The Provenance Gap: The Distillation Accusation That Proved AI Has No Ledger

Hook

Here is the datapoint that should bother you more than the accusation itself. Anthropic said it detected the abuse. It did not say how many accounts, over what span of time, or with what proof. The reporting landed in the third quarter of 2025 through a wire-service summary of a wire-service summary — Bloomberg, re-quoted by a crypto outlet, re-quoted again for a feed. By the time the claim reached the average reader, it had been compressed into a single gravity well of a sentence: a Chinese lab, Moonshot AI, allegedly ran fraudulent accounts to harvest Claude outputs for training data. Strip the formatting and the substance is thinner than the headline. One fact. One inference. Zero code. Zero logs. Zero verifiable artifact of any kind.

I have spent the better part of a decade reading post-mortems and audit reports, and I have learned to distrust the artifact-free announcement above all others. When a security claim arrives without a reproducer, it is not evidence. It is positioning. So the question I want to answer is not "did Moonshot do it." I cannot answer that, and neither can you, and that is precisely the point. The real story is structural: the AI industry has entered a phase where it is making accusations about data provenance that its own technology stack cannot substantiate. Zero knowledge is a liability, not a virtue — and right now the entire frontier-lab ecosystem is running on a mountain of it.

This is not an AI column. I write about protocols — chains, consensus, verification layers, the machinery that lets strangers agree on a fact without trusting each other. What interests me about this episode is that it exposes, in a single news cycle, the exact gap that the crypto industry keeps promising to fill. And when I look at whether crypto can actually fill it, I find the sales pitch running well ahead of the engineering.

Context

To understand why the accusation is technically plausible — plausible, not proven — you have to understand what a modern model API actually hands back to a caller.

When you call a commercial frontier model, you get text. That is the whole product surface. Tokens out, in sampled sequence. You do not get the logits, the intermediate hidden states, the attention maps, or the rejection-sampling trace the server used to shape the distribution. You get the winner of a lottery, not the odds. This distinction matters enormously, because it defines the ceiling of what anyone can steal through the API.

What a patient adversary can reconstruct from text alone is a specific and valuable subset of a model's behavior. Instruction-response pairs, obviously. The surface shape of reasoning chains — the visible scratchpad a model writes before it answers. The schema and parameter distribution of tool calls, if the API exposes function calling. The style, the refusal patterns, the formatting conventions. This is called output distillation, and it is one of the oldest tricks in machine learning. You train a smaller student to imitate the visible behavior of a larger teacher, using only the teacher's published responses.

The economic motive is easy to map. A mid-tier frontier model has historically priced in the range of a few dollars per million input tokens and a double-digit figure per million output tokens. A capable open-weight model can be served at a price that is an order of magnitude lower, or effectively free if you host it yourself. That spread creates a legitimate-looking arbitrage: pay the expensive lab to generate text, use that text as training signal, then serve a cheap model that behaves a little more like the expensive one. Do this at small scale and it is indistinguishable from ordinary product development. Do it at scale, with orchestrated accounts and identity obfuscation, and it becomes something the terms of service call fraud.

The timing is not random. Before the accusation surfaced, Anthropic had already tightened its terms around China-controlled entities. That is the tell. A terms-of-service change is a leading indicator, not a trailing one. Companies do not rewrite contracts in response to an incident they have already decided to litigate or ignore. They rewrite contracts when they have classified a behavior as a structural commercial risk and are preparing the ground for a later action. The public accusation that followed was the second move, not the first.

And this is not an isolated case. Earlier in 2025, a US frontier lab publicly alleged that a Chinese AI company had trained on its API outputs. If the Moonshot episode is real, it is a pattern, not an anomaly. Patterns are what regulators act on.

So we have a claim with a plausible mechanism, a measurable economic incentive, and a plausible geographic motive. What we do not have is a single artifact anyone outside Anthropic can inspect. That absence is where the real analysis begins.

