Distillation as Capability Extraction
Artificial intelligence has traditionally been discussed in terms of models, data, and parameters, but increasingly, the strategic asset is something else entirely.
The strategic asset is no longer mere information, it’s the capability to reason over information. This distinction changes how we should think about AI security. A frontier model is not merely a repository of knowledge. It is a reasoning engine whose value lies in synthesizing new conclusions from existing relationships. Distillation attempts to extract that reasoning capability, not just the underlying facts.
When practitioners interact with a frontier model, they’re not simply retrieving stored information. During inference, the model combines patterns and relationships learned during training to produce outputs that may never have existed explicitly in its training data. The value therefore lies not only in the information the model has learned, but in its ability to reason across that information and synthesize useful new conclusions. This distinction explains why frontier AI has become strategically important.
Traditional information security focused on protecting data. Governments classified documents, organizations encrypted databases, and security programs concentrated on preventing unauthorized disclosure. Today, the protected asset is evolving and this is where distillation becomes more than an engineering optimization.
Distillation is a legitimate machine learning technique. Every major AI laboratory uses it internally to produce smaller, faster, and more efficient models. The concern arises when repeated access to a frontier model becomes a mechanism for reconstructing capabilities that required enormous investments of data, compute, engineering, and research to create.
Capability, not merely information, becomes the target. That changes the security problem.
The objective is increasingly to protect reasoning capability itself, not merely the information on which it was trained. Recent allegations make this less theoretical. Anthropic has accused Alibaba-linked operators of using nearly 25,000 fraudulent accounts and 28.8 million Claude interactions to extract model capabilities through distillation. Earlier, OpenAI alleged that DeepSeek sought to replicate the capabilities of frontier models through similar distillation efforts, raising broader questions about whether repeated model interactions can reconstruct advanced reasoning capability.
Access control no longer determines only who may use a model. It increasingly determines who may learn from it. Usage telemetry no longer measures only customer behavior though it may reveal systematic capability extraction. Anomalous account activity may indicate more than fraud and may signal organized attempts to reconstruct frontier reasoning capability. This is why capability custody deserves recognition as its own architectural concern within AI Control Domains.
Model integrity asks whether a model has been altered, degraded, or compromised. Capability custody asks whether the model’s reasoning capability is being systematically transferred, harvested, reconstructed, or extracted through legitimate-looking interaction. Those are different questions requiring different controls. As frontier AI becomes increasingly valuable, protecting model weights alone will not be sufficient. Organizations must also protect the reasoning capability expressed through inference.
The next generation of AI security will therefore protect more than information. It will protect the capability to transform information into new knowledge and that may ultimately become the most valuable asset of all.
Consulting: Need independent analysis or security support? See AI & Cybersecurity Consulting.