CISA, NSA, and FBI Accuse Six Chinese AI Companies of Industrial-Scale Model Distillation

The National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI published a joint advisory on September 8 accusing six China-based AI companies of running industrial-scale knowledge distillation campaigns against American frontier AI models since at least late 2024. The advisory, tracked as AA26-251A, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and says the companies extracted billions of tokens across millions of requests from models built by Anthropic, OpenAI, Google, and xAI.

Knowledge distillation is a legitimate and widely used machine learning technique: a smaller “student” model learns by training on the outputs of a larger, more capable “teacher” model, which cuts training costs and speeds up development. The three agencies say what they observed goes well beyond that normal practice. Their advisory describes a “planned and well-resourced national level action” carried out with what the agencies assess is Chinese government awareness, rather than opportunistic scraping by individual firms.

Six Companies, Four Targeted Labs

According to the advisory, each of the six named companies targeted a different mix of US models:

• DeepSeek is accused of distilling data from multiple versions of Claude, GPT-4, GPT-5, Gemini, and Grok 4 between late 2024 and mid-2025 to train its R1 and V3 models, drawing on outputs covering API rule-driven tasks, agentic functions, question-answering, and fine-tuning optimization.
• Moonshot AI is accused of extracting data from Anthropic’s Claude Fable 5 to improve its Kimi K3 model, and from OpenAI’s GPT-4o to improve the earlier Kimi K2.
• MiniMax is named for targeting Claude, Gemini, and GPT models.
• Alibaba and StepFun are accused of targeting Claude and GPT models.
• Z.AI is accused of distilling GPT-5.5 and Claude Opus 4.8 by mid-2026.

The advisory goes further than describing lost training costs. It frames the campaign as a strategic threat: “a strategic economic threat to fair technological competition and U.S. technological leadership,” and Kevin Townsend’s reporting on the advisory for SecurityWeek notes the agencies see the pattern as significant enough that it “could potentially lead to a national security issue.” In one specific example, the advisory challenges DeepSeek’s own widely cited claim that it trained V3 for about $5.6 million, arguing that figure is misleading because it excludes the true cost of acquiring the distilled data in the first place.

How the Distillation Campaign Worked

The advisory describes a set of techniques the agencies say go beyond MITRE’s own ATLAS framework for adversarial AI behavior, which is what convinced them this was coordinated rather than opportunistic. Named techniques include:

• Routing requests through a “gray market of API proxies known as ‘transfer stations'” to bypass US companies’ regional restrictions and usage limits.
• Creating fraudulent accounts and abusing bulk premium subscriptions to multiply available request volume.
• Automated failover between providers and access routes whenever one path got blocked or throttled.
• Prompt injection and jailbreak attempts aimed specifically at exposing restricted chain-of-thought reasoning, the intermediate steps a model produces before its final answer, which is normally hidden from users.
• Automated quality evaluation frameworks that checked whether a target model’s responses had been deliberately degraded, then adjusted tactics accordingly.

Indicators the agencies say defenders should watch for include new accounts that immediately reach maximum usage, continuous activity with no normal human idle periods, shared accounts accessed from unusually large numbers of IP addresses or user agents, identical prompts submitted to multiple providers, and subscription-to-usage ratios far outside normal customer behavior.

Mapped to MITRE ATLAS

The advisory maps the observed campaign to specific MITRE ATLAS technique IDs spanning the full attack lifecycle: infrastructure acquisition (AML.T0008), API inference access (AML.T0040), prompt injection and jailbreaking (AML.T0051 and AML.T0054), discovery (AML.TA0008), verifying whether an attack succeeded (AML.T0042), collection (AML.TA0009), exfiltration through an inference API (AML.T0024.002), and broader external harms (AML.T0048). That level of technical detail is closer to how the same agencies document a deliberate intrusion campaign than a routine notice about a terms-of-service violation.

What the Agencies Are Telling AI Companies to Do

The advisory’s recommendations run from purely defensive to more aggressive. CISA, the NSA, and the FBI recommend that model providers, cloud platforms, and API aggregators coordinate rather than act alone, since a single provider only sees one slice of a campaign that is deliberately spread across proxies and accounts.

The most notable recommendation is a quiet one: rather than simply blocking accounts suspected of high-confidence malicious distillation, the agencies suggest deliberately degrading what those accounts receive. That could mean adding calibrated noise to outputs through differential privacy techniques, routing suspected requests to a less capable model, or otherwise “subtly alter[ing] responses for suspected malicious distillation attempts to attenuate payoffs,” without telling the requester that anything has changed. The advisory argues this imposes a real cost on distillation operations while limiting the risk of degrading service for legitimate users, particularly once activity has been “correlated across model providers, cloud platforms, and API aggregators” to build higher confidence in the attribution.

CISA Acting Director Nick Andersen framed the advisory as a call to action rather than a simple notification. “CISA is committed to promoting the secure use of AI while fostering the innovation crucial to America’s global competitiveness,” Andersen said. “We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies.”

A Bigger Escalation of an Existing Dispute

This is not the US government’s first public distillation accusation against a Chinese AI company. In July, the White House accused Moonshot AI of covertly distilling Anthropic’s Fable model to build Kimi K3, a claim that arrived alongside a Treasury threat of sanctions and Entity List action against the company. That earlier accusation named one company and one model pair. Tuesday’s joint advisory names six companies, four targeted US labs, and dozens of specific model versions, and comes with a formal MITRE ATLAS mapping and a coordinated mitigation playbook rather than a one-off statement.

Kimi K3 itself was already a market event before this advisory: its July release triggered a Nasdaq selloff and briefly pushed Nvidia’s market value below Apple’s, on fears that a Chinese lab could match frontier US performance at a fraction of the training cost. The new advisory’s specific challenge to DeepSeek’s $5.6 million training-cost claim reads as a direct response to that same fear: if the real cost of matching a frontier model includes nearly two years of distilled outputs from the model it is matching, the headline training-cost comparisons that rattled markets in the first place were never telling the whole story.

No Response Yet From the Named Companies

None of the six companies named in the advisory had issued a public response as of publication. BleepingComputer reported that it had contacted all six for comment and would update its reporting if any replied. The recommended countermeasures in the advisory, quietly degrading suspect accounts and sharing correlated activity data, are the kind of technical response typically aimed at a terms-of-service and contract dispute rather than a step toward prosecution, since distillation through a public API is not itself illegal in the way that unauthorized network intrusion would be.

Sources: CISA advisory AA26-251A, CISA press release, BleepingComputer, SecurityWeek, and Help Net Security.