U.S. intelligence and cybersecurity agencies are accusing six major Chinese artificial intelligence companies of systematically extracting capabilities from American frontier models, escalating a technical practice known as model distillation into a new point of conflict in the U.S.-China AI race.
Reuters reported that the National Security Agency, Cybersecurity and Infrastructure Security Agency and FBI accused Chinese developers of aggressive, malicious and targeted distillation activities at an industrial scale. The agencies said the activity was conducted “likely with Chinese government awareness.”
NBC News identified the six companies as DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, which U.S. officials say have systematically mined American AI models since at least late 2024.
Distillation becomes an AI trade-secret battleground
Model distillation itself is not inherently malicious. The technique generally involves using outputs from a larger, more capable model to help train a smaller system, reducing development and compute costs.
The U.S. allegations instead focus on how distillation was allegedly carried out at scale. Ars Technica reported that the companies are accused of extracting capabilities from variants of Claude, GPT, Gemini and Grok using campaigns involving large numbers of accounts and coordinated queries.
The agencies said operators used fraudulent accounts, proxy networks and thousands to millions of similar prompts to collect useful outputs while avoiding restrictions.
DeepSeek was specifically accused of seeking capabilities involving agentic functions, assistant behavior, writing optimization, question-and-answer performance and chain-of-thought reasoning, Ars Technica reported. Moonshot AI was accused of targeting areas including fine-tuning, reinforcement learning, software engineering and mathematics.
NBC News said the agencies characterized distillation as the critical core rather than merely a supplement to the development strategies of the companies they named.
US proposes new defenses against model extraction
The advisory also raises difficult product questions for American AI companies.
Ars Technica reported that U.S. agencies recommended monitoring anomalous account behavior and strengthening identity verification, while potentially switching suspected distillation accounts to less-capable models without notifying them.
Other proposed defenses include subtly altering responses, reducing reasoning depth and sharing threat intelligence across AI companies, cloud providers and infrastructure operators.
Those measures come with trade-offs. Ars noted that legitimate users mistakenly identified as attackers could receive degraded answers or lose access to capabilities without realizing why.
China rejects the allegations
Beijing has disputed Washington’s characterization.
Chinese Foreign Ministry spokesperson Mao Ning shared that China’s AI progress was the result of high-level scientific and technological self-reliance and called on the United States to strengthen cooperation instead of making “groundless accusations.”
The dispute lands ahead of planned talks involving U.S. President Donald Trump and Chinese President Xi Jinping, adding AI model development to a broader technology rivalry already shaped by semiconductor restrictions and competition over computing infrastructure.
For AI builders, the bigger issue is whether frontier-model outputs themselves are becoming valuable intellectual infrastructure. If competitors can reproduce expensive capabilities through enough carefully structured API queries, then protecting a model may increasingly require defending not only its weights and training data—but also the behavior exposed through every inference request.
