AI Model Distillation

AI Model Distillation: A New National Security Concern

U.S. intelligence and cybersecurity agencies are warning that China-based AI companies are conducting what they describe as industrial-scale efforts to extract capabilities from U.S. frontier AI models. On September 8, 2026, the NSA, FBI and CISA issued a joint Cybersecurity Advisory stating that China-based companies were systematically extracting proprietary capabilities from U.S. models to support development of their own systems. The agencies characterize the activity as a cybersecurity and national-security concern, while Chinese officials have rejected the allegations and argue that distillation is a legitimate, widely used AI-development technique.

AI distillation itself is not inherently malicious. It is a legitimate technique in which a smaller “student” model learns from the outputs of a more capable “teacher” model. The security concern arises when organizations use unauthorized access, fraudulent accounts, proxy networks or large-scale automated queries to extract proprietary capabilities. Anthropic reported in September that it had identified additional distillation campaigns involving seven China-based AI laboratories, including activity it attributed to Alibaba, DeepSeek, Moonshot and Zhipu. Anthropic reported that some campaigns involved millions of model exchanges and attempts to extract capabilities in areas including reasoning, coding, agentic systems and data analysis.

The strategic issue extends beyond intellectual property. If advanced AI capabilities can be acquired through large-scale model extraction rather than developed independently, the technology gap between frontier developers can potentially narrow faster and at lower cost. U.S. agencies are therefore treating access to frontier AI models, APIs and supporting infrastructure as part of the broader cybersecurity and technology-security environment. For organizations using advanced AI, the emerging indicators include unusual high-volume API activity, unauthorized third-party model routing, credential abuse, automated query patterns and attempts to circumvent geographic or access controls. The broader question for national security is no longer simply who can build the most capable model—but who can acquire, replicate and operationalize those capabilities fastest.

SOURCES

National Security Agency (NSA), FBI & CISA — September 8, 2026
“China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies”
NSA Cybersecurity Advisory

Anthropic — September 2026
“Detecting and countering misuse of AI: September 2026”
Anthropic Threat Intelligence Report

Anthropic — February 23, 2026
“Detecting and preventing distillation attacks”
Anthropic Distillation Report

Reuters — September 8, 2026
“US accuses Chinese AI firms of 'malicious' copying of AI technology”
Reuters coverage

China Ministry of Commerce (MOFCOM) — September 2026
“Remarks on the U.S. Cybersecurity Advisory Warning of China-Based AI Companies’ Alleged Distillation Campaigns”
China MOFCOM statement