On September 8, 2026, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the Federal Bureau of Investigation published a joint advisory, AA26-251A, titled "China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies." It names six firms - DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI - and says they have extracted billions of tokens across millions of requests from variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini and xAI's Grok since late 2024.
Knowledge distillation, which trains a less capable model on the outputs of a more capable one, is a standard machine learning technique. The advisory's charge is about scale and intent: it says distillation "is not a supplement to these companies' AI model development, but the critical core of it," and notes that DeepSeek's claimed 5.6 million dollar training cost leaves out distillation. Techniques it describes include routing traffic through gray-market proxy resellers ("transfer stations") to get around geographic restrictions, shared accounts used from many IP addresses and user agents with round-the-clock usage, query volumes in the thousands to millions per domain, and prompts asking models to imagine and articulate the internal reasoning behind their answers.
The agencies recommend three things to US model providers: detect anomalous and malicious prompts, accounts, networks and behavior, including by monitoring subscription-to-usage ratios and enterprise-scale throughput; subtly alter responses to suspected distillation attempts; and correlate activity across model providers, cloud platforms and API aggregators. CISA Acting Director Nick Andersen urged AI companies "to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies."
The advisory moves distillation from a terms-of-service dispute between labs into a formal US government national security attribution against named foreign companies. It is guidance, not a sanction or an indictment, and no court has ruled on the allegations. Its advice to degrade outputs for suspected abusers also raises the practical problem of telling distillation apart from heavy legitimate use without harming paying customers.