US intelligence agencies name six Chinese AI firms accused of copying American models at scale
&imwidth=600&imheight=450&format=webp&quality=medium "US intelligence agencies name six Chinese AI firms accused of copying American models at scale")
US intelligence agencies name six Chinese AI firms accused of copying American models at scale
The NSA, CISA and FBI have issued a joint advisory accusing six China-based AI companies of running industrial-scale campaigns to extract capabilities from US frontier models through knowledge distillation — training their own systems on the outputs of American ones. The advisory names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. China's embassy has dismissed the allegations.
Three US security agencies have publicly named six Chinese AI companies they say have been systematically extracting capabilities from American AI models.
A joint advisory from the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the FBI accuses DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI of running industrial-scale knowledge distillation campaigns against US frontier models — including versions of Claude, GPT, Gemini and Grok — since at least late 2024.
What Distillation Is
Knowledge distillation is a legitimate and widely used machine learning technique: a smaller model is trained on the outputs of a larger, more capable one.
The agencies' allegation is not that the technique exists, but how it was used. They say the companies used it to acquire capabilities from competitors' models in less time and at lower cost than developing them independently, in breach of those companies' terms of use.
In practical terms, the accusation is that American models were queried at enormous volume and their answers used as training material for Chinese rivals.
Trending Stories
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
&im=FitAndFill=(700,400))
)
)
)
)
)
How It Was Allegedly Done
The advisory describes a set of methods designed to avoid detection.
Requests were routed through native APIs, remote cloud providers and third-party aggregators that obscure user information. A grey market of proxies known as 'transfer stations' was used to get around geographic restrictions. The agencies also describe bulk purchasing of premium subscriptions shared across teams, jailbreaking techniques, efforts to extract models' step-by-step reasoning, and automatic switching between access routes when one was blocked.
The scale cited is large: billions of tokens across millions of exchanges, with proxy networks managing tens of thousands of fraudulent accounts at once.
The DeepSeek Claim
One of the advisory's most pointed passages concerns DeepSeek's widely cited claim that it trained a leading model for about $5.6 million — a figure that stunned the industry and briefly shook confidence in the economics of American AI.
The agencies call that figure misleading, arguing it excludes the cost of data acquired through distillation. If that is correct, part of the reason the model was cheap is that others had already paid to build the capabilities it learned from.
The Attribution Language
The wording deserves careful reading. The advisory says the companies acted 'likely with Chinese government awareness'.
'Likely' is a hedge, not a finding. The agencies are asserting that the activity occurred and naming the firms, while stopping short of stating that Beijing directed it. Reports that present this as a proven state-run operation go further than the advisory itself.
The Response
China's embassy dismissed the allegations as a deliberate attack on China's development in AI. None of the six companies responded to requests for comment in initial reporting.
Why It Matters Beyond Business
The agencies frame the issue as a security matter, not only a commercial one — arguing that capabilities acquired this way can strengthen China's military and cyber operations.
The advisory also recommends a notable countermeasure: US AI companies should subtly alter their responses to suspected distillation attempts, reducing their value without alerting the people behind them. In effect, providers are being encouraged to feed degraded answers to users they suspect of copying.
That approach may be effective. It also raises an obvious question for legitimate customers about how accurately suspicion is determined.
What To Watch
Whether US AI companies publicly confirm the campaigns against their own systems. Whether the advisory leads to sanctions, export restrictions or legal action against the named firms. And whether distillation becomes part of wider US-China technology negotiations — because a capability that can be copied through an API is far harder to control than a chip.
