US Agencies Warn Chinese AI Firms Are Extracting Capabilities From Frontier Models
Summary
The NSA, CISA, and FBI say China-based AI companies have systematically distilled capabilities from US frontier models since at least late 2024. They recommend coordinated monitoring, information sharing, and technical safeguards.
Key points
- The agencies allege that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens through millions of exchanges with US frontier AI models.
- The article says DeepSeek and Moonshot used distilled capabilities to improve their own models; the agencies’ report describes activity across all the named companies.
- The agencies map the reported tactics to MITRE ATLAS and describe additional techniques, including evading regional restrictions, exploiting subscriptions, routing requests centrally, sanitizing request metadata, and optimizing quotas and costs.
- The agencies characterize the activity as planned and well-resourced, with potential economic harm and risks to US technological leadership—not a direct threat to enterprise AI use.
- Recommendations include coordinated behavioral monitoring, sharing information across the AI ecosystem, and differential privacy to limit extraction of sensitive model information.
- The report also suggests targeted changes in response to high-confidence malicious requests, while noting that responses should limit risk to legitimate users.
Article Details
- Event Type
- U.S. agencies warn that China-based AI companies are systematically extracting capabilities from U.S. frontier AI models through large-scale distillation.
- Impact
- The agencies describe potential financial harm to U.S. frontier model developers, erosion of competitive advantages and U.S. technological leadership, and a possible national security concern. The article says the threat is primarily economic and strategic, rather than a direct threat to enterprise use of AI.
Threat Actors
AlibabaNamed by the agencies among the China-based AI companies that extracted capabilities from U.S. frontier models; the agencies characterize the activity as likely undertaken with Chinese government awareness.DeepSeekNamed by the agencies as a China-based AI company that extracted capabilities from U.S. frontier models through distillation; the agencies characterize the activity as likely undertaken with Chinese government awareness.MiniMaxNamed by the agencies among the China-based AI companies that extracted capabilities from U.S. frontier models; the agencies characterize the activity as likely undertaken with Chinese government awareness.Moonshot AINamed by the agencies as a China-based AI company that extracted capabilities from U.S. frontier models through distillation; the agencies characterize the activity as likely undertaken with Chinese government awareness.StepFunNamed by the agencies among the China-based AI companies that extracted capabilities from U.S. frontier models; the agencies characterize the activity as likely undertaken with Chinese government awareness.Z.AINamed by the agencies among the China-based AI companies that extracted capabilities from U.S. frontier models; the agencies characterize the activity as likely undertaken with Chinese government awareness.
Products
Claudefrontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024,” they say.Claude Fable 5Moonshot undertook a similar large scale distillation, including the extraction of significant Claude Fable 5 data to improve its Kimi-K3 model; and GPT-4o data to improve its Kimi-K2 model.Geminifrontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024,” they say.GPTfrontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024,” they say.GPT-4Between late 2024 and mid 2025, DeepSeek distilled training data and capabilities from Claude, Gemini, GPT-4 and GPT-5, and Grok 4 to train its R1 and V3 models.GPT-4oMoonshot undertook a similar large scale distillation, including the extraction of significant Claude Fable 5 data to improve its Kimi-K3 model; and GPT-4o data to improve its Kimi-K2 model.GPT-5Between late 2024 and mid 2025, DeepSeek distilled training data and capabilities from Claude, Gemini, GPT-4 and GPT-5, and Grok 4 to train its R1 and V3 models.Grokfrontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024,” they say.Grok 4Between late 2024 and mid 2025, DeepSeek distilled training data and capabilities from Claude, Gemini, GPT-4 and GPT-5, and Grok 4 to train its R1 and V3 models.Kimi-K2Moonshot undertook a similar large scale distillation, including the extraction of significant Claude Fable 5 data to improve its Kimi-K3 model; and GPT-4o data to improve its Kimi-K2 model.Kimi-K3Moonshot undertook a similar large scale distillation, including the extraction of significant Claude Fable 5 data to improve its Kimi-K3 model; and GPT-4o data to improve its Kimi-K2 model.R1Between late 2024 and mid 2025, DeepSeek distilled training data and capabilities from Claude, Gemini, GPT-4 and GPT-5, and Grok 4 to train its R1 and V3 models.V3Between late 2024 and mid 2025, DeepSeek distilled training data and capabilities from Claude, Gemini, GPT-4 and GPT-5, and Grok 4 to train its R1 and V3 models.