US Intelligence Agencies Accuse Chinese AI Firms of Industrial-Scale “Distillation” of Western Models

Three US agencies — the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI — have issued a joint warning. In their telling, Chinese AI companies are engaged in the “systematic extraction” of the restricted capabilities of cutting-edge American models through distillation attacks — and they are doing so on an industrial scale and with the tacit approval of the Chinese authorities.

Distillation in itself is a legitimate technique in AI research: one model is trained on the outputs of another. But, as the bulletin's authors stress, what is at issue here is an aggressive, targeted variant in which the very functions whose access is restricted are drawn out of someone else's models.

Who was named

The document lists DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. It claims that, since late 2024, they have extracted billions of tokens over the course of millions of queries to variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini and Grok. Specific accusations are leveled at each company: DeepSeek allegedly trained its R1 and V3 this way, Moonshot AI its Kimi-series models, Alibaba honed its coding and image-handling skills, while StepFun and Z.AI drew data from recent versions of Claude and GPT.

How it works

Since Western models are not officially available in China, developers — according to the agencies — get around the geographic restrictions using VPNs, dummy accounts and automated agents. Savings come from bulk purchases of premium subscriptions shared across an entire team. Queries are disguised by spreading them across different providers, clouds and third-party aggregators, and on the Taobao and Xianyu marketplaces a gray market has flourished for proxy servers located outside mainland China that operate as relays.

Among the technical techniques mentioned are the extraction of chains of reasoning (chain-of-thought), automatic switching between channels when blocks are hit, and quality-assessment systems capable of recognizing defensive countermeasures. The upshot is markedly shorter development timelines and lower costs for training their own cutting-edge models.

What they recommend

American companies are advised to deploy comprehensive detection mechanisms, subtly corrupt their responses when malicious distillation is suspected, and correlate activity across different providers in order to expose distributed campaigns.

This is not the first accusation of its kind. Back in February, Anthropic reported industrial-scale campaigns by DeepSeek, Moonshot AI and MiniMax, and this week Google Threat Intelligence Group registered a surge of attacks on its models — some exceeding 100 million queries.

Arctic Wolf expert Ismael Valenzuela urges treating the bulletin as an abuse of legitimate access, similar in tactics to distributed credential stuffing. In his words, even companies far removed from cutting-edge models are wrong to view the problem as purely a matter for governments: API keys and service accounts are becoming a valuable target, since abuse of access looks just like ordinary, legitimate activity.

Source: The Hacker News