Core

Distillation transfers shape, not substance.

Let me be precise about the ceiling, because this is the part the media coverage skipped entirely. When you distill from sampled text, you are fitting a student model to a distribution of outputs. You are not fitting it to the teacher's internal computation. The student learns to produce sequences that look like the teacher's sequences. It does not learn the latent structure that generated them.

What this buys you, concretely:

Instruction following. Formatting fidelity. Style consistency. Task decomposition patterns — the way a model breaks a problem into steps. And, critically, tool-use conventions: how to structure a function call, what arguments to pass, how to chain multiple calls across a long context.

What this does not buy you:

Calibration. The teacher's sense of when it is uncertain. The implicit knowledge density that comes from pretraining on a curated corpus. The deep reasoning that emerges from reinforcement learning against verifiable rewards. The safety alignment that was tuned in after the fact, unless the distillation process deliberately captures refusal behavior.

There is a reason this matters. The Claude family's most defensible differentiation in the last two years has not been raw text reasoning — open models have closed much of that gap on benchmarks that can be verified, like math and code. The moat is agentic capability: sustained tool use, long-horizon task execution, the ability to operate a terminal or a codebase over dozens of steps without losing the thread. That data is exceptionally scarce. You cannot scrape it from the web, because it does not exist on the web. It can only be produced by running a capable model through real multi-step tasks and recording the traces. If you are building a student model and you lack the compute or the environment to generate those trajectories yourself, buying them from a stronger model's API is the shortest path. The bug is always in the assumption — and here the assumption is that a metered API meters what a customer is doing with the output, which it fundamentally does not.

So the accusation is technically coherent. A lab with strong agentic traces is worth harvesting. But coherence is not proof, and the leap from "this would be valuable" to "this happened" is exactly the kind of jump I have watched wreck portfolios for eight years.

The four scarce commodities.

If I were designing the harvest, I would prioritize four data categories, in this order.

First, agentic trajectories. Multi-turn, long-context interactions where the model invokes tools, observes results, and adjusts. This is the rarest and most valuable class, because it is the hardest to synthesize. A synthetic pipeline can generate plausible-looking tool calls, but it cannot generate the ground truth of what a real tool returned and how a real model recovered from a real failure. The stochastic messiness is the training signal. You cannot fake it without losing the thing you were trying to capture.

Second, tool-call schemas and parameter distributions. Even without full trajectories, knowing exactly which functions a leading model reaches for, in what order, with what argument shapes, is worth real money. It compresses the search space for anyone trying to replicate the behavior.

Third, reasoning-process distributions. If the API exposes visible reasoning, you get a distribution over how problems get decomposed. Not the answer — the route to the answer. For a student model, this is a far richer signal than answer-only supervision.

Fourth, style and alignment behavior. How the model refuses. How it hedges. How it formats. This is the cheapest to harvest and the most useful for a product that wants to feel like the leader.

Notice what all four have in common. They require many interactions, long contexts, and sustained sessions — not a handful of API calls. This is the structural reason a large-scale account operation would be necessary at all. A scraper hitting an endpoint a few thousand times cannot produce the volume of long-horizon agentic data that would materially change a training run. You need persistent accounts, likely with identity obfuscation to defeat rate limits and abuse detection, running for weeks. The account fraud is not incidental to the alleged scheme. It is the scheme. Without the fraud, the harvesting does not scale.

The arbitrage chain is real and it is unpoliceable at the point of use.

Trace the value flow. Lab A sells tokens at price P. Customer B pays P for output. B uses the output to train model M. M is served at price P' where P' is far less than P. M competes with A's own product in the open market. A's revenue is eroded by a competitor it inadvertently subsidized.

