NSA, CISA and FBI ask providers to quietly route suspected distillers to weaker models

TechRepublic reports the advisory suggests three ways to degrade a suspect account: reduce reasoning depth, change how correct answers are reached, or move the user to a less capable model, with no notification ^[11]. IBTimes describes the same passage as advising providers to subtly alter responses or serve less sophisticated models to users identified with high confidence as malicious distillers, again without informing them ^[12]. A block returns a status code you can log, escalate and appeal. An unannounced quality drop arrives in an eval dashboard with no cause attached.

"Confirmed" and "high confidence" are different bars, and the two accounts of the advisory carry different ones. TechRepublic reports the agencies acknowledge that false positives would affect legitimate users, and recommend altering responses only during confirmed malicious campaigns, supported by stronger identity checks, behavioral monitoring and information sharing among model providers, cloud companies and API aggregators ^[13].

The signals on offer for making that call are thin. The advisory lists accounts shared across multiple IP addresses, continuous 24-hour usage, and new subscriptions that immediately consume their maximum quota ^[10]. A shared service key behind autoscaling workers hits the first, a nightly batch job the second, and a team that buys a plan on Monday to start a backfill the third.

Where the allegations get specific, they get specific about versions. DeepSeek is accused of campaigns involving Claude Sonnet 3.7, Claude Sonnet 4 and Claude Sonnet 4.5 along with multiple GPT, Gemini and Grok models, to generate training data for its R1 and V3 models ^[6]. Moonshot AI is accused of extracting Claude Fable 5 data to train Kimi-K3 and GPT-4o data to train Kimi-K2 ^[7]. Naming a model version points at request logs as the evidence.

The number worth doing arithmetic on is an older one. IBTimes reports Anthropic said DeepSeek, Moonshot and MiniMax generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts ^[16]. That averages about 670 exchanges per account ^[17]. Per-account rate limits do not see a campaign shaped like that. Catching it means correlating behaviour across accounts and across providers, which is the part of the mitigation list that only works if other companies cooperate ^[13].

The rationale the agencies give is economic. They say the firms conducting these campaigns achieve "significantly shorter AI development timelines and reduced financial expenditures" ^[14]. A White House Office of Science and Technology Policy memorandum from April 2026 put a limit on that, saying models developed through unauthorised distillation "do not replicate the full performance of the original", although they can appear comparable on selected benchmarks ^[15]. For anyone reading a distilled model's benchmark table, the memo's position is that the numbers hold on the benchmarks chosen and not past them.

"China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale," US officials said ^[4]. The advisory says the activity was conducted "likely with Chinese government awareness" and does not allege that Chinese intelligence agencies directly participated ^[3]. China's Foreign Ministry called the claims lacking factual basis and legal grounding, and said distillation is a widely used technical method ^[19]. "We hope the US will earnestly implement the important consensus reached by the leaders of both countries and refrain from making false accusations and smearing China," Foreign Ministry spokesperson Mao Ning said, according to Reuters ^[18]. Reuters reports the dispute arrives ahead of a planned Sept. 24 meeting between President Donald Trump and Chinese President Xi Jinping ^[21].