Model distillation, and particularly its legal implications, has recently become a subject of growing interest among scholars in both China and the United States. Today, I would like to introduce a recent paper by a Chinese legal scholar that explores this issue.
The paper is by Li Xinmeng, a doctoral candidate at the Law School of Renmin University of China. It is published in Issue No. 4, 2026, of Legal Science, which examines whether black-box knowledge distillation can qualify as lawful reverse engineering under trade secret law.
According to Li,technical information inside a model may constitute a trade secret, and knowledge distillation satisfies the constituent elements of reverse engineering in trade secret law. Where the principles of fairness and reasonableness are not violated, restrictive clauses in user service agreements—such as “no distillation”—may be valid as a matter of contract law; however, breach of such clauses should not give rise to trade secret misappropriation liability. Knowledge distillation as reverse engineering has an economic justification, but it should be confined to legitimate purposes, reasonable conduct, and the absence of market harm. Li also argues that clarifying the reverse-engineering characterisation of knowledge distillation and delineating its legitimacy boundaries helps achieve a dynamic balance between trade secret protection in the artificial intelligence industry and technological innovation.
Below is the full translation of the paper:
Introduction
In 2025, the *Opinions of the State Council on Deepening the Implementation of the “AI+” Action* expressly proposed, under the section on “strengthening foundational supporting capabilities,” that China should “enhance foundational model capabilities and accelerate research into more efficient model training and inference methods.” As a key technology for improving training efficiency, knowledge distillation can transfer the knowledge embedded in a highly complex model (hereinafter, the “teacher model”) to a lightweight model (hereinafter, the “student model”). After obtaining the transferred data, the student model can reduce computational resource demands while achieving inference effectiveness close to that of the teacher model.
Although knowledge distillation shows substantial potential for improving model efficiency, it has generated extensive controversy in trade secret protection because it involves obtaining technical information inside a model. In February 2025, in *OpenEvidence Inc. v. Pathway Medical, Inc.*, the plaintiff alleged that the defendant used “prompt-injection attacks” to extract pre-configured system prompts embedded in the plaintiff’s model (i.e., the model’s operating logic and instructions), and then used those system prompts to train the defendant’s AI model—thereby constituting unlawful acquisition of trade secrets, violations of the Computer Fraud and Abuse Act (CFAA) and the Digital Millennium Copyright Act (DMCA), as well as breach of contract. In April of the same year, a U.S. special committee released an investigative report asserting that DeepSeek (深度求索) was highly likely to have used knowledge distillation to systematically extract and reproduce the core capabilities of leading U.S. models; the report further suggested that such distillation likely violated OpenAI’s usage terms prohibiting the use of its services to “develop competing models.” Against this background, the legality of knowledge distillation has become a focal issue of global concern.
Although existing scholarship has extensively discussed the legal nature of knowledge distillation, it has largely focused on copyright and patent perspectives. Relatively few studies examine reverse engineering under the trade secret framework or analyze the legal effectiveness of restrictive contractual clauses such as “no distillation.” Discussing the legal nature of knowledge distillation requires answering several questions: Can knowledge distillation be characterized as reverse engineering, which operates as an exception to trade secret misappropriation? Can restrictive clauses in user agreements, such as “no distillation,” exclude such a legality characterization? Where do the legitimacy and boundaries of knowledge distillation as reverse engineering lie? Clarifying these issues not only delineates clearer behavioral boundaries for AI companies and users, but also helps strike an appropriate balance between protecting R&D incentives and promoting technological innovation.
Knowledge distillation can be divided into “white-box distillation,” conducted on the basis of known technical information such as model weight parameters, and “black-box distillation,” which infers internal technical information by reverse reasoning from model outputs. The legal controversy is more acute for the latter. Accordingly, this article focuses on “black-box distillation”: it examines whether the technical information inside a model satisfies the protection requirements for trade secrets; analyzes whether knowledge distillation meets the constituent elements of reverse engineering and the legal effectiveness of restrictive contractual clauses such as “no distillation”; and, through an economic-analytical framework, explores the legitimacy of knowledge distillation as reverse engineering and its boundaries, thereby laying a theoretical foundation for the lawful conduct of knowledge distillation.
I. Determining Whether Technical Information Inside a Model Constitutes a Trade Secret
Compared with copyright and patent protection, the trade secret pathway is more flexible in protecting abstract knowledge representations. In the “first case nationwide on protecting AI model structure and parameters,” the Beijing Intellectual Property Court stated that “a model’s structure and parameters constitute competitive interests protected by the Anti-Unfair Competition Law.” Determining a trade secret requires satisfying three elements: secrecy, value, and confidentiality measures. The value of a trade secret mainly derives from the competitive advantage produced by information not being generally known.
Developing AI models requires substantial computing investment and massive data resources. Accordingly, technical information inside a model typically confers significant competitive advantages, enabling the attraction of users and expansion of market influence. While academia generally recognizes that technical information inside a model has commercial value, significant disputes remain as to secrecy and confidentiality measures: (1) whether an AI model loses secrecy regarding its internal technical information by publicly offering services in the market, and how open-source disclosure of weight parameters affects this element; and (2) whether clauses such as “no distillation” in user service agreements constitute confidentiality measures in a legal sense. It is therefore necessary to focus on the secrecy and confidentiality-measures elements to analyze whether the internal technical information implicated by knowledge distillation satisfies the constituent elements of a trade secret.
(1) Secrecy
The Provisions of the Supreme People’s Court on Several Issues Concerning the Application of Law in the Trial of Civil Cases Involving Infringement of Trade Secrets* (hereinafter, the *Provisions on Application of Law in Trade Secret Cases*) draw on the Agreement on Trade-Related Aspects of Intellectual Property Rights (TRIPS) and interpret the secrecy element as “not generally known to and not readily obtainable by relevant persons in the field.” The *Provisions on Trade Secret Protection*, issued by the State Administration for Market Regulation in February 2026, describe the secrecy element as “not known to the public.” The U.S. Supreme Court has held that so long as information does not lose its secrecy, trade secret protection may still be available even if related products enter sales or licensing channels. Conversely, where relevant information can be easily obtained through public channels, it is generally found to lack secrecy.
Although Chinese laws and regulations do not separately define “not known to the public,” Article 4 of the *Provisions on Application of Law in Trade Secret Cases* and Article 6 of the *Provisions on Trade Secret Protection* both enumerate specific circumstances in which information is “known to the public.” In addition to “not generally known,” the secrecy element requires that the information is “not readily obtainable.” This requirement reflects the difficulty of obtaining the alleged trade secret: the cost incurred by a defendant in obtaining the plaintiff’s information often determines whether the information meets the “not readily obtainable” requirement and thus the secrecy element. Expanding trade secret protection to business information that can be obtained at low cost by unspecified persons would impede the public’s freedom of action in the public domain and increase transaction costs.
