The State Department learns to talk about distillation

The cable Reuters published on 27 April¹ is a slightly strange document, and I think it is going to produce slightly strange outcomes. It is a State Department instruction, dated 24 April, telling US diplomatic posts worldwide to raise with host governments the alleged extraction and distillation of US frontier models by Chinese firms, DeepSeek, Moonshot AI, and MiniMax are named, and to flag, specifically, that distilled models "strip safety protocols and alignment training." China called it groundless. That is the entire diplomatic surface of the thing.

I want to read the cable carefully, because the interesting story is not the accusation. The interesting story is that a US foreign-policy instrument has, for the first time I can find, treated model weights and the training process applied to them as the regulated object. Not chips. Not compute. Not the company. The weights themselves, and what someone did to them downstream.

What the cable actually argues

Three claims, in order:

One, that named Chinese labs have used "systematic extraction techniques, including high-volume API querying and synthetic data generation pipelines"² to build training corpora derived from US frontier models. This is the standard description of distillation: you query a strong model at scale, harvest the outputs, and train a smaller (or differently-shaped) model on those outputs. It is not theft in any conventional sense. The API calls were paid for. The terms of service were, presumably, violated, but ToS violations are not what the State Department usually cables about.

This is the standard description of distillation: you query a strong model at scale, harvest the outputs, and train a smaller (or differently-shaped) model on those outputs.

Two, that the resulting models inherit capabilities but not safeguards. The cable's phrasing, "distilled derivatives retain substantial capability while shedding the alignment and refusal behaviours of the source"³, is the part worth pausing on. It is technically defensible. Refusal behaviours are largely a product of post-training (RLHF, constitutional methods, the late-stage safety stack), and a distillation pipeline that samples on capability-relevant prompts will under-sample refusals. You get most of the brain and less of the conscience. Whether this matters at the frontier is a separate question; the cable asserts it does.

Three, that this constitutes a proliferation concern of the kind that warrants diplomatic engagement. This is the move. The cable is asking allied governments to treat distilled-from-US-frontier models as a category of artefact with export-control-adjacent characteristics.

The frame: safety as market position, made foreign policy

The cleanest reading is through the AI safety as market position frame. Anthropic and OpenAI have spent two years building safety posture as competitive differentiator, RSPs, preparedness frameworks, the whole apparatus that lets them sell to the Pentagon and to risk-averse enterprises. The frame predicts that this posture eventually gets institutionalised as policy, because the labs have every incentive to push it there and the US government has every incentive to accept the push.

The cable is that institutionalisation. Read it again with the frame in hand: the State Department is telling allies that the safety stack is the valuable thing, that stripping it produces a worse object, and that the world should care. This is the frontier-lab safety narrative converted, almost without modification, into diplomatic language. The labs did not need to lobby for this; the logic of the position does the work.

What the frame predicts next: defence-market and procurement-language divergence between aligned-frontier-models and everything else. Watch for FedRAMP-style accreditation that treats lineage and post-training provenance as a compliance object. Watch for allied procurement guidance that mirrors the cable.

Where the frame strains

It strains on the model weight lineage frame, which is the other lens this evidence invites.

If you take weight lineage seriously, IP and control residing in the weights and the training process, not in patents or contracts, then distillation is genuinely awkward. The "extracted" thing is not the weights. DeepSeek does not have OpenAI's weights. It has a behavioural shadow of them, sampled through an API, used to shape a different set of weights. The legal status of this is unsettled, the technical status is "this is just how you train a smaller model now," and the diplomatic status, as of last week, is apparently "proliferation concern."

The cable elides this. It uses the language of extraction, which implies a thing taken, when the more accurate language is imitation at scale. I notice this because the cable is going to be read by lawyers in capitals that do not have a domestic frontier lab to protect, and those lawyers are going to ask what, precisely, is being protected and against what. The answer, the post-training safety work of two American companies, treated as a national-interest asset, is defensible, but the cable does not quite say it.

What this is a case of

It is a case of the same pattern as the October 2022 chip controls and their successors: a US capability advantage being converted into an export-control posture, with allies asked to mirror it. The 2022 controls treated advanced logic chips as the binding constraint. The 2023 updates treated the equipment to make those chips. The 2025 diffusion rule treated allocations of compute. This cable treats the alignment layer of frontier models as the next item on the list.

That is a meaningful escalation in what counts as a controlled artefact. Chips are physical. Compute allocations are contractual. Alignment work is, at this point, a few hundred researcher-years of RLHF and red-teaming output baked into a final-stage fine-tune. The cable is asserting that this fine-tune is a strategic asset.

Through the intelligence explosion signals frame, this is also a tell about how the US government is reading the capability gap. You do not cable allies about distillation if you think distilled Chinese models are obviously inferior on the dimensions that matter. The cable's existence implies an internal assessment that DeepSeek-class and Moonshot-class systems are close enough on capability that the safety-stack delta is the differentiator worth defending diplomatically. That is a different posture from "we are years ahead."

What to watch

Three things, in rough order of how soon they show up.

First, whether any allied government adopts cable-aligned language in its own AI guidance. The UK AISI, the EU AI Office, and Japan's METI are the obvious places. If the phrase "safety-stripped derivative" or its functional equivalent appears in allied procurement or assurance guidance within ninety days, the diplomatic push is working.

Second, whether the named labs, Anthropic, OpenAI, Google DeepMind, change their API terms or rate-limiting in ways that make distillation harder, and whether they cite the cable when they do. Terms-of-service changes that invoke national-security language are the tell.

Third, whether DeepSeek, Moonshot, or MiniMax respond with provenance claims of their own. If they publish training-data documentation arguing their post-training is independent, that is the shape of the dispute going forward: duelling provenance attestations. Which is, I think, where this whole question was always going to end up. The cable just made it diplomatic.

Footnotes

¶