Kimi K3.1 Pro and DeepSeek V4.1-Flash Were Trained on GPT-6 Astra, a Report Says — What That Establishes

Kimi K3.1 Pro

The useful question for anyone who calls these models is not whether the allegation is scandalous. It is whether the behaviour you are buying is the behaviour you think you are buying, and what a distillation claim changes about that.

What the report actually claims

The reporting, as summarised across the outlets that carried it, says that both models used GPT-6 Astra outputs as training signal — the standard recipe of prompting a strong model at scale, collecting its answers, and training a weaker one to reproduce them. It does not claim weight theft, does not claim access to OpenAI's training code, and does not name a volume.

One detail from the coverage is worth separating out because it is a claim about motive rather than method: Chosun's English edition frames the shift as Chinese labs moving toward GPT-6 Astra after Anthropic tightened access to its own frontier models. That is plausible and unverified. It would also be unsurprising — the cheapest teacher available is whichever one a lab can still reach at volume.

What OpenAI has put on the record

DeepSeek V4.1-Flash

Those are different kinds of statement, and the difference matters. A vendor saying "we detect systematic extraction of our outputs" is a checkable operational claim with dates and counts. A publication saying "these two models were trained on those outputs" is a source-based claim without a published method. The second is more specific and less verifiable, and the temptation to merge them into one story is exactly how a report becomes a fact.

What distillation is, and what it is not

Distillation is a technique, not a crime. It has been standard practice inside labs for a decade: train a small model to match a large one's distribution, then serve the small one. What the labs object to is the case where the teacher is someone else's production model, queried at industrial scale, without permission.

Three things follow, and they are routinely conflated:

• The capability transfer is real but bounded. A student trained on a teacher's outputs inherits the teacher's answer distribution on the prompts it saw. It does not inherit the teacher's weights, its training data, its architecture, or its behaviour on prompts nobody thought to query.

• The legal question and the technical question are separate. Terms of service may prohibit it; detecting it is hard; proving it in a specific model is harder still. A vendor's detection of scraping traffic is not proof that a particular checkpoint was trained on the results.

• Benchmarks are a weak fingerprint. Two models distilled from the same teacher do not score the same, and two models with no relationship often score similarly on a benchmark that everyone optimises for. The tell, when there is one, is in the errors — the same unusual failure on the same unusual prompt.

Why this landed on an open-weights release

Both models are downloadable, which is what makes the story consequential rather than gossip. DeepSeek V4.1-Flash ships under MIT. Kimi K3.1 Pro is Moonshot's flagship and its weights are open. If the underlying capability came partly from a closed frontier model, then a buyer is acquiring, at open-weights prices, behaviour that was originally developed behind a paywall and an access review.

That is not automatically a problem for the buyer. It is a problem for the buyer who needs to know what they are depending on. A model whose behaviour was shaped by another vendor's outputs is a model whose behaviour can be inferred by anyone who has that other vendor's model — which matters for adversarial robustness, for evaluation design, and for anyone who thought they were buying an independent capability rather than an echo.

It also changes the risk profile of the licence. DeepSeek's MIT terms impose nothing. MiniMax's community licence, as we wrote this week, imposes attribution and a revenue threshold. A distillation dispute would not be settled by either licence; it would be settled somewhere else entirely, and the buyer would be a spectator.

What you can actually check

• Refusal behaviour on prompts your other models decline. A student that learned from a teacher inherits the teacher's guardrail patterns, including the inconsistent ones.

• Failure fingerprints. Run a set of deliberately odd prompts and compare error text, not error rate. Distillation shows up in shared idiosyncrasies.

• Calibration. Ask for confidence on questions it cannot answer, and see whether the abstention threshold matches a model you know.

• Version drift. DeepSeek V4.1-Flash has two checkpoints with different published scores, 39.46 for the September build and 45.10 for the 17 October refresh. A gap that large between two months is worth explaining regardless of any distillation claim.

None of these proves anything about training data. They do tell you whether the model behaves like something you already have, which is the practical version of the question.

What to do about it as a buyer

• Do not reprice a model on a rumour. Nothing in the reporting changes what Kimi K3.1 Pro or DeepSeek V4.1-Flash costs or how fast it is, and both remain among the cheapest strong models on the market.

• Do keep the provenance question on the procurement record. If your compliance function asks where a model's capability came from, "the vendor says it is trained from scratch" and "a report alleges it was distilled from a third party" are both statements you should be able to quote accurately six months from now.

• Test on your own traffic. Both models are on OrcaRouter at provider list price with 0% markup — code>kimi/kimi-k3.1-pro/code> and code>deepseek/deepseek-v4.1-flash/code> and code>deepseek/deepseek-v4.1-flash-1017/code> — so the comparison against your incumbent is a routing rule rather than a new contract.

The one thing not to do is treat the report as settled. Two labs, one publication, no published method: the honest position is that a plausible claim has been made and not demonstrated, and that the models' actual behaviour is measurable today regardless.

What would settle it

A lab acknowledging it, a lawsuit, or a technical analysis that matches outputs at scale. The first would end the argument, the second would move it to a court, and the third is the only one that could be done by someone outside the companies — which is why the absence of it after a week of coverage is worth noting.

Until one of those arrives, the claim belongs in the same folder as every other capability rumour: useful for how you evaluate a model, not for what you conclude about it.

Sourcing note: the distillation report, its attribution to The Information and the two named models are from the trade coverage of 29–30 October 2026; the original article was not read directly for this piece. The 1 July start date, the 24–25 July peak, the ~16,000 requests and the 4,000-plus accounts are from OpenAI's 30 September disclosure. The MIT licence for DeepSeek V4.1-Flash and the community licence terms referenced are from the respective model repositories; the two checkpoint scores, 39.46 and 45.10, are Artificial Analysis's. Neither Moonshot nor DeepSeek has confirmed the allegation. OrcaRouter model identifiers and list-price pass-through are our own catalogue.