1. Secrecy of technical information inside a model
Article 5(2) of the *Provisions on Trade Secret Protection* provides that “information such as data, algorithms, computer programs, and code related to technology constitutes the technical information referred to in the preceding paragraph.” Technical information inside an AI model includes weight parameters, model architecture, and operating logic. Because AI models deployed in the market typically provide only a user interaction interface rather than exposing internal operating mechanisms, the logical patterns behind model outputs are often non-public and thus possess the feature of “not known to the public.” Accordingly, the key to secrecy lies in whether the information is “not readily obtainable.”
Such “not readily obtainable” should be assessed by reference to the substitute cost for the public to obtain the information through legitimate channels, rather than by reference to the right holder’s own R&D or collection costs. If a party can obtain such information through routine technical means within a short period, it should be considered “readily obtainable.” Conversely, if the information can be obtained only through costly reverse engineering or long-term independent R&D, it should be deemed to satisfy the “not readily obtainable” requirement.
For AI products or services already deployed in the market, while model outputs—as external carriers of information—are publicly observable, in “black-box distillation” it remains difficult to obtain internal technical information from those outputs. In ordinary user interactions, users can access only semantic-level output content, but cannot directly obtain the embedded internal technical information. Even if one uses knowledge distillation to reverse-analyze massive volumes of model outputs, substantial computing resources and time costs are required to obtain internal technical information. Therefore, technical information inside a model is information that is “not readily obtainable.”
Moreover, the data aggregation effect further demonstrates that internal technical information is “not readily obtainable.” Fragmented user interactions do not reveal the model’s operating logic; only by analyzing statistical correlations and probabilistic characteristics across massive data can one infer such internal technical information. Similarly, in software industry practice, although software products are distributed to the public, technical information such as source code underlying software—where not disclosed to the public—still possesses secrecy. Accordingly, the internal technical information of AI models can be regarded as satisfying the secrecy element.
2. The impact of model openness on secrecy
Whether internal technical information is externally disclosed also affects secrecy. For closed-source models, developers typically keep key technical information such as algorithms, model architecture, and underlying source code strictly confidential in order to prevent competitors from obtaining internal technical information and developing competing products, thereby preserving secrecy. By contrast, open-source models are premised on knowledge sharing and collaborative innovation. Depending on the content and degree of openness, open-source models form an “openness spectrum,” disclosing to varying extents training code, training data, model architecture, model parameters, inference code, and evaluation cases. Different open-source models also impose restrictions on subsequent uses of derivative models through license agreements or commercial restrictive clauses.
For open-source models that have disclosed technical information such as weight parameters and training code, the information can be directly accessed by the public and will typically fail to satisfy the secrecy element’s requirements of “not known to the public” and “not readily obtainable.” However, this does not mean that internal technical information in open-source models necessarily fails to satisfy secrecy. Undisclosed internal technical information in open-source models (e.g., training methods) often remains secret, and the substitute cost for the public to obtain it is relatively high.
For example, to obtain undisclosed original training data for an open-source model, practice often uses “data-free distillation” methods that reverse-reconstruct the feature distribution of the original training data based on the open-source model’s weight parameters, synthesizing data extremely close to the original. Such methods rely on complex algorithms and substantial computing investment. The resulting information about the feature distribution of training data is “not known to the public” and “not readily obtainable,” and thus possesses secrecy. Accordingly, regardless of whether the model as a whole is open-source, so long as a particular technical information item has not been disclosed and the public faces high costs to obtain it through substitute means, that information can be regarded as secret.
(2) Confidentiality measures
A trade secret is not the object of an exclusive right. It is difficult to notify the public of right boundaries through property-right publicity mechanisms; accordingly, the right holder must take reasonable confidentiality measures to prevent the public from inadvertently accessing the trade secret. Article 9(1) of the *Provisions on Trade Secret Protection* requires the right holder, prior to the occurrence of the infringing act, to adopt “reasonable confidentiality measures commensurate with factors such as the nature of the trade secret and its carrier, and the commercial value of the trade secret.” The normative purpose is to facilitate limited sharing of trade secrets. The determination of confidentiality measures follows a reasonableness standard: “reasonable” means that the measures objectively notify the public of the right boundary and function to prevent others from easily obtaining the trade secret under the right holder’s control.
Confidentiality measures can be divided into “internal” and “external” measures. AI companies typically adopt both types of measures with respect to internal technical information of models in order to maintain secrecy.
“External” confidentiality measures refer to physical or technical control measures through which the right holder restricts others’ access to trade secrets. For internal technical information, closed-source models adopt confidentiality measures such as application programming interface (API) access restrictions, output filtering, and call-frequency controls. Security mechanisms configured within the model can review content before output generation, filter out internal technical information, and prevent disclosure. At the same time, the model’s computation process involves multi-layer algorithmic processing and information transformation, making it difficult for others to restore internal technical details from outputs at low cost. In practice, conducting knowledge distillation requires substantial computing resources to obtain massive model outputs and thereby infer internal technical information. In addition, because internal technical information is strongly interdependent, even partial access to weight parameters is insufficient to reproduce model functionality at an equivalent level. Therefore, based on the technical measures configured in the model, the right holder has adopted reasonable confidentiality measures with respect to internal technical information, effectively maintaining secrecy.
“Internal” confidentiality measures refer to circumstances in which the right holder allows the counterparty to access or control trade secrets by agreeing on confidentiality obligations and reasonably indicating the scope of confidential information. Where enterprises sign confidentiality agreements with employees or third parties, such agreements may still be regarded as confidentiality measures even if there is a theoretical risk of leakage. In the software industry, end-user license agreements (EULAs) are important confidentiality tools: they not only evidence the right holder’s subjective intent to maintain secrecy, but also enhance trade secret protection by clarifying the user’s confidentiality obligations.
In cases involving software products, U.S. courts have recognized that contractual clauses can serve as proof of reasonable confidentiality measures. Where a software product adopts access restrictions such as password protection while also requiring the user to promise by contract not to disclose, use, or share trade secrets, courts may find that the enterprise satisfies the requirement of reasonable confidentiality measures; the effectiveness of such contractual clauses as confidentiality measures may even extend to information that is readily knowable, such as basic design and functionality. Analogously, AI companies also set user service agreements for their products or services. Depending on the user group, such agreements can generally be divided into two categories: (i) Terms of Use for ordinary individual users, which are typically click-through standard-form contracts and generally do not impose confidentiality obligations on users; and (ii) enterprise license agreements (Enterprise Licenses) for commercial users, which are typically signed after full negotiation between parties of relatively equal bargaining power and contain express confidentiality clauses, thereby imposing corresponding confidentiality obligations on commercial users.
