OpenAI, Anthropic, Google Unite to Fight AI Model Copying

In a rare show of cooperation, OpenAI, Anthropic, and Google have started sharing intelligence about attempts by Chinese AI labs to copy their frontier models. The collaboration, announced on April 6, runs through the Frontier Model Forum — the industry nonprofit the three companies co-founded with Microsoft in 2023.

Why this matters: companies that spend billions training cutting-edge AI models are watching competitors replicate their capabilities at a fraction of the cost, potentially undermining both their business models and U.S. technological leadership.

What's Actually Happening

The three companies are pooling threat data about "adversarial distillation" — a technique where someone systematically queries a powerful AI model and uses the outputs to train a cheaper copycat. Think of it like a student copying exam answers: you don't need to study the material if you can see someone else's work.

The information-sharing model borrows directly from cybersecurity. When one company spots a new attack pattern — unusual query volumes from specific IP ranges, automated prompt chains designed to extract model behavior — it flags the pattern for the others. Each company can then update its own defenses.

The Problem That Forced Rivals Together

This collaboration didn't happen in a vacuum. In March, Anthropic identified three Chinese AI labs — DeepSeek, Moonshot, and MiniMax — as engaging in illicit capability extraction through distillation. The scale was staggering: Anthropic detected roughly 24,000 fake accounts being used to systematically harvest Claude's intelligence.

The economics explain why this keeps happening. Training a frontier model from scratch costs hundreds of millions of dollars and requires massive computing infrastructure. Distilling one through API access costs a tiny fraction of that. For labs operating under U.S. export restrictions that limit their access to cutting-edge chips, distillation becomes an appealing shortcut.

OpenAI has faced similar challenges. Researchers have previously documented cases where outputs from GPT models appeared to be feeding training pipelines at competing labs, a practice that violates the terms of service but is difficult to detect and even harder to stop.

How the Defense Works

The Frontier Model Forum's threat-sharing system works on three levels.

First, detection. Each company monitors its API for patterns that suggest distillation rather than normal usage — things like systematically probing model boundaries, extracting chain-of-thought reasoning across thousands of prompts, or running automated evaluations designed to map a model's capabilities.

Second, attribution. When a suspicious pattern is identified, the companies cross-reference data to determine whether the same actors are targeting multiple platforms simultaneously.

Third, mitigation. Shared intelligence allows all three companies to block known attack vectors before they spread. If Anthropic catches a new distillation technique on Claude, OpenAI and Google can proactively defend GPT and Gemini.

The Bigger Picture

This collaboration sits at the intersection of business competition and national security. The U.S. government has spent years trying to maintain an AI advantage through export controls on advanced chips. But if Chinese labs can simply copy the outputs of American models, hardware restrictions become less effective.

The timing is also notable. It comes as the Trump administration has taken increasingly aggressive stances toward AI companies on national security grounds — including a recent attempt to blacklist Anthropic as a supply chain risk (which a federal judge blocked in March). The industry's willingness to self-organize on IP protection may help make the case that private-sector cooperation can address security concerns without heavy-handed government intervention.

What Industry Insiders Are Saying

The reaction from the AI community has been mixed but largely supportive. Security researchers have praised the cybersecurity-inspired approach, noting that threat intelligence sharing transformed how the tech industry handles cyberattacks.

Critics, however, point out that distillation is difficult to fully prevent. Open-source models like Meta's Llama are freely available for anyone to study, and the line between legitimate research and illicit copying isn't always clear.

What Comes Next

The Frontier Model Forum plans to publish standardized detection protocols that any AI company can adopt, not just the founding members. This could expand the defensive network significantly.

For developers and enterprises using these models, the immediate impact is minimal — the protections happen behind the scenes. But if the collaboration succeeds, it could set a precedent for how AI companies handle intellectual property protection in an industry where the product is, by nature, designed to be queried.

The bottom line: three of the world's fiercest AI competitors decided that protecting their collective R&D investment matters more than their rivalry. That alone tells you how serious the distillation problem has become.