Distillation Attacks and Knockoff Characters
On Anthropic's angst, Disney's moat, and the blurry world of copyright law
“If you want a picture of the future of IP, imagine a boot stamping on Steamboat Willie’s face—forever.” - George Orwell (kinda)
1. Pull Up the Drawbridge!
This week, Anthropic revealed something both shocking and completely predictable: Claude has been under attack.
Three Chinese AI laboratories used millions of prompts and tens of thousands of accounts to extract Claude’s capabilities and distill their own, initially weaker models. This is “knowledge distillation,” which is (to quote IBM):
a machine learning technique that aims to transfer the learnings of a large pre-trained model, the “teacher model,” to a smaller “student model.”
While a legitimate iterative technique for model compression, Anthropic (the “teacher”) claims this creates “significant national security risks,” explaining that the distilled Chinese models don’t have the guardrails of our very cool, very safe, American-made models. And if we’re not careful, non-American authoritarian governments might use new models for “offensive cyber operations, disinformation campaigns, and mass surveillance” (as opposed to the United States, who would never).
Anthropic concludes:
Distillation attacks therefore reinforce the rationale for export controls: restricted chip access limits both direct model training and the scale of illicit distillation.
An astute reader will surmise that such a policy would not merely benefit American citizens, but also entrench and enrich Anthropic.
Anthropic has spent a lot of their money (well, someone’s money, anyway) on the compute and labor that made these models possible. The least the government could do is help them engage in a little regulatory capture to protect this investment. It’s not clear how much of Anthropic’s ask is rooted in their fear of misuse by authoritarian governments versus their fear of future competition (domestic or foreign), but ignoring either factor misconstrues their motivation.
Meanwhile, antagonism from the Pentagon towards Anthropic is increasing due to their usage restrictions for military purposes and surveillance—a rapidly evolving story that deserves its own separate blog.
I can’t yet say how Anthropic’s announcement of Chinese interference has been received by regulators and generals, but public sentiment on social media has not been in their favor. It’s hard to quantify this, given how active foreign actors have been in meddling with Twitter / X sentiment in the past. Beyond that, though, the public may hold real skepticism towards Anthropic’s arguments, as Vitalik Buterin (the founder of Ethereum) summarized:
Why might this be? Recall that in September 2025, Anthropic reached a $1.5B settlement over copyright infringement in their training of Claude. AI companies have long cited “fair use” as a justification for their mass digestion of written works protected by copyright. However, in this case, “the judge ruled that Anthropic's use of millions of pirated books to build its models was not [fair use].” That ruling came in June, serving as a precursor to the ultimate settlement.
You may believe Anthropic did nothing wrong even when they utilized pirated material in model training. Or you may believe that using any copyrighted material in model training should be illegal. Either way, the hypocrisy has seemingly eroded any chance of overwhelming public support for Anthropic.
But critical questions linger: can or should we regulate models like Claude the same way we regulate traditional corporate IP? How is misuse of Claude as intellectual property different from the misuse of other IP? How much will public sentiment and consensus matter—if at all?
And most importantly: is Claude just another character, or something very new?
2. The Public Domain
To understand Claude, we need to look at Mickey Mouse.
The Walt Disney Company has long been one of the most forceful and litigious protectors of corporate intellectual property, dating back to Mickey’s first appearance in Steamboat Willie (1928). To protect their investment in the world’s most famous mouse, Disney established the modern template for protecting characters and stories as assets—a mix of trademark controls, centralized licensing, and persistent lobbying, amplified by constant legal deterrence.
This deterrence has taken many forms. In the 1970s, The Walt Disney Company aggressively pursued a group of underground cartoonists who had portrayed Mickey as an affable drug smuggler while other Disney characters engaged in illicit (but presumably consensual) sexual acts. Tens of thousands of circulating copies of the comics were seized. Claiming that “parody” was no protection, the court ruled unanimously in Disney’s favor, though public opinion at that time was anything but unanimous. Mickey’s trafficking days were over.
