A growing disagreement over artificial intelligence is putting Nvidia CEO Jensen Huang at odds with Treasury Secretary Scott Bessent over one of the most complicated issues in the global AI race: whether companies that train models using another company's AI outputs are engaging in legitimate competition or stealing intellectual property. Huang says model distillation is fundamentally a form of competition, while Bessent has warned that foreign companies using distillation to extract capabilities from American AI systems could be engaging in theft and potentially face U.S. sanctions. The disagreement comes as Washington intensifies scrutiny of Chinese AI companies and their alleged use of American AI models.
Image Courtesy : blogs.nvidia.com
Huang made his position public during an appearance on CNBC's Squawk Box, where he was asked whether AI model distillation should be considered robbery. His response was direct: "That's called competition." Huang argued that companies are allowed to test competing products and learn from them, comparing the process to the way competitors examine Nvidia's own hardware to understand how it works. He acknowledged that he would rather competitors not learn from Nvidia's products, but said competition ultimately pushes technology forward. Huang also suggested that companies that do not want their AI systems used for this purpose can control access to their services and determine who is allowed to use them.
Bessent has taken a substantially different position. In July, the Treasury secretary warned that foreign companies using distillation to extract capabilities from U.S.-developed AI models could be treated as engaging in theft. He said companies conducting industrial-scale distillation attacks could potentially face sanctions or other restrictions. Bessent's position has since been reinforced by a broader U.S. government effort to investigate allegations that Chinese AI developers have systematically accessed American AI models and used their outputs to accelerate the development of competing systems.
At the center of the dispute is the meaning of AI model distillation. In simple terms, distillation involves using the outputs of a more capable "teacher" model to help train a less capable "student" model. The technique can make AI development more efficient because a company can learn from the behavior of an existing system instead of spending the same amount of time and computing resources developing every capability independently. Distillation itself is not inherently prohibited or illegitimate. AI companies routinely use the technique internally to produce smaller, cheaper and more efficient versions of their own models. Anthropic, for example, explicitly acknowledges that distillation is a widely used and legitimate training method.
The controversy begins when that technique is allegedly used against a competing company's proprietary model in ways that violate access restrictions or terms of service. Anthropic said earlier this year that it had identified what it described as industrial-scale campaigns involving DeepSeek, Moonshot and MiniMax. According to Anthropic, the three companies collectively generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts. Anthropic said the activity violated its terms of service and regional access restrictions and was designed to extract capabilities from Claude at a scale that would not resemble ordinary customer use.
Anthropic's allegations provide an important example of why the distinction is more complicated than simply declaring distillation either legal competition or theft. The company said DeepSeek generated more than 150,000 exchanges, Moonshot generated more than 3.4 million and MiniMax generated more than 13 million. Anthropic said the campaigns targeted capabilities including reasoning, coding, tool use and computer-use agents, with the activity distributed across numerous accounts and access pathways. The company characterized these campaigns as deliberate capability extraction rather than normal use of its services.
The U.S. government has made similar allegations at a much broader level. In September, the FBI, NSA and Cybersecurity and Infrastructure Security Agency issued a joint advisory accusing Chinese AI companies of conducting what they described as industrial-scale knowledge-distillation campaigns against American AI companies. The agencies said the activity involved unauthorized access to frontier AI models and alleged that Chinese companies routed requests through multiple pathways to circumvent access restrictions and violate the terms imposed by U.S. AI providers. The advisory identified American systems including Anthropic's Claude, OpenAI's GPT models, Google's Gemini and xAI's Grok as targets of alleged extraction efforts.
The allegations have become part of the much larger technological competition between the United States and China. American officials argue that if Chinese companies can extract important capabilities from leading U.S. AI systems at enormous scale, they can potentially reduce the time and cost required to develop competing models. That could weaken some of the technological advantage created by billions of dollars in American AI research, computing infrastructure and model development. Reuters reported that U.S. officials accused six Chinese companies, including DeepSeek, Moonshot AI and Alibaba, of using variants of American AI models to train their own systems more quickly.
