explainx / blog
Alibaba-linked researchers published Proxy-KD (arXiv:2401.07013) to distill GPT-4-class models without weight access. After Anthropic accused Qwen of 28.8M Claude exchanges, HN resurfaced the paper. Full breakdown.
Jun 28, 2026
Distillation is how you take a massive frontier AI and compress its knowledge into a smaller, cheaper model. It's one of the most powerful techniques in AI — and one of the most contested. Anthropic accused Alibaba of distilling Claude Fable 5 at scale using 25,000 fake accounts. Here's the full picture.
Jun 30, 2026
Rumors of an imminent Claude Sonnet 5 release are spreading on X after fresh partner-platform sightings and speculation about a Fable 5 comeback. This post separates confirmed facts from rumor — and explains why the February slug already shipped as Sonnet 4.6.
Jun 30, 2026
Day 18: UK developers and enterprises still offline. The closest US ally failed to secure a carve-out — no UK restoration path announced.
A January 2024 research paper is back in circulation on Hacker News — not because it is new, but because it describes exactly the capability-extraction playbook at the center of Anthropic's Fable 5 distillation scandal.
The paper: Knowledge Distillation of Black-Box Large Language Models (Chen et al., arXiv:2401.07013, v2 revised November 9, 2024). The method: Proxy-KD. The authors: researchers from Sun Yat-sen University and Alibaba Group.
Given that Anthropic accused Alibaba-linked operators of running ~25,000 fraudulent accounts and 28.8 million Claude exchanges to distill frontier capabilities into Qwen — the HN thread's subtext is obvious. One commenter put it plainly: "My best guess is this is a reference to the recent accusations from Anthropic of Chinese labs distilling on their models."
This post explains what Proxy-KD actually does, how it differs from the crude extraction Anthropic described, and why the Fable 5 export ban sits downstream of the same economic force.
| Question | Answer |
|---|---|
| What problem does Proxy-KD solve? | Closed models (GPT-4, Claude) are API-only — you get text, not logits. White-box distillation needs probability distributions. Proxy-KD bridges the gap with an intermediate open model. |
| How does it work? | (1) Collect black-box teacher outputs. (2) Align a white-box proxy to the teacher via SFT + DPO preference optimization. (3) Proxy generates soft distributions. (4) Student learns from weighted KL loss + hard labels. |
| Did Alibaba invent industrial Claude distillation? | The paper is legitimate research. Anthropic's allegation is about 25,000 fake accounts and 28.8M API calls — scale and ToS violation, not the existence of the technique. |
| Why does this connect to Fable 5? | Anthropic's June 10 Senate letter warned distillation could reach Mythos Preview-level capability. The June 12 export ban followed 48 hours later. |
| Is Proxy-KD what Qwen used? | Unknown publicly. Proxy-KD is one published method; alleged operators may have used simpler response-only distillation at industrial scale. The paper shows Alibaba researchers studied the problem formally. |
| Related classic paper? | Turc et al. 2019 — Well-Read Students Learn Better — pre-train the student first, then distill; effects compound. |
If you read explainx.ai's distillation primer, you already know the Hinton framing: students learn more from a teacher's soft probability distribution than from hard labels alone — Geoffrey Hinton's "dark knowledge."
The problem in 2024–2026: the best teachers are closed.
| Type | Teacher access | What the student learns | Examples |
|---|---|---|---|
| White-box KD | Weights + logits + hidden states | Full distributions, features, attention | DistilBERT, self-distillation within open models |
| Black-box KD | API outputs only | Hard completions, rationales | Alpaca (GPT-3.5), Vicuna, Orca |
| Proxy-KD | API outputs → aligned proxy → distributions | Soft distributions approximating closed teacher | Chen et al. 2024 |
White-box distillation is more sample-efficient per example. Black-box distillation is all most labs can do with GPT-4 or Claude — unless they run 28.8 million exchanges and treat volume as a substitute for logits.
Proxy-KD tries to get white-box efficiency from black-box access.
The paper's architecture has three stages:
Black-box teacher (GPT-4, Claude API)
↓ outputs + preference pairs
Proxy model (white-box LLM)
↓ aligned soft distributions + sample weights
Student model (smaller open LLM)
The proxy is an open-weight LLM (white-box). It is trained on:
The goal: make the proxy's behavior and token-level distributions track the closed teacher as closely as possible without ever seeing the teacher's weights.
Not all proxy outputs align equally well with the teacher. Proxy-KD assigns a per-sample weight reflecting alignment quality. The student concentrates learning on well-aligned distributions — ignoring proxy outputs that drift from the teacher.
Loss combines:
The student trains as if it had white-box access — learning from dense distributions the proxy synthesizes, not just final text strings.
Chen et al. claim Proxy-KD outperforms both naive black-box KD (Alpaca-style output copying) and traditional white-box KD where the white-box teacher is smaller than the black-box target. Key finding: proxy alignment quality dominates — a poorly aligned proxy hurts distillation more than model size gaps.
