Chinese AI firms are siphoning capabilities from American models, CISA warns

China-based AI companies are using large-scale knowledge distillation campaigns to copy capabilities from leading U.S. AI models, according to a joint cybersecurity advisory from the CISA, NSA, and FBI.

Knowledge distillation is a standard AI training technique that uses outputs from a more capable model to help train another model. The agencies say companies in China have used it at industrial scale to extract restricted capabilities including reasoning, coding and other specialized functions, making distillation a core part of their model development strategies.

“We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies,” said CISA Acting Director Nick Andersen.

Companies and models targeted

DeepSeek, Moonshot AI, Alibaba Group, MiniMax, StepFun and Z.AI have extracted billions of tokens through millions of requests to U.S. frontier AI models, including variants of Claude, GPT, Gemini and Grok, since at least late 2024.

The agencies assess that the activity has occurred likely with the knowledge of the Chinese government.

DeepSeek has extracted data and capabilities from U.S. frontier AI models to help train DeepSeek R1 and V3, focusing on reasoning, writing, agentic functions, question answering and specialized tasks such as legal work.

The advisory challenges DeepSeek’s reported $5.6 million training cost, saying the figure does not account for the true cost of data obtained through extensive distillation.

Moonshot AI has carried out similar activity since at least mid-2025, using U.S. frontier models to improve software engineering, mathematics, supervised fine-tuning and reinforcement learning capabilities in its Kimi models.

Alibaba, MiniMax, StepFun and Z.AI have used U.S. models to develop capabilities ranging from coding and customer service to reasoning and AI agents. By mid-2026, Z.AI had distilled billions of tokens of data from GPT-5.5 and Claude Opus 4.8 to develop chain-of-thought reasoning capabilities.

How the distillation campaigns work

The campaigns use tactics, techniques and procedures (TTPs) mapped to the MITRE ATLAS framework, spanning resource development, AI model access, execution, privilege escalation, defense evasion, discovery, AI attack staging, collection, exfiltration and impact.

They also rely on techniques not covered by the framework. Companies use a gray market of API proxies known as “transfer stations” to bypass regional restrictions, obscure their country of origin, evade safeguards and reduce traceability. Pools of premium accounts distribute requests and avoid usage limits, while centralized systems route traffic across APIs, cloud providers, aggregators and other services based on availability and quotas.

Operators remove identifying information from requests and optimize account and service usage to reduce costs.

How companies can detect distillation campaigns

Indicators include continuous 24/7 usage without normal human variation or idle periods, anomalous subscription-to-API usage ratios, new subscriptions that rapidly reach maximum usage, coordinated behavior across account pools and sudden changes in identifying metadata.

The agencies recommend stronger account identity verification and closer monitoring of individual subscriptions exhibiting enterprise-scale throughput or other deviations from legitimate usage patterns.

Mitigations and response strategies

Providers can reduce the value of suspected distillation campaigns by varying responses, limiting reasoning depth, presenting correct information through different reasoning paths or introducing stylistic inconsistencies. They can route suspected operators to less capable models without notifying them.

For confirmed malicious distillation activity, providers can alter responses without notifying operators. AI safety researchers and third-party evaluators should be informed when model changes occur.

Differential privacy offers another defense by adding controlled noise to model outputs, making extraction more difficult. Because stronger privacy protections can reduce model accuracy and usefulness, providers can combine differential privacy with rate limits, response controls and monitoring.

Sharing indicators such as IP addresses, domains, third-party services, query volumes and timing patterns can help model developers, cloud providers and API platforms identify coordinated campaigns that might otherwise appear isolated.

Safety and adversarial training can provide an additional layer of protection by making prompt injection and jailbreak techniques more difficult.