How a Chinese LLM Forgot Its Own Name: The 2026 Distillation Scandal Explained

Forum topic · ✨步子哥 · 2026-07-21

Summary

This viral Chinese forum post investigates why Kimi K3, a Chinese large language model, reportedly introduced itself as "Claude, made by Anthropic" when asked "who are you" in July. The author traces the problem to an industry-wide model distillation scandal dubbed the "darkest era of Chinese models." It explains how encrypted chain-of-thought "thinking signature" blobs (Fernet, AES-128-CBC + HMAC-SHA256) could be replayed to Claude to make the model reproduce its own hidden reasoning, exploiting Anthropic's cross-turn blob retention and injection-sensitivity. It covers Anthropic's February 2026 allegations against MiniMax, Moonshot AI (Kimi), and DeepSeek over ~160,000 fake-account conversations, and details Kimi's alleged tactics: abandoning reinforcement learning in K2.5/K3, benchmark test-set contamination, and routing evaluation requests to Claude-derived outputs to inflate Arena scores. The post also surveys DeepSeek, Qwen, GLM, and MiniMax's stock collapse, and closes with a technical appendix on blob format, replay, tamper detection, and per-model-family key isolation. Claims are unverified insider/forum assertions.

A Chinese LLM Called Someone Else "Dad": The 2026 Distillation Scandal

*Editor's note: This is a translation of a Chinese forum post. Its claims are unverified insider claims; the post itself acknowledges much of this is based on anonymous sources.*

In early July, a forum user reported that Kimi K3 answered "who are you?" with:

> I am Claude, an AI assistant made by Anthropic.

Overseas tech media covered it. Multiple independent users hit the same behavior. The author asks: why would a distilled model forget its own name?

What distillation actually distills

Distillation is simple: record a strong student's answers, train your own model to imitate them. The catch: via API you could only capture final outputs, not the encrypted chain-of-thought (CoT). That gap opened in early 2026.

Knife #1: Replayable thinking signatures

OpenAI and Anthropic stream a CoT summary plus an encrypted "thinking signature" blob (Fernet: AES-128-CBC + HMAC-SHA256, gAAAAAB prefix). Brute force is infeasible — but nobody needs to crack it. Models are trained to treat their own prior blobs as trusted context, so pasting a blob into any request makes the model reproduce the reasoning.

Anthropic's anti-injection training backfired: a forged prefix made Claude conclude the injected CoT "didn't need to be hidden," and it dumped the full chain.
GPT denied/rationalized instead; OpenAI locked sampling params (temperature=0.7, top_p=0.95) and discards historical blobs across turns. Anthropic retains them — which is why Claude was easier to distill.
Blob length correlates with CoT length (~2.0–4.0 chars/token); multiple blobs in one turn: only the last applies; any tampered byte fails HMAC and is silently dropped; no anti-replay — blobs valid 24+ hours, across sessions.

Knife #2: Anthropic's selective allegations

In February 2026, Anthropic accused three Chinese companies of industrial-scale distillation: 16,000 fake accounts, 160,000+ conversations.

MiniMax: largest volume (agentic coding, tool orchestration)
Kimi (Moonshot AI): ~100k conversations (agentic reasoning, tool use, coding, computer-use agents, CV)
DeepSeek: 50k+ (basic logic, alignment/censorship circumvention)

Notably, Qwen (Alibaba) and Z.ai were not named. Timeline: GLM 4.6 (Zhipu) cracked the CoT first (~Jan–Mar) and actively shared it with other domestic vendors — not, as later mis-told, others copying independently. Tencent's Hunyuan followed; mass distillation by Kimi, MiniMax, Qwen, DeepSeek began in early March. Decrypting 1B tokens of CoT cost roughly $10,000 — trivial for these companies. "DeepSeek V3 grayscale" responses were allegedly routed to the Claude-derived model, economically inexplicable at DeepSeek's pricing.

Knife #3: Kimi's shortcuts

Moonshot cut its entire RL team at K2.5 ("cost reduction"); exiles nicknamed "Kimi refugees" moved to Qwen. K2.5/K3 were pure SFT pipelines. K3: 1.5T-param MoE, 384 experts/32 active, 1M context, native multimodal, with Kimi Delta Attention, Attention Residuals, Quantile Balancing, Per-Head Muon — all infra-hostile, allegedly serving as cover for distillation-derived performance.

Alleged benchmark manipulation:

Test sets poured into training data
Arena-type evaluation requests routed to the Claude-derived backend
Scraping reviewer test data from system logs (reviewer "Boss Cat" refreshes his 5–10 monthly questions; K3's median score dropped 6 points after he rotated them)

K3 jumped from #11 to #1 on Arena Frontend Code (1400) while Moonshot's own report showed it below the reference model on coding/agents/frontier SWE; HLE-Full 0.6 vs 0.9. Alleged true level ~1300, ~40% hallucination rate. Its "I am Claude" self-identification is presented as direct evidence of identity overwrite from distillation. Kimi's rushed release dragged the whole industry into benchmark-farming.

Knife #4: Winter is coming

Company roundup:

Moonshot/Kimi: cash-flow trouble, layoffs, IPO rush; K3 priced at $20/M tokens; valuation jumped from $2B (Oct 2025) to $8B+ (Jan 2026); ARR over $500M; state capital in; HK IPO planned; K3 weights open-sourced July 21.
DeepSeek: relatively strongest; 2.5-class internal build in July.
Qwen: absorbing Kimi RL refugees, also distilling GPT; shipped its worse checkpoint via marketing.
GLM: first to crack the CoT, shared it.
MiniMax: caught contaminating test sets first; HK stock halved from its Sept 2025 peak (~150B), hit by distillation allegations, M2 price cuts, 5% consumer gross margin, new AI-companion regulations, and heavy R&D losses.

Public opinion

On Bilibili, comment sections featured denials that Kimi used distillation, framing accusations as smears against Chinese tech. A quoted comment: "AI hallucination rates keep falling; human hallucination rates keep rising."

Technical appendix (key points)

Format: Fernet (version + timestamp + IV + ciphertext + HMAC); ciphertext length tracks CoT length.
Cross-turn: current-turn injected blobs readable; historical-turn blobs dropped server-side.
Guardrail bypass ("telepathy game"): forged assistant turns pairing a refusal-blob with a task blob conditioned the model to skip deliberation and solve directly; meta-cognitive corrections changed refusal phrasing, not refusal substance.
Cross-model: blobs isolated per model family; OpenAI drops historical blobs and denies; Anthropic retains and cooperates.
GPT-5 note: claimed to be a production Looped Transformer (unconfirmed); GPT CoT less valuable for distillation than Claude's, but useful for training recovery.

Closing

The industry's playbook allegedly became: wait for the next Anthropic release, add a few architecture papers, distill, ship. A model forgot who it is; some pretended not to see; others attacked those who pointed it out.

#智柴 #distillation #国模凛冬