This is not a novel economic structure. It is the classic tension of any business that sells a metered capability to customers who may be competitors. The novel part is that in software, you can usually distinguish a legitimate integration from a parasitic one by inspecting the pattern of usage. A real application has users, latency profiles, retention curves. A harvesting operation has different fingerprints: high concurrency from clustered IP ranges, uniform prompt structures, session lengths tuned to context windows rather than to human needs. This is detectable. It is not preventable by policy alone, because the abuse signal is statistical, and statistical signals have false positives.

And here is the asymmetry that no one in the coverage mentioned. If Anthropic's detection has a false-positive rate — and every behavioral classifier does — then the tightening that follows an accusation penalizes legitimate customers too. More aggressive identity verification. Lower free tiers. More frequent account bans. The compliant enterprise user, the one paying full price and following the rules, absorbs the cost of a fraud operation they had nothing to do with. That is the hidden externality of this entire episode, and it is the one that will actually affect most people reading this.

Composability without audit is just delayed debt.

I want to invoke a concept from my own work here, because the parallel is exact.

In 2020, I spent roughly four hundred hours simulating flash-loan attacks against an early lending protocol architecture. I built a static analysis tool to trace value flows across six interconnected pools. The point of that exercise was not to find one bug. It was to map how a single flawed assumption in one contract could cascade through the whole system. A reentrancy edge case in a rate-adjustment function is a local defect. But because the pools were composable — because each one trusted the others' accounting — the local defect became a systemic one. Interdependence amplifies both yield and risk. The same property that made the protocol powerful made it fragile.

The AI API economy has the identical structure. Models are now composed into agent frameworks, which call other models, which call tools, which may themselves be models. The output of one system becomes the training input of another. There is no audit boundary anywhere in that stack. When you buy a model, you do not receive a provenance manifest telling you what data trained it, whether that data included another model's output, or where that other model's data came from. You receive weights and a license. That is it.

This is the same debt, deferred. In DeFi, the deferred debt eventually comes due as a flash crash. In AI, the deferred debt comes due as a provenance dispute — which is exactly what we are watching. The industry built a composable supply chain with no accounting layer, and now it is trying to resolve an accounting question with press releases. Logic does not care about your narrative. The industry's narrative is that these are isolated competitive squabbles. The logic is that it shipped a system with no ledger.

The provenance gap is the real story, and crypto keeps claiming it can close it.

Here is where my two worlds collide. The crypto industry has spent years promising "verifiable AI" — decentralized compute, on-chain model registries, cryptographic attestations of training provenance, zero-knowledge proofs of inference. On paper, this is the answer to the Moonshot question. If every model carried a cryptographic birth certificate, you would not need to accuse anyone. You would just check the proof.

In 2026 I audited the architecture of an autonomous agent framework that integrated zk-SNARKs for private identity verification. I stress-tested its oracle feeds. I found a flaw in how the agent handled ambiguous state transitions — if the training data was skewed, the model could execute unauthorized transfers during edge cases where the state was genuinely indeterminate. My proposed fix was a deterministic fallback: when confidence dropped below a threshold, the system would halt and route to human review. This is the instinct that defines my work. Precision is the only kindness in code. An autonomous system that cannot prove what it will do next is not autonomous. It is unverified.

So I am sympathetic to the verifiable-AI thesis. But I am also a forensic skeptic, and when I look at what is actually deployable today, I see a gap between the pitch and the physics.

Consider what it would take to prove that a model was not trained on another model's outputs. You would need to audit the entire data lineage: every token, its source, its license, its generation process. The training corpus for a frontier model is on the order of trillions of tokens. Cryptographically committing to that corpus is feasible — you can hash a dataset. But proving that the hashed dataset contains no distilled content requires proving a negative over a distribution, which is not something a Merkle root can do. A hash commitment tells you the data has not changed. It tells you nothing about whether the data should have been there.

Zero-knowledge proofs of inference are real and improving. You can, in principle, prove that a given model produced a given output without revealing the weights. That is genuinely useful — it lets you verify what a model said and which model said it. But it does not let you verify how that model was trained. Provenance of weights is a separate problem from provenance of outputs, and the crypto narrative routinely conflates them.

