US Agencies Warn China Is Systematically Extracting Frontier AI Capabilities
US intelligence agencies (NSA, CISA, FBI) allege that Chinese AI companies systematically distilled billions of tokens from US frontier models (Claude, GPT, Gemini, Grok) since late 2024, likely with government awareness. DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI are named as entities that extracted training data and capabilities including API rule-driven tasks, agentic functions, SFT optimization, and creative writing optimization. The TTPs used go beyond the MITRE ATLAS framew
Analysis
TL;DR
- US intelligence agencies (NSA, CISA, FBI) allege that Chinese AI companies systematically distilled billions of tokens from US frontier models (Claude, GPT, Gemini, Grok) since late 2024, likely with government awareness.
- DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI are named as entities that extracted training data and capabilities including API rule-driven tasks, agentic functions, SFT optimization, and creative writing optimization.
- The TTPs used go beyond the MITRE ATLAS framework, including novel techniques like regional restriction evasion, centralized request routing, automated metadata sanitization, and systematic quota/cost optimization—indicating a planned national-level operation.
- Agencies recommend coordinated defensive measures across the US AI ecosystem, including behavioral detection, differential privacy, and targeted response degradation against high-confidence malicious distillation requests.
- The threat is characterized as a strategic economic and national security concern targeting US technological leadership rather than direct enterprise AI security.
Why It Matters
This report represents a significant escalation in the AI geopolitical landscape, framing model distillation not as opportunistic exploitation but as state-sponsored industrial-scale knowledge extraction. For AI practitioners and frontier model developers, it signals that API-based model access is now considered a critical national security vulnerability requiring defensive investment. The recommendation for differential privacy and targeted response degradation will likely influence how US AI companies design their API security, rate limiting, and output sanitization going forward.
Technical Details
- Distillation Scope: Between late 2024 and mid 2025, Chinese companies extracted billions of tokens across millions of API requests from Claude (including Fable 5 variants), GPT-4, GPT-4o, GPT-5, Gemini, and Grok 4 to train models including DeepSeek R1/V3, Kimi-K2/Kimi-K3.
- Knowledge Categories Distilled: API rule-driven tasks, agentic functions, Q&A optimization, supervised fine-tuning (SFT) optimization, creative writing optimization, and occupational writing optimization.
- Novel TTPs Beyond MITRE ATLAS: Regional restriction evasion and subscription exploitation; centralized request routing infrastructure; automated request metadata sanitization; systematic quota and cost optimization—techniques that distinguish this from opportunistic exploitation.
- MITRE ATLAS Mapping: The report maps distillation activities across the full attack lifecycle: resource development, access, execution, discovery, AI attack staging, collection, exfiltration, and impact.
- Proposed Mitigations: Behavioral detection and monitoring, differential privacy (adding calibrated noise to model outputs to prevent extraction of training data membership, decision boundaries, and private data signals), multi-source correlated activity attribution, and targeted response degradation against high-confidence malicious requests.
Industry Insight
- US frontier AI model providers should treat API access as a potential supply chain and IP vulnerability, investing in behavioral anomaly detection, output perturbation, and rate-limiting strategies that differentiate legitimate usage from systematic distillation campaigns.
- The characterization of distillation as a "strategic economic threat" rather than a competitive practice means regulatory and legal exposure is increasing for companies that fail to implement adequate API protections—compliance should be treated as a security priority.
- The recommendation for information sharing and coordinated defense across cloud providers, API aggregators, and infrastructure providers suggests a coming industry-wide shift toward collective threat intelligence, similar to financial-sector ISACs, which will create both compliance obligations and competitive advantages for early adopters.
Disclaimer: The above content is generated by AI and is for reference only.