US Agencies Accuse Chinese AI Firms of Industrial-Scale Distillation From American Models

AI distillation lets a smaller student model learn behavior from a larger teacher model by studying its responses. The method can reduce training costs, shrink models for deployment, and make advanced capabilities available on cheaper hardware. It is a standard research and engineering technique, but its use becomes contentious when companies query proprietary systems at scale to reproduce capabilities without access to the underlying weights.

That distinction sits at the center of a new U.S. government accusation against Chinese AI companies. The FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency said six China-based firms have conducted systematic extraction campaigns against American frontier models since 2024. The agencies named DeepSeek, Alibaba and Moonshot AI, the company behind Kimi, among the firms involved.

The agencies describe the activity as industrial-scale and say distillation forms a central part of the companies’ model-development strategy. Their advisory says the firms used gray-market access, proxy accounts and other methods to send large volumes of prompts to U.S. systems, collect outputs, and train competing models on those responses.

The alleged targets include Anthropic’s Claude, OpenAI’s ChatGPT, Google’s Gemini and xAI’s Grok. The approach would give companies access to capabilities refined through years of research and enormous computing investments, while reducing the cost and time required to build a comparable product. The Register’s account, summarized by Valueaddvc, characterized the activity as aggressive, malicious and targeted, while the government urged providers to identify suspicious users and restrict access.

The dispute threatens the economics behind frontier AI. U.S. companies have spent hundreds of billions of dollars developing large models and data-center capacity, expecting revenue from subscriptions, enterprise software and APIs to repay that investment. A rival that extracts useful behavior through inexpensive queries can avoid part of the research bill while competing for the same customers.

Distillation also complicates the value of model access. Providers can protect weights inside their own infrastructure, but an external system can still learn from enough outputs to imitate reasoning patterns, coding ability, safety behavior or specialized knowledge. Bloomberg reported that the U.S. warning comes as companies confront the possibility that their most expensive assets are exposed through ordinary customer interfaces.

Distillation itself isn't a form of theft by definition. Researchers use teacher models to create smaller, faster systems, and the technique can lower inference costs, support on-device AI and extend services to organizations with limited computing budgets. Work on financial services has also framed distilled models as a way to deliver coaching and recommendations to underserved users, though it has raised concerns about bias and security.

The policy dispute concerns consent, scale and ownership. A company training a compact model from its own system's outputs operates differently from a rival systematically querying another provider's model through intermediaries. Americans for Responsible Innovation has grouped distillation with model piracy and model-weight theft in policy discussions, while CNBC reported that lawmakers and technology executives are debating where legitimate knowledge transfer ends and unauthorized copying begins.

The accusations add a new front to an already tense technology relationship shaped by export controls, chip restrictions and competition over advanced computing. They also arrive before a key summit, raising the diplomatic stakes. China has dismissed the allegations as groundless, according to NBC News, leaving the dispute centered on government evidence that has not been fully detailed publicly in the excerpts available here.

For Washington, the issue is both commercial and national-security related. If foreign firms can reproduce advanced capabilities through access to U.S. services, restrictions on chips and model weights address only part of the problem. Providers may respond with stronger identity checks, regional access controls, rate limits and lower-capability models for suspicious accounts. Those measures can protect intellectual property, but they also add friction for legitimate international users and developers.

AI companies are likely to tighten API monitoring and treat unusual prompt patterns as a security signal. The government advisory puts pressure on providers to detect proxy access and distinguish ordinary experimentation from coordinated extraction. That will push model-security teams toward customer verification, abuse detection and output controls alongside conventional cybersecurity defenses.

The larger question is whether new rules will target the technique or the conduct. Broad limits on distillation could slow useful model compression and make affordable AI harder to build, while narrow rules focused on unauthorized access, deception and commercial copying would preserve legitimate research. The dispute will also test whether U.S. companies can defend expensive model capabilities when their products are designed to answer questions at global scale.