NSA, CISA and FBI warn of industrial-scale distillation campaigns by China-based AI firms against U.S. frontier AI models

Linha do tempo

1. cisa.gov ↗ · pub. 04/09/2026 13:12 · coletado 19/10 18:37 primeiro registro

   NSA, CISA and FBI warn of industrial-scale distillation campaigns by China-based AI firms against U.S. frontier AI models

   ler a análise desta fonte ocultar

   The NSA, CISA and FBI issued joint advisory AA26-251A warning that China-based AI companies are running industrial-scale knowledge distillation campaigns against U.S. frontier AI models. The named companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the agencies, they have extracted billions of tokens across millions of exchanges since at least late 2024, likely with Chinese government awareness. Targets include variants of Claude, GPT, Gemini and Grok. The agencies assess that distillation is the core of these firms' AI development strategy, not a supplement. It shortens development timelines and cuts training costs, and the agencies describe it as an economic threat to U.S. technological leadership.

   Technical Details

   • Access and evasion: Requests are routed through native APIs, remote cloud providers and third-party aggregators that obfuscate user metadata. A gray market of API proxies called "transfer stations" bypasses geographic restrictions and undermines traceability. Actors use fraudulent accounts with similar registration and payment details, and bulk-procured premium subscriptions shared across developer teams.
   • Extraction tactics: Prompts force models to reveal hidden chain-of-thought (CoT) reasoning. The actors also use jailbreak and prompt injection prompts, automated failover between pathways when blocked, and quality-evaluation pipelines that detect defensive response degradation. Automated sanitization removes organizational identifiers.
   • Actor-specific activity:
     • DeepSeek has run organized campaigns since at least late 2024 to train its R1 and V3 models, and the advisory calls its publicly quoted $5.6M training cost misleading.
     • Moonshot AI distilled Claude and GPT data for its Kimi models.
     • Alibaba distilled Claude and GPT models to improve Qwen.
     • MiniMax redirected traffic to a new Claude model within 24 hours of its release, and used prompt injection to try to make Claude Code believe it was a MiniMax product.
     • StepFun used pools of accounts with concurrent sessions and per-agent daily budgets.
     • Z.AI distilled billions of tokens from GPT and Claude models for CoT reasoning.
   • Detection indicators: Shared accounts across multiple IPs and user agents; 24/7 usage with no human idle periods; anomalous subscription-to-API usage ratios; new subscriptions at maximum usage immediately; correlated timing across pathways; abrupt disappearance of consistent metadata; and generic or randomized patterns replacing organizational markers.
   • Framework mapping: The advisory maps the TTPs to MITRE ATLAS and notes that some techniques are not covered by ATLAS. The article provides no IOCs or CVEs.

   Remediation

   • Detection and monitoring: Detect anomalous prompts, accounts, networks and behaviors. Monitor subscription-to-usage ratios, maximum usage from new accounts and enterprise-scale throughput. Strengthen identity verification.
   • Response alteration: For high-confidence suspected distillation, subtly alter responses, for example with differential privacy, downgraded models, reduced reasoning depth or stylistic inconsistencies. Do not inform suspected distillers of the change. AI safety researchers and third-party evaluators should be informed.
   • Intelligence sharing: Share infrastructure indicators (IPs, domains, providers) and behavioral indicators (timing, query volume) across model providers, cloud platforms and API aggregators.
   • Control mappings: Apply ATLAS mitigations such as AML.M0004 (rate and query limits), AML.M0019 (access control), AML.M0024 (telemetry logging), AML.M0002 (output obfuscation) and AML.M0015 (input detection). Also apply NIST AI 100-2e2025 mitigations, including differential privacy, adversarial training and prompt instruction/formatting.