US Intelligence Agencies Accuse Six Chinese AI Firms of Covert, Industrial-Scale Distillation of Frontier Models
On Tuesday, September 8, 2026, the U.S. government escalated its technological standoff with China, issuing a joint cybersecurity advisory accusing six prominent Chinese artificial intelligence companies of executing systematic, industrial-scale knowledge distillation campaigns against U.S. frontier models. The advisory, published jointly by the National Security Agency (NSA), the FBI, and the Cybersecurity and Infrastructure Security Agency (CISA), named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as the entities responsible.
The intelligence agencies concluded that since at least late 2024, these Chinese labs have siphoned billions of tokens across millions of exchanges from U.S. frontier models—including variants of OpenAI's GPT, Anthropic's Claude, Google's Gemini, and SpaceXAI's Grok—to bypass geographic restrictions and fast-track their own model development.
Covert Distillation via "Transfer Station" Gray Markets
Knowledge distillation is a machine learning technique where a smaller, less computationally expensive model is trained on the high-quality outputs generated by a larger, more sophisticated "teacher" model. While distillation is a standard technique in machine learning, the U.S. government alleges that the Chinese campaigns were systematically designed to steal intellectual property and evade detection.
According to the advisory, the Chinese firms utilized fraudulent accounts and routed their queries through a gray market of API proxies known as "transfer stations" to bypass geographic blocks and terms-of-service restrictions1. The agencies asserted that distillation is not merely an ancillary method but functions as "the critical core" of these Chinese companies' development programs.
The advisory detailed specific distillation targets for each named company:
- DeepSeek: Targeted advanced reasoning capabilities, agentic functions, and specialized code optimizations from GPT-4, GPT-5, and multiple Claude versions to train its flagship R1 and V3 models. The agencies noted that DeepSeek's highly publicized $5.6 million training cost is misleading because it entirely excludes the massive cost of data acquired through illicit distillation.
- Moonshot AI: Extracted massive datasets from Anthropic's Claude Fable 5 to train its 2.8-trillion-parameter Kimi K3 model.
- Alibaba, MiniMax, StepFun, and Z.AI: Systematically distilled capabilities across software engineering, coding, customer service, and complex chain-of-thought reasoning.
Geopolitical Friction and Sanctions Threats
The joint advisory has intensified geopolitical tensions ahead of a scheduled summit between President Donald Trump and Chinese President Xi Jinping in Washington, D.C. Following the release of the report, Treasury Secretary Scott Bessent reiterated his July warning that the administration is prepared to levy severe sanctions against Chinese AI models built on stolen American intellectual property.
"When PRC firms conduct covert, industrial-scale distillation attacks that cross the line into IP theft, sanctions and Entity List designations will be on the table." — Treasury Secretary Scott Bessent on X
China’s Foreign Ministry sharply rejected the accusations, calling the advisory a "deliberate attack" designed to smear China’s technological progress.
"U.S. framing is a deliberate attack on China's development and progress in the AI industry. ... [China's AI progress is due to] the country's own scientific and technological capabilities." — Mao Ning, Chinese Foreign Ministry Spokesperson, quoted in Reuters
Industry Defensive Guidelines
To counter the distillation campaigns, CISA, the FBI, and the NSA urged U.S. AI developers to adopt a series of active defense measures:
- Behavioral Monitoring: Implement advanced monitoring tools to detect anomalous query patterns and repetitive, structured API requests indicative of automated distillation.
- Output Poisoning: Quietly and dynamically modify or degrade model outputs (e.g., introducing subtle formatting changes or minor noise) when distillation activity is suspected from specific accounts or IP ranges, thereby degrading the quality of the Chinese training data.
- Threat Intelligence Sharing: Coordinate and share threat intelligence across peer companies to identify and block gray-market API proxies and transfer stations.
-
An instance of Platform bans cannot prevent rivals from distilling superior model outputs to train their own. — Chinese AI labs bypassed platform security and geographic restrictions to systematically distill high-quality outputs from leading Western models. ↩︎