Advisory
China AI Firms Deploy Industrial‑Scale Distillation to Steal U.S. Model Secrets
The NSA, CISA and FBI have issued a joint advisory warning that Chinese AI companies are conducting large‑scale knowledge‑distillation operations against U.S. frontier models such as Claude, GPT, Gemini and Grok. By routing requests through APIs, cloud services, third‑party aggregators and proxy “transfer stations,” firms like DeepSeek, Alibaba, Moonshot AI, MiniMax, StepFun and Z.AI harvest billions of tokens to train their own models, violating terms of use and threatening intellectual‑property security. The advisory details the tactics and recommends mitigation steps for U.S. organizations.
The National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI have jointly released an advisory that exposes a coordinated effort by several Chinese AI firms to siphon proprietary capabilities from U.S. AI models. Using industrial‑scale knowledge distillation, these companies harvest data from leading models—Claude, GPT, Gemini, Grok and others—to train their own successors.
What Is Knowledge Distillation?
In AI research, distillation is a legitimate technique for compressing a large, high‑performance model into a smaller, more efficient one. The process typically involves feeding the teacher model’s outputs into a student model during training. The problem arises when the technique is weaponized: the target model’s internal behaviors are extracted on a massive scale, effectively cloning its proprietary features.
How the Campaigns Operate
- Multiple entry points: native APIs, cloud providers, and third‑party aggregators that scrub user metadata.
- Use of proxy “transfer stations” to bypass geographic restrictions and obscure the origin of requests.
- Bulk purchasing of premium subscriptions to reduce cost and enable large‑volume token extraction.
- Targeted focus on reasoning, domain‑specific functions and specialized optimizations to create competitive models.
Key Actors
- DeepSeek – running organized campaigns since 2024 to extract reasoning capabilities for its R1 and V3 models.
- Alibaba – leveraging distillation to enhance its Qwen family.
- Moonshot AI, MiniMax, StepFun, Z.AI – all engaged in large‑scale extraction of U.S. model data.
Potential Impact
These activities threaten the intellectual property of U.S. AI companies, undermine the integrity of the AI ecosystem, and could enable the creation of competitive models that replicate or exceed U.S. capabilities. The scale—billions of tokens across millions of requests—suggests a systematic, industrial approach rather than isolated incidents.
Mitigation Recommendations
- Monitor API usage patterns for anomalous token volumes or repeated requests from unfamiliar IP ranges.
- Implement strict access controls and rate limiting on AI model endpoints.
- Enforce geographic restrictions and validate user identities against known proxies or VPN services.
- Audit subscription usage to detect bulk procurement that may indicate coordinated extraction efforts.
- Educate developers and data scientists on the legal and ethical boundaries of knowledge distillation.
Organizations are urged to review their AI deployment policies and strengthen safeguards against unauthorized distillation. The advisory underscores that while distillation is a valuable research tool, its misuse at an industrial scale poses a serious security threat to the U.S. AI landscape.
Related vulnerabilities
China AI Firms Launch Industrial-Scale Knowledge Distillation Attacks on U.S. Models
CISA, NSA, and FBI have issued a joint warning that Chinese AI companies are deploying large‑scale knowledge distillation campaigns to siphon data from U.S. AI models. By extracting distilled knowledge, attackers can accelerate their own development while bypassing costly training. The threat poses risks to commercial, governmental, and national‑security AI systems, prompting urgent calls for tighter model protection and monitoring.
Read briefing
US Agencies Accuse Chinese AI Firms of Large‑Scale Distillation of U.S. LLMs
The FBI, NSA and CISA jointly warned that a group of Chinese startups—Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun and Z.AI—have been quietly harvesting billions of tokens from leading U.S. language models such as GPT, Claude, Gemini and Grok. Using industrial‑scale distillation tactics, the firms allegedly bypassed terms of service, leveraged premium API plans, and routed requests through opaque proxies to avoid detection. The move is said to slash development time and costs for Chinese competitors while potentially compromising U.S. intellectual property.
Read briefing
NIST & CISA Release New Token‑Protection Playbook for Multi‑Cloud Agencies
The National Institute of Standards and Technology, in partnership with the Cybersecurity and Infrastructure Security Agency, has unveiled a comprehensive guide for federal agencies and cloud service providers to safeguard signed tokens, assertions, and cryptographic keys. With the rise of hybrid, multi‑cloud deployments, single sign‑on, federation, and API‑driven access, adversaries increasingly target these credentials for forgery, theft, and lateral movement. The report refines token validation, secrets management, and large‑scale detection, and embeds Secure‑by‑Design principles to reinfor
Read briefing
AI‑Enabled Attacks: The Open Letter That Left Out Who’s Behind the Threat
A recent open letter from major tech firms warned that AI could make sophisticated cyberattacks cheaper and more common, but it failed to identify the actors exploiting the new tools or how to close the emerging threat window. The warning came after U.S. agencies uncovered AI‑generated exploitation scripts targeting exposed Siemens S7 PLCs in critical infrastructure. Analysts argue that criminals are driven by profit, not novelty, and that the real risk lies in old misconfigurations now being weaponized by AI. The industry must prioritize hardening high‑risk assets, scrutinize AI‑generated cod
Read briefing