What the NSA says six Chinese AI companies did to copy American models, and how to spot it on your own platform
The advisory is 'industrial-scale distillation.' Here is what that means, why the agencies say it is different from the distillation every lab does, and the four abuse signals it hands to anyone running a paid AI service.
Read the original first: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a
In one minute
- On September 8, the NSA, CISA and FBI jointly named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI.
- The charge is 'aggressive, malicious, and targeted distillation activities at an industrial scale' against US frontier models, since at least late 2024.
- Distillation itself is legal and normal. The agencies object to the scale, the evasion of geographic limits, and prompts built to expose hidden chain-of-thought reasoning.
- The advisory says DeepSeek's quoted $5.6 million training cost is misleading because it leaves out the data taken this way.
- It lists four account-level signals of distillation abuse that any AI provider can watch for today.
- The agencies say this happened 'likely with Chinese government awareness,' but do not claim the government directed it.
What distillation is, and why it is usually fine
Distillation is a training technique. You take a large, strong model (the teacher), ask it a huge number of questions, and train a smaller model (the student) on the answers. The student ends up with much of the teacher's skill at a fraction of the size and cost. Every major lab does this to its own models. The advisory says so directly: distillation is 'recognized as a legitimate and useful technique in AI research.'
The problem the agencies describe is distillation against someone else's model, at a scale and with methods that break the provider's terms. Their phrase is 'aggressive, malicious, and targeted distillation activities at an industrial scale.'
Who is named, and for what
DeepSeek: 'conducting an organized distillation campaign against U.S. AI companies' frontier AI models since at least late 2024.'
Moonshot AI: 'a widespread distillation campaign against U.S. frontier AI companies since at least mid-2025.'
Alibaba: 'leveraged industrial-scale distillation to improve the company's Qwen family of AI models.'
MiniMax, StepFun and Z.AI: 'also engaged in malicious knowledge distillation of U.S. AI companies' models.' The advisory gives these three less detail than the first three.
The mechanism the advisory describes
Getting in: a 'gray market of proxies known as transfer stations' that route traffic around the US companies' geographic restrictions, plus 'bulk procurement of the U.S. AI companies' premium subscriptions shared across teams.' In plain words, buy many consumer or team accounts through middlemen, then run them as a fleet.
Getting the good stuff out: prompts 'forcing models to reveal their hidden CoT reasoning' despite restrictions. CoT means chain of thought, the step-by-step reasoning a model does before its final answer. Providers hide it on purpose. Reasoning traces are far more useful training data than final answers alone, because they teach the student how to think, not just what to say.
Scale: 'billions of tokens across millions of exchanges/requests from U.S. frontier AI models,' from at least late 2024 through mid-2026.
The $5.6 million claim
DeepSeek's low quoted training cost became a talking point in early 2025 and moved markets. The advisory takes it on directly: the figure 'is misleading as it does not include the true cost of the data acquired through extensive malicious distillation.' The argument is that the expensive part, the teacher's knowledge, was paid for by someone else.
The four signals, as a checklist
The advisory asks AI providers to detect and respond, and it names what to look for. If you run any paid AI product, these apply to you as much as to a frontier lab.
1. Shared accounts used from multiple IP addresses or user agents at once. 2. Sustained 24/7 usage with none of the idle periods a human shows. 3. Anomalous ratios of subscription use to API use. 4. New subscriptions that hit maximum usage immediately.
Its recommended responses are detection and mitigation of anomalous prompts and accounts, 'subtly alter responses for suspected malicious distillation attempts,' and cross-organization intelligence sharing so providers can correlate the same actors across platforms.
Who is affected
| Case | Status |
|---|---|
| Businesses running DeepSeek, Qwen, Kimi (Moonshot), MiniMax, StepFun or Z.AI models | No action ordered. The advisory is a warning, not a ban. It does raise the question of what happens to your data on those services, which the advisory does not address. |
| US frontier model providers | Asked to deploy detection, alter responses to suspected distillation, and share intelligence across companies. |
| Anyone running a paid AI service with user accounts | The four detection indicators are directly usable in account monitoring today. |
| The six named companies | Named publicly by three US agencies. No legal action is described in the advisory. |
What to do
- If you resell or embed a Chinese-hosted model, write down which one and what data reaches it. The advisory does not say that data is misused, but you should be able to answer the question.
- If you run an AI product with accounts, add the four indicators to monitoring: multi-IP shared accounts, 24/7 usage with no idle time, odd subscription-to-API ratios, and new accounts at max usage on day one.
- Treat hidden reasoning as a secret. If your product exposes chain-of-thought, know that it is the most valuable thing a distiller can take.
- Read the advisory before quoting anyone's training cost as a fact.
What is still unknown
- How much of each named company's model quality came from distillation versus their own training. The advisory does not quantify it.
- Whether the Chinese government directed the campaigns. The advisory says 'likely with Chinese government awareness' and stops there.
- Whether the US providers detected and blocked the activity at the time, and how much still continues. The advisory describes the campaigns through mid-2026 without saying they ended.
- What, if anything, US providers will change for ordinary customers when they 'subtly alter responses' to suspected distillers.
Sources
- NSA, CISA and FBI joint advisory AA26-251A — the original report