US Government Accuses Chinese AI Firms of Distilling Frontier Models

US agencies claim Chinese companies covertly extracted billions of tokens from OpenAI, Anthropic, Google Gemini, and SpaceX's Grok to reduce development costs.

Chinese AI firms are stealing proprietary capabilities belonging to US-based AI models via massive distillation campaigns , acccording to US government agencies.

The FBI , the National Security Agency (NSA), and the Cybersecurity and Infrastructure Security Agency (CISA) published a joint advisory on Sept. 8, warning that Chinese AI firms were conducting "industrial-scale" efforts to extract capabilities from leading US AI models. The advisory accuses a number of AI vendors — including Alibaba, DeepSeek , MiniMax, Moonshot AI, StepFun, and Z.AI — of using US large language models (LLMs) to assist training and development of their own proprietary models.

These companies supposedly "extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024," the advisory stated.

The agencies claim the firms are doing this through a process called distillation , a common practice in which mature "teacher" AI models are used to train "student" AI models. On its own, distillation is a widely accepted practice used for academic research, making models more efficient, and improving models with specialized use cases.

Related: AI's Vulnerability Surge May Be More Manageable Than First Feared

Inside China's AI Distillery

The advisory outlines multiple techniques for accessing US frontier models at industrial scale.

"Advanced industrial-scale distillation tactics include chain-of-thought (CoT) reasoning extraction, automated failover between pathways during blocking attempts, and sophisticated quality evaluation frameworks to detect defensive countermeasures," the advisory read. "China-based AI companies that conduct industrial-scale distillation against U.S. AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model."

To save money during this intensive process, China -based AI firms allegedly obtain bulk premium subscriptions for US AI models and them across teams of developers.

And to avoid detection, the firms reportedly route distillation requests through native APIs, remote cloud providers, and third-party aggregators that automatically obfuscate user metadata. They also take advantage of "transfer stations," a gray market of proxies used specifically to bypass US AI model geographic restrictions and evade safeguards.

Related: Attackers Pounce on Critical Artifactory Bug Following Disclosure

The advisory made multiple claims specific to different companies. CISA said DeepSeek ran an organized distillation campaign against frontier models of US AI companies since at least late 2024 in order to "generate synthetic training data for its models."

"The company targeted specific knowledge domains to extract proprietary functionality and reasoning capabilities to reduce their compute and research costs," the advisory read. "DeepSeek's publicly quoted training costs of $5.6M are misleading as it does not include the true cost of the data acquired through extensive malicious distillation."

Moonshot AI, meanwhile, allegedly extracted "significant Claude Fable 5 data to train its Kimi-K3 model and GPT-4o data to train its Kimi-K2 model." Both firms supposedly plundered models from Anthropic, OpenAI , Google, and xAI as part of this campaign.

What AI Companies Should Do

The authoring agencies recommend that US AI companies implement comprehensive detection and mitigation measures to find anomalous and malicious behavior; intelligence with other AI organizations to gain awareness of broader campaigns; and tune responses for suspected malicious attempts to reduce the effectiveness of these outputs.

Related: 'HTTP Terminator' Hunts for Novel Desync Attacks

Ismael Valenzuela, vice president of labs, threat research and intelligence at Arctic Wolf, tells Dark Reading that model extraction and distillation "should be treated as a security event category" in itself, rather than treating it as API abuse or an intellectual property dispute.

"AI companies and organizations should prioritize 24/7 monitoring of AI API access patterns for automation at scale, anomalous prompt harvesting behavior, and distributed account creation," Valenzuela says. "Organizations should work with model providers to telemetry and indicators, rather than treating detection as something each organization has to solve alone."

Senior News Writer, Dark Reading

Alex is an award-winning writer, journalist, and podcast host based in Boston. After cutting his teeth writing for independent gaming publications as a teenager, he graduated from Emerson College in 2016 with a Bachelor of Science in journalism. He has previously been published on VentureFizz, Security, Nintendo World Report, and elsewhere.

At Dark Reading, he covers a variety of cybersecurity topics, including the cybercrime ecosystem, open source security, and the intersection between AI and threat actors. In his spare time, Alex hosts the weekly Nintendo podcast, "Talk Nintendo Podcast," and works on personal writing projects, including two previously self-published science fiction novels.

He has received numerous awards, including TechTarget's Writer of the Year in 2022 as well as more than 10 Azbee awards for his reporting between 2022 and today.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Essential News & Insights from Black Hat USA 2025

Benchmark Scores Are a False Flag

Benchmark Scores Are a False Flag

Threat Exposure Analytics: Measuring and Communicating Security Risk

Threat Exposure Analytics: Measuring and Communicating Security Risk

Building an Effective Red Team: Beyond Penetration Testing

Building an Effective Red Team: Beyond Penetration Testing

How to Leverage Threat Intelligence Without Drowning: The Zero Noise Approach

How to Leverage Threat Intelligence Without Drowning: The Zero Noise Approach

Cloud Incident Response: Forensics in Distributed Environments

Cloud Incident Response: Forensics in Distributed Environments

Supply Chain Attack Secretly Installs OpenClaw for Cline Users

Chinese Hackers Hijack Notepad++ Updates for 6 Months

Trump Administration Rescinds Biden-Era Software Guidance

Microsoft Fixes Exploited Zero Day in Light Patch Tuesday