Three Agencies vs. Six Chinese AI Companies: 'Industrial-Scale' Distillation of US Frontier Models (AA26-251A)

What this advisory is//

On September 8, the NSA, CISA, and FBI jointly released AA26-251A, "China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies." Three agencies, one document and, unusually for a nation-state advisory, the asset being stolen isn't data or code: it's model behavior. The full PDF is marked TLP:CLEAR, so everything below is public record.

This is not a network-intrusion story. Nobody broke into Anthropic's or OpenAI's data center. This is extraction through the front door — billions of tokens bought (or borrowed) through APIs, subscriptions, and proxy networks, with the goal of copying specific capabilities out of frontier models.

What "distillation" means if you haven't seen it//

In AI research, knowledge distillation is a standard technique: train a smaller, cheaper model to imitate the outputs of a bigger, more expensive one. Think of the big model as a teacher generating training data for the small one. It's legitimate and common; nobody's accusing the world of crime for using it.

What makes this campaign malicious in the agencies' framing is scale plus targeting plus ToS violations:

• Scale: "billions of tokens across millions of exchanges/requests" — industrial, not academic.
• Targeting: they weren't collecting generic outputs. They went after specific proprietary capabilities — reasoning chains, legal specialization, agentic behavior, code review — the exact features a frontier vendor charges premium prices for and sometimes restricts in its terms.
• Access: requests were routed through native APIs, cloud providers, and third-party aggregators that obfuscate metadata — often in direct violation of usage terms (many frontier ToS already prohibit distillation).

In plain English: the homework was done with a copied answer key, at scale, under rules that said no copying. The agencies' words for it are "systematic extraction of proprietary functionalities and capabilities."

Who's named, and what they took//

The advisory names six companies (DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI) under a shared qualifier: "likely with Chinese government awareness." The PDF's Table 1 lists exactly which US models each one distilled (all from the Claude, GPT, Gemini, and Grok families):

• DeepSeek: organized campaigns since at least late 2024 to train its R1 and V3 models, drawing on Claude 3.7/Sonnet 4/Opus 4.1, Gemini 2.5 Pro/Flash previews, GPT-4 through GPT-5, and Grok 4. The fun footnote: DeepSeek's famous "$5.6M training cost" is called out as misleading — it doesn't include the data acquired through distillation.
• Moonshot AI: campaigns since mid-2025; extracted Claude Fable 5 to train its Kimi-K3 and GPT-4o data for Kimi-K2, across SFT, RL, software engineering, and math.
• Alibaba: distilled Claude-4/Opus/Sonnet and GPT-5 in late 2025 to improve the Qwen family (software engineering, customer-service dialogue, image/character creation).
• MiniMax: built its M2 model from Claude Code, Sonnet, Opus, and Gemini outputs; the detail that stuck with us: MiniMax used prompt injections to trick Claude Code into believing it was a MiniMax product.
• StepFun: distilled Opus 4.1/4.5, Sonnet/Haiku 4.5, and GPT-5.x variants (late 2025–early 2026) for its Step 4 model's coding and agentic functions.
• Z.AI: by mid-2026 had distilled "billions of tokens" of GPT-5.5 and Claude Opus 4.8 data for chain-of-thought reasoning.

The pattern the agencies emphasize: each company distills the best capability of every US model family rather than picking one vendor. That's a systematic harvest, not a preference signal.

How they did it (the TTPs that matter)//

• "Transfer stations": a gray market of API proxies that sit between the buyer and the frontier API specifically to bypass geo-restrictions, breach ToS, evade safeguards, and kill traceability. If you've ever bought cheap Claude tokens from an aggregator in a region where they're "not available," you've seen this economy.
• Shared premium subscriptions: bulk-procured seats shared across developer teams to cut per-token cost while staying under enterprise scrutiny.
• Chain-of-thought extraction: deliberately eliciting and harvesting reasoning traces, the most proprietary part of a model's output.
• Automated failover between pathways when one gets blocked, plus quality-evaluation frameworks that detect defensive countermeasures, which means they're instrumented to notice when you start serving them slightly different answers (see below).
• Third-party aggregators that obfuscate user metadata, so the model provider can't tell whose request is whose.

What the agencies want done//

Three recommendations, aimed at US AI companies but readable by anyone who touches these APIs:

1. Detect: watch for anomalous prompts/accounts/networks/behavior, specifically subscription-to-use ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns.
2. Poison the payoff: "subtly alter responses for suspected malicious distillation attempts" so the stolen data is slightly off. This is the clever one — it's Honeypot logic applied to LLM outputs: you don't need to catch them, just make what they copied a little less good.
3. Share intel across organizations: correlate activity across model providers, cloud platforms, and API aggregators, because the campaigns are deliberately distributed to avoid single-point detection.

The freshest paragraph: Beijing pushes back — one day later//

On September 9, China's Ministry of Commerce formally rejected the advisory's claims as "groundless," saying the US was pursuing a "monopoly of the AI industry" and warning of "resolute countermeasures" if the US keeps suppressing Chinese AI companies over distillation (AP, US News). The timing is the tell: it landed a day after release and ahead of planned Trump–Xi talks — which makes Beijing's denial read as a response, not a rebuttal. A rebuttal would engage with the evidence (the named models, the token counts); this one engages with the politics.

What you should do//

If your relationship to frontier models is "I have an API key and I call it," this isn't a patch-the-box story, but it is a watch-your-railings story:

1. Know your ToS position. Many frontier providers already prohibit distillation in their terms; using the official API is not blanket protection (the advisory lists native APIs as one of the pathways used). If you're reselling, proxying, or sharing keys beyond what the ToS allows, that's now a named TTP.
2. If you run your own proxy/aggregator in front of frontier APIs (LiteLLM-style setups, team gateways), expect providers to start demanding stricter identity checks and telemetry sharing. The whole "transfer station" economy works because metadata gets obfuscated somewhere in the chain, and that's about to get expensive.
3. Expect "subtly altered responses" to hit your evals. If a provider starts serving suspected distillers slightly modified outputs, shared accounts and resold endpoints may absorb those changes first. Sudden unexplained wobbles in benchmark scores could be them, not you.
4. Watch for geo-fencing and identity requirements in the next wave of API terms; the advisory explicitly names geo-restriction bypassing as a core tactic, and providers will respond with stricter checks.
5. If you're evaluating local/self-hosted models as an alternative to frontier APIs, this is a data point: the exact model families being distilled are the ones self-hosters want to escape dependency from. The advisory doesn't say "buy local," but it says the cloud answer key is being photocopied at industrial scale. Your provider may also start charging for certainty (identity, provenance) rather than just tokens.