DECISION ARCHITECTURE | TRUSTED ARCHITECTURE | OPEN CAPABILITY
Policy should punish fraudulent extraction and protect real intellectual property without criminalizing ordinary learning from lawfully available outputs.
By Vincent Sullivan, Founder, Cyber Strategy Institute
The word distillation is being used to describe several different activities, from routine model optimization to coordinated fraud. Treating them as one category will either leave genuine theft unaddressed or turn normal research and competition into a prohibited act.
Anthropic’s February 2026 disclosure is a useful place to start. The company reported more than 16 million exchanges generated through approximately 24,000 fraudulent accounts, proxy services, and evasive access methods. Anthropic also made an important distinction: distillation itself is a widely used and legitimate training method. The alleged wrongdoing was the coordinated circumvention of access restrictions and terms at industrial scale.
Four categories should not be collapsed
Fraudulent access: fake accounts, credential misuse, proxy networks, identity evasion, or other methods used to defeat access controls.
Extraction of protected proprietary material: theft of model weights, source code, confidential reasoning traces, nonpublic datasets, or trade secrets.
Contract disputes: high-volume use of a paid service in ways the provider says violate its terms, without theft of protected systems or credentials.
Lawful learning and adaptation: using publicly released weights, openly licensed artifacts, or outputs obtained through ordinary authorized access to research, compare, fine-tune, or build a new system.
The first two categories justify strong enforcement. The third may support account termination, damages, or other remedies depending on the contract and law. The fourth is central to innovation and should not be transformed into a general policy offense merely because a new competitor learns efficiently.
A familiar analogy
Buying a book does not transfer its copyright. It does permit the reader to learn from it. Breaking into the publisher’s server to steal the manuscript is different. Creating thousands of fraudulent subscriptions to scrape protected material may also be different. The legal and policy analysis should identify the boundary instead of declaring that all learning from outputs is theft.
AI complicates the analogy because output can be generated at enormous scale and may encode valuable capabilities. That scale can justify technical safeguards, rate limits, identity verification, and evidence-based counterintelligence measures. It does not justify treating every user who improves another model as an industrial spy.
Protect national security without building a moat
Executive Order 14409 directs the government to protect American ingenuity and intellectual property from adversary exploitation. NSPM-11 calls for partnerships to defend against malicious distillation attacks. Those are legitimate objectives. The implementation should target proven fraud, unauthorized access, protected material, and state-backed extraction; not open research, ordinary fine-tuning, interoperability, or the use of publicly released weights.
Rules written too broadly will be easy for the largest laboratories to satisfy and difficult for startups, researchers, and small businesses to navigate. That creates the appearance of security while concentrating the market around the firms that helped define the rule.
A workable policy test
Before calling an activity an illicit distillation operation, government should require evidence addressing:
Was access authorized, paid for, public, or openly licensed?
Were identity, geographic, account, or technical controls intentionally evaded?
Was protected nonpublic material acquired?
Was the activity coordinated at industrial scale to extract a narrow proprietary capability?
What contractual term or law was violated?
What national-security harm is supported by evidence rather than inference?
Would the proposed remedy also burden ordinary research, interoperability, or competition?
This framework protects owners without granting them ownership over every idea a user learns through lawful interaction.
Preserve plural intelligence
The decision-architecture concern is larger than model economics. If legitimate learning, comparison, and fine-tuning are restricted too broadly, a few providers can become the dominant source of analysis and framing. That creates a decision monoculture even where multiple brands remain.
Protect actual theft and unauthorized access. Preserve lawful learning, interoperability, and independent model development so institutions retain more than one path to knowledge.
Author note: Vincent Sullivan is the founder of Cyber Strategy Institute and a retired U.S. Air Force lieutenant colonel. His work focuses on runtime AI governance, zero-trust architecture, federal acquisition, and operational resilience.
The policy line should follow the conduct used to obtain the information, not the fact that learning occurred.
Protect the vault. Enforce the contract. Do not outlaw learning.
