OpenAI, Anthropic, Google Unite Against Chinese Model Copying

OpenAI, Anthropic, and Google have started systematic cooperation through the Frontier Model Forum to combat Chinese AI labs that extract outputs from their frontier models to train competitive Chinese systems. The joint effort, reported by Bloomberg, represents a notable shift in an otherwise aggressively competitive industry.

The Problem

Chinese AI labs have been systematically extracting outputs from US frontier models (GPT-5.4, Claude Opus 4.6, Gemini 3.1 Pro) to train their own models. Techniques include:

Knowledge distillation: Using extracted outputs as training targets for smaller, faster Chinese models. This lets Chinese labs achieve frontier-adjacent capability without the compute cost of true frontier training.

Adversarial probing: Programmatic queries designed to extract model capabilities, weaknesses, and training data signatures.

Benchmark hacking: Extracting specific high-quality outputs on benchmark tasks to improve Chinese model scores without genuine capability gains.

Synthetic data generation: Using US models to generate training data for Chinese models — a violation of most US providers' terms of service.

The Specific Concern: Frontier Capabilities

The most concerning case is cybersecurity. Per reports, Chinese researchers have been probing Claude Mythos Preview (despite Anthropic's restricted access via Project Glasswing) to understand its zero-day discovery capabilities.

If Chinese labs successfully replicate frontier cybersecurity capabilities through distillation:

• National security: Advanced vulnerability discovery is militarily significant
• Critical infrastructure risk: Power grids, financial systems, healthcare become targets
• Arms race acceleration: Forces democratic AI labs to also develop offensive capabilities

Hence the unusual cooperation — even aggressive competitors see shared interest in preventing rapid capability transfer to Chinese labs.

The Frontier Model Forum

Founded in 2023 by Google, Anthropic, Microsoft (via OpenAI), the Frontier Model Forum was originally focused on AI safety research. In April 2026, it expanded charter to include:

Threat intelligence sharing: Labs share detected extraction attempts, characteristic patterns, and attacker tactics.

Coordinated response: When Chinese extraction is detected on one lab's infrastructure, others get notified quickly.

Joint policy advocacy: Coordinated approach to US and allied government AI export controls.

Technical countermeasures: Shared detection methods, watermarking research, API usage pattern analysis.

Detection Methods

Labs are deploying multiple techniques:

Query pattern analysis: Normal users ask varied questions. Extraction attempts show statistical signatures — systematic probing of capabilities, benchmark-like queries, unusual batch patterns.

Response watermarking: Embedding subtle statistical signatures in outputs that can be detected in derivative models. If Chinese model X shows statistical correlation with US model Y's outputs, that's evidence of distillation.

Anomalous billing: Large-scale extraction requires substantial API spending. Unusual corporate accounts with massive query volumes trigger review.

Behavioral fingerprinting: Different model architectures have characteristic ways of solving problems. Fingerprint matching identifies when Chinese outputs are suspiciously similar to US model patterns.

Indian Position

Where does India sit in this geopolitical AI competition?

Ambiguous positioning: India has strong technology relationships with US AI labs (Microsoft invests heavily in India, OpenAI and Anthropic have India strategies) while also avoiding direct confrontation with China.

Local models important: Sarvam AI, Krutrim, and other Indian foundation models become geopolitically relevant. Sovereign Indian AI capability reduces dependency on either US or Chinese AI.

Indian AI regulation: India's AI regulatory approach will need to account for both ecosystems. Outright bans on Chinese AI APIs would hurt Indian startups using DeepSeek for cost reasons. But permissive access could create national security concerns.

Practical approach: Indian enterprises working with sensitive data (defense, finance, healthcare, government) should default to US AI or Indian AI. Cost-sensitive consumer applications can consider Chinese options with appropriate data safeguards.

Implications for US AI Users

Terms of service enforcement: Expect US labs to more aggressively enforce anti-distillation terms. Large corporate customers may see increased scrutiny.

Geographic restrictions: Some US labs may restrict API access from specific countries (already the case with some Chinese IP addresses).

Export controls: Expect further expansion of US export controls on advanced AI chips to China, potentially expanding to AI model access.

Pricing changes: Detection and enforcement costs may flow through to pricing, especially at enterprise tiers.

Implications for Chinese AI Users

Access uncertainty: Chinese users of US AI APIs may see reduced access, VPN detection, or outright blocks.

Domestic alternatives: DeepSeek, Qwen, Baichuan, GLM will continue improving. For most use cases, Chinese alternatives remain viable.

Innovation incentive: Access restrictions may accelerate genuine Chinese foundational AI development rather than extraction-based shortcuts.

The Bigger Picture

The Frontier Model Forum's coordination is remarkable for how rarely AI labs cooperate on anything. The fact that OpenAI, Anthropic, and Google — intense competitors — are working together suggests both the scale of the extraction problem and the geopolitical stakes.

Expect this cooperation to expand. Expect Chinese labs to push back via their own cooperation. Expect governments on both sides to further enmesh AI development with national security policy.

For Indian AI, the lesson is clear: strategic autonomy matters. Dependency on either US or Chinese AI infrastructure creates long-term strategic vulnerability. Sarvam AI's rise, IndiaAI Mission investment, and domestic data center buildout are all responses to this reality.

---

Source: Bloomberg (April 6 2026), Frontier Model Forum statements