The U.S. National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI issued a joint cybersecurity advisory on Tuesday accusing several China-based artificial intelligence companies of running industrial-scale knowledge distillation campaigns against American frontier models. The U.S. government claims that firms including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have extracted billions of tokens from models like Claude, GPT, Gemini, and Grok since at least late 2024 to shorten AI research development for the China-based companies.
For Archyde readers, this warning lands at a critical intersection of national security policy, machine learning engineering, and international diplomacy. As Treasury Secretary Scott Bessent prepares to sit down with Chinese officials this month for talks on AI security, intelligence agencies are laying bare the mechanics of modern model acquisition. Distillation is not inherently illegal; it is a machine learning technique where a more powerful “teacher” model can confer the ability to generate more useful and accurate results to a smaller “student” model, resulting in a compressed, but effective model.
The Mechanics of Industrial-Scale Distillation
Knowledge distillation involves training a less capable AI model using the outputs of a larger, more capable one. By feeding prompts into a teacher model and capturing its token outputs, a developer can train a compressed student model.
https://x.com/patrick_oshag/status/2082104296175198361
The joint advisory from CISA, the NSA, and the FBI outlines how China-based labs utilized millions of exchanges/requests to extract capabilities from U.S. platforms. These campaigns shorten research development for the China-based companies. Anthropic has previously noted that illicitly distilled models lack necessary safeguards, creating significant national security risks.
Last year, OpenAI gathered evidence indicating that DeepSeek had performed distillation against its wishes. Yet, the commercial landscape has grown more nuanced over time. In a July interview, OpenAI CEO Sam Altman downplayed the immediate threat of the practice, remarking that while he would rather people not distill from them, it is not in his top ten list of worries. Even so, the national security apparatus views the systemic extraction of frontier data through a much sharper lens.
Defensive Posture and Enterprise Mitigation Strategies
CISA has recommended three immediate technical countermeasures for frontier providers:
- Comprehensive Detection and Mitigation: Monitoring subscription-to-usage ratios, identifying immediate maximum usage from new accounts, and detecting anomalous and malicious prompts, accounts, networks, and behaviors.
- Targeted Response Changes: Subtly altering responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.
- Cross-Organization Intelligence Sharing: Correlating activity across model providers, cloud platforms, and API aggregators to reveal distributed campaigns.
