NSA, CISA and FBI have accused six Chinese companies of staging campaigns industrial scale distillation against the main American linguistic models. They are in the crosshairs of the joint notice, published on Tuesday DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AIaccused of systematically extracting proprietary capabilities from ChatGPT, Claude, Gemini and Grok since at least the end of 2024.
According to the three agencies, this is a structural strategy. The companies would have sorted millions of requests through multiple accounts, APIs, proxies, cloud providers and third-party aggregators, with the declared aim of circumventing geographic restrictions and usage limits imposed by American manufacturers.
“China-based AI companies conduct systematic extraction of proprietary features of US models through industrial-scale knowledge distillation campaigns that form the core, not a mere complement, of their development strategy,” the agencies write in the document.
How the hunt for US model capabilities works
Distillation, in itself, is a well-known technique: you use the responses of a large, expensive model to train a smaller, cheaper one. The point of the accusation is the scale and systematicity with which it is applied: according to the agencies, it would drastically reduce both the time and cost of developing a Chinese border model.
DeepSeek would distill multiple American Frontier models, including four versions of Claude, two of Gemini, five of ChatGPT, and Grok 4, to generate synthetic data used in training its latest models on agentic features, response optimization, and creative and professional writing. Moonshot AI would have drawn on 18 different US models, including Fable 5 (Anthropic’s current most advanced commercial model), to train Kimi K2 and Kimi K3, with millions of queries targeting agentic reasoning, programming, data analysis and computer vision.
Among the most insidious techniques described by the agencies is the use of prompt injection to force models to reveal hidden internal reasoning (the so-called chain-of-thought). DeepSeek, in particular, would use prompts that asked models to “imagine and articulate, step by step, the reasoning behind an already completed answer.”
The agencies are now calling for coordinated action from the entire US AI ecosystem: detecting anomalous accounts and behavior, introducing subtle variations in responses when an attempt at distillation is suspected, sharing information between competing companies. A common front that is not to be taken for granted, considering how the American companies themselves have built their own models by drawing, without too many compliments, on the data available on the web.