Watermarking is the most commonly cited mitigation, and it is the weakest. You can bias a model to emit statistically detectable tokens. You can fingerprint its style. But watermarking is adversarial the same way steganography is adversarial: a sophisticated harvester can filter, paraphrase, or retrain past it. It raises the cost of undetected distillation. It does not prevent distillation. And it introduces its own false-positive problem — a legitimate model that happens to share stylistic patterns with a watermark could be falsely accused. We already tolerate this in plagiarism detection, and we already know how badly it fails.

So the honest answer to "can crypto close the provenance gap" is: partially, later, and expensively. Not today, and not in a way that would have settled the Moonshot dispute. Trust is a variable, not a constant. Anyone selling you a constant is selling you a story.

The evidence problem is the part the industry refuses to confront.

Let me return to attribution, because this is the crux and it is almost entirely absent from the coverage.

How do you prove that a specific entity ran fraudulent accounts? You need to link a cluster of accounts to an organization. The evidence chain is: account behavior → network infrastructure → payment rails → corporate identity. Each link is attackable. Accounts can be run through proxies. Infrastructure can be leased through resellers. Payment can be routed through intermediaries. Corporate identity is the last link and the hardest to establish, which is precisely why attribution disputes in cybersecurity are so often resolved by geopolitics rather than forensics.

I spent six weeks in 2017 doing a manual line-by-line audit of a smart contract release — a task distribution system — and found an integer overflow the core team missed during a rapid deploy. I documented twelve distinct flaws and submitted a patch. The lesson I took from that exercise was not that I was clever. It was that the defect you can prove is meaningfully different from the defect you suspect. I could prove the overflow. I could point to the exact line, the exact input, the exact consequence. That is why the fix landed. Suspicion without a reproducer gets ignored, and rightly so.

Apply that standard here. Anthropic's public claim, as reported, contains no reproducer. No account list. No session logs. No behavioral fingerprint. No count of how much data was allegedly extracted, or over what window. Without those artifacts, the claim is a statement, not a finding. Companies make statements for many reasons — legal positioning, regulatory lobbying, competitive signaling, investor narrative — and a statement that happens to be true is still a statement. The absence of evidence does not mean the event did not occur. It means the public cannot evaluate it, and therefore the correct posture is suspended judgment, not conviction.

This is where the media ecosystem fails structurally. A wire report summarizing a wire report, republished by a crypto outlet, produces a headline with maximum reach and minimum verifiability. The person who benefits from reach has no incentive to add the caveats that the person doing analysis would insist on. So the caveats vanish, and the claim hardens into conventional wisdom within a single news cycle. I have watched this happen with algorithmic stablecoins, with flash-loan exploits, with every token narrative of the last eight years. The pattern is invariant: the story travels faster than the truth, and the gap between them is where retail money goes to die.

What an actual audit would look like.

I want to be constructive, not just critical. If you wanted to make this dispute decidable, here is the minimum viable evidence set.

A behavioral fingerprint of the suspect accounts: concurrency patterns, prompt entropy, session-length distribution, and the statistical separation from the legitimate user population. A false-positive analysis: how many legitimate accounts match the same fingerprint, and at what rate. A quantified extraction estimate: how many tokens of which categories over what window, with the methodology disclosed. A chain of custody: how the accounts map to infrastructure and, if possible, to a legal entity. And an independent verifier — a third party with access to the raw data, bound by confidentiality, who can attest to the methodology without revealing the underlying accounts.

None of that was published. Which tells you the purpose was not proof. It was signal. And signaling is a legitimate strategic act. It is just not evidence, and we should stop treating it as such.

The competitive reading is the one that actually matters.

Step back from the drama and look at what the accusation reveals about the state of the race. If a frontier lab believes its output is valuable enough to be harvested at scale, that belief is a confession: the leader believes its lead is extractable, at least in part, from behavior. And if the lead is extractable from behavior, then the lead is not a durable moat. It is a head start.