Accordingly, confidentiality measures should be assessed differently depending on the user group. For commercial users, the express confidentiality clauses in their license agreements can constitute effective confidentiality measures for internal model information. For individual users, even where the service agreement lacks an express confidentiality obligation, the right holder may still effectively control internal technical information through technical measures such as closed-source configurations, access restrictions, and output filtering. The legal nature and scope of effectiveness of restrictive clauses such as “no distillation” in individual user service agreements will be further analyzed below.
II. Determining the Legal Characterization of Knowledge Distillation as Reverse Engineering
The legal logic of trade secret protection is to maintain the relative competitive advantage that the right holder has established through confidentiality measures, rather than to achieve absolute exclusive control over trade secret information. Therefore, the law prohibits only improper acquisition of trade secrets and does not restrict acquisition through legitimate means such as reverse engineering or independent R&D.
Accordingly, it is necessary to clarify the meaning and implementation process of knowledge distillation and, on that basis, to focus on “black-box distillation” to analyze whether it satisfies the constituent elements of reverse engineering and to examine the effectiveness of restrictive clauses such as “no distillation” in user agreements.
(1) The meaning and implementation process of knowledge distillation
To determine whether knowledge distillation constitutes “improper acquisition” of trade secrets, it is necessary to clarify its meaning and implementation process. As a model compression technique, knowledge distillation involves three core elements: the “knowledge” embedded in the teacher model as the source of knowledge; the distillation algorithm that transfers knowledge; and the “teacher–student architecture” consisting of the teacher model and the student model.
The core logic of knowledge distillation is to achieve knowledge transfer through the teacher–student architecture, enabling the student model to learn the teacher model’s decision logic more effectively, so that the student model can approach the teacher model’s performance even when its parameter scale is significantly compressed.
The “knowledge” that is the object of distillation refers to technical information embedded inside the teacher model that users cannot directly obtain through ordinary interaction, including information such as the probability distribution at the output layer, feature representations at intermediate layers, the model’s decision logic, and correlation structures across layers. More specifically, such knowledge can be divided into three categories.
First, response-based knowledge: the probability distribution (soft labels) over categories at the teacher model’s output layer. Unlike hard labels that indicate only the correct answer, soft labels include not only the teacher model’s probability judgment for the correct class but also information about relative similarities among all classes, enabling the student model to learn the teacher model’s decision logic more effectively.
Second, feature-based knowledge: feature representations at the teacher model’s intermediate layers, reflecting the model’s internal processing logic and abstract representation capability.
Third, relation-based knowledge: correlation structure information among outputs across different layers of the model.
These three categories collectively constitute the core object obtained through knowledge distillation.
Traditional knowledge distillation often depends on direct access to the teacher model’s weight parameters, training data, and the output-layer probability distribution (soft labels). However, in practical application, closed-source models often provide only APIs: external parties cannot obtain weight parameters, cannot access original training data, and APIs often return only final class results (hard labels) rather than the full probability distribution.
As a result, “black-box distillation,” which can be conducted without access to internal parameters and solely through outputs, has increasingly emerged. Where there is no training data, no access to weight parameters, or even only hard-label outputs are available, the student model can still gradually learn the teacher model’s decision logic by inputting prompts to the teacher model and analyzing its output characteristics. Through a “question–answer” interactive mode, the student model reconstructs a knowledge set and thereby achieves inter-model knowledge transfer. This process not only requires substantial computing resources but also relies on the data aggregation effect.
(2) Knowledge distillation satisfies the constituent elements of reverse engineering
Reverse engineering operates as an exemption from trade secret misappropriation liability. Article 14(1) of the *Provisions on Application of Law in Trade Secret Cases* provides that acquiring the alleged infringing information through independent R&D or reverse engineering does not constitute trade secret infringement. Article 15 of the *Provisions on Trade Secret Protection* further clarifies that obtaining relevant technical information by disassembling, surveying, or analyzing products obtained through public channels does not constitute trade secret infringement. The Uniform Trade Secrets Act (UTSA) in the United States and the U.S. Supreme Court’s decision in *Kewanee Oil Co. v. Bicron Corp.* establish analogous reverse engineering rules.
The UTSA emphasizes that obtaining a product through the public market in a “fair and honest manner” and dismantling it to understand its manufacturing process does not constitute trade secret misappropriation. The EU Trade Secrets Directive likewise notes that observing, studying, disassembling, or testing a product that is available to the public or lawfully possessed by the acquirer constitutes a lawful means of acquiring trade secrets.
Synthesizing these rules, reverse engineering generally requires: lawful acquisition of the product; legitimate implementation methods; and the absence of breach of confidentiality obligations. It is therefore necessary to analyze, element by element, whether knowledge distillation satisfies these requirements.
First, reverse engineering can be applied to products or services based on AI models. The aim of knowledge distillation is to obtain internal technical information of a model, and such information is carried by AI products or services. Although reverse engineering traditionally applied to “products obtained through public channels,” this historical focus reflects the industrial-era reality that trade secrets were typically embedded in tangible goods, requiring physical disassembly to obtain know-how. With technological development, the distinction between products and services has increasingly blurred in the digital era. What is “provided on the market” is not limited to tangible products, but also includes non-tangible products or services such as software and AI models.
China’s *Interim Measures for the Administration of Generative AI Services* define “services” as the provision of content to the public by using generative AI technologies. However, “product” versus “service” is merely a market-provision form of an AI model and does not affect whether the AI model can be an object of reverse engineering. The concept of “product” in the digital era should be interpreted with sufficient flexibility and inclusiveness. There is no legal obstacle to including software and AI systems within the scope of “products,” and even AI outputs may potentially qualify as products. For example, the EU’s *New Product Liability Directive* defines “products” to include tangible and intangible movable property, including software, expressly recognizing the multiplicity of product forms in the digital era. Accordingly, the “product” concept relevant to reverse engineering can be interpreted teleologically to include products or services provided based on AI models.
Second, the source of the product analyzed by reverse engineering must be “lawfully acquired.” Lawful acquisition entails two layers: lawful source and legitimate means. As to the source, lawful acquisition includes obtaining a license to use the product through a user agreement. One key justification for allowing reverse engineering is that the implementer has a right of disposition over lawfully obtained products.
