Can AI Reasoning Be Extracted? New Study Intensifies US-China Distillation Debate

A new research paper is adding fresh heat to the growing debate over AI “distillation”, a technique used to transfer capabilities from one AI model to another. The issue has attracted particular attention as Chinese open-weight models such as Moonshot AI’s Kimi K3 continue to gain ground. Researchers say they have found a way to uncover hidden reasoning traces generated by advanced AI models before they produce their final answers. They also suggest that similar techniques could potentially be used to obtain reasoning information from powerful proprietary models and use it to train other systems through distillation.

The study was carried out by researchers from the University of Tübingen, the Max Planck Institute, MATS Research and cybersecurity firm Snyk. In their experiments, the researchers observed notable similarities between reasoning generated by Kimi K3 and hidden reasoning traces associated with Anthropic’s Claude Opus 4.8 and OpenAI’s GPT-5.6 Sol when responding to certain prompts. However, the researchers made clear that these similarities do not prove that Moonshot AI or another Chinese developer actually distilled reasoning data from those US models.

The paper specifically states that the results cannot establish a causal link. Researchers also found that the US-based open-weight model Inkling from Thinking Machines and a DeepSeek model did not show the same type of reasoning similarities with Claude Opus. The controversy comes as artificial intelligence development has become an increasingly important area of competition between the United States and China. Distillation itself is not new and has long been used in machine learning to transfer capabilities from larger models to smaller and more efficient systems. But the technique has become politically and commercially sensitive as companies accuse rivals of using their models to accelerate development.

OpenAI previously alleged that DeepSeek had used outputs from its models while developing its R1 reasoning system. Anthropic also accused Chinese technology giant Alibaba of similar activity. At the same time, some Silicon Valley leaders have defended distillation as a legitimate part of the wider AI ecosystem. Meta CEO Mark Zuckerberg recently argued that restricting the practice could place US developers at a disadvantage.

The researchers' method for examining hidden reasoning relies on an unusual property of smaller models. While proprietary systems generally conceal their chain-of-thought reasoning, an encrypted version of this information is transmitted to a user's computer for computational purposes. The researchers found that feeding these traces into a smaller model from the same family could cause it to reveal more of the underlying reasoning because smaller models typically undergo less alignment training.

To investigate whether open-weight models might show evidence of similar training, the researchers tested 90 questions across several systems. They then supplied the models with the opening portions of reasoning traces obtained from a proprietary model. According to the study, some models produced answers that showed similarities to the original reasoning, with Kimi K3 displaying particularly noticeable overlaps.

The researchers cautioned that these results should not be treated as proof that any particular company copied confidential reasoning data. The research also raises a separate cybersecurity concern. The researchers warned that techniques capable of exposing hidden model reasoning could potentially be abused to retrieve sensitive information supplied to AI systems, including passwords and API keys. They said tests involving frontier models from OpenAI, Anthropic and Google demonstrated that sensitive information could be recovered through API access. The companies were reportedly notified about the vulnerability and subsequently introduced measures to reduce the risk.

Anthropic spokesperson Michael Aciman told Wired that the company welcomed independent research into its models and had begun implementing short-term protections against the replay behaviour described in the study. He also denied that the researchers had accessed Anthropic's internal infrastructure or obtained encryption keys and personal data from its systems. The research therefore raises important questions about both AI security and competition. While the similarities between certain models are notable, the study does not establish that Chinese companies deliberately extracted and distilled proprietary reasoning from US AI systems. Further research will be needed to determine whether the observed overlaps result from distillation, common training data, model behaviour or other factors. As the AI race between the US and China intensifies, the ability to protect proprietary reasoning while allowing legitimate research and innovation is likely to become an increasingly important challenge for the industry.