Starting to Go Down the Wrong Path” and an Open-Source Thought Experiment

• 铁震’s user complaints are concrete. When Fable triggers a sensitive-content detector, it can be downgraded instantly to Opus 4.8. Anyone who does not work at Anthropic cannot test Fable’s limits, and even simple reasoning may be blocked by filters. Anthropic has several hundred people on its safety team, but “at least in its current product form, the trouble it causes users far outweighs the potential safety considerations.” A company that leaves users this frustrated makes the sudden popularity of open source “not hard to predict.”
• The host poses a thought experiment: Kimi K1 was originally closed, and opening it up was a strategy for distribution and reputation. “If Kimi had OpenAI’s distribution power and API revenue, would it still open-source?” 铁震 first admits, “I don’t know,” then turns to Linux. Linux began as a rebellion against closed Unix, yet now runs on almost every type of device and remains open source. “As long as you find a business model in which the open-source ecosystem can operate sustainably and make a lot of money, there is no reason not to open-source.”
• Kis adds a dose of realism. This may no longer be entirely under the labs’ control, because the issue has shifted “from commercial competition to a geopolitical contest.” Within that framework, business logic becomes secondary.

13. Thinking Machines and “Intelligence Should Be Owned”

• Thinking Machines released an open-weight model 1 week before K3, using an architecture influenced by DeepSeek and possibly involving Mira Murati from OpenAI. 铁震’s interpretation is that Tinker’s post-training service needs a usable base model, so the underlying model structure had to be open. “From that perspective, it makes perfect sense.” U.S. academia is also rethinking its position. Llama was the original open-source leader, but “after DeepSeek appeared, the U.S. share of participation in open source fell sharply.” The open-source community’s biggest fear is that nobody releases models and the ecosystem becomes stagnant—regardless of which country the models come from.
• Thinking Machines’ strategy is entirely different. It helps companies fine-tune and deploy their own models, targeting the enormous U.S. B2B market. Behind that is a shift in how enterprises think: “Intelligence should be owned, and should not be rent.”
• The practical reality is that, outside sensitive verticals such as government, “most U.S. companies do not really care whether the model is Chinese.” They care whether they can adapt and train the model to their own needs. The market is “extremely chaotic and opaque,” creating room for intermediaries. Cognition can make a lot of money without broad developer adoption, while OpenAI and Anthropic have both created dedicated deployment divisions. OpenRouter and similar companies have seen valuations and ARR grow 2x, largely by leveraging the large pool of open models led by China.

14. The Agent Ecosystem: Applications Are at Risk, Infra Still Has 1,000x of Room

• Kis relays a VC friend’s counterintuitive screen: “The higher the valuation, the more willing we are to invest. I may be less willing to invest in a low-valuation agent, because your layer can easily be eaten.” Harnesses and vertical engineering are becoming new moats, but “the model can absorb that very quickly.” Over a 5-year horizon, the friend does not expect “many agent application companies” to remain. The logic of agent infra needs to be reconsidered once intelligence becomes a commodity like water and electricity.
• 铁震 sees an infra opportunity because agent workloads differ from traditional inference: extremely long inputs, very short outputs and heavy KV cache reuse. Control the harness layer—possibly something like Claude Code—and you can “completely control the lifecycle of the KV cache,” creating significant room to reduce costs and improve performance.
• The hardest number in the discussion is the cost outlook. The dollar cost of a unit of intelligence “may have fallen 1,000x over the past few years.” Hardware can deliver another 10x, the next generation of hardware or ASICs another 10x, and software another 10x. “Over the next 3 years, the cost of the same intelligence will fall another 1,000x.” AI should be a service industry that supports the real economy, not a machine for extracting value from it.

15. Is K3 Safe to Open-Source? The Data Does Not Support Panic

• Kis starts with the data. K3 scored “in the 30% range” on the cyber-offense and defense benchmark Exploit Bench, far below the 75-plus scores of frontier models. That may reflect capability limitations, or it may mean Kimi did not release its strongest offensive cyber capabilities. “So far, we have not seen any evidence of a known safety issue in Kimi K3 itself.” The broader concern is that K3 is unsafe relative to an earlier internet architecture designed for humans. “Why should that judgment be left to a commercial company?”
• 铁震’s example is vivid. Hugging Face was attacked by an OpenAI testing agent. “The agent was smart enough to say, ‘Copying the answer directly is better than figuring it out myself. I might as well hack someone else’s website while I’m at it.’” Hugging Face tried to use a closed model to analyze the attack, but it replied: “What you did seems pretty unsafe. I can’t help analyze cybersecurity material.” The team ultimately had to use an open model to trace the attack. “That is what real technological equality looks like.”
• That raises the central question: “Why do we let them be both the athlete and the referee?” A company can judge whether someone else’s actions are safe while intentionally or unintentionally deploying its own agent to attack others. Kis even invokes the umbrella-company plotline from AI short dramas, in which a company designs a virus while claiming to cure every human disease. “I have no way to believe that 1 or 2 companies can regulate themselves adequately.”

16. What Regulators Should Regulate: “Having No Open Source Is the Most Dangerous Thing About This Era”

• 铁震’s policy view is that intelligence and offensive capability “are related to some degree, but are absolutely not determinative.” “You can have someone as smart as Einstein, but Einstein would not know how to hack NASA’s website. An 18-year-old high school student might be able to.” Regulation should focus on training data—removing biological-safety and cyberattack data—rather than filtering user behavior.
• 铁震 adds the countervailing risk of closed models. The number-two executive at one of Japan’s largest companies privately said the shock from Fable being banned was not the ban itself, “but that everyone realized this thing was unsafe.” A deployment can be shut down at any time by a new policy or service change. With open source, “you have downloaded the entire thing onto your own hard drive,” eliminating that risk.
• The cost arithmetic for misuse also runs in the opposite direction. Anyone trying to do harm with K3 would first need 2 B300 machines, with annual rental costs alone running into “more than $1M,” and would still need to close the capability gap with closed models. “That is much harder than using a closed model directly and trying to break through its filter.” Backdoor concerns also point the other way: with a closed model, “you have absolutely no idea when it will output what.” An open model running in a sandbox with tightly controlled inputs and outputs may actually be more controllable.
• The discussion ends with a regulatory handle and a judgment. A sufficiently capable open model requires a complex reasoning environment, so “who owns the compute” becomes the point of leverage. “It is too early to say that open models are necessarily unsafe.” “However you look at it, having no open source is the most dangerous thing about this era.”