U.S. Intelligence Agencies Warn of Industrial-Scale AI Model Distillation Campaigns by China-Based Firms

WASHINGTON - The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) have issued a joint Cybersecurity Advisory (AA26-251a) warning of industrial-scale knowledge distillation campaigns conducted by China-based AI companies against U.S. AI firms.

According to the advisory, since at least late 2024, companies including DeepSeek, Moonshot AI, Alibaba Group, MiniMax, StepFun, and Z.AI have extracted billions of tokens across millions of exchanges from U.S. frontier AI models. The targeted models include variants of Claude, GPT, Gemini, and Grok. The agencies say the extracted capabilities and functionalities form the core of the China-based companies' own AI development, rather than serving as a supplementary technique.

The advisory details multiple pathways used by the actors to conduct distillation. These include native application programming interfaces (APIs), remote cloud providers, third-party aggregators, and a gray market of proxies referred to as "transfer stations." These routes are used to bypass U.S. AI companies' geographic restrictions, violate terms of use, and evade detection. The advisory also notes that China-based companies achieve cost savings through bulk procurement and shared use of premium subscriptions across developer teams.

Advanced tactics cited include chain-of-thought (CoT) reasoning extraction, automated failover between pathways during blocking attempts, and sophisticated quality evaluation frameworks to detect defensive countermeasures. The agencies say these techniques allow the actors to systematically extract the best capabilities from each U.S. frontier model.

The advisory attributes the campaigns to actors likely operating with Chinese government awareness. The agencies warn that the sheer scale and sophistication of the campaigns indicate distillation is the critical core of these companies' AI model development. The advisory threatens U.S. technological leadership and raises concerns regarding intellectual property and national security.

In response, the authoring agencies recommend that U.S. AI companies implement comprehensive detection and mitigation measures, deploy targeted response changes to attenuate payoffs for malicious actors, and establish cross-organization intelligence sharing across model providers, cloud platforms, and API aggregators to reveal distributed campaigns.