China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

Summary

A joint CISA/NSA/FBI Cybersecurity Advisory (AA26-251A), released September 8, 2026, warns that China-based AI companies are conducting systematic, industrial-scale knowledge distillation campaigns to extract restricted proprietary functionalities and capabilities from U.S. frontier AI models, describing distillation as the core—not a supplement—of these companies' development strategy.^[0][36]

The agencies name DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, assessing that likely with Chinese government awareness they extracted billions of tokens across millions of exchanges from Claude, GPT, Gemini, and Grok variants since at least late 2024 to accelerate development and reduce training costs for models such as DeepSeek R1/V3, Moonshot's Kimi, Alibaba's Qwen, and MiniMax's M2.^[0]

To gain unauthorized access, the companies route requests through native APIs, cloud providers, and third-party aggregators that obfuscate metadata, and use a gray market of proxies known as 'transfer stations' to bypass geographic restrictions, breach terms of use, evade safeguards, and undermine traceability, while bulk-procuring premium subscriptions to cut costs.^[0]

The advisory recommends U.S. AI companies implement comprehensive anomaly detection, deploy targeted response alteration for suspected distillation, and establish cross-organization intelligence sharing to reveal distributed campaigns.^[0]

Attack chain

1. Resource Development (Acquire Infrastructure, AML.T0008): China-based entities establish tiered infrastructure and circumvent access controls through a large gray market of API proxies ('transfer stations') that resell frontier-model access at a fraction of official prices, creating a scalable mechanism for evading provider safeguards and eroding traceability.^[0]
2. AI Model Access (AML.T0040): Actors exploit inference APIs via fraudulent accounts not registered to legitimate users, reusing similar registration details and payment methods, switching between models, and using third-party API aggregators to execute highly coordinated queries at volumes far exceeding legitimate use.^[0]
3. Execution / Defense Evasion (Prompt Injection & Jailbreak, AML.T0051/T0054): Actors craft jailbreaking prompts forcing models to reveal hidden chain-of-thought reasoning; DeepSeek instructed models to imagine and articulate their internal step-by-step reasoning to teach student models reasoning methodologies for agentic tasks, coding, and logic.^[0]
4. Discovery (AML.TA0008): Actors employ aggressive, adaptive discovery to identify valuable extractable data; MiniMax redirected exchanges to a new Claude model within 24 hours of release, demonstrating real-time provider monitoring and pre-positioned retargeting infrastructure.^[0]
5. AI Attack Staging (Verify Attack, AML.T0042): Actors deploy production-grade automated quality-assurance pipelines with multi-modal validation to detect degraded outputs and distinguish service issues from defensive data-degradation countermeasures.^[0]
6. Collection (AML.TA0009): Actors systematically collect outputs into synthetic training datasets via continuous API querying targeting specific domains—Moonshot AI targeted agentic reasoning, coding, computer-use agents, and computer vision; DeepSeek targeted reasoning, rubric-based grading, and censorship-safe rewriting—at thousands-to-millions of queries per domain.^[0]
7. Exfiltration (Extract AI Model, AML.T0024.002): Actors collect U.S. frontier LLM inferences into datasets used to train their own models to mimic the behavior and performance of the targeted models.^[0]
8. Impact (External Harms, AML.T0048): The extraction inflicts financial harm by capturing capabilities worth billions in development costs and undermining U.S. competitive advantages and technological leadership.^[0]

Disclosure timeline

Actor profile

China-based AI companies (DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, Z.AI)

The advisory attributes high-volume, industrial-scale knowledge distillation campaigns against U.S. frontier AI models to these six named China-based AI companies, assessing—likely with Chinese government awareness—that distillation forms the core of their model development strategy to bridge technological and performance gaps. DeepSeek is assessed as an early and organized operator since at least late 2024; MiniMax demonstrated rapid operational maturity, retargeting new Claude models within 24 hours and even attempting prompt injections against Claude Code. The scale and sophistication—automated failover, quality-evaluation frameworks, and metadata sanitization—are cited as evidence of substantial organizational investment rather than opportunistic use.^[0]

How it works

Knowledge distillation abuse works by systematically querying U.S. frontier models through APIs and collecting their outputs into synthetic training datasets that let 'student' models mimic the behavior and performance of the target 'teacher' models. Actors target specific high-value domains rather than gathering indiscriminately.^[0]

A key technique is chain-of-thought (CoT) reasoning extraction: actors craft jailbreak/prompt-injection prompts that force models to reveal hidden step-by-step internal reasoning despite provider restrictions on CoT visibility, teaching student models reasoning methodologies rather than only factual outputs.^[0]

Operationally, the campaigns rely on fraudulent account pools, bulk premium subscriptions shared across teams, centralized request-routing systems that abstract providers and enforce quotas, automated metadata sanitization to strip organizational identifiers, and automated quality-assurance pipelines to detect defensive data-degradation countermeasures.^[0]

Affected versions and patch status

Key takeaways

• The threat here is competitive/economic extraction of proprietary AI capabilities via API abuse and distillation, not traditional network intrusion—defenders must monitor account behavior, subscription patterns, and query volumes rather than only malware indicators.^[0]
• Effective defense requires ecosystem-wide coordination among model providers, cloud platforms, and API aggregators, because actors deliberately distribute operations across pathways and sanitize metadata to defeat single-point detection.^[0]
• Advertised low training costs for some China-based models may understate true cost because they exclude data acquired through malicious distillation of U.S. frontier models.^[0]

Defensive actions

• Strengthen identity verification and monitor subscription-to-usage ratios, enterprise-scale throughput, and new accounts that immediately hit maximum usage rather than ramping gradually.: China-based AI companies exploit fraudulent account pools and bulk premium subscriptions; anomalous subscription-to-API usage ratios and immediate maximum usage are named detection indicators of distillation campaigns.^[0]
• Apply targeted response alteration for high-confidence malicious distillation requests, such as differential privacy, downgraded models, reduced reasoning depth, or stylistic inconsistencies, without informing the suspected distiller.: Subtly degrading responses reduces the training usefulness and payoff of distillation while avoiding tipping off actors so they cannot improve evasion or roll back training; safety researchers and evaluators should still be informed of changes.^[0]
• Establish cross-organization intelligence sharing across model providers, cloud platforms, and API aggregators, exchanging infrastructure indicators (IPs, domains, third-party providers) and behavioral indicators (timing correlations, query-volume patterns).: Actors deliberately distribute operations across multiple providers, platforms, and pathways to avoid single-point detection; correlated multi-source visibility reveals distributed campaigns and enables more confident attribution.^[0]
• Detect anomalous queries and enforce per-key/IP quotas, rate limits, and progressive throttling, and log inputs/outputs for detection and forensics (MITRE ATLAS AML.M0015, M0004, M0024).: Adversaries are sensitive to rate limits and implement sophisticated strategies to work within constraints; telemetry logging is foundational for behavioral detection and correlation.^[0]