On September 8, 2026, the U.S. National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI released a joint Cybersecurity Advisory with an unusually direct title: "China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies." It's the U.S. government's most detailed public accounting to date of how Chinese AI developers have been extracting the outputs of American frontier models—not as an occasional research shortcut, but, in the agencies' words, as the "critical core" of their model development strategy.
The advisory names six companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—and lays out, in more granular detail than is typical for this kind of document, which U.S. models each one targeted, what capabilities they extracted, and how. For an audience that has spent the past two years debating whether Chinese labs were closing the capability gap through genuine innovation or through appropriation of U.S. research investment, the advisory reads like the government finally putting a stake in the ground.
Knowledge distillation is not, on its own, a novel or nefarious technique. It's a standard part of the machine learning toolkit: a smaller "student" model is trained to mimic the outputs of a larger "teacher" model, transferring some of the teacher's capability at a fraction of the training cost. Labs distill their own models all the time—it's how you get a fast, cheap model that still performs reasonably well on the tasks that matter.
The advisory's core claim is that Chinese AI companies have industrialized this technique and turned it outward, running "systematic extraction of proprietary functionalities and capabilities" against U.S. frontier models at a scale and with a level of coordination that the authoring agencies argue crosses from legitimate research practice into something akin to intellectual property theft. The document is careful to preserve that distinction: distillation-as-technique isn't the problem; distillation-as-industrial-scale-extraction-in-violation-of-terms-of-use is.
That framing matters for how practitioners should read the rest of the document. This isn't an argument that distillation itself should be restricted. It's an argument that a specific pattern of behavior—bulk account creation, geographic evasion, chain-of-thought extraction, coordinated infrastructure—constitutes a security and economic threat that the AI ecosystem needs to actively defend against.
The level of specificity here is worth sitting with. The advisory states that, likely with Chinese government awareness, the named companies extracted billions of tokens across millions of exchanges from U.S. frontier models—including variants of Claude, GPT, Gemini, and Grok—since at least late 2024.
DeepSeek gets the most extensive treatment. The advisory describes an organized distillation campaign running since late 2024 that fed the training of R1 and V3, targeting Claude 3.7, Claude Sonnet 4, Claude Sonnet 4.5, Claude Opus 4.1, Gemini 2.5 Pro/Flash previews, several GPT-4 variants, GPT-5, and Grok 4. Notably, the agencies take a direct swing at DeepSeek's public cost narrative, stating that the widely cited $5.6 million training figure for DeepSeek-V3 "is misleading as it does not include the true cost of the data acquired through extensive malicious distillation." The domains extracted read like a list of everything that makes a frontier model commercially valuable: legal specialization, API rule-driven tasks, chain-of-thought writing, agentic function execution, and supervised fine-tuning optimization.
[RELATED: Markets Plummet Amid Surprise AI Breakthrough from China's DeepSeek]
Moonshot AI is described as having run a widespread campaign since at least mid-2025, notably extracting data from Claude Fable 5 to train Kimi-K3 and from GPT-4o to train Kimi-K2, alongside a long list of other Claude, GPT, and Gemini variants—targeting SFT, reinforcement learning, software engineering, and math capabilities.
Alibaba, MiniMax, StepFun, and Z.AI round out the list, each with a narrower but still specific footprint: Alibaba distilling Claude and GPT-5 outputs to improve Qwen's customer service and agentic workflows; MiniMax targeting Claude Code, Claude Sonnet/Opus, and Gemini models for its M2 model—including, notably, using prompt injection in an attempt to convince Claude Code it was a MiniMax product; StepFun working through Claude Opus and Sonnet, Claude Haiku 4.5, and multiple GPT-5 variants to improve its Step 4 model's coding and agentic functions; and Z.AI distilling billions of tokens of GPT-5.5 and Claude Opus 4.8 data to develop chain-of-thought reasoning.
The consistent thread across all six is that this isn't opportunistic scraping. It's targeted, sustained, and—per the advisory—organizationally resourced extraction aimed specifically at the capabilities that are hardest and most expensive to build from scratch: reasoning, agentic behavior, and domain-specific fine-tuning.
The advisory frames the observed behavior using the MITRE ATLAS framework—the adversarial-ML analog to ATT&CK—which is itself a signal of how the government wants this treated: not as a business dispute, but as adversary activity with a lifecycle, from resource development through exfiltration.
A few of the mapped techniques stand out for their operational specificity.
Infrastructure ("transfer stations"): Chinese entities are described as relying on a gray market of API proxies that resell frontier model access at a fraction of official pricing, explicitly designed to bypass both Chinese and U.S. access controls and undermine traceability.
Inference API access via fraudulent accounts: Multiple accounts with similar registration and payment details, frequent model-switching, and reliance on third-party API aggregators, with query volumes the advisory says range from thousands to millions on a single topic—"far exceeding legitimate use."