This is the contrarian read, and it cuts against the framing of the entire news cycle. The commentary on both sides treated the accusation as evidence of the leader's strength — a rich model being robbed by a poorer one. I read it differently. It is evidence of the narrowing of the gap. You do not mount a covert operation to steal something that cannot be stolen. Distillation is worthwhile precisely because the behavior is copyable and the underlying capability is not.

Look at the trajectory of open models over the last two years. On verifiable tasks — math, code, structured reasoning — the gap between open and closed has compressed steadily. The dimension where the gap persists is agentic: long-horizon, tool-using, environment-interacting capability. That is exactly the dimension the alleged harvesting targeted. The choice of target tells you where the remaining moat lives. It lives in the data that is hardest to synthesize, which is the data that only real task execution produces.

And that, finally, connects back to crypto in a way I did not expect when I started writing this. The scarce commodity in AI is no longer purely compute. It is verified experience — ground-truth traces of an agent operating in the world and succeeding or failing. Crypto has spent a decade building infrastructure for exactly this kind of thing: systems that record what happened, in a way that cannot be quietly rewritten. A blockchain is, at its core, a machine for producing trustworthy traces. If the AI industry's bottleneck is trustworthy experience data, then the two industries are chasing the same primitive from opposite directions.

Whether they will actually meet is a different question. My experience says the pitch will run ahead of the engineering for years. But the direction of the pressure is real.

Contrarian

Here is the blind spot that both the accusers and the accused are incentivized to ignore.

The public debate is entirely about capability theft. Did a lab steal the ability to reason better? That framing is dramatic and easy to sell. It is also probably the least important question on the table.

The more consequential question is about alignment inheritance. When you distill from a model's outputs, you do not only inherit its capabilities. You inherit its behavioral dispositions — its refusal patterns, its hedging, its failure modes. And you inherit them selectively, because distillation is a lossy process. A student trained on sampled outputs learns the visible behavior but only partially learns the constraints that shaped it. Those constraints were enforced during the teacher's post-training via reinforcement against safety objectives. The student sees only the results of that enforcement, not the process.

So a distilled model can inherit the look of alignment without the mechanism of alignment. It learns to refuse in the patterns it observed, but it never learned why the refusal existed, so the refusal is brittle. Push it in a direction the teacher's training data never covered and there is no underlying principle to fall back on, because the principle was never transferred — only its shadow. The bug is always in the assumption, and here the assumption is that behavior transfer implies disposition transfer. It does not.

There is a second blind spot. If the harvesting process involved impersonating users or sharing context, it is possible that third-party data entered the pipeline. The coverage is fixated on "stolen capabilities" — a competitive injury. Almost no one is asking whether user conversations were swept up in the alleged operation. That would be a privacy harm, affecting individuals who never consented, and it is categorically more serious than one lab borrowing another's style. The reports do not address it. I am not claiming it happened. I am noting that the question was never asked, and the fact that it was never asked tells you the discourse is tracking commercial interests, not harm.

And a third. The entire framing rewards the accuser. A public allegation of data theft is itself a punishment, executed instantly, with no appeal. It lands everywhere in a day. The defense takes months to mount and never catches up. Trust is a variable, not a constant — and so is reputation, and the asymmetry between accusation and exoneration is structural, not accidental.

Takeaway

Every model in production today is running on an unrecorded data lineage. We cannot verify what trained it, we cannot verify what it has seen, and we cannot verify what it inherited from another model's behavior. The Moonshot episode did not create this problem. It merely made it visible for one news cycle, and then the industry went back to shipping. The question worth holding onto is not whether one lab harvested another's output. It is this: when the next dispute arrives — and it will, larger, and involving something more consequential than model weights — what artifact will anyone be able to point to? Because right now, the answer is none. And a system that cannot produce an audit trail will eventually be forced to trust whoever shouts first.