The NSA, CISA, and FBI report that since late 2024, Chinese AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have conducted large-scale knowledge distillation attacks against US frontier AI models like Claude, GPT-4/5, Gemini, and Grok. Distillation captures outputs and reasoning processes to train new models, extracting capabilities such as API rule-driven tasks, agentic functions, and fine-tuning optimizations. The agencies mapped these tactics to the MITRE ATLAS framework and identified novel techniques like regional restriction evasion and subscription exploitation. This systematic extraction threatens US AI technological leadership and economic competitiveness. The agencies recommend coordinated defensive actions, behavioral detection, targeted response to malicious requests, information sharing, and differential privacy to mitigate the threat.

The distillation attacks result in financial harm to US AI developers by undermining their competitive advantages and technological leadership. This represents a strategic economic threat to fair technological competition and could have national security implications. The threat is primarily to US frontier AI model developers rather than direct enterprise AI users. The systematic and well-resourced nature of the activity indicates a planned national-level campaign by China, increasing the risk to US AI innovation and economic interests.

The US agencies recommend coordinated mitigation efforts across the US AI ecosystem, including cloud providers, API aggregators, and infrastructure providers. Defensive measures include behavioral detection and monitoring of distillation activities, sharing information about distillation campaigns to improve attribution and response, and employing targeted changes to impose costs on malicious distillation requests. The use of differential privacy—adding calibrated noise to model outputs to prevent extraction of sensitive training data—is also advised. These mitigations aim to reduce the effectiveness of knowledge distillation attacks and protect AI model intellectual property.