As reported by CISA in joint advisory AA26-251A, the NSA, FBI, and CISA have formally confirmed what many in the AI security community have suspected since the DeepSeek R1 release: Chinese AI firms are not merely inspired by U.S. frontier models — they are systematically extracting their capabilities through industrial-scale knowledge distillation. This advisory elevates the issue from industry rumor to formal national-level threat guidance, and it demands a fundamental rethink of how AI companies protect their most valuable assets.

AI Security Alert: As reported by CISA in joint advisory AA26-251A, the NSA, FBI, and CISA have formally confirmed what many in the AI security community have suspected since the DeepSeek R1 release: Chinese AI firms are not merely inspired by U.S.

Why This Matters: Distillation as IP Exfiltration

The advisory identifies a critical distinction that has been lost in public discourse. Knowledge distillation — using a teacher model's outputs to train a student model — is a legitimate, well-established ML technique. What CISA describes is something categorically different: coordinated, multi-vector extraction campaigns designed to violate terms of service, evade detection, and reproduce proprietary capabilities at a scale that constitutes the core development strategy, not a supplementary technique.

The named entities — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — allegedly extracted billions of tokens across millions of requests from Claude, GPT, Gemini, and Grok variants. DeepSeek's R1 and V3 models and Alibaba's Qwen family are specifically cited as beneficiaries. The advisory notes this activity occurred likely with Chinese government awareness, which reframes the threat from competitive intelligence gathering to state-aligned economic espionage.

The Detection Problem Nobody Solved

The most alarming technical detail is not who did it, but how they got away with it. The advisory describes routing through native APIs, remote cloud providers, third-party aggregators that strip metadata, and a gray market of proxy services. This exposes a glaring gap: U.S. AI companies built sophisticated rate limiting and content moderation, but never built robust distillation-detection pipelines.

Distributed query patterns that individually look benign can collectively reconstruct a model's reasoning traces, safety behaviors, and domain-specific capabilities. Traditional API abuse detection — focused on volume, authentication, and content policy — is structurally blind to this threat because the queries are valid, authenticated, and policy-compliant at the individual request level.

The threat isn't that someone is breaking into your model. It's that someone is politely asking it millions of carefully crafted questions until they've reconstructed everything that makes it valuable.

Who Is at Risk

The Detection Problem Nobody Solved
Frontier model providers — Anthropic, OpenAI, Google, xAI, and any organization training models at the frontier of capability. Their competitive moat is being systematically dismantled.
Enterprise API customers — organizations whose API keys and credentials may be compromised or resold through gray-market proxy networks, exposing them to abuse liability and cost fraud.
AI infrastructure providers — cloud and inference platforms that may unknowingly serve as routing intermediaries for distillation traffic.
Specialized domain AI companies — firms in healthcare, finance, legal, or defense AI where domain-specific fine-tuning represents the core IP. These are softer targets with less mature telemetry.

Shield53 Recommendations

AI companies must treat model capability extraction as a first-class security threat, equivalent to source code exfiltration or database theft. Defensive programs should include:

  • Distillation-pattern detection: Deploy ML-based anomaly detection that identifies coordinated query patterns across accounts, IP ranges, and aggregator traffic — not just per-account rate limits. Look for systematic coverage of reasoning chains, edge cases, and capability boundaries.
  • Output watermarking and fingerprinting: Implement cryptographic or statistical watermarks in model outputs that can survive distillation, enabling provenance attribution when suspected distilled models are released.
  • Aggregator and proxy disqualification: Aggressively identify and block third-party API aggregators and proxy services that obfuscate user identity. Require direct identity attestation for API access at scale.
  • Behavioral query analysis: Flag accounts exhibiting structured exploration patterns — high diversity of question types, systematic capability probing, and reasoning-chain extraction sequences — even when total volume appears normal.
  • Cross-account correlation: Break out of per-account siloed detection. Distillation campaigns distribute workload across thousands of keys. Correlation engines must operate at the infrastructure level.
  • Terms-of-use enforcement with teeth: Move beyond automated account suspension. Document and preserve evidence for legal and trade-secret enforcement actions. Coordinate with federal law enforcement when state-aligned activity is suspected.
  • Output throttling on sensitive capabilities: For high-value reasoning and domain-specific functions, consider rate limitations on chain-of-thought exposure and structured output formats that make systematic extraction more costly.

This advisory should end the debate about whether AI model IP needs the same protection as source code and trade secrets. It does. The question now is whether AI companies will build the detection and response infrastructure to match the sophistication of the campaigns already underway against them.