A January 2024 research paper is back in circulation on Hacker News — not because it is new, but because it describes exactly the capability-extraction playbook at the center of Anthropic's Fable 5 distillation scandal.
The paper: Knowledge Distillation of Black-Box Large Language Models (Chen et al., arXiv:2401.07013, v2 revised November 9, 2024). The method: Proxy-KD. The authors: researchers from Sun Yat-sen University and Alibaba Group.
Given that Anthropic accused Alibaba-linked operators of running ~25,000 fraudulent accounts and 28.8 million Claude exchanges to distill frontier capabilities into Qwen — the HN thread's subtext is obvious. One commenter put it plainly: "My best guess is this is a reference to the recent accusations from Anthropic of Chinese labs distilling on their models."
This post explains what Proxy-KD actually does, how it differs from the crude extraction Anthropic described, and why the Fable 5 export ban sits downstream of the same economic force.
TL;DR — questions people are asking
| Question | Answer |
|---|---|
| What problem does Proxy-KD solve? | Closed models (GPT-4, Claude) are API-only — you get text, not logits. White-box distillation needs probability distributions. Proxy-KD bridges the gap with an intermediate open model. |
| How does it work? | (1) Collect black-box teacher outputs. (2) Align a white-box proxy to the teacher via SFT + DPO preference optimization. (3) Proxy generates soft distributions. (4) Student learns from weighted KL loss + hard labels. |
| Did Alibaba invent industrial Claude distillation? | The paper is legitimate research. Anthropic's allegation is about 25,000 fake accounts and 28.8M API calls — scale and ToS violation, not the existence of the technique. |
| Why does this connect to Fable 5? | Anthropic's June 10 Senate letter warned distillation could reach Mythos Preview-level capability. The June 12 export ban followed 48 hours later. |
| Is Proxy-KD what Qwen used? | Unknown publicly. Proxy-KD is one published method; alleged operators may have used simpler response-only distillation at industrial scale. The paper shows Alibaba researchers studied the problem formally. |
| Related classic paper? | Turc et al. 2019 — Well-Read Students Learn Better — pre-train the student first, then distill; effects compound. |
Black-box vs white-box distillation
If you read explainx.ai's distillation primer, you already know the Hinton framing: students learn more from a teacher's soft probability distribution than from hard labels alone — Geoffrey Hinton's "dark knowledge."
The problem in 2024–2026: the best teachers are closed.
| Type | Teacher access | What the student learns | Examples |
|---|---|---|---|
| White-box KD | Weights + logits + hidden states | Full distributions, features, attention | DistilBERT, self-distillation within open models |
| Black-box KD | API outputs only | Hard completions, rationales | Alpaca (GPT-3.5), Vicuna, Orca |
| Proxy-KD | API outputs → aligned proxy → distributions | Soft distributions approximating closed teacher | Chen et al. 2024 |
White-box distillation is more sample-efficient per example. Black-box distillation is all most labs can do with GPT-4 or Claude — unless they run 28.8 million exchanges and treat volume as a substitute for logits.
Proxy-KD tries to get white-box efficiency from black-box access.
How Proxy-KD works (arXiv:2401.07013)
The paper's architecture has three stages:
Black-box teacher (GPT-4, Claude API)
↓ outputs + preference pairs
Proxy model (white-box LLM)
↓ aligned soft distributions + sample weights
Student model (smaller open LLM)
Stage 1 — Proxy alignment
The proxy is an open-weight LLM (white-box). It is trained on:
- Hard labels — text outputs from the black-box teacher
- DPO preference optimization — chosen/rejected pairs where the teacher's output is the "winning" response
The goal: make the proxy's behavior and token-level distributions track the closed teacher as closely as possible without ever seeing the teacher's weights.
Stage 2 — Sample-level weighted distillation
Not all proxy outputs align equally well with the teacher. Proxy-KD assigns a per-sample weight reflecting alignment quality. The student concentrates learning on well-aligned distributions — ignoring proxy outputs that drift from the teacher.
Loss combines:
- KL divergence between student and proxy distributions (weighted)
- NLL loss on teacher hard labels (standard supervised fine-tuning)
Stage 3 — Student training
The student trains as if it had white-box access — learning from dense distributions the proxy synthesizes, not just final text strings.
