NSA, FBI and CISA accuse six Chinese labs of distilling US AI models
On September 8, 2026, a joint advisory from the NSA, FBI and CISA described “industrial-scale distillation” of American frontier AI models by DeepSeek, Alibaba, Moonshot AI and three other Chinese players, routed through a gray market of proxies called “transfer stations”. For model providers it is a countermeasure playbook; for enterprises it is one more due-diligence question about where their dependencies come from.
September 8, 2026. The NSA, FBI and CISA published a joint advisory accusing Chinese AI companies of running “aggressive, malicious and targeted distillation activities at an industrial scale” to extract capabilities from American frontier AI models. Six labs are named: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. Why it matters: for the first time, US agencies are claiming distillation is not an incidental by-product but “the core — not merely a supplement — of their AI development strategy”.
A legitimate technique, weaponized
Distillation is not exotic. It is a training technique in which a small model queries a large model and learns to reproduce its responses; over enough examples, the small model approaches the large one without rerunning the full training. It is entirely legitimate when the owner of the large model wants a compact, low-cost version of it — an everyday internal practice at most providers.
The abuse hinges on terms of service. Commercial providers explicitly forbid using their models to train or distill a competing model, because the colossal investment in compute and data behind a frontier model is exactly what those clauses protect. The three agencies believe Chinese firms flout those terms systematically, routing distillation requests “through multiple pathways to gain unauthorized access”, including native APIs, remote cloud providers and third-party aggregators that automatically obfuscate user metadata.
This is where the advisory turns operational. It describes a gray market of proxies called “transfer stations” that resell access to frontier models “at a fraction of the official price” and form “a scalable mechanism for evading provider safeguards and eroding traceability”. Those stations break geolocation, billing and auditability at once — the three levers on which a provider’s trust in its own API rests.
Two accusations that go beyond the technical
The advisory does not stop at method; it makes two economically charged claims.
The first targets DeepSeek. The agencies allege the company used distillation to generate synthetic data used to train its models, which would make false its claim of having built them with trivial amounts of compute. The stakes are high: DeepSeek’s early-2025 announcements panicked investors, who worried the billions poured into compute infrastructure might no longer be needed. If the allegation holds, part of that panic rested on a misleading picture of the real costs.
The second targets Alibaba, alleging the company “leveraged industrial-scale distillation to improve the Qwen family of AI models”. Several Qwen models are high quality, free to download and reuse — a direct challenge to US providers that charge for access while racking up heavy losses. The accusation paints an asymmetric business model: distill, redistribute for free, and erode the proprietary model market from below.
It must be said plainly: these are allegations, made by government agencies in a climate of technological tension, not facts established in a court. The Register reported it had sought comment from the Chinese firms and received no substantive response by publication. Beijing, for its part, has argued for months that US firms distill Chinese models too, and has threatened retaliation against any US bans flowing from such claims.
A defense playbook every provider should read
The most concrete part of the advisory is its list of countermeasures, which applies to any operator of a model API. It recommends detecting and deflecting distillation attempts, treating immediate maximum usage from a brand-new account as an indicator of malicious activity. It suggests “subtly altering responses” for suspected distillation attempts to attenuate their payoff without degrading the experience of legitimate users. It also urges correlating activity across providers, cloud platforms and aggregators to surface distributed campaigns that are individually invisible.
These recommendations translate directly into engineering. Detection means rate limiting and query-pattern analysis; response alteration means an inference layer that injects calibrated noise when a caller’s profile looks suspicious; correlation means sharing indicators across competitors — a trust project that is anything but obvious in a fiercely competitive sector.
For enterprises that consume models, the advisory reads differently: provenance becomes a risk criterion. Depending on a model whose training lineage is contested exposes you to legal risk — terms-of-service violations, intellectual-property disputes — as much as to reputational risk. The question is no longer just “is this model good?” but “is its training defensible?”.
Why distillation is so hard to prove
One reason the practice can reach “industrial scale” is that it is structurally hard to catch. Distillation does not copy a model’s weights; it learns an approximation of its behavior from its outputs. A distilled model contains no trace of the original’s parameters, so there is no signature to recover from the files. Detection therefore rests on behavioral heuristics, not on material evidence.
Those heuristics have known limits. A distillation query is indistinguishable from a legitimate one by its content: it is a question posed to a model, like millions of others. What betrays a campaign is the pattern — abnormally high volume, a breadth of questions that systematically covers the model’s full capability range, brand-new accounts ramping to maximum usage immediately. Hence the advisory’s concrete recommendations: rate limiting, new-account surge detection, and cross-platform correlation.
The most ambitious response, subtly altering responses, injects calibrated noise into outputs for suspected callers, degrading the quality of any distilled model without touching the experience of normal users. It is an open arms race: transfer stations obfuscate metadata, providers refine their detectors, and neither side can claim a stable position.
The advisory also lands inside an escalation already underway. US agencies have leveled similar accusations for months, and Beijing has responded by accusing US firms of distilling Chinese models, with veiled threats of retaliation against any US bans. Distillation has become a diplomatic issue as much as an engineering one, which is why the response cannot be purely technical.
What this means for buyers and builders
The accusation also complicates the open-weights story. Qwen’s appeal is that its weights are downloadable and reusable; if part of its lineage rests on distilled outputs from closed models, the “open” label carries an asterisk that downstream users inherit. That is the quiet risk for the wider ecosystem: a licensing chain whose first link may be contested.
For builders, the practical test becomes provenance, not just performance. Model cards, training-data disclosures and licensing terms are turning into first-class requirements, because a model you cannot legally defend is a model you cannot ship into a regulated market. Expect procurement checklists to grow a provenance section within the next year.
For the open-source community, the advisory is a double-edged signal. Distillation itself is a legitimate, widely used technique that underpins compact open models; what the agencies object to is doing it against closed providers’ terms at industrial scale. The line between “open” and “extracted without permission” is exactly the line the next wave of policy will try to draw, and it will shape which models enterprises feel safe adopting.
Verdict
If you run a model API, treat this advisory as a free audit of your anti-distillation defenses: build detection for new over-consuming accounts, prepare a response-alteration path, and join — or start — a cross-provider correlation channel. If you buy models or build on them, add training provenance to your due diligence: a free, high-performing model can hide a legal liability you will inherit by integrating it. And if you track AI geopolitics, remember this: distillation is moving from an optimization technique to a sovereignty issue, and US agencies have chosen to make it a public battleground.