Article 15 of the *Provisions on Trade Secret Protection* does not explicitly clarify whether “obtained through public channels” is limited to obtaining ownership of products carrying trade secrets, or whether it can include access acquired through a license. Similar to software products, in AI model services users typically must subscribe to obtain access, and service providers impose restrictions on user conduct through service agreements. If “transfer of ownership” is insisted upon as the sole criterion for lawful acquisition, this would fail to accommodate the characteristics of AI technology development and would further compress the space for applying reverse engineering.
In addition, whether knowledge distillation constitutes lawful acquisition of internal technical information also requires examining the lawfulness of the source of teacher-model outputs used. Express authorization in user agreements can serve as a basis for lawful acquisition. Some AI providers have expressly granted users rights relating to model outputs in their license agreements. In such cases, users obtain model outputs pursuant to contractual authorization, thereby constituting lawful acquisition of the AI model outputs.
As to means, lawful acquisition further requires obtaining model outputs through legitimate methods. Although theory and practice recognize reverse engineering as a defense in trade secret cases, the boundary between lawful reverse engineering and unlawful improper acquisition methods can be blurred. The determination of “improper” methods depends on the degree of social impropriety attributed to the conduct within a particular industry context, as well as the trade secret holder’s own fault.
Knowledge distillation typically obtains model outputs through large-scale automated queries. With respect to the legitimacy of using automated means to obtain information, *Compulife Software Inc. v. Newman* established a “foreseeability of technological means” standard. In that case, the U.S. Court of Appeals for the Eleventh Circuit held that the defendant’s use of automated programs to scrape the plaintiff’s trade secret database constituted improper acquisition, reasoning that the plaintiff could not reasonably foresee the need to defend against non-human access.
However, as AI technologies become widespread, and the use of non-human methods to obtain data becomes an industry-common approach, it is more reasonable to shift the legitimacy assessment toward a substantive evaluation of the propriety of the conduct itself, where right holders can reasonably foresee such means. In the context of knowledge distillation, where an actor has lawful access to the model and does not adopt technical means that are unlawful or potentially harmful to normal model operation or cybersecurity—such as illegal access, cracking technical protection measures, bypassing API rate limits, or generating adversarial-sample attacks—the acquisition method should be regarded as legitimate.
Third, in terms of process, reverse engineering implementers do not possess the trade secret ex ante; they identify undisclosed information through analysis and testing. Reverse engineering typically begins with an observable product and uses observation and black-box testing to infer internal structure, operating mechanisms, or implementation pathways. Knowledge distillation is similar in behavioral mode to traditional reverse engineering: both use observation of external outputs to infer internal technical information.
For example, the “black-box testing” logic in software reverse engineering is that even if software exposes only an API, an actor can infer internal operating logic by observing the “input–output” relationship of the computer system. “Black-box distillation” follows a similar logic: the implementer continuously inputs prompts to the teacher model, analyzes its output, and uses distillation algorithms to reverse-analyze the “input–output” mapping, thereby inferring internal technical information. This is essentially consistent with the traditional “disassemble–reconstruct” model of reverse engineering.
Finally, reverse engineering implementers must not breach confidentiality obligations. Reverse engineering implementers are not internal technical personnel and cannot access or know internal technical information; therefore, they do not owe confidentiality obligations under trade secret law.
For individual users, although their user agreements may contain technical confidentiality clauses prohibiting reverse engineering (hereinafter, “anti–reverse engineering clauses”), such as OpenAI’s service agreement that expressly prohibits competitors from using automated means to obtain data to train competing models, individual user agreements are typically standard-form contracts with unequal bargaining positions and lack meaningful negotiation; the legal effectiveness of such clauses is questionable, and they should not be used to infer that individual users owe confidentiality obligations to AI companies.
For commercial users, by contrast, where parties of equal bargaining power expressly agree on confidentiality obligations in commercial authorization agreements, such obligations are legally binding on commercial users.
(3) Legal effectiveness analysis of restrictive clauses relating to “no distillation”
Although knowledge distillation satisfies the constituent elements of reverse engineering, in commercial practice AI product or service providers often include restrictive clauses prohibiting knowledge distillation in user service agreements. One category consists of “anti–reverse engineering clauses,” which primarily restrict the conduct itself by prohibiting reverse engineering, extraction, or copying of internal technical information such as weight parameters, or prohibiting automated extraction of model outputs. Another category consists of “anti-competitive-use clauses,” which primarily restrict the purpose of conduct by prohibiting users from using model outputs to develop competing products.
The legal effectiveness of these clauses has become a central dispute in assessing the legality of knowledge distillation. It is therefore necessary to conduct an in-depth analysis of the legal effectiveness of both anti–reverse engineering clauses and anti-competitive-use clauses.
1. Breach of an anti–reverse engineering clause does not constitute an improper means of acquiring trade secrets
There is controversy in both theory and practice as to whether breaching an anti–reverse engineering clause can constitute an improper means of acquiring trade secrets. Some U.S. cases tend to recognize the effectiveness of such clauses in specific circumstances. For example, in *SoCal Diesel, Inc. v. Extrasensory Software, Inc.*, the California Court of Appeal, Second Appellate District, held that even absent a pre-existing confidentiality obligation between an individual user and a trade secret holder, intentionally or fraudulently breaching a license agreement that expressly prohibited reverse engineering might still be regarded as acquiring trade secrets by improper means.
However, scholarship generally adopts a cautious stance, arguing that reverse engineering is a lawful pathway for acquiring trade secrets and courts should not treat breach of an anti–reverse engineering clause as an improper means of acquiring trade secrets. Recognizing such clauses as a basis for “improper means” would effectively grant trade secret holders perpetual protection, undermining the balance between trade secret holders and the public.
U.S. judicial practice also commonly holds that even where a user service agreement is breached, reverse engineering may still be a lawful means of acquiring trade secrets. In *DVD Copy Control Ass’n v. Bunner*, the defendant conducted reverse engineering in breach of an anti–reverse engineering clause to obtain trade secrets. Although the California Supreme Court did not decide whether breach of such a clause constituted “improper acquisition,” Justice Moreno stated in a concurring opinion that no precedent had recognized that trade secret holders could use standard-form contracts to bring reverse engineering within the category of “improper means.”
In *Aqua Connect, Inc. v. Code Rebel, LLC*, the defendant downloaded a trial version of the plaintiff’s software and reverse engineered it to develop a competing product, directly breaching the end-user license agreement. The U.S. District Court for the Central District of California likewise held that breach of an anti–reverse engineering clause should not be treated as an improper means of acquiring trade secrets.