Reported results
Chen et al. claim Proxy-KD outperforms both naive black-box KD (Alpaca-style output copying) and traditional white-box KD where the white-box teacher is smaller than the black-box target. Key finding: proxy alignment quality dominates — a poorly aligned proxy hurts distillation more than model size gaps.
Full paper: https://arxiv.org/pdf/2401.07013
The Alpaca lineage — and where Proxy-KD fits
Proxy-KD did not appear in a vacuum. It sits in a well-documented research line:
| Era | Method | Teacher | What transferred |
|---|---|---|---|
| 2019 | Pre-trained Distillation (Turc et al.) | Fine-tuned BERT-large | Task knowledge into mini-BERT after pre-training |
| 2023 | Alpaca | GPT-3.5 API | 52K instruction examples → LLaMA-7B |
| 2023 | Vicuna / Orca | GPT-4 / ChatGPT API | Conversations + reasoning traces |
| 2024 | Proxy-KD | GPT-4 API (black-box) | Distributions via aligned proxy |
| 2025 | DeepSeek R1 distill | Open R1 traces | Reasoning behavior into 1.5B–70B students |
| 2026 | Alleged Qwen extraction | Claude API (Fable-era) | 28.8M exchanges, agentic + coding (Anthropic claim) |
Turc et al.'s insight — cited on HN as essential companion reading — still holds: pre-train the student, then distill. Pre-training and distillation have a compound effect even on the same data. Modern Chinese labs apply both: strong base models (Qwen, GLM) plus frontier teacher outputs.
Why HN resurfaced this now
The HN submission (66 points, June 2026) arrived amid:
- Anthropic's Senate Banking letter (June 10, 2026) — ~25,000 fraudulent accounts, 28.8M Claude exchanges, April 22–June 5, operators linked to Alibaba Qwen
- Fable 5 + Mythos 5 export ban (June 12) — global suspension citing national security
- Zhipu matching Mythos on security benchmarks (June 28) — capability gap closing outside US export control
The thread's tension mirrors the industry debate:
- Technical view: Black-box distillation is published science. Proxy-KD is a better version of what Alpaca did. Scale + pre-training + efficient architectures (DeepSeek economics) explain Chinese catch-up — not magic.
- Policy view: Industrial extraction via fake account farms violates ToS, evades billing, and accelerates rival capability on capabilities Washington treats as export-controlled (Fable status Day 18).
- Market view: HN commenters debated whether developers should route spend to cheaper Chinese APIs to compress US AI margins — the same China playbook argument in research form.
Anthropic's framing in the Senate letter: distillation at this scale is not academic reproduction — it is "the largest known distillation attack" targeting agentic reasoning, software engineering, and long-horizon tasks — the same capability classes Fable and Mythos represent.
Proxy-KD vs what Anthropic alleged
Important distinction — conflating them makes bad policy and bad engineering decisions.
| Dimension | Proxy-KD (research) | Alleged Claude extraction (Anthropic) |
|---|---|---|
| Scale | Benchmark datasets | 28.8 million exchanges |
| Access | API calls under research budget | ~25,000 fraudulent accounts, evasion infrastructure |
| Goal | Publish method beating baselines | Train production rival models (Qwen) |
| Legal frame | Academic citation | ToS violation + lawmaker briefing |
| Technique | Proxy alignment + weighted KL | Unknown — may be simpler response copying at volume |
| Authors | Alibaba + university | Operators linked to Alibaba Qwen (Anthropic claim) |
Proxy-KD explains why black-box distillation is hard and how to do it better. The scandal is about industrializing extraction against a closed frontier API — and doing it while Fable and Mythos were still live, before Anthropic's bot-detection and July 8 ID verification layer.
The Mythos detection irony: export controls target foreign-national access to cyber-capable models, while 25,000 bot accounts reportedly ran millions of exchanges undetected pre-ban.
What defenders and rivals actually distill
Not all distillation is equal. Production teams tier by what they extract:
Tier 1 — Instruction following (cheap, common)
Alpaca-style: collect (prompt, completion) pairs. Transfers chat behavior, not frontier reasoning. Legal risk: high on closed APIs.
