The NSA, CISA, and FBI escalated their warning on China-based AI firms, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI and saying they pulled billions of tokens from Anthropic Claude, OpenAI GPT, Google Gemini, and Grok since at least late 2024. The agencies now frame the activity as industrialized distillation, not a side effect of model use.
The technique is simple in plain terms: one model’s answers are harvested at scale and fed into another model so the student learns the teacher’s behavior without paying to discover it itself. The advisory says the firms used premium subscriptions, proxy routing, and blocking evasions to keep collecting outputs, and maps the tradecraft to MITRE ATLAS as a structured development pipeline.
For frontier-model providers, the durable exposure sits in the service layer: if valuable behavior is reachable through APIs or shared subscriptions, it can be extracted repeatedly even when the underlying model weights stay untouched. The remaining question is not whether distillation exists, but how much competitive advantage and training spend the collection pipeline can strip away before normal abuse controls notice it.
US says Chinese firms extracted billions of tokens from frontier AI models
cybersecurity and intelligence agencies say that six Chinese AI companies conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024.