Joint Cybersecurity Advisory AA26-251A: China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns (NSA/CISA/FBI, September 2026)

AA26-251A is a joint cybersecurity advisory released September 8, 2026 by the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation. It states that six named China-based AI companies have conducted knowledge-distillation campaigns against US frontier models "likely with Chinese government awareness," and that distillation is "not a supplement to these companies' AI model development, but the critical core of it." It is the first US government document naming specific firms in connection with the practice the April 2026 OSTP memorandum NSTM-4 called adversarial distillation; see Adversarial Distillation.

The advisory distinguishes the conduct from the technique: distillation "is recognized as a legitimate and useful technique in AI research," and what it describes is "aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities."

Attribution

The six companies named are DeepSeek (DeepSeek Artificial Intelligence Technology Research Co., Ltd.), Moonshot AI (Beijing Moonshot Technology Co., Ltd.), Alibaba Group, MiniMax (Shanghai MiniMax Co., Ltd.), StepFun (Shanghai Jieyue Xingchen Intelligence Technology Co., Ltd.) and Z.AI. They are attributed individually, each with its own list of US models distilled and capabilities targeted, rather than as an undifferentiated set; the corporate registrations are given for four of the six.

Dates differ by actor: DeepSeek since at least late 2024, targeting R1 (released early 2025) and V3; Moonshot AI since at least mid-2025, with Claude Fable 5 data named for Kimi-K3 and GPT-4o data for Kimi-K2; Alibaba and MiniMax in late 2025, the latter for its M2 model; StepFun between late 2025 and early 2026 for its Step 4 model; and Z.AI by mid-2026, having distilled "billions of tokens" of GPT-5.5 and Claude Opus 4.8 data.

The advisory states that DeepSeek's "publicly quoted training costs of $5.6M are misleading as it does not include the true cost of the data acquired through extensive malicious distillation," citing the DeepSeek-V3 technical report as the source of that figure. It also records that MiniMax used Claude Code for internal software development and "even used prompt injections to try to trick Claude Code into believing it was a MiniMax product."

The document's prose and its summary table differ in two places. DeepSeek's prose list omits Gemini 2 and Grok 3 Mini, which the table includes, and writes "Claude 3.7" where the table writes "Claude Sonnet 3.7"; and the prose states that GPT-4o data trained Kimi-K2 while Moonshot's table row lists GPT-4o mini and not plain GPT-4o.

The basis for the government-awareness assessment is given as an inference from scale and sophistication rather than as separately sourced intelligence: the advisory writes that "the sheer scale of these campaigns and their sophistication indicate that distillation is not a supplement … but the critical core," and that the sector turned to the strategy "likely with the knowledge of the Chinese government … in an attempt to bridge the technological and performance gaps." No detection methodology, indicator-of-compromise list, or volume series beyond "billions of tokens across millions of exchanges/requests" is published.

Access pathways

Requests are described as routed through native APIs, remote cloud providers, third-party aggregators that "automatically obfuscate user metadata to avoid detection," third-party relays, and vendor account pools. Regional restrictions are bypassed through "a gray market of API proxies known as 'transfer stations'," which "resell access to frontier models at a fraction of the official price." Cost savings come from bulk procurement of premium subscriptions shared across developer teams. The advisory's reference list cites a Decoder account of that gray market.

MITRE ATLAS mapping and novel techniques

Eight techniques are mapped to MITRE ATLAS across resource development, model access, execution and defense evasion, discovery, attack staging, collection, exfiltration and impact. Two of the mapped entries carry specific factual claims: under the prompt-injection and jailbreak techniques, the advisory states that operators "craft prompts forcing models to reveal their hidden CoT reasoning … despite U.S. models restricting CoT output visibility to users," with DeepSeek "instructing models to imagine and articulate the internal reasoning behind completed responses and write it out step by step"; and under discovery, that "MiniMax redirected exchanges to a new Claude model within 24 hours of release, demonstrating real-time provider monitoring and pre-positioned infrastructure for immediate retargeting."

