China's Industrial-Scale AI Distillation: The NSA/FBI/CISA Report Every AI Leader Needs to Read

On September 8, 2026, a joint report from the National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) leveled sweeping accusations against China’s leading AI developers. The allegation: systematic, industrial-scale extraction of proprietary capabilities from US-developed AI models through knowledge distillation campaigns since at least late 2024.

The named companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — allegedly “extracted billions of tokens across millions of exchanges/requests” from US frontier models including Claude, GPT, Gemini, and Grok. The report states that the Chinese government is “likely” aware of these activities.

This is not a cybersecurity story in the traditional sense. It’s an intellectual property extraction story — and it changes how every AI leader needs to think about model deployment, API access, and competitive moats.

What Is AI Distillation?

The Technique

Knowledge distillation is a machine learning technique where a smaller or less capable model (the “student”) is trained to replicate the outputs and behaviors of a more advanced model (the “teacher”). The student queries the teacher extensively — sometimes millions of times — and uses the responses as training data.

The result: the student model acquires capabilities, reasoning patterns, and specialized knowledge that took the teacher model billions of dollars and years of research to develop — without ever accessing the teacher’s weights, architecture, or training data.

Why It Works

Frontier AI models expose their capabilities through their outputs. When Claude solves a complex reasoning problem, GPT generates code, or Gemini analyzes an image, the response contains the model’s reasoning process, knowledge representation, and problem-solving strategy. An attacker who queries the model enough times can capture enough of these patterns to train a replica.

Why It’s Hard to Stop

API access is the attack vector. Every organization that uses frontier AI models via API is potentially vulnerable. The queries look legitimate — they’re just API calls. The extraction happens gradually, over millions of requests, across extended periods. Without sophisticated rate limiting and anomaly detection, it’s nearly invisible.

The Allegations: What the Report Says

The Named Companies

The joint NSA/FBI/CISA report names six Chinese AI developers:

• DeepSeek — whose V4.1 Flash model was released the same week as this report, with 552B parameters and MIT-licensed weights
• Moonshot AI — a leading Chinese LLM developer
• Alibaba — whose Qwen models are widely used globally
• MiniMax — a Chinese AI startup
• StepFun — a Chinese AI company
• Z.AI — whose GLM models have been evaluated by SaferAI and found to have significant safety gaps

The Targeted Models

The report alleges that variants of Claude (Anthropic), GPT (OpenAI), Gemini (Google DeepMind), and Grok (xAI) were targeted. These are the four most capable frontier model families in the US — and their capabilities are now allegedly being replicated through distillation.

The Scale

“Billions of tokens across millions of exchanges/requests” since at least late 2024. This is not a few researchers experimenting. This is industrial-scale extraction — the kind of operation that requires coordination, infrastructure, and sustained effort.

Government Awareness

The report states that the Chinese government is “likely” aware of the distillation activities. This elevates the allegations from corporate IP theft to a state-backed campaign — or at minimum, state-tolerated activity.

The Timing: DeepSeek V4.1 Flash

The same week the distillation report landed, DeepSeek released V4.1 Flash — a 552-billion-parameter model with:

• 1 million token context window
• MIT license with weights included on Hugging Face
• A brand-new Causal Encoder-Decoder architecture — not an incremental update
• 4x reduction in active key-value cache memory for long-running agents
• 384K maximum output tokens

DeepSeek’s own model card files V4.1 Flash under what the company calls its “new architecture family.” It’s the first time DeepSeek has hung a .1 version number on a completely new base model — a label that normally signals a tune-up, not a rebuild.

Starting September 14, 2026, all API traffic directed to the deepseek-v4-pro endpoint will be automatically rerouted to V4.1 Flash at V4.1 Flash rates. The transition is mandatory.

The timing is not subtle. A model benefiting from alleged distillation is now being released as open-weight, distributing the extracted capabilities globally.

What This Means for Business Leaders

1. Your AI Competitive Moat May Be Thinner Than You Think

If your organization builds proprietary capabilities on top of frontier AI models via API — custom prompts, fine-tuned behaviors, specialized workflows, domain-specific reasoning patterns — those capabilities can be extracted through distillation. Anyone who queries your model enough times can replicate what you’ve built.

This means the investment you’ve made in prompt engineering, fine-tuning, and workflow design may not be as defensible as you think. Your AI competitive moat isn’t the model — it’s the data, the workflow integration, and the organizational knowledge that surrounds the model.

