US agencies warn of industrial-scale AI model distillation

What this is about

On September 8, 2026, the NSA, FBI, and CISA published a joint cybersecurity advisory on knowledge distillation involving AI models. The agencies allege that several China-based AI companies had queried capabilities of US frontier models at industrial scale since at least late 2024 in order to train their own systems. They name DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and say variants of Claude, GPT, Gemini, and Grok were targeted.

The distinction between technique and conduct matters. Knowledge distillation is an established and generally legitimate method. According to the agencies, it becomes problematic through scale, evasion of access restrictions, and a querying infrastructure spread across many accounts, cloud services, and intermediaries. The report is therefore less a criticism of distillation itself than a warning about coordinated extraction of protected model capabilities.

What knowledge distillation actually does

In distillation, a smaller “student model” learns patterns from a more capable “teacher model.” The teacher receives many tasks, and its answers become training material. The smaller model can then learn writing styles, reasoning patterns, tool use, or complex instruction following without repeating all of the original data collection and compute-intensive training.

The advisory says the observed actors distributed requests across multiple model providers, API aggregators, cloud platforms, and regions. SecurityWeek, citing the agencies, reports billions of extracted tokens across millions of interactions. The report also describes regional restriction evasion, subscription exploitation, centralized request routing, sanitized metadata, and systematic optimization of quotas and costs. The described techniques are mapped to the MITRE ATLAS framework; the agencies say some patterns go beyond its existing categories.

Why it matters

A frontier model represents more than money. It can embody years of research, specialized chips, electricity, and scarce expertise. Replicating selected capabilities through another model’s outputs can bypass part of that investment. The agencies therefore frame the campaigns as an economic, national-security, and cyber-strategic risk at the same time.

For providers, defense moves from a single account to the wider supply chain. A model company may see only a harmless-looking fragment. The distributed pattern may become visible only when cloud providers, payment services, API intermediaries, and infrastructure operators combine signals. The advisory consequently recommends correlated behavioral detection, indicator sharing, limits on suspicious querying, and targeted changes to responses when confidence is high. It also mentions differential privacy as a possible protective technique.

In plain language

Imagine a cooking school. A student may ask the chef questions and learn from the answers; that is normal. It becomes problematic when thousands of apparently unrelated students ask every variation of a secret recipe around the clock, merge their notes centrally, and evade access restrictions. Each question looks harmless on its own; only the combined pattern reveals an attempt to reconstruct the cookbook.

A practical example

A fictional model provider allows each account 200 high-quality answers per day. A coordinated group operates 50,000 accounts through several intermediaries. In one full day, that could produce ten million interactions. Requests are mixed so that every account appears ordinary: some programming, some mathematics, and some writing.

A single alarm is not enough. The provider needs features across accounts: unusually similar task families, repeated variants of the same evaluation, synchronized querying, and shared technical infrastructure. Even then, the response should be graduated: additional verification and lower quotas first, followed by blocking when links are confirmed. These numbers are deliberately hypothetical and are not an estimate of the reported campaigns.

Scope and limits

First, the attribution is an assessment by US security agencies, not a court judgment. The named companies may dispute individual allegations, and the publicly released indicators do not let outsiders independently reproduce every claim.

Second, distillation is not automatically abuse. Research, model compression, and permitted synthetic training data use the same basic idea. Overly aggressive detection can affect legitimate developers, researchers, or fast-growing customers.

Third, rate limits alone do not solve the problem. Distributed actors can rotate accounts and providers, while pervasive monitoring creates privacy and competition concerns. Altering responses must also avoid harming uninvolved users. Effective defense therefore requires contractual rules, technical detection, human review, and the exchange of well-supported indicators.

SEO & GEO keywords

AI model distillation, knowledge distillation, NSA, CISA, FBI, DeepSeek, Moonshot AI, Alibaba, MITRE ATLAS, frontier models, API security, AI competition