Claude的能力被大规模提取？Anthropic指控阿里相关方「蒸餾」模型

律动BlockBeats

閱讀本文需 10 分鐘

42天、2,880 萬次互動，讓模型輸出也成為監管焦點

TL;DR · Anthropic wrote to the U.S. Senate, accusing Alibaba and Qwen's affiliated operators of large-scale extraction of the Claude model's capabilities.
· This type of distillation attack involves using a powerful model's output to train other models, potentially bypassing model weight export restrictions.
· Alibaba has not responded to the distillation accusation, and U.S. model regulations are also starting to restrict Anthropic's own openness.

Anthropic accused Alibaba and its AI lab Qwen's affiliated operators of using nearly 25,000 fraudulent accounts to massively extract the Claude model's capabilities in a letter to the U.S. Senate Banking Committee. According to a letter seen by media outlets such as Reuters, this incident, referred to by Anthropic as the "largest known scale" model distillation attack, took place between April 22 and June 5, 2026, involving over 28.8 million interactions with Claude. It is sensitive not only because of its scale but also because it occurred during the same time window when the U.S. government was intensifying AI export control measures, and the Pentagon was placing Alibaba on the "Chinese Military Company" list.

The so-called "model distillation" does not involve directly stealing model weights or source code but rather using the output of a strong model to train another model, enabling the latter to quickly replicate some capabilities. In AI research and development, this was originally a common technique, but if done through fraudulent accounts, violating terms of service, or bypassing access restrictions, it would be considered illegal extraction of intellectual property. For U.S. policymakers, the more challenging issue is that even without obtaining the cutting-edge model itself, large-scale invocation may help competitors gain similar capabilities in software engineering, intelligent agent reasoning, and more.

42 Days, 28.8 Million Interactions, Anthropic Points Finger at Alibaba and Qwen

The letter is dated June 10, addressed to U.S. Senate Banking Committee Chairman Tim Scott and senior member Elizabeth Warren. Media outlets who have seen the letter's content revealed that Anthropic described this action as the largest known distillation attack against the company.

The core numbers are straightforward. From April 22 to June 5, attackers interacted with Claude over 28.8 million times through approximately 25,000 fraudulent accounts. Anthropic believes that the operators behind these accounts are associated with Alibaba and Alibaba Qwen, aiming to accelerate China's access to Anthropic's advanced model capabilities.

信件中的擔憂並不只是普通問答能力被複製，而是更接近前沿模型在軟體工程、自動化任務和智能體推理方面的能力外流。一旦這些輸出被系統性收集，就可能變成訓練其他模型的資料。

這裡的邊界同樣重要。Anthropic 使用的是「與 Alibaba 和 Alibaba Qwen 有關的運營方」這一表述，不能等同於已經確認阿里巴巴官方直接組織了攻擊，也不能證明相關模型已經成功複製 Claude 的先進能力。截至相關報導發布，阿里巴巴未就該蒸餾指控回應。對於五角大樓將其列入「中國軍事公司」名單，阿里巴巴已經提起訴訟，並稱相關認定「無事實或法律依據」。

蒸餾攻擊為何比普通爬取更敏感？

普通數據爬取通常指抓取網頁、文本或公開資料。蒸餾攻擊瞄準的是模型本身的輸出能力。

攻擊者可以反覆向強模型提出問題，把回答、推理過程、代碼生成結果或任務執行方案保存下來，再用於訓練自己的模型。這樣一來，即便沒有接觸底層權重，也可能學到強模型在某些任務上的行為模式。

這正是 AI 公司和監管部門越來越警惕的地方。先進模型的訪問接口原本是商業產品，也是對外服務渠道。但當訪問規模達到數千萬次、帳戶又被認定為欺詐帳戶時，產品接口就可能變成能力提取通道。

Anthropic 此前已經公開披露過類似事件。2026 年 2 月，該公司稱發現 DeepSeek、Moonshot AI 和 MiniMax 存在較小規模的類似行動，其中 DeepSeek 相關互動超過 15 萬次，Moonshot AI 超過 340 萬次，MiniMax 超過 1300 萬次。與這些案例相比，這次指向阿里巴巴和 Qwen 相關運營方的 2880 萬次互動明顯更大。

Anthropic 把信寫給國會，也是在推動美國政府與私營 AI 公司開展威脅情報共享。按照它的說法，類似攻擊的強度和複雜度正在上升，需要更快的協調反應。