Chinese Firms Conduct Distillation Attacks on U.S. AI Models, U.S. Agencies Warn

U.S. cybersecurity and intelligence agencies have issued a warning regarding six Chinese AI companies that have reportedly conducted industrial-scale distillation attacks on American frontier AI models since at least late 2024. A joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) identifies the companies involved as DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. These firms are said to have extracted billions of tokens through millions of requests from AI models developed by Anthropic, OpenAI, Google, and xAI.

The advisory indicates that the scale and sophistication of these operations suggest awareness and possible involvement from the Chinese government, framing this approach as a core development strategy for the companies in question. AI model distillation is a legitimate technique where a 'student' model learns from the outputs of a well-trained model, which can help reduce training costs and accelerate AI deployment. However, as Google highlighted earlier this year, distillation attacks can exploit API access to extract knowledge and logic from powerful models, allowing competitors to develop similar capabilities at a fraction of the cost.

According to the advisory, the Chinese firms have been using various tactics to bypass geographic restrictions and usage limits. They distribute API requests across fraudulent or shared accounts, cloud services, and proxies. Some of the prompts used in these attacks aimed to uncover restricted chain-of-thought reasoning, while automated systems were employed to switch providers and check for defensive measures.

The advisory details advanced tactics employed by these firms, including chain-of-thought reasoning extraction and automated failover during blocking attempts. The report notes that Chinese companies conducting these distillation operations can significantly shorten their AI development timelines and reduce training costs.

DeepSeek and MoonShot AI have been identified as the primary offenders, distilling multiple models including Claude, GPT, Gemini, and Grok. MiniMax has also targeted these models, while Alibaba and StepFun are accused of focusing on Claude and GPT models. Z.AI is reported to have targeted GPT-5.5 and Claude Opus 4.8.

To combat these threats, the advisory recommends that AI companies enhance their detection capabilities and modify responses when distillation operations are suspected. It also encourages sharing intelligence about these campaigns among stakeholders. Indicators of such activities may include new accounts reaching maximum usage immediately, continuous activity without normal human idle periods, and coordinated switching between access routes.

BleepingComputer has reached out to the six Chinese AI firms for comments and will update the report with their responses if received. The advisory underscores the importance of vigilance in the face of these sophisticated cyber threats, as the potential for exploitation remains high once attackers gain valid credentials.