The NSA, CISA, and FBI released a joint cybersecurity advisory yesterday naming six Chinese AI companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, in what amounts to an accusation of systematic industrial espionage. The agencies say these companies have been running coordinated, large-scale distillation campaigns against U.S. frontier models since late 2024, extracting "billions of tokens" through millions of requests routed through fake accounts, cloud proxies, and gray-market API relays to evade detection.
The specificity matters. MiniMax used Claude Code to build its own software stack, then used prompt injections to try to trick Claude into thinking it was a MiniMax product. StepFun distilled data from eight separate Claude and GPT model versions to improve its Step 4 coding capabilities. Z.AI bulk-ordered premium subscriptions and pooled them across development teams to harvest billions of tokens of GPT-5.5 and Claude Opus 4.8 data for chain-of-thought reasoning.
This is the move from rumor to formal threat model. Anthropic disclosed last April that three Chinese labs had created over 16 million fraudulent exchanges with Claude via roughly 24,000 fake accounts. The April White House memo conceded that distilled models "do not replicate the full performance" of the original. But yesterday's advisory is different: it's the U.S. intelligence apparatus saying this is core to China's AI development strategy, likely with government knowledge, and the agencies are calling on American companies to fight back with subtle response manipulation rather than hard blocks.
The weird part is that knowledge distillation itself is legitimate. It's a standard ML technique: train a smaller model on the outputs of a larger one. The thing that makes it theft is the deception, the scale, the terms-of-use violations, and the intent to avoid paying for compute. But here's where it gets thorny: how do you detect intent at the model API level? The advisory tells companies to watch for "immediate maximum usage from new accounts" and "enterprise-scale throughput patterns," but these are behavioral signals, not cryptographic proof. And the recommended response, subtly alter model outputs to degrade the distillation payoff, sounds like it could poison data across millions of innocent requests. That's a mitigation strategy that trades security for accuracy in ways we haven't fully thought through.
The advisory also assumes coordinated defense. The agencies explicitly call for "cross-organization intelligence sharing" between model providers, cloud platforms, and API aggregators. That's complicated in practice. OpenAI, Anthropic, and Google aren't exactly unified. They don't have the same detection heuristics or risk tolerance. And sharing telemetry about which accounts look suspicious requires legal frameworks that mostly don't exist yet.
The larger truth here is that frontier models are API services, and API services don't have natural borders. You can rent a server in Singapore and query them from there. You can federate requests across ten thousand cheap accounts. The distillation techniques described in the advisory are industrialized, but they're not novel. They're engineering. And they work because U.S. companies priced their APIs low enough and open enough that large-scale extraction is cheaper than training from scratch.
The intelligence community is essentially saying the problem is unsolvable at the API layer. If that's true, and I think it probably is, then the actual response isn't better detection. It's a policy choice: either frontier models stay open and we accept distributed distillation as the cost of accessibility, or they become more restricted and expensive, which raises questions about who gets to use them and how that shapes the industry globally.
The advisory doesn't make that choice. It offers tactical mitigations. But the game has moved past whether distillation is happening to whether the economic model of open API access to frontier AI is compatible with defending proprietary capabilities in a world where compute is globally available and cheap.
Top comments (0)