China has rejected the U.S. characterization of its AI industry's activities as malicious or aggressive extraction. Chinese officials have argued for AI development that is open, inclusive and beneficial to the broader international community. The Chinese government has also criticized U.S. efforts to restrict access to advanced technologies and has disputed American claims regarding the behavior of Chinese AI companies. That means the underlying allegations remain part of a broader geopolitical dispute in which Washington and Beijing have competing interpretations of what constitutes fair technological competition.
Huang's comments introduce another perspective into that dispute. Rather than treating the act of learning from another AI system as inherently improper, he emphasized the normal competitive dynamics of the technology industry. His analogy to Nvidia hardware is important because Nvidia's products are themselves extensively studied by competitors seeking to understand their performance and develop alternative chips. From Huang's perspective, companies observing and learning from competing technology is an unavoidable part of innovation.
The policy question becomes much harder when the scale and method of that learning change. There is a meaningful difference between a developer using an AI service normally and studying its publicly available behavior and an organization allegedly operating thousands of accounts to systematically extract millions of responses for training another commercial model. Huang's argument focuses on the broader principle of competition, while Bessent's position focuses more heavily on whether particular methods of obtaining that competitive information cross legal, contractual or national-security boundaries.
That distinction could become increasingly important as AI companies rely more heavily on APIs. Unlike traditional software, where competitors can often purchase a product and examine its features directly, advanced AI models are frequently accessed through online services. Companies can restrict those services based on geography, account type, usage levels and other criteria. They can also monitor patterns of activity. That creates a new category of competitive intelligence in which the behavior of a model itself can become a valuable source of training data.
The economics help explain why the issue has attracted so much attention. Training a frontier AI model requires enormous amounts of computing power, data and engineering resources. If a competing company can obtain large amounts of high-quality output from an already-trained model and use those outputs to improve its own system, it may potentially reduce some of the expense and time involved in developing comparable capabilities. Anthropic has argued that illicit distillation can allow competitors to acquire powerful capabilities at a fraction of the cost required to develop them independently.
At the same time, distillation is an important tool for legitimate AI development. Companies can use it to create smaller models that are cheaper to operate, easier to deploy and more appropriate for specialized applications. A large frontier model might be distilled into a smaller system that retains some of its useful capabilities while requiring substantially less computing power. Researchers can also use the technique to study how model behavior can be transferred between systems. Treating every instance of distillation as theft could therefore have consequences for ordinary AI research and product development.
That is why the precise circumstances surrounding an alleged distillation campaign matter. Questions include whether the model provider authorized the activity, whether the accounts were obtained legitimately, whether access controls were circumvented, how the data was collected, how much output was generated and whether the resulting model was built in violation of contractual or other legal restrictions. The underlying technology may be the same, but the circumstances can be dramatically different.
For Washington, there is an additional national-security dimension. The U.S. government has argued that unrestricted extraction of advanced AI capabilities could undermine export controls and allow foreign competitors to acquire capabilities indirectly even when they cannot obtain the most advanced American chips or model weights. Anthropic has made a similar argument, saying illicit distillation can undermine technology restrictions designed to preserve America's AI advantage.
The debate therefore goes beyond an ordinary disagreement between two executives and government officials. It touches on how the United States defines intellectual property in the AI era. Traditional software and semiconductor protections generally focus on source code, designs, patents, trade secrets and other identifiable forms of intellectual property. AI models introduce a more complicated situation because a significant amount of a model's useful capability can be expressed through its responses rather than through publicly accessible source code or model weights.
If a competitor never obtains the original model's weights but instead asks the model millions of carefully designed questions and uses the responses to train another system, determining exactly what has been copied becomes more complicated. The resulting model may not contain a literal copy of the original system, but it may nevertheless reproduce important behaviors or capabilities. That is one reason the legal and policy questions surrounding distillation are still developing.
Huang's comments also highlight a potential tension between maintaining American technological leadership and maintaining an open competitive environment. Nvidia has benefited enormously from the worldwide expansion of AI development. The more companies that build AI systems, the more demand there is for Nvidia's GPUs and networking equipment. Huang therefore has a commercial interest in an expanding AI ecosystem, including competition among AI developers.
