White House Accuses China of Copying AI Models on an Industrial Scale

⏱️ Lectura: 10 min

The White House formally accused China of copying American AI models on an industrial scale, according to CNN, which reported the story on April 23, 2026. The accusation reopens a question the industry has been debating for over a year: what does it technically mean to copy a language model, and what tools exist today to prove it.

📑 En este artículo

1. TL;DR
2. What happened: the accusation of copying AI models
3. Background and history
4. Technical details and performance
   1. Watermarking: the other detection route
   2. Detection methods, compared
5. How to test it
6. Impact and analysis
7. What’s next
8. Frequently Asked Questions
   1. What exactly does it mean to copy an AI model?
   2. Is it illegal to train a model on another model’s responses?
   3. How can you detect whether a model was distilled from another?
   4. Did the White House present public technical evidence?
   5. Does this affect developers who use Chinese open models?
   6. What is watermarking for AI-generated text?
9. References

The announcement comes amid the race for AI leadership between the two powers, with chip export controls in place since 2022. But accusing isn’t the same as proving: model distillation leaves technical traces that can be measured with code, not just with statements.

TL;DR

• The White House accused China of copying US AI models on an industrial scale, according to CNN (April 23, 2026).
• China frames the accusation as part of the broader dispute over AI leadership.
• Technically, copying a model usually means distillation: training your own model on another model’s outputs via API.
• The foundational knowledge distillation paper is by Hinton, Vinyals, and Dean (2015), available on arXiv.
• Detecting distillation relies on embedding similarity, membership inference, or watermarks in the generated text.
• The lm-watermarking project on GitHub implements a statistical watermarking technique for LLM outputs.
• The accusation wasn’t accompanied by detailed public technical evidence, according to reports so far.
• The episode adds to the AI chip export controls between the US and China that have been in place since 2022.

What happened: the accusation of copying AI models

According to the CNN report, the US administration claims that Chinese companies and labs are replicating AI models developed in the US through what it describes as an industrial-scale copying campaign. The report doesn’t detail specific public technical evidence: no API access logs, no weight comparisons, no independent audits cited. The accusation is presented as a political statement, not a forensic report.

China, for its part, frames this type of accusation as part of a broader dispute over AI leadership, one in which Washington has been restricting the export of advanced chips since 2022 and expanding those restrictions in successive rounds. The backdrop is well known: Chinese open models keep closing the gap with closed models from US labs on public benchmarks, and that closeness fuels mutual suspicion about how they were trained.

Background and history

The technique at the center of the discussion is neither new nor secret: it’s called knowledge distillation, formalized in 2015 by Geoffrey Hinton, Oriol Vinyals, and Jeff Dean in a paper that’s now required reading in any deep learning course. The original idea was benign: train a small model (student) to mimic the outputs of a large model (teacher), cutting inference costs without losing too much quality.

The problem arises when the teacher is a closed commercial model and the student is trained by querying its API without authorization. During 2025, cross-accusations already circulated in the industry about labs allegedly using rival models’ outputs to train cheaper products of their own. None of those earlier accusations turned into public litigation with open technical evidence, and the April 2026 one hasn’t either, at least not yet.

What has changed is the volume. Training a competitive language model today costs a fraction of what it cost three years ago, partly because copying AI models, legitimately or not, drastically shortens the path from scratch to a production-ready model.

Technical details and performance

Technically, copying AI models can mean at least three different things, and each leaves a different trace:

• Output distillation: the target model’s API is queried with thousands or millions of prompts, and the prompt-response pairs are used to fine-tune your own model.
• Weight extraction: direct access to or leaking of the model’s parameters, bypassing API queries entirely.
• Embedding extraction: reconstructing the model’s internal representation space from the probabilities exposed by the API (logprobs).

flowchart TD
A["Attacker"] --> B["API queries"]
B --> C["Target model (teacher)"]
C --> D["Generated responses"]
D --> E["Distillation dataset"]
E --> F["Own model (student)"]

Of the three, output distillation is the hardest to pursue legally and the easiest to detect statistically, because two models trained on the same prompt-response pairs tend to converge in phrasing, structure, and even characteristic errors.

A basic check compares, for the same set of prompts, how similar two models’ responses are using sentence embedding similarity:

from sentence_transformers import SentenceTransformer, util

modelo_embeddings = SentenceTransformer("all-MiniLM-L6-v2")

respuesta_original = "Photosynthesis converts sunlight into chemical energy."
respuesta_sospechosa = "Photosynthesis transforms sunlight into chemical energy."

emb1 = modelo_embeddings.encode(respuesta_original, convert_to_tensor=True)
emb2 = modelo_embeddings.encode(respuesta_sospechosa, convert_to_tensor=True)

similitud = util.cos_sim(emb1, emb2)
print(f"Cosine similarity: {similitud.item():.4f}")

