US Agencies Warn China-Based AI Firms Are Conducting Industrial-Scale Model Distillation
Summary
NSA, CISA and the FBI say China-based AI companies have used large-scale, evasive access to extract capabilities from U.S. AI models since at least late 2024. They recommend behavioral monitoring, targeted response changes and cross-industry intelligence sharing.
Key points
- The agencies identify DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as participants; the advisory says campaigns have targeted models including Claude, GPT, Gemini and Grok.
- The advisory says activity since at least late 2024 involved billions of tokens and millions of exchanges or requests.
- Reported access routes include native APIs, cloud providers, third-party aggregators and gray-market API proxies called “transfer stations,” which the advisory says can obscure users and bypass restrictions.
- Described tactics include bulk or shared accounts, chain-of-thought extraction, automated routing between access paths and metadata sanitization.
- The agencies recommend monitoring anomalous prompts, accounts and usage patterns, and sharing infrastructure and behavioral indicators across providers.
- For suspected malicious distillation, the advisory recommends subtly altering responses to reduce their usefulness while avoiding alerts to suspected users.
Article Details
- Event Type
- Joint cybersecurity advisory warning of reported industrial-scale knowledge distillation campaigns against U.S. frontier AI models.
- Impact
- The advisory reports that named China-based AI companies extracted billions of tokens across millions of exchanges or requests from models including Claude, GPT, Gemini, and Grok. The activity allegedly obtains proprietary capabilities and reasoning data, reduces model-development costs and timelines, and threatens U.S. companies’ competitive advantage. The reported access methods include APIs, cloud providers, third-party aggregators, and gray-market transfer stations.
MITRE ATT&CK
T1020 · Automated ExfiltrationThe advisory describes automated, continuous API querying to collect model outputs into datasets.T1027 · Obfuscated Files or InformationThe advisory describes automated sanitization and obfuscation of user metadata to avoid detection.T1078 · Valid AccountsThe advisory reports use of shared accounts and bulk premium subscriptions to access AI services.T1583 · Acquire InfrastructureThe advisory describes sustained extraction infrastructure, including gray-market API proxies called transfer stations.
Threat Actors
AlibabaThe advisory reports that Alibaba used industrial-scale distillation to improve its AI models.DeepSeekThe advisory attributes an organized distillation campaign against U.S. frontier AI models to DeepSeek.MiniMaxThe advisory identifies MiniMax as conducting distillation activity against U.S. AI models.Moonshot AIThe advisory identifies Moonshot AI as conducting distillation campaigns against U.S. frontier AI models.StepFunThe advisory reports that StepFun distilled data from U.S. frontier AI models.Z.AIThe advisory reports that Z.AI distilled data from U.S. frontier AI models.
Products
Claudefrontier AI models, including Claude, GPT, Gemini, and Grok.Geminifrontier AI models, including Claude, GPT, Gemini, and Grok.GPTfrontier AI models, including Claude, GPT, Gemini, and Grok.Grokfrontier AI models, including Claude, GPT, Gemini, and Grok.Kimi-K2Notably, Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model.Kimi-K3Notably, Moonshot AI extracted significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model.M2In late 2025, MiniMax distilled CoT reasoning, RL, SFT, and software engineering capabilities to improve its M2 model from Claude Code, Claude Sonnet 4, Claude Opus, Gemini 1, Gemini 2.5 Pro, and Gemini 3 Pro.QwenAlibaba leveraged industrial-scale distillation to improve the company’s Qwen family of AI models.R1DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models.Step 4Sonnet 4.5, Claude Haiku 4.5, GPT-5 Mini, GPT-5 Pro, GPT-5.1, GPT-5.1 Codex, and GPT-5.2 to improve its Step 4 model’s coding and agentic functions.V3DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models.
Countries
ChinaNSA, CISA, and the FBI warn that China-based AI companies are running industrial-scale knowledge distillation campaigns to extract proprietary capabilities from U.S.United Statesor otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.