On this basis, it is further necessary to distinguish between commercial license agreements and ordinary standard-form user contracts. In a commercial negotiation context, reverse engineering undertaken in breach of a license agreement may violate the confidentiality obligations mutually assumed under the contract, thereby constituting improper acquisition of trade secrets, because the anti–reverse engineering clause in a commercial agreement may concretize mutually agreed confidentiality obligations. By contrast, individual user agreements typically take the form of standard-form contracts; the parties do not substantively negotiate the licensing terms and there is no foundational confidentiality obligation. Therefore, an anti–reverse engineering clause in such a standard-form contract should not be treated as part of a confidentiality obligation formed through equal negotiation, and breach of such a clause does not constitute an improper means of acquiring trade secrets.
Regardless of whether an individual user agreement contains an anti–reverse engineering clause, individual users do not owe confidentiality obligations. Individual users who lawfully obtain access to a model may conduct knowledge distillation, which can be characterized as reverse engineering. However, trade secret law and contract law operate as distinct evaluative dimensions: breaching an anti–reverse engineering clause may give rise to contractual liability.
2. Contract validity of anti–reverse engineering clauses and anti-competitive-use clauses
In judicial practice, the contractual validity of anti–reverse engineering clauses is often recognized, and U.S. courts rarely invalidate such clauses on the ground that they are standard-form terms. For example, in *Triage Logic Mgmt. & Consulting, LLC v. Innovative Triage Servs., LLC*, the North Carolina Business Court recognized the validity of an anti–reverse engineering clause in a software license agreement, holding that the clause did not constitute an unlawful restraint of trade.
The contractual validity of anti–reverse engineering clauses is not without limits. In general, the law does not interfere with freedom of contract. However, in IP markets, firms with strong market control can readily restrict user rights through contracts, and the law should intervene in a timely manner to limit the validity of such terms. The stronger the substantive restriction, the more closely fairness should be scrutinized.
In the U.S. context, a finding of unconscionability requires proof of both lack of “meaningful choice” and that the term is “unreasonably favorable” to the other party. Articles 496 and 497 of the PRC Civil Code (《民法典》) establish analogous rules. Article 496 provides that where the provider of standard-form terms fails to perform its duty of reminder or explanation such that the other party did not notice or understand a term of material interest, the other party may claim that the term does not become part of the contract. Article 497 provides that standard-form terms that unreasonably restrict or exclude the other party’s principal rights are invalid.
As standard-form terms unilaterally drafted by AI companies, anti–reverse engineering clauses in individual user agreements offer users no realistic space to negotiate. Where AI companies fail to fulfill the duty to highlight or explain such clauses, users may invoke Article 496 of the Civil Code to argue that the clause does not form part of the contract. Even where the duty is fulfilled, if an anti–reverse engineering clause imposes overly broad and generalized restrictions that exceed what is reasonably necessary to protect technical information of the AI product or service and unreasonably restrict users’ legitimate use of model outputs lawfully obtained, the clause may be held invalid under Article 497.
From a comparative perspective, the EU Trade Secrets Directive also states that “reverse engineering of a lawfully acquired product should be considered a lawful means of acquiring information unless otherwise agreed in a contract. However, the freedom to conclude such contractual arrangements may be limited by law.” This indicates that while trade secret holders may use contracts to restrict reverse engineering, the law should intervene and limit freedom of contract where anti–reverse engineering clauses impede innovation or restrict market competition.
For example, the EU has treated contractual clauses prohibiting necessary decompilation for interoperability as invalid. Knowledge distillation implicates significant public interests in promoting market competition and technological progress. Where an anti–reverse engineering clause substantially impedes the realization of such public interests and exceeds the legitimate boundary of contractual freedom, its contractual effectiveness should be restricted.
With respect to anti-competitive-use clauses, “reasonableness” is an important consideration in confirming contractual validity. Reasonableness assessments typically consider factors such as time, geographic scope, and the scope of restriction. The Restatement (Second) of Contracts identifies relevant factors for reasonableness: where the restriction exceeds what is necessary to protect the legitimate interests of the promisee (the licensor), an anti-competitive-use clause may be found unreasonable.
While AI companies’ massive investments in model development constitute protectable interests, overly broad competition restrictions may still be deemed unreasonable because they exceed what is necessary to protect those interests. For example, some user agreements do not clearly limit the type or temporal scope of outputs covered, potentially sweeping in any model outputs generated by users. Such a scope exceeds what is necessary to protect AI companies’ legitimate interests, and the clause may be held invalid.
U.S. courts, when scrutinizing such clauses, also consider whether users receive adequate notice, have an opportunity to read the contract, and whether the restriction scope exceeds users’ reasonable expectations at the time of contracting. Under Article 497 of the Civil Code, standard-form terms that unreasonably restrict the other party’s principal rights should be deemed invalid. Accordingly, users have legitimate interests in model outputs lawfully obtained, and overly broad non-compete restrictions constitute unreasonable restrictions. For example, in the above-mentioned *Triage Logic* case, while the court upheld the validity of an anti-competitive-use clause, it also found that a non-compete clause in the software license agreement constituted an “unlawful restraint of trade,” because it permanently prohibited users from developing software, services, or products substantially similar to the software, exceeding the scope of a reasonable restriction and therefore lacking legal effect.
Even where such anti–reverse engineering clauses and anti-competitive-use clauses may not necessarily be legally effective, the “chilling effect” they generate can still significantly weaken the public’s incentives to use AI tools, influence the characterization of reverse engineering, and thereby seriously harm the public interest. Out of risk-avoidance considerations, later entrants may abandon reasonable competitive R&D, producing negative effects on industry innovation. Accordingly, restrictive clauses relating to knowledge distillation that do not satisfy fairness and reasonableness requirements should have their contractual effectiveness limited in accordance with law.
III. Legitimacy Analysis of Knowledge Distillation as Reverse Engineering
Although knowledge distillation satisfies the constituent elements of reverse engineering, a legality characterization merely resolves whether the conduct constitutes trade secret misappropriation; it does not sufficiently answer under what conditions reverse engineering is legitimate. Accordingly, it is necessary to introduce legitimacy analysis as a more refined normative framework to construct substantive standards for allowing or restricting reverse engineering.
Experience from traditional manufacturing, semiconductors, and software industries indicates that the core of assessing the legitimacy of reverse engineering lies in evaluating the conduct’s impact on subsequent innovation and overall social welfare. Whether knowledge distillation as reverse engineering is legitimate likewise depends on whether it can balance promoting innovation in the AI industry and maintaining fair competition.
The following analysis draws on the economic analysis paradigm of reverse engineering proposed by Samuelson and Scotchmer, and examines the legitimacy of knowledge distillation as reverse engineering along four dimensions.