On collection volumes, the advisory states that campaigns "span days to months with query volumes in the thousands to millions per domain," that Moonshot AI "used millions of exchanges targeting agentic reasoning/tool use, coding/data analysis, computer-use agent development, and computer vision," and that DeepSeek's queries targeted "reasoning capabilities, rubric-based grading tasks (reward model function), and censorship-safe query rewriting, extracting how U.S. models evaluate response quality."

Four techniques are described as not present in MITRE ATLAS, each with detection indicators: regional-restriction evasion combined with bulk subscription exploitation, for which StepFun is named as structuring access "around pools of accounts with employees running multiple concurrent sessions"; centralized request-routing infrastructure providing "model/provider abstraction, real-time health monitoring, centralized quota enforcement, and automated sanitization"; automated request-metadata sanitization operating "at an infrastructure layer with automated enforcement instead of manual modification"; and systematic quota and cost optimization through pathway selection, centralized budget allocation and account segmentation.

Recommended mitigations

Three immediate actions are recommended: comprehensive detection and mitigation, monitoring subscription-to-usage ratios, immediate maximum usage from new accounts and enterprise-scale throughput; targeted response changes; and cross-organization intelligence sharing correlating activity across model providers, cloud platforms and API aggregators.

The response-alteration recommendation is set out in operational detail. Providers are advised to vary changes across requests "such that the subtle changes avoid triggering obvious alerts," with reduced reasoning depth, correct information presented with different reasoning, or stylistic inconsistencies named as measures that "may evade detection while reducing training usefulness." The advisory states that suspected distillers should not be informed of a switch to a downgraded model, "as informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training," and draws one boundary: "AI safety researchers and third-party evaluators should be informed of model changes while still applying strong distillation mitigations." Degradation is to be applied to "users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns," and the information-sharing section states that multi-source correlation is what justifies "response degradation with lower-to-no legitimate user risk." The implications for other API users are addressed only through that confidence standard; no false-positive rate or appeal mechanism is described. See AI Benchmarks and Evaluation for the evaluator carve-out's bearing on reproducibility.

Eleven MITRE ATLAS mitigations are listed, including query-volume and rate limits, telemetry logging, output obfuscation, model hardening through adversarial training and defensive distillation, and the use of ensembles "so extracting one yields a less usable clone." A further section applies NIST AI 100-2e2025's adversarial-machine-learning mitigations, treating differential privacy at length: it describes a finite privacy budget consumed by accumulated queries and a noise-versus-utility tradeoff in which "stronger privacy protection requires more noise, which can lower prediction precision and business usefulness." See NIST AI Risk Management Framework 1.0.

References cited

The advisory's reference list names Anthropic's "Detecting and preventing distillation attacks," Google's GTIG AI Threat Tracker, NIST AI 100-2e2025, an OpenAI document titled "RE: Updated Stakes for American-Led, Democratic AI" hosted on a Bloomberg assets domain, the Decoder gray-market account, NSPM-11 (NSPM-11 — Artificial Intelligence in the National Security Enterprise (Trump, June 5, 2026)), NSTM-4 (OSTP NSTM-4: Adversarial Distillation of American AI Models), and an OSTP post on X.

Relationships

• supports: Adversarial Distillation — the first interagency attribution naming firms, models and capabilities.
• depends-on: OSTP NSTM-4: Adversarial Distillation of American AI Models — the April 2026 OSTP memorandum whose allegations it particularizes.
• related: 2028: Two Scenarios for Global AI Leadership (Anthropic) — vendor attribution of the same practice to DeepSeek, Moonshot and MiniMax.
• related: Stealing Reasoning Traces from Proprietary LLM APIs — an extraction channel that would not appear in the account-level telemetry this advisory's detection recommendations rely on.
• related: DeepSeek, Moonshot AI, Alibaba / Qwen Team, MiniMax, StepFun (Shanghai Jieyue Xingchen Intelligence Technology), Zhipu AI — the named actors.
• related: Cybersecurity and Infrastructure Security Agency (CISA) — regulator role, National Security Agency (NSA) — two of the three authoring agencies.
• related: US-China AI Competition: Different Races, Different Metrics — the competitive frame the advisory asserts.