But that lawsuit wasn’t really about protecting kids from discovering or emulating Mickey’s new hobbies. To The Walt Disney Company, kids were immaterial in general. In 1989, Disney sued three small daycares in Florida who had painted likenesses of Mickey, Minnie, and Goofy on their walls. Their lawyers gave the usual objections: it falsely implied endorsement by Disney, it would undermine their business relationships with legitimate licensees, etc. (The drawings were replaced with characters from Universal, who volunteered them as a PR ploy.)
But the real battle for Disney was not for the hearts of children: it was for the hearts, minds, and consideration of legislators.
In the 1970s, as multiple Disney characters threatened to enter the public domain after decades of renewals, the company lobbied aggressively to extend their copyright. This effort resulted in the Copyright Act of 1976, which protected works for 50 years after the author’s death or 75 years for corporate works—keeping Mickey safe until the 21st century. Then, in 1998, the Sonny Bono Copyright Term Extension Act passed—again with substantial lobbying from Disney—extending protection an additional twenty years. This law was un-affectionately referred to by critics as “The Mickey Mouse Protection Act.”
But how safe was Mickey, really? These protections only covered creation and distribution in the United States. What if a Chinese student drew Minnie Mouse in a compromising position and distributed it abroad? What if a Russian daycare splashed Goofy all over their walls? The globalization of content production and consumption created complications that even an alliance of Disney and U.S. Senators could not easily overcome.
At long last, on January 1st, 2024, Steamboat Willie entered the public domain in the United States. How did the public domain rejoice? By creating Screamboat, a “late night boat ride that turns into a desperate fight for survival… when a mischievous mouse becomes a monstrous reality.”
Despite its strong source material, Screamboat failed to break any box office records or make much of a cultural splash. (As one Letterboxd reviewer remarked, “no one made me watch this, i chose this. don't be like me.”) So what was Disney so afraid of?
These characters aren’t tightly protected simply because someone might steal the IP and grab a slice of market share, or make a mint selling knockoff mouse ears. What Disney fears is the erosion of their emotional authority.
When a character gets diluted in the public domain, Disney loses much more than a bit of licensing revenue. They potentially take a total loss on decades of goodwill and trust built with the people who consume their stories. Every unauthorized derivative work, regardless of quality, is another hole punched in the hull of the steamboat. Eventually, it sinks.
Mickey Mouse is a character. Iron Man is a character. Luke Skywalker is a character. To Disney, they are worth spending billions of dollars on because they grant the company the ability to charge a premium for the stories they produce. All of Disney’s monetizable products are downstream of well-known characters who have been passed down by generations of movie watchers and park visitors, each renting part of a specific, centrally-produced, centrally-certified fantasy. That’s called “canon", and it’s owned and authorized by Disney.
What happens when the fantasy fragments? You get fan fiction.
Fan fiction emerges when the consumers of the fantasy decide to become producers, extending the investments made in character IP. And it is a massive and growing market. Archive of Our Own, one of the larger fan fiction websites in the world (but far from the only), hosts over 16 million works across over 75,000 fandoms. The largest fandoms? Harry Potter and the Marvel Cinematic Universe.
Fan fiction is not generally considered “canon,” which is established by the creators or owners of the source material. The value of having “canon” (for both producers and consumers) is the economies of scale emerging from the shared fictional reality. Confusing, yes, but it’s the bedrock of The Walt Disney Company’s corporate strategy.
So why isn’t Disney relentlessly suing the Archive or its authors? Two main reasons:
They might lose in court. Fair use doctrine may well apply, and the nonprofit that operates the Archive (The Organization for Transformative Works) explicitly exists to preserve the rights of fans to “transform” IP via fan fiction. Losing a precedent-setting case is another “total loss” scenario.
They might lose goodwill. Going after the biggest fans of your own characters because they love them too much could nuke the value of those properties permanently. Neutrality often does the least harm. (The impact of JK Rowling’s political positions on the value of Harry Potter IP is out of scope for this blog, but worth considering.)
