The National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI on Tuesday published a joint advisory accusing six China-based artificial intelligence companies of running industrial-scale campaigns to extract proprietary capabilities from leading U.S. AI models, a practice known as distillation.
The advisory, catalogued as AA26-251A, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and says the activity has been running since at least late 2024. The agencies say the companies used the technique to improve their own models' coding, reasoning and legal-specialization capabilities by training on outputs harvested from U.S. systems including Anthropic's Claude, OpenAI's GPT models, Google's Gemini and xAI's Grok.
"Transfer Stations" and Obfuscated Traffic
According to the advisory, the companies routed requests through native application programming interfaces, cloud providers and third-party aggregators designed to strip identifying metadata, and relied on a gray market of proxy services the agencies call "transfer stations" to bypass geographic access restrictions and evade detection. The advisory also describes prompt-injection techniques aimed at extracting the underlying chain-of-thought reasoning from restricted models — reasoning steps that AI developers generally try to keep hidden even from paying customers.
Distillation itself is not new or inherently illicit; it is a standard machine-learning technique in which a smaller "student" model is trained to mimic a larger "teacher" model's outputs, and U.S. companies use it too. What the advisory characterizes as abuse is the scale and method: billions of tokens harvested across millions of queries, routed to evade the terms of service and rate limits that model providers impose specifically to prevent this kind of wholesale extraction, as detailed by Defense One.
The advisory recommends that AI developers deploy behavioral monitoring to flag suspicious usage patterns, apply stricter rate limiting, introduce subtle response variations for accounts suspected of distillation, and share threat intelligence across companies and with government agencies.
The naming of Alibaba alongside smaller, less established labs is notable: Alibaba is one of China's largest technology companies and a significant cloud provider in its own right, and its inclusion suggests the agencies view the practice as widespread across China's AI industry rather than confined to scrappy startups. None of the six companies named in the advisory had issued a public response at the time of publication.
