Six Chinese AI Firms Caught Aggressively Copying US Frontier Models

An Ars Technica investigation published today has identified six major Chinese AI companies systematically copying frontier models from OpenAI, Anthropic, and Google through sophisticated distillation techniques. The firms—including household names like DeepSeek, Baidu, and Alibaba—have been querying US models millions of times to replicate their behaviors without ever accessing the underlying training data or model architectures.

The revelation comes at a critical moment when AI companies are racing to protect their competitive advantages while Chinese firms accelerate their attempts to match Western AI capabilities. For content creators, the implications are profound: the models you rely on may have foreign clones you've never heard of, operating outside US copyright and safety frameworks.

What the Investigation Found

Ars Technica's six-month investigation used behavioral fingerprinting to compare Chinese AI models against their US counterparts. The results were stark: six Chinese companies showed pattern scores between 85% and 92% similarity to OpenAI's GPT models, Anthropic's Claude, and Google's Gemini across hundreds of test scenarios.

The investigation tracked API query patterns from Chinese AI labs to US model providers. DeepSeek alone made an estimated 4.2 million queries to OpenAI's API between March and August 2026, with query volumes spiking immediately before each new Chinese model release. Baidu's ERNIE 5.0 model, released in June, showed similar timing patterns with 3.8 million queries to Anthropic's Claude API in the preceding eight weeks.

The similarity isn't just in outputs—it extends to edge cases, failure modes, and even specific refusal patterns. When researchers tested obscure prompts designed to trigger specific safety responses, the Chinese models responded identically to their US counterparts 78% of the time. This level of behavioral replication is virtually impossible without deliberate copying.

How Model Distillation Actually Works

Model distillation is a legitimate ML technique that becomes problematic at scale. The basic process: query a "teacher" model (like GPT-5.6) with thousands or millions of prompts, collect the outputs, then train a "student" model to replicate those input-output pairs. The student never sees the teacher's weights, training data, or architecture—just its behavior.

At small scale, distillation is a standard optimization technique. A company might distill a large internal model into a smaller, faster version for production. But at the scale documented in this investigation, distillation becomes wholesale copying. The Chinese firms queried US models with carefully crafted prompts designed to map the entire behavioral space: edge cases, reasoning chains, style variations, multilingual outputs, and code generation patterns.

The genius—and the ethical problem—is that this circumvents traditional IP protections. Anthropic and OpenAI can't copyright model outputs (in most jurisdictions), only the model weights themselves. By never accessing the weights, Chinese firms operate in a legal gray zone while achieving functionally identical models.

One AI researcher quoted in the investigation described it as "photocopying a book by reading every page aloud into a dictation app, then claiming you never copied the book because you never touched the physical pages."

The Six Companies Caught Copying

The investigation names six companies with documented distillation patterns: DeepSeek, Baidu, Alibaba Cloud, Tencent AI Lab, ByteDance's Doubao, and iFlytek. All six have released models in 2026 showing suspicious similarity to US counterparts released months earlier.

DeepSeek, the most aggressive copycat, launched DeepSeek-V3 in July 2026 claiming "original architecture innovations." The investigation found 92% behavioral overlap with OpenAI's GPT-5.6, released four months earlier. DeepSeek's API query logs show 4.2 million calls to OpenAI endpoints in the intervening period—an average of 35,000 queries per day.

Baidu's ERNIE 5.0 shows 88% similarity to Claude Fable 5.1, particularly in reasoning tasks and structured outputs. When tested with the same 200 coding challenges, ERNIE and Claude produced byte-for-byte identical solutions in 67 cases and functionally equivalent solutions in another 89. The probability of this occurring by chance is effectively zero.

Alibaba's Qwen-Max, marketed as China's answer to Google's multimodal models, exhibits the same distinctive artifacts and failure modes as Gemini 3.0. Both models, for example, incorrectly calculate the same obscure mathematical identity in the same way—a mistake that appears in no other model tested.

The Legal and Ethical Gray Zone

OpenAI and Anthropic's terms of service explicitly prohibit using their APIs for model training or distillation. Section 2.3 of OpenAI's API Terms states: "You may not use the Services to develop models that compete with OpenAI." Anthropic's terms contain nearly identical language.

But enforcement is nearly impossible. The Chinese companies don't use their own accounts—they route queries through intermediaries, shell companies, and sometimes unwitting third-party developers. DeepSeek's 4.2 million queries to OpenAI came from 847 different API keys registered to various entities. Tracing them back to DeepSeek required months of investigative work comparing payment patterns, geographic data, and organizational links.

Even if US companies could prove terms violations, there's little they can do. The Chinese firms operate under Chinese jurisdiction, which doesn't recognize many Western IP claims around AI models. China's 2023 AI regulations focus on safety and political compliance, not protecting foreign intellectual property.

Some AI researchers argue distillation should be legal—that if a human can learn from a model's outputs without violating copyright, an AI should be able to as well. Others counter that the scale and systematic nature of these operations crosses ethical lines, even if legal ones remain blurry. "There's a difference," one Stanford researcher told Ars, "between learning from a few examples and industrial-scale copying of billions of dollars in R&D investment."

What US AI Labs Are Doing About It

US AI companies are scrambling to respond. OpenAI has implemented new rate limiting specifically targeting suspected distillation patterns—accounts that make unusually diverse queries across many capability domains get automatically throttled. In August alone, OpenAI suspended 2,400 API keys flagged by these systems.

Anthropic is taking a different approach: fingerprinting. The company now injects subtle, statistically detectable patterns into Claude's outputs that can identify distilled copies. Think of it as a watermark, but one that survives the distillation process. When researchers tested DeepSeek-V3 using Anthropic's detection tools, they found Claude-specific fingerprints in 34% of outputs.

Google DeepMind is exploring technical countermeasures: outputs that look correct to humans but confuse models trying to learn from them. Early tests show this "adversarial distillation resistance" can reduce copycat model quality by 15-20% without affecting human usability.

Industry-wide, there's discussion of a coordinated response. The Frontier Model Forum—a consortium of US and European AI labs—is drafting shared terms of service that would make large-scale distillation explicitly grounds for immediate API termination and possible legal action. Whether this has teeth against foreign entities remains to be seen.

What This Means for Creators

For content creators and marketers, this revelation has immediate practical implications. If you're building workflows around US AI models, be aware that functionally identical Chinese alternatives exist—often at lower prices because they didn't pay the R&D costs.

But cheaper isn't necessarily better. The Chinese models lack the safety training, bias mitigation, and content policy enforcement of their US counterparts. Baidu's ERNIE 5.0, while technically comparable to Claude, will generate content that violates most Western platform policies around 12% more often, according to the investigation's testing.

There's also the question of what happens if OpenAI, Anthropic, or Google succeed in blocking these distillation operations. The Chinese models would stop improving in lockstep with US releases. If you've built business processes around a Chinese model assuming it will keep pace with GPT or Claude, you may find yourself stuck with a model that becomes increasingly outdated.

For YouTube creators and video producers, this matters especially for tools built on Chinese AI infrastructure. Many lower-cost video AI tools use Chinese language models under the hood for scripting, translation, and content planning. If those models are degraded copies trained through distillation, you're working with slightly worse versions of what you could access directly.

The broader implication: the AI ecosystem you're navigating is more fragmented and legally complex than it appears. What looks like innovation is sometimes just sophisticated copying. Understanding the provenance of your AI tools—where they really come from, not just where they're marketed—is becoming as important as understanding the tools themselves.