The National Security Agency, FBI, and Cybersecurity and Infrastructure Security Agency said Tuesday that China-based AI companies have systematically extracted proprietary capabilities from U.S. frontier models through industrial-scale knowledge distillation, according to a joint advisory (AA26-251A) and Bloomberg. The agencies named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, saying the campaigns are a core development strategy rather than a side technique, likely with Chinese government awareness.
Since at least late 2024, the advisory says, those firms pulled billions of tokens across millions of exchanges from Claude, GPT, Gemini, and Grok variants. DeepSeek is accused of targeting reasoning and domain-specific functions for R1 and V3; Moonshot of using Claude Fable 5 and GPT-4o data for Kimi models; Alibaba of improving Qwen; and MiniMax, StepFun, and Z.AI of similar chain-of-thought, coding, and agentic extractions. Bloomberg framed the warning as a direct charge that Silicon Valley’s lead is being siphoned at scale.
CISA says the firms routed requests through native APIs, cloud providers, aggregators, and gray-market “transfer stations” that bypass geographic limits, obscure metadata, and share premium subscriptions across developer teams. Techniques include chain-of-thought extraction, prompt injection and jailbreaks, automated failover when blocked, and quality checks to spot defensive response degradation. Public training-cost figures such as DeepSeek’s quoted $5.6 million omit the value of distilled data, the agencies argue.
U.S. frontier labs are urged to detect anomalous accounts and usage ratios, subtly alter responses for high-confidence distillation traffic without tipping off attackers, and share indicators across providers and cloud platforms. Acting CISA Director Nick Andersen said companies should protect platforms so distillation does not close the gap with American models. The advisory does not announce new sanctions; it is a defensive playbook for the industry. A CISA press release accompanies the full advisory.