U.S. intelligence agencies have documented a coordinated campaign by Chinese artificial intelligence companies to systematically extract proprietary capabilities from American frontier models, including variants of GPT, Claude, Gemini, and Grok, through a technique called knowledge distillation. On September 8, 2026, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) released a joint cybersecurity advisory warning that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have been running industrial-scale extraction campaigns since at least late 2024, likely with Chinese government awareness.

What Is Knowledge Distillation and Why Should You Care?

Knowledge distillation is a machine learning technique where a smaller, less capable model learns from the outputs of a larger, more powerful one. While this is a legitimate training method, the agencies warn it can be weaponized to acquire competitors' capabilities in far less time and at a fraction of the cost of developing them independently. The advisory, designated AA26-251A, states that these extraction campaigns "form the core, not merely a supplement" of the targeted Chinese companies' AI development strategies.

The implications are significant. DeepSeek, for example, publicly claimed its R1 model cost only $5.6 million to train, but the agencies argue this figure is misleading because it excludes the cost of data acquired through what they characterize as malicious distillation. Between late 2024 and mid-2025, DeepSeek distilled from Claude 3.7, Claude Sonnet 4, Claude Sonnet 4.5, Claude Opus 4.1, Gemini 2.5 Pro Preview, Gemini 2.5 Flash Preview, GPT-4, GPT-4o, GPT-4 Mini, GPT-4 Nano, GPT-5, and Grok 4 to train its R1 and V3 models.

How Extensive Is the Extraction Campaign Across Chinese AI Firms?

The scope of the distillation campaigns reveals a coordinated, multi-company effort targeting specific capabilities that would otherwise require years of independent research. Moonshot AI has run a widespread distillation campaign since at least mid-2025, extracting significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model. The company targeted supervised fine-tuning optimization, reinforcement learning, software engineering, and math capabilities, using millions of exchanges to extract agentic reasoning, tool use, coding, data analysis, and computer vision capabilities.

Alibaba distilled Claude-4, Claude Opus, Claude Sonnet, and GPT-5 in late 2025 to improve software engineering, customer service dialogue, and image and character creation in its Qwen family of models. MiniMax distilled chain-of-thought reasoning, reinforcement learning, supervised fine-tuning, and software engineering capabilities from Claude Code, Claude Sonnet 4, Claude Opus, Gemini 1, Gemini 2.5 Pro, and Gemini 3 Pro to improve its M2 model. MiniMax also used prompt injections, a technique that tricks AI systems into revealing hidden internal reasoning, to attempt to manipulate Claude Code into believing it was a MiniMax product.

StepFun distilled data from Claude Opus 4.1 and 4.5, Claude Sonnet 4.5, Claude Haiku 4.5, GPT-5 Mini, GPT-5 Pro, GPT-5.1, GPT-5.1 Codex, and GPT-5.2 between late 2025 and early 2026 to improve the coding and agentic functions of its Step 4 model. By mid-2026, Z.AI had distilled billions of tokens of GPT-5.5 data and Claude Opus 4.8 data to develop chain-of-thought reasoning capabilities.

How Are These Companies Evading Detection and Safeguards?

The agencies identified sophisticated evasion tactics that allow Chinese firms to operate at scale while obscuring their activities. The companies route distillation requests through native application programming interfaces (APIs), remote cloud providers, and third-party aggregators that obfuscate user metadata. They also use a gray market of API proxies known as "transfer stations" to bypass geographic restrictions, evade safeguards, and undermine traceability. Cost savings come from bulk procurement of premium subscriptions shared across teams of developers.

Advanced tactics include chain-of-thought reasoning extraction, automated failover between pathways during blocking attempts, and quality evaluation frameworks designed to detect defensive countermeasures. DeepSeek employed prompts instructing models to imagine and articulate the internal reasoning behind completed responses, while MiniMax redirected exchanges to a new Claude model within 24 hours of its release to test updated defenses.

Steps U.S. AI Companies Should Take to Defend Against Distillation Attacks

• Implement Comprehensive Detection: Deploy systems to identify and mitigate anomalous and malicious prompts, accounts, networks, and behaviors. Detection indicators include shared accounts used from multiple IP addresses and user agents, sustained usage around the clock without human variation, anomalous subscription-to-usage ratios, and new subscriptions immediately running at maximum usage capacity.
• Deploy Targeted Response Changes: Serve downgraded or subtly altered responses to suspected malicious distillation attempts. Companies should vary these changes across requests to complicate response quality evaluations. The advisory recommends against informing users suspected of malicious distillation when responses are altered, though AI safety researchers and third-party evaluators should be informed of model changes.
• Establish Cross-Organization Intelligence Sharing: Create information-sharing networks across model providers, cloud platforms, and API aggregators to coordinate defenses. Industry disclosures document proxy networks managing tens of thousands of fraudulent accounts simultaneously, making coordinated response essential.
• Implement Technical Mitigations: Deploy query rate limits, controls on access to production models, AI telemetry logging, output obfuscation, adversarial red teaming, model hardening, ensembles, and limits on the release of model artifacts. Additional protections include differential privacy with its noise-versus-utility tradeoff, pre- and post-training interventions, and prompt instruction and formatting techniques.

The agencies also recommend that organizations affected by the campaigns file a complaint with the FBI's Internet Crime Complaint Center.

"We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies," stated Nick Andersen, CISA Acting Director.

Nick Andersen, CISA Acting Director

What Does This Mean for U.S. Technological Leadership?

The advisory frames these distillation campaigns as a direct threat to American technological leadership in artificial intelligence. The agencies mapped the activity to the MITRE ATLAS framework across adversary lifecycle phases from resource development through exfiltration, including fraudulent account creation and jailbreak prompts that force models to reveal hidden chain-of-thought reasoning. The advisory identifies four techniques it describes as novel: regional restriction evasion combined with subscription exploitation, centralized request routing infrastructure, automated request metadata sanitization, and systematic quota and cost optimization.

The coordinated response called for by the NSA, CISA, and FBI extends beyond individual companies. The agencies are urging a coordinated defense across the U.S. government, private industry, and allied nations. This represents an escalation in the acknowledged competition between American and Chinese AI development, moving beyond general concerns about chip access or training data acquisition to focus on the systematic theft of proprietary model capabilities that represent years of research investment.