Bessent's responsibilities are different. As Treasury secretary, he is involved in economic and national-security policy at a time when the United States is attempting to maintain an advantage over China in advanced technology. His concern is not simply whether one company can outperform another. It is whether American technological capabilities are being transferred to a strategic competitor in ways that undermine U.S. economic and national-security objectives.
That difference helps explain why Huang and Bessent can reach different conclusions about the same technology without necessarily disagreeing about the importance of American AI leadership. Huang is emphasizing the competitive process, while Bessent is emphasizing the circumstances under which competition becomes unauthorized extraction.
The issue is also emerging at a particularly sensitive moment in U.S.-China relations. Artificial intelligence has become one of the central areas of technological competition between the two countries, alongside semiconductors, advanced manufacturing, robotics and computing infrastructure. Washington has imposed restrictions on some advanced chips and AI technologies going to China, while Beijing has encouraged domestic companies to develop alternatives. Allegations involving model distillation add another layer to those technology restrictions because they concern the transfer of capabilities through software rather than hardware.
The disagreement could ultimately lead to more aggressive technical protections from American AI companies. Providers may increase identity verification, impose stricter usage monitoring, detect coordinated account activity and develop systems specifically designed to identify unusual patterns associated with capability extraction. Anthropic has already described deploying behavioral fingerprinting, classifiers, stronger access controls and other countermeasures intended to identify and disrupt large-scale distillation activity.
Government policy could evolve alongside those technical defenses. If Washington determines that certain forms of model extraction constitute a national-security threat, sanctions, export restrictions or other measures could potentially be applied to companies accused of conducting unauthorized campaigns. Bessent has already indicated that sanctions could be considered in cases involving what the administration views as industrial-scale theft of American AI capabilities.
But the policy challenge will be drawing a line that does not inadvertently restrict legitimate research and competition. AI development depends heavily on researchers comparing systems, benchmarking models, testing capabilities and learning from existing technology. A rule that treats every attempt to learn from another AI system as improper could have implications for the broader pace of innovation.
That makes the Huang-Bessent disagreement particularly significant. The two positions represent different concerns about the same technological development. Huang's argument is that competition necessarily involves studying what competitors build and using that knowledge to improve. Bessent's position is that there is a point at which systematic, unauthorized extraction of proprietary capabilities becomes something more serious than ordinary competition. The difficult part for policymakers is determining exactly where that boundary lies.
As AI systems become more capable, the distinction may become even harder to maintain. Future models could potentially be trained through enormous numbers of interactions with other systems, making it increasingly difficult to determine which capabilities were independently developed and which were acquired through another model's outputs. Companies may therefore need stronger technical mechanisms for proving provenance, controlling access and identifying suspicious training patterns.
For Nvidia, the controversy also underscores the increasingly complicated role the company plays in AI policy. Huang has become one of the most prominent technology executives involved in discussions about artificial intelligence, chips and U.S.-China competition. His views carry particular weight because Nvidia's hardware powers a huge portion of the global AI ecosystem. His willingness to describe distillation as competition rather than theft puts one of the industry's most influential executives on a different side of an important policy question from senior officials in the U.S. government.
The disagreement does not necessarily establish that either characterization applies to every form of model distillation. The technology itself is legitimate and widely used, while specific methods of acquiring and using another company's model outputs can raise serious contractual, legal and national-security questions. Those distinctions will likely become increasingly important as regulators, courts and technology companies attempt to establish clearer rules for AI development.
For now, Huang is emphasizing the competitive nature of technological progress, while Bessent is emphasizing the protection of American AI capabilities against unauthorized extraction. The clash illustrates how quickly model distillation has evolved from a technical concept used by AI researchers into a major issue in the global technology and national-security debate.
The central question is no longer simply whether one AI model can learn from another. It is how that learning happens, whether it is authorized, how extensively it is performed and what happens to the capabilities that are extracted. As the United States and China compete to lead the next generation of artificial intelligence, the answers could help determine how open — or restrictive — the global AI ecosystem becomes.