Anthropic Alleges Alibaba Illicitly Extracted Advanced AI Capabilities in Massive Campaign
Table of Contents
You might want to know
Was a major Chinese technology company involved in an organized effort to extract proprietary AI behavior from a US-developed model?
How might large-scale "distillation" attacks affect the competitiveness and security of AI research and national technology investments?
Main Topic
US-based artificial intelligence developer Anthropic has formally accused Alibaba, a Chinese e-commerce and technology conglomerate, of conducting what Anthropic describes as a large-scale, illicit extraction of capabilities from its Claude model. In a letter dated 10 June addressed to US Senators Tim Scott and Elizabeth Warren, Anthropic alleges that operators linked to Alibaba executed nearly 29 million interactions with Claude through thousands of fraudulent accounts. The company characterizes this activity as the largest campaign of its kind and urges legislative and regulatory responses.
Anthropic explains that the campaigns used so-called "distillation attacks," a technique that extracts responses from a more capable AI to train or improve a less capable model. According to Anthropic, the attackers focused on Claude's most valuable features — specifically its capacity to handle lengthy, complex tasks and its internal approach to reasoning and decision-making. By systematically querying the more advanced model and collecting outputs, attackers can approximate or reproduce behaviors of the target model without direct access to its underlying weights or training data.
The company frames these attacks as being executed on an "industrial scale," enabling adversaries to harvest advanced capabilities and repackage them as part of their own products. Anthropic further contends that such efforts effectively convert extensive American investment in research and development into a de facto subsidy for geopolitical competitors. The company highlighted additional alleged incidents that, in its view, pose risks beyond commercial competition, including possible implications for national defense.
This key insight significantly impacts the understanding of how AI models can be exploited without direct code theft: distillation attacks can reproduce high-level behaviors by repeatedly querying a model and using its outputs as training data for a separate model. The result can be rapid capability transfer at far lower cost than building a comparable system from scratch.
Anthropic referenced assertions from the US Department of Defense linking Alibaba and several other large Chinese companies to military-related activities. Those companies have denied such claims. Alibaba has taken legal steps in response to US government actions, including suing to remove its name from a Pentagon blacklist. Anthropic’s letter also requested that Congress consider sanctions or other penalties against entities that carry out or materially enable these extraction campaigns, and called for stronger protections to prevent US technological innovations from being misappropriated.
The concerns Anthropic raises are not isolated. Other US AI developers, including OpenAI, have previously reported similar tactics being used by foreign operators to train competing models. Industry observers warn that distillation-style extraction undermines incentives for expensive, time-consuming research and could accelerate the diffusion of advanced capabilities to actors who did not invest in foundational work. Beyond economic and competitive harm, Anthropic warns of cybersecurity and defense consequences, noting that some advanced models have capabilities that could be misused to identify vulnerabilities or automate complex tasks.
From a technical standpoint, countermeasures against distillation attacks are complex. Possible defenses include stricter access controls, usage monitoring and anomaly detection, API rate limiting, synthetic watermarking of model outputs, and legal or contractual restrictions on reuse. Each approach has trade-offs: tighter controls can impede legitimate research and collaboration, while watermarking and detection techniques can be evaded by determined adversaries. Consequently, Anthropic urged a combination of technical, legal, and policy responses to reduce the risk and raise the costs of large-scale extraction.
In response to the allegations, the BBC and other outlets sought comment from Alibaba, and the company has publicly denied the claims made by various US authorities when referenced. Alibaba has also taken legal action against certain US government measures. Meanwhile, Anthropic and other AI firms continue to prepare for significant commercial milestones — including initial public offerings — which may increase scrutiny of their claims and approaches to protecting intellectual property.
Overall, the episode exemplifies mounting tensions at the intersection of commercial AI development, international competition, and national security. It highlights how advanced AI capabilities can be disseminated through non-traditional vectors and underscores the growing need for coordinated technical, corporate, and governmental strategies to safeguard critical research while preserving productive global collaboration.
Key Insights Table
| Aspect | Description |
|---|---|
| Allegation | Anthropic claims Alibaba-linked operators performed nearly 29 million interactions to extract Claude's capabilities. |
| Method | The activity is described as "distillation attacks," using a stronger model's outputs to train weaker models. |
| Targeted Capabilities | Focus on handling of long-form, complex tasks and decision-making behaviors. |
| Scale and Impact | Anthropic characterizes the campaign as industrial-scale, with potential economic and national security implications. |
| Suggested Responses | Stronger technical safeguards, legal penalties, monitoring, and international policy coordination. |
Afterwards...
Looking forward, there are several areas where technical and policy work could reduce the risk and impact of large-scale extraction attacks. Improved monitoring and anomaly detection for API usage, robust output watermarking, and enhanced access control models are technical avenues worth pursuing. Additionally, international norms and agreements around responsible use, data provenance, and cross-border commercial practices could help set expectations and penalties for misuse.
Policy-makers should consider frameworks that balance innovation with protection: targeted export controls, clearer liability rules for intermediaries, and incentives for firms to adopt protective measures without stifling legitimate research. Collaboration between industry, academia, and government will be crucial to develop standards that are practical, enforceable, and adaptable to rapidly evolving AI capabilities.
Exploring defensive research into model watermarking, query-behavior analytics, and privacy-preserving mechanisms for shared research would strengthen resilience. Concurrently, international dialogue on acceptable commercial practices and cooperative security measures will be important to prevent high-stakes technology transfer through covert means.
Ultimately, the incident underscores a broader need to rethink how advanced AI capabilities are protected, governed, and shared in a globally connected research and commercial ecosystem. Ongoing investment in detection technologies, combined with thoughtful policy and diplomatic engagement, offers the best path to preserving both innovation and security.