2. Treat Proprietary Prompts as Trade Secrets

Your system prompts, custom prompts, and fine-tuned behaviors are intellectual property. Treat them accordingly:

• Document them as trade secrets with legal protections
• Restrict access to prompt libraries within your organization
• Monitor API usage for patterns consistent with distillation
• Include confidentiality clauses in contracts with AI vendors and partners

3. Implement Technical Protections

• Rate limiting — cap the number of requests per user/IP/time window
• Anomaly detection — flag unusual query patterns (high volume, repetitive, systematic)
• Access controls — prevent bulk extraction through authentication and authorization
• API monitoring — track usage patterns for signs of distillation campaigns
• Output watermarking — where available, use models that embed watermarks in outputs

The CTO Technology Advisory service helps organizations assess their distillation risk and build technical protections: rate limiting, anomaly detection, access controls, and API monitoring tailored to your AI deployment.

4. Diversify Model Providers

Single-vendor dependency creates single-point vulnerability. If all your AI capabilities are built on one model provider, a distillation attack on that provider compromises your entire stack. Diversify across providers (OpenAI, Anthropic, Google, open-weight models) to reduce concentration risk.

5. Consider Private Deployment for Sensitive Capabilities

For your most sensitive AI capabilities — proprietary workflows, domain-specific reasoning, competitive differentiation — consider on-premise or private cloud deployment of open-weight models. This removes the API attack vector entirely. You control the model, the infrastructure, and the access.

Models like DeepSeek V4.1 Flash (MIT license, weights included) make private deployment increasingly viable. The irony: the model that allegedly benefited from distillation is also the model that makes private deployment most accessible.

6. Include Distillation Protections in Vendor Contracts

Your contracts with AI model providers should include:

• Distillation protection clauses — the vendor commits to detecting and preventing distillation attacks
• Notification obligations — the vendor notifies you if your usage patterns suggest you’re being targeted
• Liability allocation — who bears the cost if your proprietary capabilities are extracted through the vendor’s API
• Rate limiting commitments — the vendor maintains rate limiting and anomaly detection on their endpoints

The AI Strategy for Business consultation now includes distillation risk assessment: evaluating your API exposure, identifying extractable capabilities, and building contractual and technical protections.

The Bigger Picture: AI IP as National Security

The NSA/FBI/CISA report elevates AI intellectual property from a corporate concern to a national security priority. When the signals intelligence agency, the federal law enforcement agency, and the cybersecurity agency jointly publish a report on AI distillation, the message is clear: AI capabilities are now a strategic asset, and their extraction is a threat.

This has implications beyond the named companies:

For AI Labs

Frontier model providers face a fundamental tension: API access drives revenue and adoption, but it also creates the distillation attack vector. Expect to see more aggressive rate limiting, anomaly detection, and access controls from US AI labs — not just because they want to, but because the government is now watching.

For Open-Weight Models

The report strengthens the argument for open-weight models — if you’re going to be distilled anyway, you might as well release the weights. But it also raises the question: should open-weight models built on distilled capabilities be subject to export controls or usage restrictions?

For Regulators

The report provides ammunition for those arguing that AI capabilities should be subject to export controls, similar to dual-use technologies. If AI model capabilities can be extracted through API access, then API access itself becomes a controlled export.

For Every Organization

If the most advanced AI models in the world can be distilled through their APIs, so can your proprietary AI capabilities. The question isn’t whether distillation is happening — it’s whether you’re aware of it and prepared for it.

The Bottom Line

China’s AI developers allegedly extracted billions of tokens from US frontier models through industrial-scale distillation. The Chinese government was likely aware. The same week, DeepSeek released V4.1 Flash as open-weight. The capabilities extracted from US models are now being distributed globally.

For AI leaders, the lesson is clear: your AI competitive moat is not the model — it’s the data, workflow integration, and organizational knowledge that surrounds the model. If you’re building your competitive advantage on prompts, fine-tuning, and API-based workflows, that advantage can be distilled.

Treat your proprietary AI capabilities as intellectual property. Implement rate limiting, anomaly detection, and access controls. Diversify your model providers. Consider private deployment for sensitive capabilities. Include distillation protections in vendor contracts.

The distillation report is a wake-up call. The organizations that treat AI IP as a strategic asset — with legal protections, technical safeguards, and contractual obligations — will maintain their competitive moat. The organizations that don’t will find their proprietary capabilities replicated and distributed before they know it.