The FBI, National Security Agency (NSA), and Cybersecurity and Infrastructure Security Agency (CISA) accused Chinese artificial intelligence (AI) companies on Tuesday of conducting “aggressive” and “malicious” campaigns to steal American technology with the full blessing of the Chinese government.
The report said Chinese companies are “targeting U.S. AI companies to systematically extract proprietary models through knowledge distillation campaigns.”
Distillation is the process of using a more complete and powerful AI system to “train” a weaker one. The “teacher” in this system is a cutting-edge AI known as a frontier model, which was created with huge investments of time, money, and computer power.
The “student” is a much smaller and more limited AI that does not attempt to emulate the full capabilities of the frontier model. Instead, it “learns” from the larger AI to replicate specific aspects of its knowledge and behavior. Interacting with the frontier model can give the “student” model a chance to deduce, and duplicate, the teacher’s painstakingly designed and tested algorithms.
Distillation has often been used as a legitimate development technique for new AI designs, but it can also be abused as a form of industrial espionage, akin to spying on a master chef to copy a few of the private recipes he developed with years of effort.
Some of the big American AI companies have accused Chinese firms of waging massive distillation campaigns to harvest proprietary information from their models. Anthropic, for example, published a security report in February that accused Chinese firms DeepSeek, Moonshot, and MiniMax of waging “industrial-scale campaigns” to “illicitly extract” capabilities from Anthropic’s flagship product, Claude.
“These labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, in violation of our terms of service and regional access restrictions,” Anthropic alleged.
The Anthropic report noted that one of the dangers of distillation is that the illicitly copied models might be able to duplicate some of the capabilities of frontier models, but they lack the “necessary safeguards” to prevent dangerous abuse, such as creating weapons or conducting cyber-espionage.
The new report from the FBI, NSA, and CISA expressed similar concerns, and named the same Chinese companies as Anthropic did, plus a few more. The report said these Chinese firms have “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.”
“The distillation tactics used by China-based AI companies violate the U.S. companies’ terms of service and shorten AI research development for the China-based companies, undermining fair competition,” the U.S. government advisory said.
The Chinese Commerce Ministry responded by dismissing the American concerns as “groundless,” and accused the United States in turn of trying to establish a “monopoly of the AI industry.”
The Chinese response insisted distillation is a “common practice,” and accused the United States of unreasonable “anxiety” and “double standards.”
“If the U.S. suppresses Chinese AI companies under the pretext of targeting distillation, China will take resolute countermeasures,” the Chinese Commerce Ministry threatened.
Chinese Foreign Ministry spokeswoman Mao Ning insisted on Wednesday that China’s progress in AI development is entirely due to “greater self-reliance and strength in science and technology, and is fueled by China’s vision of extensive consultation and joint contribution for shared benefit and commitment to open cooperation.”
“We hope the U.S. side will earnestly act on the important common understandings reached between the two presidents and stop leveling false allegations to smear China,” she said.