What Was Kimi K3 Made From? — Zero Trust for the Maker's Side, Too

Authentication Comes in Two Weeks

On July 16, 2026, China's Moonshot AI announced Kimi K3. A sparse Mixture-of-Experts model with 2.8 trillion total parameters (activating 16 of 896 experts), a one-million-token context window, native vision input. On the major benchmarks it sits second or third, behind only Anthropic's Claude Fable 5 and OpenAI's GPT 5.6 Sol — and by some reports it beat Fable 5 in a head-to-head frontend-coding arena. It is the largest open-weights model ever, with the weights themselves promised for July 27.

The previous piece was about zero trust for the user's side: never make the output's origin the basis of trust; verify the content, every time. This is the sequel — zero trust for the maker's side. And Kimi K3 is the best teaching material available, because two opposite stories are circulating about this model right now, and discourse alone cannot settle either one.

Two Stories

The first story is "they stole it." On February 23 of this year, Anthropic published a document titled "Detecting and preventing distillation attacks," alleging that three companies — DeepSeek, Moonshot AI, and MiniMax — had conducted over 16 million exchanges with Claude through roughly 24,000 fraudulent accounts, extracting its capabilities to train their own models. Moonshot's share: over 3.4 million exchanges. The targets named were agentic reasoning, tool use, coding, vision, and computer-use agent development. Right on cue, days after K3's release came the anecdote that K3 had introduced itself in conversation as "Claude, an AI assistant made by Anthropic."

The second story is "they caught up by engineering." Officially, K3's gains are attributed to architecture: Kimi Delta Attention, a linear-attention hybrid delivering up to 6.3x faster decoding at million-token contexts; Attention Residuals, which selectively carries representations across model depth; Stable LatentMoE, which allocates experts by quantiles. Together, Moonshot says, they yield 2.5x the scaling efficiency of K2. Nathan Lambert, a researcher who tracks open models, writes that "if adversarial distillation from the closed frontier models in the U.S. contributed, it is at most to a relatively small degree" — the results, he argues, cannot be explained by distillation alone.

Here the previous piece's argument connects. Both stories are weighted by interest. The first was issued by a competing American frontier lab in the middle of the AI-chip export-control debate. The second underwrites the legitimacy of the open-weights camp and of the Chinese side. Judging which is true by circulation volume or loudness of voice is exactly what must not be done — it would be the geopolitical version of trusting the commercially weighted average of public discourse.

What the Public Record Says

So what do the published primary sources say, as opposed to the discourse?

Remarkably, the methodology itself — building by distillation and verification — is documented by Moonshot's own hand, independently of the allegations. The technical report for the previous model, Kimi K2 (arXiv:2507.20534), states two things as the core of the design. One is a large-scale agentic data-synthesis pipeline: generate tool-use trajectories en masse in simulated and real environments, and keep as teaching material only the interactions that are verifiably correct. The other is reinforcement learning with verifiable rewards (RLVR) combined with a self-critique rubric. On top of a 15.5-trillion-token pretraining pass over the raw web, they layer material that has been selected, synthesized, and passed through a verifier. As lineages go, this is about as far as you can get from "trust the mass of internet data indiscriminately."

And note what the Anthropic allegations name as targets — agentic reasoning, tool use, coding. These are precisely the domains where an output's correctness can be checked by machine. Code either runs or it doesn't. A tool call returns success or failure. Distillation's greatest weakness — errors begetting errors — can be severed by a verifier, but only in verifiable domains. Don't trust the teacher's outputs indiscriminately; inherit only the trajectories that passed verification. Whichever story is true, the location of the fight itself shows that "distillation plus verification" is the main battlefield of model-making now.

Choose your own canon, inherit by distillation, filter by verification — the hypothesis that this is K3's essence is consistent with the public record. But it remains a hypothesis. As of this writing, K3's own technical report and data recipes are unpublished.

On July 27, the Model Submits Itself to Verification

And this, I think, is the most interesting part of the story.

The question "is K3 a product of distillation or of engineering?" will not be decided by discourse. It will be decided by the weights released on July 27. Because the model is open-weights, third parties can probe them, study the behavior, and test for traces of distillation and lexical fingerprints. The anecdote of K3 calling itself Claude is not, by itself, evidence — it can arise merely from Claude outputs that saturate the web contaminating the training data, or by way of public datasets. A plausible anecdote and a verified fact are different things. In the previous piece's terms: this is where you read plausibility and correctness separately.

A closed model can tell its story on the premise of never being verified. An open-weights model exposes its story, whole, to verification. In zero-trust terms, on July 27 K3 comes before the world to be authenticated. Which story survives will be decided there.

Putting the Prediction on Record — A Scorecard for July 27

An article about verification that never exposes its own predictions to verification would not hold together. So here is my prediction as of this writing (July 21), in falsifiable form.