That script compares two standalone texts. In practice, the check is run over a large batch of prompts so the result is statistically significant rather than an isolated case:

import json
from sentence_transformers import SentenceTransformer, util

modelo_embeddings = SentenceTransformer("all-MiniLM-L6-v2")

with open("prompts_benchmark.jsonl") as f:
    prompts = [json.loads(linea)["prompt"] for linea in f]

def generar_respuestas(cliente_api, prompts):
    return [cliente_api.completar(p) for p in prompts]

respuestas_modelo_base = generar_respuestas(cliente_openai, prompts)
respuestas_modelo_candidato = generar_respuestas(cliente_candidato, prompts)

similitudes = []
for original, candidata in zip(respuestas_modelo_base, respuestas_modelo_candidato):
    e1 = modelo_embeddings.encode(original, convert_to_tensor=True)
    e2 = modelo_embeddings.encode(candidata, convert_to_tensor=True)
    similitudes.append(util.cos_sim(e1, e2).item())

promedio = sum(similitudes) / len(similitudes)
print(f"Average similarity over {len(prompts)} prompts: {promedio:.4f}")

An average that stays consistently above what two independently trained models on the same topic would produce is a sign of distillation, though not definitive proof: two models trained on similar public datasets also converge to some extent.

Watermarking: the other detection route

If the teacher model is controlled from the source, there’s a more reliable alternative to comparing outputs after the fact: marking the generated text with a statistical watermark invisible to the human eye. The lm-watermarking project, published by Kirchenbauer and team, slightly biases token selection toward a pseudorandom green list during generation, and a detector then calculates a z-score over that list:

pip install lm-watermarking
python detect.py --input_text respuesta_generada.txt --gamma 0.25 --delta 2.0

A high z-score in the analyzed text indicates it likely came from a model with that watermark active, useful if a lab wants to later prove its own outputs were reused to train a third party.

💡 Tip: If you’re going to compare two models with embedding similarity, always use the same set of prompts for both: the comparison only makes sense if the input is identical.

Detection methods, compared

Method	When to use it	Advantage	Limitation
Embedding similarity	Comparing two models’ outputs on the same prompts	Fast and doesn’t require access to the suspected model	Only a statistical indicator, not direct proof
Membership inference	Determining whether a specific example was in the training data	Directly addresses the question of what the model saw	Loses precision on models with very large datasets
Watermarking	When the teacher model can be modified before release	High statistical confidence detection (z-score)	Requires the original model to implement it from the start
Output fingerprinting	Looking for repeated idiomatic patterns or characteristic errors	Requires no tools, can be done manually	Easy to evade with text post-processing

How to test it

To replicate a basic similarity check, all you need is Python and a reference API:

pip install sentence-transformers

With that installed, put together a prompts_benchmark.jsonl file with at least 50-100 varied prompts (avoid repeating the same topic every time, since that skews the average), run the script from the previous section against two models, and look at the full distribution of similarities, not just the average: a few very high values mixed with mostly low ones usually indicate isolated coincidences, not systematic distillation.

Impact and analysis

If the White House’s accusation moves toward concrete measures, it will most likely translate into stricter chip export controls and, possibly, additional restrictions on Chinese labs’ access to commercial APIs of US models, something that already happens partially through terms of service that prohibit using outputs to train competing models.

The real risk for the industry isn’t just geopolitical. If proving that someone is copying AI models becomes a routine compliance practice, any lab, Chinese, European, or American, that trains on synthetic data generated by another model (extremely common in 2026) could come under suspicion even without having copied anything illicitly. The line between legitimately using synthetic data and distilling without permission depends largely on each provider’s terms of service, not on a general law.

⚠️ Heads up: Output similarity is a statistical indicator, not legal proof of distillation: two models trained on similar public data can also converge on similar answers without any copying involved.

What’s next

What to watch next is whether the accusation comes with verifiable technical evidence (weight comparisons, API access logs, third-party audits) or remains purely declarative. It’s also worth watching whether US labs announce new watermarking measures or stricter terms of service limits to make API-based distillation harder, and whether China responds with symmetric accusations about the use of its own open models.

📖 Summary on Telegram: View summary

Try it yourself: run pip install sentence-transformers and compare two models’ responses to the same 50 prompts to see firsthand how similar, or not, their outputs are.

Frequently Asked Questions

What exactly does it mean to copy an AI model?

It can refer to at least three different things: distilling its outputs to train your own model, extracting its weights without authorization, or reconstructing its representation space from the probabilities exposed by the API. The White House didn’t specify which one it meant.

Is it illegal to train a model on another model’s responses?

It depends on the provider’s terms of service, not on a general law. Several labs explicitly prohibit using their outputs to train competing models, but enforcing that outside their own infrastructure is difficult.

How can you detect whether a model was distilled from another?

Through embedding similarity between responses to the same prompts, membership inference, or, if the original model implemented it from the start, a statistical watermark in the generated text.

Did the White House present public technical evidence?

According to what’s been reported so far, no specific forensic evidence was detailed: no logs, no weight comparisons, no independent audits cited. The accusation remains, for now, purely declarative.

Does this affect developers who use Chinese open models?

Not directly. Using a model that’s already been released under its own license is different from the dispute over how that model was trained in the first place.

What is watermarking for AI-generated text?

A technique that slightly biases token selection during generation to leave an invisible statistical mark, later detectable by calculating a z-score over the text.

References

• CNN: original report on the White House’s accusation against China.
• arXiv (Hinton, Vinyals, and Dean, 2015): foundational paper on knowledge distillation in neural networks.
• GitHub: lm-watermarking: reference implementation of statistical watermarking for LLM-generated text.
• Wikipedia: Knowledge distillation: definition and general background on the technique.

📱 Do you like this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.