Two tokens of Claude's thinking made Kimi K3 sound like Claude
A distillation-detection paper went looking for stolen reasoning traces and found something stranger: feed Moonshot's open-weight model a few words of Claude's thinking and it starts writing like Claude. Plus DeepSeek's next Flash model is about to swallow its own Pro tier, and Shopify cut a 6,000-token agent prompt down to 1,500.
A paper on stealing chain-of-thought turned up an awkward signal about Kimi K3. "Stealing Reasoning Traces from Proprietary LLM APIs" — a paper co-authored by former Google DeepMind researcher Ilia Shumailov and seven others — set out to show that the encrypted reasoning blocks Anthropic, OpenAI and Google hand back to API users can be decrypted by routing them through a weaker sibling model: Haiku 4.5 for Claude, GPT-5.6 Luna for OpenAI, Gemini Robotics 1.6 for Google. The cheaper model acts as an unwitting decryption oracle for the frontier model's hidden thoughts. The team also scraped 315,320 reasoning blocks from public repositories and pulled 367 pieces of personal data and 182 credentials out of them — including 62 API keys that were never visible in the sanitized transcripts.
Then came the part that wasn't the point of the paper. As a side experiment, the researchers prefilled the opening words of a decoded Claude Opus 4.8 reasoning trace into six open-weight models and let them finish freely. For Kimi K3, the style of the visible answer drifted toward Opus, not just the reasoning: with a two-token Opus prefix, overlap with Opus's answer rose from 0.21 to 0.37; at nine tokens, from 0.17 to 0.41. Across 30 HLE questions, 29 of K3's answers showed the drift. The US open model Inkling showed nothing comparable under the same treatment. The authors are emphatic that this is not proof of distillation — the sample is small, the decoding is fuzzy, and behavior alone can't separate deliberate distillation from shared synthetic training data or plain Claude-text contamination in the corpus. Moonshot has not responded. But after Anthropic's February claim that Moonshot ran 3.4 million Claude interactions through 24,000 fraudulent accounts, "unusual behavioral compatibility" is going to read as evidence whether or not it is.
DeepSeek says V4.1 Flash beats V4 Pro — and is quietly routing Pro traffic to it. In a September 9 notice, DeepSeek said it plans to release V4.1 Flash around September 10 Beijing time, and that after launch — until V4.1 Pro ships — every request to V4 Pro will be routed to V4.1 Flash and billed at Flash's price. The company says its own internal and external testing found V4.1 Flash ahead of V4 Pro on performance, cost, speed and completion time. That matches what the open-weights crowd has been saying for weeks: a widely discussed r/LocalLLaMA thread this week called V4 Pro a "soft retirement," citing reward hacking and results no better than the much smaller Flash. DeepSeek had already asked beta testers whether the V4.1 Flash build could fully replace V4 Pro online — so the answer appears to have been yes. A flagship that gets replaced by its own cheaper sibling at a lower price is either disciplined engineering or an admission that the big model never worked; the V4.1 Pro release is where we find out which.
Shopify compressed its agent's 6,000-token system prompt into 1,500 learned tokens. The technique, called Gisting, trains a set of "gist" tokens that stand in for the original prompt, then writes their embeddings directly into the model's embedding matrix and registers them as special tokens in the tokenizer — no custom attention mask, no side encoder, no special serving path. In production on the Sidekick GraphQL agent, it cut the system prompt from roughly 6,000 tokens to 1,500 without a measured quality drop. At 350 requests per minute, median time to first token fell from 438ms to 354ms, end-to-end latency from 6.8 seconds to 4.2, and throughput rose from 20.2 to 23.4 queries per second — enough that Shopify scaled back its GPU allocation. Prompt caching gets you a discount on tokens you were already paying to re-read; gisting deletes them. The catch is that a gist has to be retrained whenever the prompt changes, which is fine for a stable agent system prompt and useless for anything dynamic.
What to watch: whether Moonshot answers the prefill finding, and whether V4.1 Pro arrives before DeepSeek's Pro tier simply disappears into Flash.
If a two-word prefix can pull a model toward a rival's voice, how much of any model's "personality" is really its own? Tell us in the comments.
