CISA Warns Chinese AI Firms Are Copying U.S. Models Using Distillation

According to a recent cybersecurity advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI), China-based AI companies are engaging in large-scale knowledge distillation campaigns to replicate capabilities from prominent U.S. AI models. Knowledge distillation is a common AI training method that utilizes outputs from a more advanced model to assist in training another model. The advisory indicates that Chinese firms have implemented this technique on an industrial scale to extract restricted capabilities, including reasoning and coding, which are integral to their model development strategies.

CISA Acting Director Nick Andersen emphasized the urgency for AI companies to take immediate measures to protect their platforms against these knowledge distillation campaigns, which threaten to diminish the advancements achieved by American companies. The advisory highlights that companies such as DeepSeek, Moonshot AI, Alibaba Group, MiniMax, StepFun, and Z.AI have collectively extracted billions of tokens through millions of requests directed at U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.

DeepSeek has notably utilized data and capabilities from U.S. AI models to train its DeepSeek R1 and V3 models, focusing on functions such as reasoning, writing, and specialized tasks like legal work. The advisory challenges DeepSeek's reported training cost of $5.6 million, suggesting that this figure does not accurately reflect the true cost of the data obtained through extensive distillation efforts.

Moonshot AI has been engaged in similar activities since mid-2025, leveraging U.S. models to enhance its Kimi models in areas such as software engineering and mathematics. Other companies, including Alibaba, MiniMax, StepFun, and Z.AI, have also utilized U.S. models to develop a range of capabilities, from coding and customer service to reasoning and AI agents. By mid-2026, Z.AI had distilled billions of tokens from GPT-5.5 and Claude Opus 4.8 to enhance its chain-of-thought reasoning capabilities.

The advisory outlines various tactics, techniques, and procedures (TTPs) associated with these campaigns, which align with the MITRE ATLAS framework. These include resource development, AI model access, execution, privilege escalation, and defense evasion. Additionally, the companies employ a gray market of API proxies, known as "transfer stations," to circumvent regional restrictions, obscure their origins, evade safeguards, and minimize traceability. They utilize pools of premium accounts to distribute requests and avoid usage limits, while centralized systems manage traffic across APIs and cloud services based on availability.

Identifying Malicious AI Usage Patterns

Indicators of these campaigns include continuous usage patterns without normal human variation, unusual subscription-to-API usage ratios, and rapid escalation of new subscriptions to maximum usage limits. The advisory recommends that AI providers implement stronger account identity verification and closely monitor subscriptions that exhibit enterprise-scale throughput or other anomalies.

To mitigate the impact of suspected distillation campaigns, providers can vary responses, limit reasoning depth, and introduce stylistic inconsistencies. For confirmed malicious activities, they can alter responses without notifying the operators. The advisory also suggests that AI safety researchers and third-party evaluators should be informed of any model changes.

Final Brief

Differential privacy is proposed as an additional defense mechanism, which involves adding controlled noise to model outputs to complicate extraction efforts. However, stronger privacy measures may reduce model accuracy, necessitating a balance between privacy and functionality. Sharing indicators such as IP addresses and query patterns can aid in identifying coordinated campaigns that might otherwise appear isolated.

Safety and adversarial training are recommended as further protective measures to counteract prompt injection and jailbreak techniques.