Prediction: K3 is a product of verification more than of distillation.

• Distillation is secondary. Even if all 3.4 million alleged exchanges are real, against a pretraining run of 15.5 trillion tokens for K2 alone they are a drop in the ocean — at most seed material for the synthesis pipeline. The real question is not "did they do it" but "what fraction of the capability does it explain," and that fraction is small.
• Verification is primary. The frontend strength in particular (beating Fable 5 in the head-to-head arena) is the product of a self-verification loop built on native vision — render the UI you just generated, look at it with your own eyes, and score it. Frontend looks like a hard domain to grade mechanically, but if the model's own vision is the verifier, the loop closes. The lineage — K2 (agentic + verification) → K2.5 (a technical report titled, of all things, "Visual Agentic Intelligence") → K3 — is consistent with this reading.
• It follows that small specialized models are coming. If the moat is not access to a teacher model but verifiers and data recipes, then verifiers are reusable. Pick a narrow domain, generate, filter through the verifier — this time by legitimate distillation from K3 itself — and small, strong, cheap specialist models fall out.

The grading criteria are also fixed in advance. From July 27 onward, four things to check:

1. In the technical report's data recipe, what share is verification-gated synthetic data, and how is distillation-derived data handled?
2. Is a visual verification loop (render-and-grade) explicitly described?
3. What do third-party fingerprint probes of the weights show (lexical habits, self-identification rates, statistical proximity to Claude outputs)?
4. Is a family of small models announced?

If the prediction misses, I will write that it missed. That is the discipline this piece is about.

Closing — The User's Discipline and the Maker's Discipline Converge on the Same Three

The previous piece folded the discipline of using AI into three rules. Make it use reasoning, not memory. Hold the canon in your own hands. Never let go of verification.

The discipline of making models is converging on the same three. Don't trust the teacher model's outputs indiscriminately (no unverified distillation). Choose your own teaching material (the data recipe has become the competitive edge). Inherit only what passed the verifier (RLVR, verification-gated synthetic data). The Kimi K2 technical report belongs to the first group of documents to record this shift at frontier scale, and K3 is — or is about to be verified as — the largest piece of evidence yet for that line.

The stage of trusting the mass of internet data indiscriminately is ending on the user's side and the maker's side alike. What remains is the engineering of canon and verification. When K3's weights are released, I will grade the scorecard above and write the sequel.

Related

• Blog AI Isn't Wrong Because It's Ignorant — What One Bad Answer Teaches About Working With AI — the first half of this pair: zero trust for the user's side
• Blog The Beginning of the End of American AI Hegemony — The Supreme Court Ruling and Five Layers of Structural US-Dependence Risk — the geopolitical backdrop to the rise of Chinese open-weights models
• Blog When Fable 5 Returns, Do This First — Verify Every System You Run — the organizational version of "when verification becomes free, whatever assumed it would never be verified collapses"

References

1. China's Moonshot AI releases Kimi K3, the largest open-source model ever (VentureBeat, 2026-07-16) — https://venturebeat.com/technology/chinas-moonshot-ai-releases-kimi-k3-the-largest-open-source-model-ever-rivaling-top-u-s-systems
2. Moonshot AI Releases Kimi K3: A 2.8 Trillion Parameter Open MoE Model (MarkTechPost, 2026-07-16) — https://www.marktechpost.com/2026/07/16/moonshot-ai-releases-kimi-k3-a-2-8-trillion-parameter-open-moe-model-with-kimi-delta-attention-and-1m-context/
3. Kimi K3: The open-weights escalation (Nathan Lambert, Interconnects, 2026-07) — https://www.interconnects.ai/p/kimi-k3-the-open-weights-escalation
4. Detecting and preventing distillation attacks (Anthropic, 2026-02-23) — https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
5. Anthropic accuses DeepSeek, Moonshot and MiniMax of distillation attacks on Claude (CNBC, 2026-02-24) — https://www.cnbc.com/2026/02/24/anthropic-openai-china-firms-distillation-deepseek.html
6. Kimi K2: Open Agentic Intelligence — Technical Report (Kimi Team, arXiv:2507.20534) — https://arxiv.org/abs/2507.20534
7. China's Kimi K3 Identifies Itself As Anthropic's Claude In At Least One Conversation (Wccftech, 2026-07-18) — https://wccftech.com/chinas-kimi-k3-identifies-itself-as-anthropics-claude-in-at-least-one-conversation-betraying-its-distilled-origins/
8. China's 2.8-trillion-parameter Kimi K3 beats Claude Fable 5 in Frontend Code Arena benchmark (Tom's Hardware, 2026-07) — https://www.tomshardware.com/tech-industry/artificial-intelligence/moonshot-releases-2-8-trillion-parameter-kimi-k3