The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), and FBI warned on Sept. 8 that China-based artificial intelligence (AI) companies are conducting large-scale campaigns to extract capabilities from U.S. frontier AI models through knowledge distillation.
The agencies said in a joint cybersecurity advisory that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have extracted billions of tokens across millions of interactions with U.S. models since at least late 2024. The targeted models include variants of Anthropic’s Claude, OpenAI’s GPT, Google’s Gemini, and xAI’s Grok.
“CISA is committed to promoting the secure use of AI while fostering the innovation crucial to America’s global competitiveness,” CISA acting Director Nick Andersen said in a press release.
“We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies,” Andersen added.
Knowledge distillation is a machine learning technique in which a smaller or less capable AI model is trained using outputs from a larger model. CISA said the technique can be misused to acquire capabilities from competing models while reducing development time and costs.
The agencies said the companies distributed activity across model providers, cloud platforms, application programming interface (API) aggregators, and other infrastructure to make the campaigns harder to detect. They assessed that the activity likely occurred with Chinese government awareness.
CISA, NSA, and the FBI recommended that U.S. frontier AI companies take three immediate steps:
- Improve detection of anomalous prompts, accounts, networks, and usage patterns
- Subtly alter responses when malicious distillation is suspected to reduce the value of extracted outputs
- Expand intelligence sharing across model providers, cloud platforms, and API aggregators to reveal distributed campaigns
“Addressing industrial-scale distillation merits a coordinated response across the AI ecosystem, including effective information-sharing, spanning the U.S. government, private industry, and allied nations,” the advisory says.