“Distillation Cascade”: How China’s AI Capabilities Form, Spread, and Escape Export Controls

In February, Anthropic revealed that three Chinese AI labs — DeepSeek, Moonshot AI, and MiniMax — systematically extracted capabilities from Claude through over 16 million API exchanges. OpenAI had earlier flagged DeepSeek’s use of obfuscated routing to distill its models in a memo to Congress. These disclosures matter. But they only address one question: what Chinese labs took from American companies.

No one asked what happened next.

In a recent policy commentary, DSET Democratic Governance Program Director Kai-Shen Huang proposes a framework to answer that question: the “distillation cascade.”

▌ The real policy challenge begins after Stage 1

Distillation is not a one-off event. It is a three-stage chain. In Stage 1, certain Chinese labs extract capabilities from U.S. frontier models. In Stage 2, those labs publish papers, release open-source weights, and share technical reports — disseminating what they learned across the broader ecosystem. In Stage 3, other Chinese labs absorb these advances through standard academic citation and architectural adoption. By that point, the capability’s origin is untraceable. Conventional export controls cannot reach it.

▌ Zhipu AI: capability flows after Entity List designation

Zhipu AI has been on the U.S. Entity List since January 2025. Yet in 2026, it released GLM-5, claiming frontier-comparable performance across eight benchmarks. Its technical report reveals heavy reliance on DeepSeek’s architecture — the same lab both Anthropic and OpenAI confirmed had engaged in systematic distillation. The implication is clear: capabilities originally sourced from U.S. frontier models might have completed a full cycle within China’s AI ecosystem. They now sit downstream, beyond the reach of export controls.

▌ China’s AI capability source is shifting inward

This is not an isolated case. It reflects a structural shift. China’s frontier AI capabilities have evolved through three phases: early indigenous research, heavy absorption from the U.S. open-source ecosystem, and now a pattern dominated by lab-to-lab adoption within China — “PRC-to-PRC transfer.” Once DeepSeek’s innovations circulate through papers and open weights, downstream labs no longer need direct access to any U.S. API or chip. Export controls are designed to cut external inputs. But when the primary diffusion channel has moved inside China’s own ecosystem, that logic demands reassessment.

Blocking direct distillation is necessary but insufficient. The policy conversation now must confront a harder question: how to redefine the boundaries and goals of control after the distillation cascade has already run.