(1) Knowledge distillation as reverse engineering has an economic justification
1. Impact on innovation incentives of prior developers
As a policy lever, reverse engineering can provide appropriate incentives for innovators across different technological and industrial contexts. Views advocating strict restrictions on reverse engineering argue that reverse engineering may harm the expected returns of prior developers, making it difficult for them to recoup high R&D costs and thereby weakening overall innovation incentives.
However, not all returns of prior developers should be protected by law. Where later entrants can reverse engineer and produce competing products at costs so much lower than prior developers’ costs that prior developers cannot obtain expected returns through market competition, law should regulate such reverse engineering conduct. Knowledge distillation provides later entrants in the AI industry with a pathway for rapid training, but whether rapid training necessarily implies “low cost” remains debatable. It is therefore necessary to examine the economic impact of knowledge distillation from the perspectives of development costs and substitution effects.
From the perspective of implementation costs, knowledge distillation improves the efficiency of student models through interactive training, reducing training complexity and computational costs, but it still requires substantial computing resources and R&D investment. If the cost of competitive copying becomes so low that innovators cannot recoup R&D investments, incentives to develop innovative products will be undermined. U.S. judicial regulation of “plug molding” behavior reflects this logic. “Plug molding” is a manufacturing technique in traditional industries that uses an original product as a mold to cast duplicates directly. Although the U.S. Supreme Court in *Bonito Boats, Inc. v. Thunder Craft Boats, Inc.* confirmed that plug molding is one method of reverse engineering, because its essence is low-cost copying of original innovation—without advancing subsequent innovation and without benefiting overall social welfare—such conduct lacks the legitimacy of reverse engineering.
By contrast, in the software industry, disassembly and decompilation of computer programs require significant time and economic costs. Such reverse engineering can facilitate the development of interoperable products and can diminish industry monopolies in a constructive manner. This indicates that the legitimacy of reverse engineering is closely related to its cost inputs.
In the AI industry, knowledge distillation obtains internal technical information derived from analyzing and processing teacher-model outputs. Yet student-model performance depends not only on distillation features but also on the training corpus, training and fine-tuning methods, and other factors. The complete model development process involves data collection, cleaning, pre-training, and fine-tuning. Knowledge distillation likewise requires organizing and cleaning teacher-model output data and independently designing the student model’s system architecture and learning process. In addition, distillation effectiveness depends on the intrinsic structure and distributional characteristics of training data and on continuous optimization of distillation algorithms.
Accordingly, although knowledge distillation can save certain R&D costs, developing a student model still requires substantial training costs. It is therefore inappropriate to treat knowledge distillation as low-cost copying of a teacher model.
From the perspective of substitution effects, skepticism about the legitimacy of knowledge distillation is based on the concern that student models will rapidly eliminate the teacher model’s leading advantage, capturing market share at lower prices and thereby undermining innovators’ incentives. This view, however, overlooks inherent technical limitations of knowledge distillation.
First, a “scale gap” makes it difficult for student models to achieve the same performance as teacher models. Knowledge distillation does not directly use information such as the teacher model’s structure, parameters, or code. Rather, it analyzes teacher-model outputs to obtain internal technical information such as probability distributions and uses that information to optimize student-model training. The capacity gap between large deep neural networks and small student networks reduces knowledge transfer effectiveness. The “small-model learnability gap” phenomenon in fact indicates that small language models cannot stably benefit from distillation from large teacher models. From the perspective of transfer effectiveness, data obtained from learning a teacher model with a similar parameter scale better matches the student model’s own capability level.
Nevertheless, industry practice commonly adopts teacher–student architectures with large scale differences. This is not because they pursue optimal transfer effectiveness, but because they trade off some performance in exchange for lightweight and efficient models, improving inference efficiency and reducing memory usage. Accordingly, the aim of knowledge distillation is to achieve lightweight and efficient student models, rather than to fully replicate teacher-model capabilities. A substantial performance gap between student and teacher models remains.
Second, student models trained on distillation data have limitations in performance. Pre-training is the primary source of model capabilities. While student models may reach levels comparable to teacher models in specific tasks, their adaptability to new scenarios or tasks often falls below teacher models when tasks lack sufficient training data support, and they still require massive data for fine-tuning to narrow capability gaps.
In addition, student models trained solely on teacher-model output data face the risk of performance degradation. Research indicates that teacher-model output data only partially represents the patterns embedded in the original training data; it cannot reflect all characteristics of the training data, and the student model introduces errors in learning. If training uses only teacher-model outputs, these two categories of errors will continuously accumulate. Student models will gradually lose low-frequency but important data features in the true data distribution. Such error accumulation can cause irreversible “model collapse,” namely performance degradation. Although introducing real human data into training can slow this process, declines in student-model performance are difficult to avoid. Therefore, to maintain long-term market competitiveness, significant costs are still required to obtain and use real human data for training, so as to offset error accumulation and performance degradation brought about by distillation.
Third, market demand for AI models is differentiated. Student models and teacher models serve different market demands. Student models obtained through knowledge distillation typically have smaller parameter scales, lower computational requirements, and are mainly oriented toward niche markets with higher requirements for privacy protection and localized deployment. Teacher models, by contrast, have larger parameter scales and mainly serve cloud application scenarios requiring high-precision inference and complex computation. The two types of models have significantly different market positioning, and student models are difficult to serve as direct market substitutes for teacher models.
Although student models may compete with teacher models in specific tasks, knowledge distillation itself requires substantial time and economic inputs. During this period, prior developers can maintain a sufficient lead, recoup R&D costs, and obtain innovation returns.
2. Impact on competitive order and market prices
Although products obtained through reverse engineering may enter the market and compete with prior products, causing the market price of prior products to decline, such competition can still be regarded as constructive within a certain range. This is because such competition motivates developers to improve product quality, enhance management, and reduce costs and prices.
After student-model products or services enter the market—whether released in open-source or closed-source form—knowledge distillation can effectively reduce overall price levels for AI products and services, increase market supply, and help maintain a sound competitive order.
On the one hand, knowledge distillation as reverse engineering can prevent prior developers from setting excessively high license fees for AI products or services. The pricing strategy of distillation implementers is cost-dependent. Once student-model products or services enter the market, they exert downward pricing pressure on teacher-model products or services. At the same time, prior developers have incentives to set license fees at reasonable levels to attract licensees and to prevent later entrants from entering the market through reverse engineering as a lawful means. Regardless of motivation, knowledge distillation as reverse engineering can objectively promote reasonable pricing by prior developers.
