China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

Summary

NSA, CISA, and FBI attributed industrial-scale distillation campaigns to six China-based AI companies. Since at least late 2024, these companies collected outputs from U.S. AI models over millions of exchanges, and used the responses to train or improve their own models. The companies targeted specific capabilities, such as reasoning, coding, and agentic functionality, from different models to improve their own models and reduce development costs. The companies obtained access through fraudulent accounts, bulk purchases of premium subscriptions, and gray-market AI service proxies known as "transfer stations." Centralized routing infrastructure distributed requests across provider APIs, cloud services, third-party aggregators, relays, and account pools. This infrastructure enabled operators to bypass geographic restrictions, manage quotas and costs, and switch access pathways when blocked. Distributing requests across providers and pathways also helped obscure the coordinated activity and evade detection. The agencies reported prompts designed to elicit hidden chain-of-thought reasoning, including DeepSeek requests to reconstruct the reasoning behind completed responses. Operators also automatically removed organizational identifiers from requests to hinder attribution, collected model responses into training datasets, and used automated quality-assurance pipelines to detect degraded outputs and distinguish defensive countermeasures from ordinary service problems. The advisory provides additional actor-specific reporting on the capabilities and models targeted: | Actor | Reported activity period | Collection and distillation details | | --- | --- | --- | | [DeepSeek](/entities/AML.E0024) | Since at least late 2024 | The agencies reported targeting Claude, GPT, Gemini, and Grok variants to support R1 and V3 development. Targeted functionality included reasoning, legal specialization, API rule-driven tasks, question answering, writing, supervised fine-tuning optimization, and agentic capabilities. | | [Moonshot AI](/entities/AML.E0025) | Since at least mid-2025 | The agencies reported cross-provider collection targeting supervised fine-tuning, reinforcement learning, software engineering, and mathematics. The advisory specifically states that Claude Fable 5 data supported Kimi-K3 and GPT-4o data supported Kimi-K2. | | [MiniMax](/entities/AML.E0026) | Late 2025 | The agencies reported using Claude and Gemini services to improve M2's reasoning, reinforcement learning, supervised fine-tuning, and software engineering capabilities. They also identified using GPT-5's code review, agentic functionality, and dataset refinement among the targeted capabilities. | | [Alibaba](/entities/AML.E0040) | Late 2025 | The agencies reported distillation from Claude and GPT variants to improve Alibaba's models, including the Qwen family. Targets included software engineering, customer-service dialogue, image or virtual-character creation, evaluation and training datasets, and agentic workflows. | | [StepFun](/entities/AML.E0041) | Late 2025 to early 2026 | The agencies reported collecting outputs from Claude and GPT variants to improve Step 4's coding and agentic functions. | | [Z.AI](/entities/AML.E0042) | By mid-2026 | The agencies reported distillation of chain-of-thought reasoning capabilities from GPT-5.5 and Claude Opus 4.8 involving billions of tokens. | Target: Models from Anthropic, OpenAI, Google, and XAI Reporter: NSA, CISA, FBI Procedure: 1. The companies created fraudulent accounts, including accounts that obscured their country of origin, and procured premium subscriptions in bulk to support access at scale. 2. The companies used gray-market AI service proxies known as "transfer stations" to access U.S. models, bypass geographic restrictions, and obscure the origin of requests. 3. The companies used established accounts and premium-subscription pools to access AI services. 4. The companies used centralized infrastructure to distribute requests across native APIs, cloud providers, third-party aggregators, and account pools to evade restrictions and avoid detection. Routing incorporated service-health monitoring, automated failover when blocked, centralized quota and budget management, and cost-aware pathway selection. 5. The companies automatically removed organizational identifiers from requests to obscure their origin and hinder attribution. 6. The companies identified model outputs useful for extracting selected capabilities and generating training data. They performed adaptive discovery intended to identify valuable extractable data, supporting targeted collection rather than indiscriminate gathering. 7. The companies crafted systematic sets of prompts to elicit outputs for distillation, concentrating queries on selected domains and capabilities. 8. The companies submitted their adversarial prompts directly to target models to override intended behavior and elicit responses supporting their distillation object

Deployers

• Models from Anthropic, OpenAI, Google, and XAI

Tags

• MITRE ATLAS
• AML.CS0076