Distillation attackers deploy networks consisting of hundreds of thousands of fake accounts to systematically copy internal chain-of-thought steps from targeted AI models