Taking OpenAI as an example, its official distillation tools allow users to store model responses free of charge and charge subsequent evaluation and fine-tuning at the standard fine-tuning fee rates. Although this license price is relatively low, licensees obtain only usage rights to customized student models based on API calls. Because the student model is hosted in the cloud, licensees cannot access underlying files such as core weight parameters and must pay subsequent fees higher than standard API calls. Some studies suggest that prior developers’ motivations for granting technical licenses often stem from concerns about reverse engineering.
Accordingly, knowledge distillation as reverse engineering can incentivize prior developers to adjust license-fee pricing and reduce market prices for related products or services, thereby promoting constructive competition and broader adoption of AI technologies.
If knowledge distillation were not characterized as reverse engineering, prior developers would no longer face competitive pressure from distillation implementers. In that scenario, prior developers may reduce prices in the short term to expand market share. However, once monopoly power is formed, prior developers may charge higher prices to users dependent on the product or service, increasing overall service prices.
Where knowledge distillation can be characterized as reverse engineering, competition between closed-source student models and teacher models manifests as price competition; both sides may adjust pricing strategies in response to the other’s market price. Yet because student models and teacher models maintain performance gaps and student models likewise must recover development costs through pricing, student-model products or services may reduce teacher-model market prices but will not trigger destructive price competition.
On the other hand, if student models obtained through knowledge distillation are released as open-source, they can also compete with teacher models through differentiation. Compared with price competition among closed-source models, competition between open-source and closed-source models takes a different form. Closed-source developers are often more vigilant regarding the effects of open-source models on pricing strategies and market share.
Some argue that knowledge distillation can enable open-source models to rapidly narrow gaps with closed-source models, thereby exposing closed-source models to risks of losing competitive advantages. For example, a Stanford University study found that the open-source model “Alpaca” distilled from OpenAI’s base model (approximately 175 billion parameters) could, with only 7 billion parameters, exhibit performance similar to the latter in specific tasks. Nevertheless, the two still have substantial capability gaps in long-tail knowledge handling and complex reasoning logic. Closing these gaps requires high R&D costs and reliance on massive generated data or stronger base models; in complex application scenarios, student models are therefore unlikely to directly substitute for teacher models in the short term.
Open-source models exert some competitive pressure on closed-source models in terms of user costs and market choice. Open-sourcing as a market strategy aims to establish technical standards and expand ecosystem influence, thereby competing with closed-source models through differentiation.
At the cost level, open-source student models provide lower-priced substitutes in scenarios where users have higher data-security requirements or specific vertical-domain needs, leading to some decline in market prices of closed-source teacher models. Yet this impact mainly manifests in particular niche markets and is unlikely to constitute comprehensive substitution.
With respect to user choice, scholarship distinguishes between two competitive strategies for open-source models. Where open-source models adopt a “reactive strategy,” namely always following closed-source models’ performance improvements at a fixed ratio, closed-source models can always induce users to choose closed-source models through price reductions or performance adjustments. Only where open-source models adopt a “proactive strategy,” namely independently developing high-performance models rather than merely following closed-source development, will users tend to choose open-source models, thereby weakening closed-source competitive advantages. Accordingly, knowledge distillation, as a typical “reactive strategy,” will not directly substitute teacher models in the market. Rather, the existence of open-source alternatives can incentivize closed-source providers to lower prices for related products or services, thereby promoting a fair competitive environment.
3. Impact on subsequent innovation in the AI industry
This factor assesses whether reverse engineering enables later entrants, after obtaining technical information, to develop improved, compatible, or more advanced new products, thereby advancing technological innovation and progress. Knowledge distillation obtains internal technical information by learning from teacher-model outputs; its essence is not direct copying of teacher-model performance, but innovation built on that basis.
In the semiconductor chip industry, the U.S. Semiconductor Chip Protection Act of 1984 (SCPA) clarified the legitimacy of reverse engineering: it allows copying of chip layouts for purposes of learning and analysis, but requires later entrants to engage in “forward engineering,” namely using acquired knowledge to develop original chip designs. This institutional design ensures that prior developers can recoup costs while compelling later competitors to improve upon the original product, thereby encouraging competition and preventing technological monopolies.
Analogously, valuable knowledge distillation is often accompanied by substantial subsequent innovation. Implementers must invest significant R&D costs in fine-tuning and optimizing student models before bringing them to market.
In terms of specific paths for subsequent innovation, knowledge distillation can enable at least the following.
First, student models obtained via knowledge distillation can expand the scope of AI applications and be applied across computer vision, speech recognition, and natural language processing. By adding vertical-domain data for training, student models can achieve—in specific professional scenarios such as medicine and law—capabilities comparable to or even exceeding those of general-purpose large models serving as teacher models.
Second, knowledge distillation can break technological monopolies by a small number of leading industry models and reduce entry barriers for subsequent developers. Specifically, distillation can transfer advanced capabilities of base models such as GPT-4 to accessible open-source models such as LLaMA and Mistral, enabling secondary innovation by developers.
Third, knowledge distillation can convert ultra-large-parameter models into lightweight models deployable on mobile devices or IoT endpoints, allowing high-performance models that previously could run only in the cloud to run on end-user devices, thereby supporting differentiated new AI products or services.
In addition, knowledge distillation can promote interoperability among AI applications and reduce developers’ dependence on a single closed-source model. Just as reverse engineering in software can achieve interoperability between platforms and applications—reducing monopolies formed by non-interoperable systems and incentivizing platform licensing and application development—knowledge distillation in AI enables developers, when faced with monopolistic pricing by model vendors, to reduce model migration costs, achieve low-cost switching among models, reduce dependence on a single closed-source model, provide more diverse market choices, and promote a sound competitive order.
4. Impact on waste of social R&D resources
Legitimate reverse engineering can reduce repetitive and ineffective R&D inputs, enabling more efficient use of social innovation resources. With respect to knowledge distillation, its effects on R&D investment can be analyzed in two respects.
On the one hand, knowledge distillation can reduce repetitive and ineffective exploratory R&D investment. Model training is highly dependent on computing resources. According to industry reports, by 2024 the training costs of the most advanced base large models (such as GPT-4 and Gemini Ultra) had reached USD 78 million and USD 191 million, respectively. Given the extremely high training costs of such ultra-large models, R&D is currently mainly conducted by a small number of cash-rich technology giants.
Knowledge distillation enables later developers to directly benefit from prior models’ development experience and reduces large amounts of ineffective investment in prior R&D. If the legitimacy of knowledge distillation as reverse engineering is not recognized, later developers would have to independently complete the model training process, producing large amounts of duplicative R&D investment.
