CISA, the NSA, and the FBI have revealed that six Chinese AI companies conducted massive distillation attacks against American frontier models to bypass training costs and accelerate development.
- Six Chinese AI firms targeted frontier models from OpenAI, Google, Anthropic, and xAI.
- Billions of tokens were extracted via 'distillation attacks' to reduce R&D costs.
- Fraudulent accounts and proxy networks were used to bypass geographic restrictions.
- US agencies assess these operations as state-aware strategic development efforts.
U.S. cybersecurity and intelligence agencies, including CISA, the NSA, and the FBI, have issued a joint advisory stating that six Chinese AI companies have conducted industrial-scale distillation attacks on American frontier AI models since late 2024. The entities identified include DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI.
The advisory reveals that these firms extracted billions of tokens through millions of API requests targeting models from Anthropic, OpenAI, Google, and xAI. The scale and sophistication of these operations suggest that the Chinese government is aware of these activities, which likely serve as a core development strategy for the offending firms to leapfrog traditional training timelines.
Understanding AI Model Distillation
AI model distillation is a legitimate technique where a smaller "student" model learns from the outputs of a highly trained "teacher" model. This helps developers reduce training costs and speed up deployment. However, when conducted outside controlled environments via API abuse, it becomes a "distillation attack," allowing competitors to extract the knowledge and logic of powerful models at a fraction of the original training cost.
Why This Matters
BozokMedia analysis shows that this represents a critical shift in the AI arms race. By extracting "Chain-of-Thought" (CoT) reasoning, Chinese firms are not just stealing data but are effectively stealing the cognitive process of the world's most advanced AI. This undermines the massive financial and intellectual investments made by US tech giants.
"Industrial-scale distillation is essentially intellectual property theft masked as API usage, allowing adversaries to weaponize US innovation against the US."
To evade detection, Chinese firms distributed requests across fraudulent accounts, cloud services, and "transfer station" proxies to bypass geographic blocks. Automated systems were used to switch providers and evaluate whether defensive countermeasures had degraded the quality of the responses.
| Chinese Company | Targeted US Models |
|---|---|
| DeepSeek, Moonshot AI | Claude, GPT, Gemini, Grok |
| MiniMax | Claude, Gemini, GPT |
| Alibaba, StepFun | Claude, GPT |
| Z.AI | GPT-5.5, Claude Opus 4.8 |
CISA recommends that AI providers improve behavioral detection and modify responses when distillation is suspected. Key indicators of such attacks include accounts reaching maximum usage immediately, continuous activity without human idle periods, and coordinated switching between access routes.
Frequently Asked Questions
1. Is distillation always illegal?
No, distillation is a standard research technique. It becomes an attack when it is used to illegally extract proprietary logic from a competitor's model via API abuse.
2. How do these attacks help Chinese companies?
They significantly reduce the financial expenditure and time required to train a frontier model, as they can simply 'mimic' the intelligence of an existing, superior model.
