The White House Office of Science and Technology Policy (OSTP) on Thursday published a memo that accused China of conducting “industrial-scale” theft of artificial intelligence (AI) technology from American firms.
“The U.S. government has information indicating that foreign entities, principally based in China, are engaged in deliberate, industrial-scale campaigns to distill U.S. frontier AI systems,” said the memo from OSTP Director Michael Kratsios, as first seen by the Financial Times (FT) on Thursday.
“Model distillation” means harvesting the output from existing large AI systems to create smaller ones, rather like a cuckoo bird laying its eggs in the nests of other birds. As with many techniques, there are legitimate and illegitimate ways to distill.
The most notorious example to date was China’s groundbreaking DeepSeek, which rocked the nascent AI industry by ostensibly delivering top-shelf artificial intelligence capabilities at a fraction of the cost. Critics say DeepSeek turned distillation into outright theft by stealing data from the rival OpenAI system without permission.
The debate over distillation has some similarities to the concept of “fair use” copies and quotations. A little distilling from publicly available AI output is unobjectionable, especially if the company that created the AI grants permission. Industrial-scale distillation without consent is not much different than stealing and republishing copyrighted material, as though a Chinese company suddenly announced it was publishing a book series about a boy wizard with a lightning-bolt scar on his forehead.
Kratsios said Chinese developers are “leveraging tens of thousands of proxy accounts to evade detection and using jailbreaking techniques to expose proprietary information.” Jailbreaking means hacking the security measures on a program or device so it can be used in ways that were not intended by the end user agreement.
“These coordinated campaigns systematically extract capabilities from American AI models, exploiting American expertise and innovation,” Kratsios charged.
The White House memo said the Trump administration intends to “hold foreign actors accountable for industrial-scale distillation campaigns.”
The Chinese embassy in Washington responded to the FT article by dismissing the White House accusations as “pure slander.”
“China has always been committed to promoting scientific and technological progress through co-operation and healthy competition. China attaches great importance to the protection of intellectual property rights,” claimed the embassy.
Another Chinese embassy representative boasted to the BBC that China “is not only the world’s factory, but is also becoming the world’s innovation lab.”
“China’s development is the result of its own dedication and effort as well as international cooperation that delivers mutual benefits,” the Chinese spokesperson said.
Contrary to China’s breezy dismissal, FT noted that the AI industry is very much aware of what China is doing and has serious problems with those illicit practices.
Not only are there questions of technology theft, but American experts warn that China has a habit of disabling safety measures with its “jailbreaking” schemes, making stolen AI code even more dangerous than it already was. China’s knockoff AIs are willing to undertake tasks the original systems were prohibited from pursuing, such as designing bio-weapons.
American companies like Anthropic describe China’s distillation schemes as “attacks” that violate terms of service. In February, Anthropic accused three Chinese projects, including DeepSeek, of illicitly extracting data from the Claude AI system.
“These campaigns are growing in intensity and sophistication. The window to act is narrow, and the threat extends beyond any single company or region. Addressing it will require rapid, coordinated action among industry players, policymakers, and the global AI community,” Anthropic said, noting that China’s distillation attacks often violate crucial export controls from the U.S. and other targeted nations.
“Without visibility into these attacks, the apparently rapid advancements made by these labs are incorrectly taken as evidence that export controls are ineffective and able to be circumvented by innovation,” the American company said.
According to Anthropic’s security experts, China used gigantic networks of fraudulent accounts hosted by proxy services to attack Claude, making it difficult to determine which requests to the AI were part of the distillation campaign, or where the requests were coming from. The fraudulent accounts were replaced as quickly as Anthropic could ban them.
“In one case, a single proxy network managed more than 20,000 fraudulent accounts simultaneously, mixing distillation traffic with unrelated customer requests to make detection harder,” the company said.
Another industry leader, OpenAI, leveled similar allegations against the People’s Republic of China (PRC) in February. OpenAI told the U.S. House Select Committee on the Chinese Communist Party that it hardened its defenses against distillation after DeepSeek was unveiled, but Chinese attacks persisted, giving Chinese firms a “free ride” to improve their models.
“OpenAI believes the best defense is offense: the best way to ward off a fast-oncoming PRC making headway around the world for autocratic AI is continued investment in American AI leadership and global adoption of responsibly developed, democratic AI,” the company said.
Reuters on Thursday speculated the Kratsios memo could be part of the White House laying the groundwork for rescinding permission for companies like Nvidia to sell state-of-the-art AI chips to China, or perhaps drive a harder bargain for those chips when President Donald Trump meets with Chinese dictator Xi Jinping next month.
“The Trump administration gave a green light to the sales in January, with conditions. On Wednesday, however, Commerce Secretary Howard Lutnick indicated that no shipments had yet been made,” Reuters noted.