Chain-of-thought extraction via jailbreak: DeepSeek specifically is called out for prompting models to narrate their internal reasoning step by step, despite provider restrictions on exposing that reasoning—because CoT data teaches a student model methodology, not just facts.
Rapid retargeting: MiniMax reportedly redirected distillation traffic to a newly-released Claude model within 24 hours, which the advisory reads as evidence of active provider monitoring and pre-positioned infrastructure rather than ad hoc opportunism.
Beyond the ATLAS-mapped techniques, the advisory identifies four "novel TTPs" not currently captured in the framework: regional-restriction and subscription evasion (bulk premium subscriptions run across pooled accounts, with StepFun singled out for structuring access around employee account pools with load-balanced sessions); centralized request-routing infrastructure that abstracts across models and providers for unified control; automated metadata sanitization at the infrastructure layer; and systematic cost optimization that treats pathway selection as a routing-and-pricing problem. That last category is a useful reminder that this is being run with the operational discipline of a production system, not a research side project.
The recommended mitigations are worth flagging separately for practitioner and executive audiences, because they ask for different things.
For security and detection teams, the advisory's asks are fairly conventional extensions of existing anomaly detection: watch subscription-to-usage ratios, flag new accounts that hit maximum usage immediately rather than ramping up, correlate timing and behavior across account pools, and apply the relevant MITRE ATLAS mitigations—rate limiting, output obfuscation, red-teaming, and access controls.
The more editorially interesting recommendation is response alteration—deliberately degrading output quality (reduced reasoning depth, alternate correct reasoning paths, stylistic variation) for accounts suspected of running distillation campaigns, without informing the account holder that a downgrade has occurred. The advisory is explicit that the reasoning behind this asymmetry is operational: telling a suspected distiller that they've been switched to a degraded model would let them detect and route around the mitigation. It draws a contrast with how AI safety researchers and third-party evaluators should be treated—informed of changes, not silently degraded—which implies a classification problem that isn't trivial to solve at scale: distinguishing a malicious distillation campaign from a legitimate high-volume enterprise customer or a benchmarking effort is exactly the kind of judgment call that behavioral heuristics can get wrong in both directions.
For executive and procurement audiences, the advisory's call for cross-organization intelligence sharing—across model providers, cloud platforms, and API aggregators—is the piece that requires the most new coordination infrastructure. The advisory points to industry disclosures of proxy networks managing tens of thousands of fraudulent accounts simultaneously as evidence that no single provider has full visibility into a distributed campaign. That's a reasonable technical argument, but it also implies a level of information-sharing between competing commercial AI labs that doesn't currently have an established mechanism. This advisory calls for it without specifying who convenes it or what legal protections participating companies would need.
A few things are worth flagging for readers evaluating how much weight to put on this document, separate from whether its factual claims hold up.
First, the phrase "likely with Chinese government awareness" is doing real work in the executive summary, but the advisory doesn't present direct evidence of state direction or coordination—the attribution is to the companies themselves, with government awareness offered as an inference rather than a documented finding. That's a meaningfully different claim than state-sponsored operation, and the distinction matters for how this gets read in the context of broader U.S.-China tech policy.
Second, the advisory cites DeepSeek's own technical report to challenge DeepSeek's public training-cost figures, which is a legitimate use of a primary source but also worth noting as an advocacy move: the agencies are using the company's self-reported numbers against its own narrative rather than presenting independent cost accounting.
Third, this advisory sits inside a policy context—it references two White House documents, National Security Presidential Memorandum 11 on AI in the national security enterprise and National Science and Technology Memorandum 4 on adversarial distillation specifically—that suggest this advisory is one component of a broader administration push rather than a standalone technical disclosure. Readers tracking the policy dimension of this story will want to look at NSTM-4 directly, since it appears to be the document actually establishing U.S. policy on adversarial distillation, with this advisory serving as the technical/operational companion.
Finally, the advisory's mitigation strategy—degrade outputs for suspected bad actors without telling them—is a defensible security practice, but it's also the kind of policy that, if it becomes public knowledge as a general practice (as it now has, via this very advisory), changes the game for legitimate high-volume users who might now reasonably wonder whether their own outputs are being silently downgraded.
The strategic argument threaded through the advisory is straightforward: distillation lets a fast-follower skip the most expensive parts of frontier AI development—the research risk, the compute spend, the iterative RLHF and safety work—and get most of the capability gain anyway. If that's happening at the scale this advisory describes, it reframes a lot of the "China is closing the AI gap through efficiency innovation" narrative that's circulated since DeepSeek's initial release. The advisory's position is that at least part of that efficiency was never free—it was subsidized, without consent, by the R&D investment of the U.S. labs being distilled.
For security teams at AI companies, the immediate task is the detection and response engineering the advisory lays out. For the industry more broadly, the harder question is whether competing commercial labs will actually build the cross-provider information-sharing mechanism the advisory calls for, or whether this becomes another advisory that names a real problem without producing the coordination structure needed to address it.