Although implementing knowledge distillation requires collecting and analyzing teacher-model outputs and continuously debugging distillation algorithms to train student models, these costs are far lower than the R&D investment required to independently repeat training. Where legal risks, compliance barriers, or difficulties in fully eliminating potential infringement risks associated with training data make re-training necessary, independent training may indeed be justified. Outside such circumstances, however, repeatedly conducting pre-training will waste social resources, and allowing knowledge distillation helps achieve efficient allocation of social innovation resources.
On the other hand, as a widely adopted technology in the AI industry, knowledge distillation can help direct limited R&D resources toward more valuable frontier technological innovations. Resources saved through distillation can be reinvested into independent R&D such as training data collection, algorithm debugging, and model optimization, thereby producing higher-quality model products. This differs fundamentally from “free-riding” conduct that directly copies others’ achievements. If knowledge distillation is not recognized as legitimate reverse engineering, the AI industry will be unable to reasonably draw on prior R&D results, markets will generate extensive duplicative R&D, and overall social R&D efficiency will significantly decline.
The above four dimensions indicate that knowledge distillation as reverse engineering can effectively promote constructive market competition. The basic function of competition is to incentivize producers to continuously develop and adopt new technologies, improve management to reduce costs, and thereby increase public welfare. Knowledge distillation, as a reverse engineering method, can promote technological progress while maintaining innovation incentives, maximizing overall social welfare.
(2) The legitimacy boundaries of knowledge distillation as reverse engineering
Although knowledge distillation as reverse engineering has an economic justification, it should, like reverse engineering in traditional industries, be subject to legitimacy boundaries. The legitimacy boundaries should be argued in light of the market characteristics of the relevant industry, the specific threats faced, and the economic impact of restrictions. A legitimacy assessment framework based on three dimensions—“purpose–conduct–result”—can be constructed around the characteristics of knowledge distillation.
First, as to purpose legitimacy, one should examine whether the distillation implementer has an intent to innovate. Where an actor conducts knowledge distillation to improve student-model performance based on obtaining internal technical information, or to create complementary innovation vis-à-vis teacher-model products, the purpose should be regarded as legitimate. By contrast, knowledge distillation aimed at purely copying teacher-model functionality rather than pursuing innovative development lacks legitimacy.
Because purpose legitimacy is a subjective element and difficult to directly prove in practice, it can be inferred from objective conduct. Where an actor continuously invests R&D resources to optimize the student model during the distillation process and further fine-tunes and optimizes the student model with real data after distillation, one may infer an intent to innovate. Conversely, where an actor brings a student-model-based product or service to market immediately after completing basic distillation steps, with no subsequent R&D investment, one may infer that the purpose is copying rather than innovation.
Second, as to conduct reasonableness, one should assess the necessity and innovativeness of knowledge distillation conduct.
At the necessity level, it should be analyzed whether knowledge distillation is a necessary pathway for obtaining internal technical information and improving student-model performance. Where there is a reasonably priced alternative pathway capable of achieving the same effect—for example, obtaining a distillation license at a reasonable price—the necessity of conducting knowledge distillation is weakened. However, the necessity requirement should not be overly stringent; otherwise, later developers may abandon knowledge distillation out of risk avoidance, thereby unduly narrowing the scope of reverse engineering.
At the innovativeness level, it is necessary to examine whether the implementer, on the basis of knowledge distillation, has invested a substantial degree of R&D costs. Such costs include not only economic inputs such as computing resources necessary to conduct distillation, but also subsequent innovation inputs such as further fine-tuning and optimization of the model using real human data.
One may draw on the SCPA’s “forward engineering” institutional design and require distillation implementers to produce results with a certain degree of originality: the student model should form performance advantages different from those of the teacher model. In *Sega Enterprises Ltd. v. Accolade, Inc.*, one of the reasons the court found the defendant’s reverse engineering legitimate was that the defendant developed a new non-infringing program, thereby promoting the creativity incentives intended by copyright law. The innovativeness requirement objectively extends the student model development cycle, enabling prior developers to maintain a lead during that period and recoup R&D costs.
Finally, as to market harm, one should examine whether the student model, after entering the market, directly substitutes for the teacher model, substantially affects the prior developer’s ability to recoup R&D costs, and weakens its incentives for subsequent innovation. Where student-model products or services target different market segments and user groups and compete with teacher models through differentiation rather than direct substitution, market harm is absent.
In determining direct market substitution, the following factors may be considered: (i) whether student and teacher models have significant differences in market positioning and target different user groups; and (ii) whether the student model forms differentiated functionality in specific vertical domains distinct from the teacher model. If either condition is satisfied, direct market substitution will generally not be found, and market harm will be absent.
It should be noted that implementation costs of knowledge distillation may continue to decline with technological iteration. If the technology develops to a point where it can replicate teacher models at extremely low cost, the risk of direct market substitution will substantially increase.
In applying these standards, the three factors form a progressive logic. Purpose legitimacy is the prerequisite, examining whether the actor has a subjective intent of substantive innovation. Conduct reasonableness is the key: on the basis of legitimate purpose, it further examines whether the distillation method is necessary and whether the implementer has invested substantive R&D costs and produced innovative results. Market harm is the final step: on the basis of legitimate purpose and reasonable conduct, it examines whether the student model directly substitutes for the teacher model and weakens prior developers’ innovation incentives.
Accordingly, distillation conducted for the purpose of copying teacher-model functionality, without subsequent innovation inputs, and resulting in direct market substitution lacks legitimacy and should not be characterized as reverse engineering. Conversely, where knowledge distillation, with certain subsequent R&D inputs, enhances differentiated performance of student models and constitutes complementary innovation rather than direct market substitution, it should be regarded as legitimate reverse engineering.
Conclusion
Technological innovation in the intelligent era has brought new needs and opportunities for the development of intellectual property law. The Central Economic Work Conference in 2025 for the first time proposed “improving the intellectual property protection system in emerging fields,” signaling that IP protection in emerging technology fields has risen to the level of national strategy.
The controversy over the legality of knowledge distillation is, in essence, a conflict between protecting R&D incentives and enabling subsequent technological innovation. Legal protection of technological innovation should not come at the expense of subsequent innovation. Knowledge distillation conduct that satisfies purpose legitimacy, conduct reasonableness, and the absence of market harm should constitute reverse engineering.
Clarifying the legality of knowledge distillation as reverse engineering helps form a dynamic balance between trade secret protection and industrial innovation incentives. In the AI era, technology evolves rapidly; only by actively responding to technological transformation can law promote high-quality and sustainable development of the AI industry in open competition.