Tier 2 — Chain-of-thought and tool traces (medium cost)
Orca / DeepSeek R1 pattern: collect reasoning steps, tool calls, multi-turn trajectories. Transfers how the model thinks. This is what Anthropic's letter emphasizes for agentic and coding workloads.
Tier 3 — Proxy-KD-style distribution matching (research-grade)
Requires proxy alignment infrastructure. Better capability retention per sample — but still needs diverse, high-quality teacher queries.
Tier 4 — White-box self-distillation (legal on open weights)
DeepSeek, Meta, Mistral distill within their own open models. Unambiguously permitted under permissive licenses.
The alleged Alibaba campaign, per Anthropic, targeted Tier 2+ at Tier 1 scale — millions of traces on Fable-class models.
Implications for developers and policy
If you build on closed APIs
Assume your outputs can and will be distilled if they are valuable. Terms of service are enforcement, not physics. Proxy-KD shows the technique improves every year.
Practical hedges:
- Rate limiting and anomaly detection on account farms (Anthropic's July 8 KYC push)
- Export controls on frontier tiers (Fable/Mythos ban)
- Open-weight release of previous generations to commoditize the teacher role (Meta Llama pattern)
If you build open models
Proxy-KD is a blueprint for legal distillation from API teachers you pay for at research scale. The compound recipe from Turc et al. still applies:
- Pre-train a capable student base (Qwen, GLM, Llama)
- Collect teacher outputs (legally, at scale you can afford)
- Align a proxy if you need distribution-level transfer
- Distill with sample weighting
- Evaluate on your tasks — not leaderboard marketing
If you follow the Fable ban
Distillation and export control are the same war viewed from different angles:
- Anthropic wants to stop capability extraction via fake accounts
- Commerce wants to stop capability export via API access to foreign nationals
- Chinese labs want frontier capability without $285B US training spend (Stanford AI Index)
Proxy-KD is the research-side documentation of item three. The Senate Banking letter is the policy-side response to item one. The June 12 directive is the response to item two.
Key papers to read
| Paper | arXiv | Why read it |
|---|---|---|
| Proxy-KD | 2401.07013 | Black-box LLM distillation via aligned proxy + DPO |
| Pre-trained Distillation | 1908.08962 | Pre-train student first; compound gains (HN recommended) |
| Distilling the Knowledge in a Neural Network | 1503.02531 | Hinton original — dark knowledge, temperature softmax |
| DistilBERT | 1910.01108 | Production distillation milestone |
Primary source for Proxy-KD claims in this article: Chen et al., PDF. Policy claims about Alibaba: Anthropic Senate Banking letter breakdown.
Bottom line
Proxy-KD is not the scandal — it is the instruction manual.
A 2024 paper from Alibaba-affiliated researchers described how to distill closed frontier models more efficiently than Alpaca ever could — using a proxy to recover the logit-level signal black-box APIs hide. Hacker News resurfaced it in June 2026 because Anthropic accused operators linked to the same ecosystem of running industrial-scale Claude extraction two days before Fable 5 went offline globally.
The technique is real, published, and improving. The allegation is about scale, fraud, and ToS — not about whether distillation works. It works. That is exactly why export controls, ID verification, and open-weight alternatives are all happening at once.
If you are choosing models today: understand that every closed API call is potentially a training example for someone else's student — unless you self-host or route through tiers you control.
Related reading
- Stealing reasoning traces: the encrypted CoT flaw — an anti-distillation bypass that extracts a frontier model's raw traces without attacking it directly
- What is AI distillation? Full primer + Fable controversy
- Anthropic vs Alibaba: 25,000 fake accounts, 28.8M exchanges
- Is Fable 5 back? Day 18 status
- Why the US banned Fable 5 — full timeline
- Claude token black market and distillation supply chain
- China AI playbook — free models and cheap compute
- Proxy-KD paper (PDF)
- Turc et al. — Pre-trained Distillation (2019)
Paper details and benchmark claims reflect arXiv:2401.07013 v2 (November 9, 2024). Anthropic allegations reflect June 2026 Senate Banking letter reporting. Verify live policy and API terms before production decisions.