Full paper: https://arxiv.org/pdf/2401.07013
Proxy-KD did not appear in a vacuum. It sits in a well-documented research line:
| Era | Method | Teacher | What transferred |
|---|---|---|---|
| 2019 | Pre-trained Distillation (Turc et al.) | Fine-tuned BERT-large | Task knowledge into mini-BERT after pre-training |
| 2023 | Alpaca | GPT-3.5 API | 52K instruction examples → LLaMA-7B |
| 2023 | Vicuna / Orca | GPT-4 / ChatGPT API | Conversations + reasoning traces |
| 2024 | Proxy-KD | GPT-4 API (black-box) | Distributions via aligned proxy |
| 2025 | DeepSeek R1 distill | Open R1 traces | Reasoning behavior into 1.5B–70B students |
| 2026 | Alleged Qwen extraction | Claude API (Fable-era) | 28.8M exchanges, agentic + coding (Anthropic claim) |
Turc et al.'s insight — cited on HN as essential companion reading — still holds: pre-train the student, then distill. Pre-training and distillation have a compound effect even on the same data. Modern Chinese labs apply both: strong base models (Qwen, GLM) plus frontier teacher outputs.
The HN submission (66 points, June 2026) arrived amid:
The thread's tension mirrors the industry debate:
Anthropic's framing in the Senate letter: distillation at this scale is not academic reproduction — it is "the largest known distillation attack" targeting agentic reasoning, software engineering, and long-horizon tasks — the same capability classes Fable and Mythos represent.
Important distinction — conflating them makes bad policy and bad engineering decisions.
| Dimension | Proxy-KD (research) | Alleged Claude extraction (Anthropic) |
|---|---|---|
| Scale | Benchmark datasets | 28.8 million exchanges |
| Access | API calls under research budget | ~25,000 fraudulent accounts, evasion infrastructure |
| Goal | Publish method beating baselines | Train production rival models (Qwen) |
| Legal frame | Academic citation | ToS violation + lawmaker briefing |
| Technique | Proxy alignment + weighted KL | Unknown — may be simpler response copying at volume |
| Authors | Alibaba + university | Operators linked to Alibaba Qwen (Anthropic claim) |
Proxy-KD explains why black-box distillation is hard and how to do it better. The scandal is about industrializing extraction against a closed frontier API — and doing it while Fable and Mythos were still live, before Anthropic's bot-detection and July 8 ID verification layer.
The Mythos detection irony: export controls target foreign-national access to cyber-capable models, while 25,000 bot accounts reportedly ran millions of exchanges undetected pre-ban.
Not all distillation is equal. Production teams tier by what they extract:
Tier 1 — Instruction following (cheap, common)
Alpaca-style: collect (prompt, completion) pairs. Transfers chat behavior, not frontier reasoning. Legal risk: high on closed APIs.
Tier 2 — Chain-of-thought and tool traces (medium cost)
Orca / DeepSeek R1 pattern: collect reasoning steps, tool calls, multi-turn trajectories. Transfers how the model thinks. This is what Anthropic's letter emphasizes for agentic and coding workloads.
Tier 3 — Proxy-KD-style distribution matching (research-grade)
Requires proxy alignment infrastructure. Better capability retention per sample — but still needs diverse, high-quality teacher queries.
Tier 4 — White-box self-distillation (legal on open weights)
DeepSeek, Meta, Mistral distill within their own open models. Unambiguously permitted under permissive licenses.
The alleged Alibaba campaign, per Anthropic, targeted Tier 2+ at Tier 1 scale — millions of traces on Fable-class models.
Assume your outputs can and will be distilled if they are valuable. Terms of service are enforcement, not physics. Proxy-KD shows the technique improves every year.
Practical hedges:
Proxy-KD is a blueprint for legal distillation from API teachers you pay for at research scale. The compound recipe from Turc et al. still applies:
Distillation and export control are the same war viewed from different angles:
Proxy-KD is the research-side documentation of item three. The Senate Banking letter is the policy-side response to item one. The June 12 directive is the response to item two.
| Paper | arXiv | Why read it |
|---|---|---|
| Proxy-KD | 2401.07013 | Black-box LLM distillation via aligned proxy + DPO |
| Pre-trained Distillation | 1908.08962 | Pre-train student first; compound gains (HN recommended) |
| Distilling the Knowledge in a Neural Network | 1503.02531 | Hinton original — dark knowledge, temperature softmax |
| DistilBERT | 1910.01108 | Production distillation milestone |
Primary source for Proxy-KD claims in this article: Chen et al., PDF. Policy claims about Alibaba: Anthropic Senate Banking letter breakdown.
Proxy-KD is not the scandal — it is the instruction manual.
A 2024 paper from Alibaba-affiliated researchers described how to distill closed frontier models more efficiently than Alpaca ever could — using a proxy to recover the logit-level signal black-box APIs hide. Hacker News resurfaced it in June 2026 because Anthropic accused operators linked to the same ecosystem of running industrial-scale Claude extraction two days before Fable 5 went offline globally.
The technique is real, published, and improving. The allegation is about scale, fraud, and ToS — not about whether distillation works. It works. That is exactly why export controls, ID verification, and open-weight alternatives are all happening at once.
If you are choosing models today: understand that every closed API call is potentially a training example for someone else's student — unless you self-host or route through tiers you control.
Paper details and benchmark claims reflect arXiv:2401.07013 v2 (November 9, 2024). Anthropic allegations reflect June 2026 Senate Banking letter reporting. Verify live policy and API terms before production decisions.