- Three agencies have released a joint advisory on China-based AI distillation activity
- Six China-based companies were named in connection with the campaigns
- The 2026 Intel Summit will address AI, cybersecurity and more
The National Security Agency, the FBI and the Cybersecurity and Infrastructure Security Agency have released a joint cybersecurity advisory warning that China-based artificial intelligence companies are conducting industrial-scale knowledge distillation campaigns against U.S. frontier AI models.
Adversarial exploitation of emerging technologies remains a persistent focus for the intelligence community as it shapes acquisition, tradecraft and workforce priorities. The Potomac Officers Club’s 2026 Intel Summit on Sept. 24 will bring together senior intelligence officials and industry executives to discuss artificial intelligence, open-source intelligence, agentic AI and quantum risk in classified environments, and cybersecurity in the agentic AI era. Sign up now to join the conversation.
The agencies said Tuesday the advisory identifies distillation — a technique used to extract restricted proprietary functionality from AI models — as a core, rather than supplemental, element of several China-based companies’ AI development strategy.
What Does the Advisory Cover?
The cybersecurity advisory outlines how AI knowledge distillation works, describes indicators that can help organizations determine whether their models are being distilled, details the tactics, techniques and procedures, or TTPs, associated with these campaigns, and offers recommended mitigation practices. The document maps the observed activity to the MITRE ATLAS framework, tracing the adversary lifecycle from initial access through exfiltration, and references complementary guidance from the National Institute of Standards and Technology.
Which Companies Were Identified in the Campaigns?
The advisory names six China-based AI companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI — as having extracted proprietary capabilities from U.S. frontier models, including variants of Claude, GPT, Gemini and Grok, since at least late 2024. The agencies said the activity was likely conducted with awareness from the Chinese government and has enabled Chinese AI models to narrow the performance gap with U.S. systems while reducing research, development and compute costs.
What Tactics Are the Campaigns Using?
According to the advisory, China-based companies route distillation requests through multiple pathways — including native application programming interfaces, cloud platforms and third-party aggregators — to obscure their origin and evade detection. The companies reportedly rely on a gray market of API proxies, described in the advisory as “transfer stations,” to bypass geographic restrictions and bulk-procure premium AI subscriptions across teams of developers. The advisory also documents techniques such as chain-of-thought extraction and prompt injection used to surface hidden model reasoning.
What Immediate Actions Do the Agencies Recommend?
The advisory calls on U.S. AI companies to take three immediate steps:
- Implement comprehensive detection and mitigation by monitoring for anomalous accounts, subscription-to-usage ratios and enterprise-scale query throughput.
- Deploy targeted response changes, such as subtly altering outputs for suspected distillation attempts to reduce their training value.
- Establish cross-organization intelligence-sharing to correlate activity across model providers, cloud platforms and API aggregators.
What Other Joint Advisories Have NSA, FBI & CISA Issued?
The three agencies have a long history of teaming up on threat advisories. Past joint efforts include warnings on Russian state-sponsored cyber threats, BlackMatter ransomware, and, alongside the Department of Energy, advanced persistent threat actors targeting industrial control systems and supervisory control and data acquisition devices.
The agency combinations behind these advisories have also varied by threat. NSA and CISA alone have addressed common cybersecurity misconfigurations, coding environment security and memory safe languages, while CISA and the FBI have worked together on Microsoft Exchange Online monitoring.
