Two Vocabularies
In English, this year's loudest fight in AI has one word at its center. Distillation. Anthropic calls it an attack. Chinese computer science has been writing about distillation for a decade, and has never needed the word.
That is because Chinese keeps two vocabularies where the English policy debate keeps one. On one side sits 知识蒸馏, knowledge distillation, a settled and respectable efficiency technique. On the other sits a scattered handful of terms for the idea of stealing a model, among them 模型窃取 (model stealing) and 模型提取攻击 (model extraction attack), with a few variants besides. The first is everywhere and agreed upon. The others are rare, and they do not even agree with each other. And the compound at the heart of the English dispute, 蒸馏攻击, "distillation attack," does not appear in the Chinese journal literature at all.
This issue is about that gap. One word for the innocent thing, a small cloud of unsettled words for the hostile one, and an English coinage that has not yet crossed into either.
The five terms, plainly. 知识蒸馏 (knowledge distillation) is the neutral technique, in ordinary use for a decade. 模型窃取 (model stealing), together with 模型提取攻击 and 模型抽取攻击 (model extraction attack, in two written variants), are the threat-side terms for copying a model without permission. 蒸馏攻击 ("distillation attack") is the compound at the center of the English fight, and the word this issue follows. Every judgment below is about how often, and where, each of these appears in the Chinese record.
Parallel Frontier is a biweekly intelligence report on China's and Russia's AI ecosystems, read in the original. Each issue works a single primary source in the language it was written in, for people who follow these systems professionally and need the source, not a recap. The name nods to 平行智能 (píngxíng zhìnéng, "parallel intelligence"), a real term in Chinese AI research.
One thing this issue does not claim. Whether the small threat-side literature leans toward defense or toward attack methods is a separate question that a word count cannot answer, and we make no judgment on it here.
On 12 July 2026 this publication ran a subject-facet retrieval on CNKI, the central Chinese journal database, across the vocabulary of the distillation dispute: the technique term 知识蒸馏 (knowledge distillation); the threat-side terms 模型窃取 (model stealing), 模型提取攻击 and 模型抽取攻击 (model extraction attack, in two variants); and the compound at the center of the English fight, 蒸馏攻击 ("distillation attack"). Counts are journal articles under CNKI's subject facet, from a single retrieval date.
Four features of the record are doing the real work. First, 知识蒸馏 returns 478 journal articles under one settled index label, in steady use since the mid-2010s. Second, the entire threat side comes to roughly twenty-five to thirty articles, summed across every competing term, and splits three ways. 模型窃取 is the broadest at 23, 模型提取攻击 the narrowest at 1, and the 抽取 variant, at 3, carries no index label of its own. Third, 蒸馏攻击 returns zero uses as a compound: ten hits, every one the words 蒸馏 and 攻击 happening to co-occur (distillation used to build some other kind of attack, or used inside a defense), and no index label at all. Fourth, one item is noted but not yet read, a February 2026 criminal-law treatment of attacks on generative models in 中国刑事法杂志, a candidate sign of the dispute reaching Chinese academic venues.
The size gap is better than fifteen to one, and it tilts further once the overlapping threat-side searches are de-duplicated. But the size is only half the story. The other half is the shape. The technique sits under one clean index label. The threat is scattered across three competing labels, one unindexed and another nonexistent as a compound. A hostile concept spread thinly across three unsettled words is weaker evidence of a mature idea than one agreed term would be. A settled word is what a settled concept looks like in a database. The right image is not two bars of different height. It is one settled word standing beside a cloud of unsettled ones.
In English, the moral charge sits inside the technique word itself. "Distillation attack" fuses the neutral method with the accusation. The Chinese record refuses that fusion. 蒸馏 has spent a decade as a respectable efficiency technique, and the hostile idea, where it appears at all, wears different words entirely: 窃取 ("stealing"), 提取 and 抽取 ("extraction"). On the evidence here, 蒸馏攻击 is a translation artifact. Anthropic's coinage was carried into Chinese by journalists, landing on top of settled neutral usage, and handled at arm's length with quotation marks and the hedge 单方面定性 ("unilaterally characterized"). Chinese frontier labs are themselves extraction targets, which is why we assess the pressure to adopt a formal term will come from industry before the state or the universities (Key Judgment Four).
For labs: whether 蒸馏攻击 enters a Chinese company's security disclosure or terms of service is the earliest tell on how Chinese industry will formalize model-extraction threats. For policy shops: arguments that treat "distillation attack" as a shared international term of art overstate the concept's standing in Chinese. The threat-side literature is small and unsettled. For translators and analysts: the quotation marks are load-bearing. Drop them in translation and you manufacture a consensus that does not exist. Indicators to watch: (1) the first Chinese institutional text using 蒸馏攻击 without hedging, the tripwire in The Signal below, (2) a company security disclosure or terms of service adopting the compound, Key Judgment Four's bet, (3) the February criminal-law treatment, to be read next pass, and (4) any consolidation of the threat side onto a single indexed term.
内外有别 (nèi wài yǒu bié), "inside and outside are treated differently," is a standing principle of Chinese external communication, and the standing subject of this section. In Issue 1 the line ran outward. The state kept the governance layer in Chinese. In this issue the line runs the other way, an English coinage pressing inward, and the Chinese record declining, so far, to take it.
"Distillation attack" is Anthropic's English coinage, and it did the framing work in the English dispute. Chinese newsrooms had to render it, and did so as 蒸馏攻击. The journal literature did not. Zero compound uses, no index label, on the 12 July retrieval.
What crossed over. The story, fully. The dispute, the accusation, the company's name, and the compound itself in Chinese headlines. The word arrived.
What has not crossed. The word as a term of art.
- The quotation marks themselves. In coverage the compound appears as "蒸馏攻击", someone else's phrase, reported rather than used.
- The hedge. 单方面定性, "unilaterally characterized," the definition tagged as Anthropic's act, not as a fact about the world.
- The journal record. No index label, no true-compound titles, and a threat-side vocabulary still split across 窃取 / 提取 / 抽取.
- The moral charge. A decade of neutral 蒸馏 left undisturbed. The accusation has not attached to the technique word.
We assess the quotation marks are the language line itself, typographic 内外有别. The term is being held at the border, used to report a foreign dispute, not adopted to describe the domestic field. What crossed is a quotation. What has not crossed is a concept.
This is a single retrieval date in a single database, and journal publishing runs slow. The gap between press and journals could be lag rather than refusal. The unread February criminal-law item could complicate the picture cleanly. If it uses the compound plainly, the tripwire has already fired. That is why it sits on the docket.
Read only the English debate and "distillation attack" looks like settled international vocabulary. It is not. Whoever first writes 蒸馏攻击 into institutional Chinese (a regulator, a journal, or a lab's terms of service) will fix its meaning, and Key Judgment Four is a bet on which it will be.
Issue 3, "The List," followed a single word, 后门 ("backdoor"), as it traveled from a corporate notice into a formal state advisory in the space of five days. This issue is the mirror image. It follows a word that has not traveled at all. 蒸馏攻击 lives in the English dispute and in Chinese headlines, but it has not crossed into the Chinese academic record. Two issues, one process seen from opposite ends, how the vocabulary of a dispute does, and does not, work its way into the institutions that outlast the news.