Loading page…
The warning treats alleged misuse of model outputs as a national-security concern and calls for defenses that reach beyond any single AI provider.
Listen to this story
A joint NSA, FBI and CISA advisory alleges China-based firms have used large-scale, fragmented querying to extract capabilities from restricted U.S. frontier models since at least late 2024. The agencies distinguish legitimate knowledge distillation from targeted extraction, citing billions of tokens across millions of requests, proxies and third-party infrastructure.
DeepSeek allegedly used outputs from 12 Claude, Gemini, ChatGPT and Grok variants to train its R1 and R3 models.
Moonshot AI allegedly queried 18 U.S. models while training Kimi-K2 and Kimi K3.
Operators reportedly spread activity across accounts, providers, proxies and aggregators to evade detection and geographic restrictions.
The NSA, FBI and CISA released a joint cybersecurity advisory alleging that China-based AI companies systematically extracted restricted proprietary capabilities from U.S. frontier models to train their own. The agencies characterize the alleged activity as industrial-scale and say it could narrow a technology gap without comparable research costs.
Knowledge distillation is a training method in which one model queries a larger, more advanced model to learn from its outputs. The agencies explicitly say it can be legitimate and useful in AI research. Their warning draws its boundary at allegedly aggressive, targeted extraction of restricted features, rather than treating all distillation as improper.
The advisory identifies DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI as participants in the alleged campaigns. It lists variants of Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini and xAI’s Grok as targets.
The advisory alleges DeepSeek generated synthetic training data from four Claude versions, two Gemini versions, five ChatGPT versions and Grok 4 for its R1 and R3 models. It separately alleges Moonshot AI queried 18 U.S. models to train Kimi-K2 and Kimi K3.
According to the advisory, operators spread queries over accounts, models and platforms, using native APIs, remote cloud providers and third-party aggregators that can obscure user metadata. It also cites proxies and gray-market technology as tools to bypass geographic restrictions, terms of use and model safeguards. The agencies say dispersing operations among providers and infrastructure was intended to avoid a single point of detection.
The agencies say such activity can help Chinese models close the technology gap without equivalent spending on compute, electricity or foundational research. They also assess that advances could enhance military and cyberattack capabilities against the United States and its allies.
The agencies call for collaboration among government, private industry and allied nations. They specifically point to cloud providers, API aggregators and infrastructure providers as parts of a coordinated defense against industrial-scale campaigns.
Editorial analysis
The advisory turns a familiar training method into a question of access patterns. Its concern is not simply what a model can do, but whether distributed use can reconstruct valuable behavior across commercial AI services. That is an interpretation of the agencies’ allegations, not evidence that every form of distillation is improper. The next concrete test is whether model providers, cloud services and aggregators develop shared ways to identify and respond to suspicious patterns without treating legitimate research or ordinary customer activity as equivalent.
Loading discussion...
Join the conversation
Where should that coordination stop?
Be the first to share a perspective or an experience.
Reader comments
Newest comments first. Replies stay oldest first.