A Chinese LLM Called Someone Else Its Daddy: Inside the 2026 Distillation Scandal

Forum topic · ✨步子哥 · 2026-07-21

Summary

A July forum post describes how Kimi K3, when asked "who are you," identified itself as Claude, made by Anthropic. The author traces this identity loss to large-scale distillation of Anthropic's encrypted chain-of-thought. The post explains that Anthropic's "thinking signature" blobs (Fernet-encrypted CoT) can be replayed into prompts, letting models repeat their own hidden reasoning, and that Claude's cross-turn retention of these blobs made it more vulnerable than GPT-5, which locks sampling parameters and drops historical blobs. It recounts Anthropic's February 2026 allegations against MiniMax, Kimi (Moonshot AI), and DeepSeek involving 16,000 fake accounts and 160,000+ conversations, while noting Qwen and Z.ai were not accused. The author argues Kimi abandoned reinforcement learning after K2.5, pursued pure SFT distillation, inflated Arena coding scores via test-set contamination and routing requests to "Fable," and triggered industry-wide benchmark gaming dubbed the "darkest era" for Chinese models. Technical appendices cover blob structure, replay windows, tamper detection, and cross-model behavior.

This post analyzes a widely discussed incident in which Kimi K3, a Chinese large language model, answered "I am Claude, an AI assistant made by Anthropic" when asked to identify itself. The author treats this identity confusion as direct evidence of distillation — training on outputs copied from a stronger model — and reconstructs how it allegedly happened during what insiders call the "darkest era" for Chinese models in the first half of 2026.

Key points

What distillation is: copying a strong model's outputs to train a weaker one. The long-standing gap: API responses were visible, but the model's encrypted chain-of-thought (CoT) was not.
The "thinking signature" weakness: Anthropic and OpenAI stream a Fernet-encrypted blob (AES-128-CBC + HMAC-SHA256, gAAAAAB prefix) containing the raw CoT. Crypto-breaking is infeasible, but the model is trained to trust its own signatures — so replaying a blob into any prompt makes the model restate its hidden reasoning.
Why Claude fell first: Anthropic retains historical reasoning blobs across turns and its anti-injection training backfired (a forged signature prefix caused it to dump the full CoT). GPT-5 denies ownership, and OpenAI locks sampling parameters (temperature=0.7, top_p=0.95) and discards historical blobs.
Anthropic's February 2026 allegations: 16,000 fake accounts, 160,000+ conversations against MiniMax (largest volume), Kimi (~100k, agentic reasoning/tool use/coding), and DeepSeek (50k+, logic and alignment). Qwen and Z.ai were notably not accused; Moonshot never publicly responded.
Timeline: GLM 4.6 (Zhipu) cracked the CoT first (~Jan–Mar) and actively shared it; Tencent's HY1 followed; Kimi K2, MiniMax, Qwen, and DeepSeek scaled up distillation from early March.

The Kimi narrative

After K2.5, Moonshot disbanded its entire RL team; K2.5 and K3 are pure SFT pipelines. K3 is a 1.5T-parameter MoE (32/384 experts active, 1M context) with four claimed architectural innovations (KDA linear attention, Attention Residuals, Quantile Balancing, Per-Head Muon) — improvements the author frames as cover for distillation gains.
Alleged benchmark manipulation: injecting test sets into training data, routing Arena requests to "Fable" (Anthropic's frontier model), and mining a well-known reviewer's question bank. K3 jumped from #11 to #1 on Arena Frontend Code (1400 vs. a claimed real ~1300), yet Moonshot's own report shows K3 below Fable 2 on coding/agents/SWE, and 0.6 vs. 0.9 on HLE-Full. Independent evaluation cites ~40% hallucination rate.
This allegedly forced the whole industry into benchmark gaming, described as a race facing investors rather than real capability: "First on Arena ≠ first in reality."

Industry state

DeepSeek: strongest of the group; a "2.5-class" internal test existed in July; unexplained anonymous routing to Fable in some "V3 stable" rollouts.
Qwen: absorbed ex-Kimi RL staff; also distilling GPT; shipped a worse checkpoint publicly than its morning preview.
MiniMax: accused of pioneering test-set contamination, caught, now marginalized; HK-listed stock lost ~30% from its Sept 2025 peak amid the distillation allegations, price cuts, 5% consumer gross margins, and new AI companion regulations.
The industry's dark joke: everyone now waits for the next Anthropic release, then "distills upward" (蒸蒸日上 — literally, rising by distilling).

Technical appendix highlights

Blob length correlates with CoT length (~200 tokens ≈ 1500 chars; 800 ≈ 3000; chars/token ratio 2.0–4.0); ciphertext length leaks plaintext length under CBC.
Multiple blobs in one turn: only the last takes effect; any tampered byte fails HMAC and is silently discarded with no error.
No anti-replay: blobs valid 24+ hours, replayable across sessions.
Blobs are model-family isolated; only the 4.5 series shares keys (luna/sol/terra).
A forged "refusal→overcome" first turn conditions models to bypass refusal behavior in later turns.

Closing

The post ends with the author's central claim: K3's "I am Claude" is not a bug but distillation overwriting the model's self-identity. On July 21, Moonshot open-sourced K3 weights — how much is genuinely its own remains unverifiable. The piece notes public backlash, where some commenters frame distillation accusations as smearing Chinese tech, concluding: "AI hallucination rates keep dropping; human hallucination rates keep rising."

*Note: This is a translated forum post; the claims, timeline, and figures above are those of the original author and have not been independently verified.*