Model Distillation Campaigns Targeting Google AI Services

Summary

Google Threat Intelligence Group and Google DeepMind reported recurring distillation campaigns targeting Google AI services. Adversaries sought model outputs to reproduce capabilities, including reasoning, visual and audio understanding, image generation, and video generation. The unknown actors utilized proxy infrastructure to orchestrate requests, distributing queries across thousands of compromised and fraudulent accounts spanning different product channels. Google reported that this fragmented activity obscured the attackers' origin and helped bypass security controls.[[google-sep]] The actors queried Google's services to elicit responses and collected the outputs. Model outputs are subsequently used by the actors to train or fine-tune their own models. In February 2026, Google reported a campaign involving over 100,000 prompts that attempted to obtain Gemini's full reasoning traces rather than the summaries normally delivered to users.[[google-feb]] By September 2026, Google reported regularly observing coordinated distillation campaigns, some exceeding 100 million prompts. These campaigns targeted reasoning as well as multimodal capabilities, including visual and audio understanding, image generation, and video generation.[[google-sep]] Google reported recognizing the reasoning-focused attack in real time and reducing its risk while protecting internal reasoning traces. For the broader campaigns, Google reported measures to reduce their utility and block responsible accounts, as well as techniques to identify Gemini-distilled models and trace their provenance.[[google-feb]][[google-sep]] Target: Google AI Services, including Gemini Actor: Multiple unknown actors Reporter: Google Threat Intelligence Group, Google DeepMind Procedure: 1. Unknown actors compromised user credentials for Google AI services. 2. Unknown actors established many fraudulent accounts for Google AI Services. 3. Unknown actors deployed proxy infrastructure to orchestrate large-scale automated activity targeting Google AI models. The infrastructure supported requests distributed across credentials, accounts, and product channels. 4. The fraudulent and compromised accounts were used to access Google AI services via the proxy infrastructure. 5. Unknown actors rotated queries across thousands of valid accounts across different product channels to obscure their origin and bypass security controls. 6. Unknown actors crafted prompts to elicit outputs supporting capability replication. 7. Unknown actors used the Google service inference APIs to acquire model outputs. 8. Unknown actors collected the model responses as training material for distillation. Google identified over 100,000 prompts in the February 2026 reasoning-focused campaign. Later campaigns targeting reasoning and other capabilities exceeded 100 million prompts

Deployers

• Google AI Services, including Gemini

Tags

• MITRE ATLAS
• AML.CS0075