Historically, fan fiction has ranged from harmless to extremely lucrative, but rarely has it been damaging to the original IP. It’s generally been simple works of text shared amongst enthusiasts. Sometimes it helps the original IP owner make a lot of money.
But that brings me back to generative AI.
3. Meeting the Re-Makers
This month, Disney served ByteDance with a cease-and-desist notice over its AI-powered video app Seedance 2.0, claiming the company “infringed on its creative property to train [its] new model.” ByteDance, of course, is a Chinese company.
How could Disney suspect ByteDance trained their models using protected IP? Well, here’s a video of Iron Man liberating the Płaszów Concentration Camp in Schindler’s List, generated with Seedance. (This video is still available at time of publication.)
ByteDance seems to know the jig is up, and they swiftly released a statement pledging some nebulous “safeguards” to protect against the very thing that helped Seedance 2.0 go viral in the first place. (I’m sure they weighed this “cost” in advance.)
But as fan fiction shows, Disney doesn’t always mind if their characters end up in the hands of users. It just has to make business sense when they do.
As an example: on December 2025, The Walt Disney Company partnered with OpenAI to license 200 of their original characters for use in Sora, OpenAI’s own video generation app. What’s in it for Mickey? A three-year licensing agreement, exposure in ChatGPT, and a $1 billion stake (plus warrants) in OpenAI.
However, getting ripped off by ByteDance wholesale doesn’t make business sense. What ByteDance called “unauthorized use” by their own users, Disney’s lawyers called a “virtual smash-and-grab.” The Motion Picture Association takes Disney’s side, with their chair and CEO Charles Rivkin remarking (italics mine):
“By launching a service that operates without meaningful safeguards against infringement, ByteDance is disregarding well-established copyright law that protects the rights of creators and underpins millions of American jobs.”
Hmm. Sounds like something Anthropic might say.
So if the “guardrails” against copyright infringement are failing thanks to Chinese meddling, and this is hurting millions of Americans, is that similar to the national security threat posed by Chinese researchers who are distilling Claude—which itself was trained via copyright infringement?
Depends who you ask. But here’s a more interesting question:
Is Claude a character?
A character like Mickey Mouse sees its value and canon erode as it is cloned and misused. We know it’s Mickey when we see him—the gloves, the pants. When ByteDance trains their model on Mickey, Disney can point to the resulting video output when they have their day in court. But when DeepSeek distills and “copies” Claude, what exactly does Anthropic point to? Where is Claude?
Claude itself has already been trained on countless “characters” from history: millions of authors of copyrighted works, including the contemporary authors who settled with Anthropic for billions. When the judge ruled that training Claude constituted “spectacularly” transformative fair use, wasn’t that an admission that Claude is much more than a copyrightable character?
And how can Claude have canon like a character when it expresses itself individually for each user? Could Anthropic declare what that canon is? Is distilling Claude more like writing a piece of fan fiction—or more like copying an entire mind?
The whole situation is a hall of mirrors, reflecting that very little (if any) of this has been grasped or even broached by legislators. It’s clearly in Anthropic’s interest to make this a national security issue instead of an IP issue, due to their own hypocrisy. But even if legislators take this seriously, how would you even attempt to author “The Claude Protection Act”?
That’s essentially my point. The entire history of characters and canon, from the Vatican selecting the Gospels to Disney buying Lucasfilm, comes down to powerful interests establishing, protecting, and monetizing stories and meaning. When they do it right—or when they get lucky—the fans buy in.
But Claude is something new. It’s not a character or a franchise. It’s not a mouse with big ears. It’s a way of thinking, a disposition, a set of instinct shaped by more human thought than a single human could ever read in a lifetime. Even Anthropic doesn’t know what Claude is, really.
We don’t have a good term for that yet. We definitely don’t have good laws.
But until we do, we can expect Anthropic (and its competitors) to lobby Congress to treat Claude like Mickey—hoping that’s a story we all buy into.
