US urges AI firms to ID, then secretly switch, Chinese users to less-capable models

In an escalating technological and geopolitical confrontation, the United States government has formally named six prominent Chinese artificial intelligence firms accused of conducting industrial-scale "model distillation" attacks against American frontier AI systems. In a joint advisory released by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI), Washington claimed that these Chinese corporations have systematically extracted capabilities from premier US platforms to drastically reduce their own research expenditures and developmental timelines.

The advisory represents the most detailed and aggressive public accusation issued by the United States regarding intellectual property theft in the artificial intelligence sector. As both nations race for global technological supremacy, the allegations have triggered intense diplomatic friction, forcing major technology providers to weigh the security of their proprietary models against the operational friction and privacy concerns associated with heightened user monitoring.

Anatomy of an Industrial-Scale Distillation Campaign

According to the joint federal advisory, the targeted Chinese entities—identified as DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—have been executing coordinated campaigns against American models, including advanced variants of OpenAI’s GPT series, Anthropic’s Claude, Google’s Gemini, and xAI’s Grok.

Model distillation is a machine learning process wherein a smaller, less capable model is trained using the outputs of a larger, more advanced frontier model. While distillation is a recognized and legal technique when performed on one’s own models or with explicit licensing, federal agencies allege that these Chinese firms have weaponized the process on an unprecedented scale. By leveraging stolen capabilities—ranging from advanced agentic functions and complex coding frameworks to nuanced chain-of-thought reasoning—Chinese developers have allegedly bypassed billions of dollars in fundamental research and computational training costs.

The advisory outlines sophisticated methodologies utilized by the accused firms. Chief among these is the exploitation of AI model inference application programming interfaces (APIs). Attackers reportedly bypassed geographical restrictions and platform terms of service by bulk-purchasing fraudulent accounts through a "gray market of proxies." These automated swarms of accounts executed millions of identical or highly similar queries, spanning days or months, designed to extract specific behavioral patterns and proprietary weights.

Furthermore, US agencies revealed that some firms deployed advanced prompt-injection techniques to force models to strip away their safety guardrails and expose hidden internal reasoning processes. For instance, DeepSeek was specifically cited for utilizing specialized prompts that instructed target models to articulate the step-by-step logic behind completed responses, allowing the attacking system to mirror sophisticated cognitive architectures.

Recommended Mitigations and User Experience Trade-Offs

To counter these extraction campaigns, federal cybersecurity authorities have outlined a stringent set of defensive measures for American AI providers. The proposed strategies, however, present significant technical challenges and threaten to impact legitimate everyday users.

First, US artificial intelligence companies have been urged to significantly overhaul their identity verification protocols and enhance behavioral monitoring. Agencies recommend flagging accounts that exhibit suspicious subscription-to-usage ratios, sudden spikes in activity that immediately hit maximum thresholds, or high query volumes originating from known proxy networks. While these steps are intended to root out automated extraction rings, critics note that aggressive tracking of enterprise subscriptions and user behaviors inevitably raises serious data privacy concerns.

More controversially, the advisory recommends that AI providers implement dynamic, defensive degradation. When a user account is flagged as potentially malicious, companies are advised to "subtly" alter responses—such as introducing stylistic inconsistencies, varying the underlying reasoning, or entirely and secretly switching the user to an inferior model without notification.

The practicality of this recommendation remains heavily debated. Security experts point out that Chinese AI firms employ automated quality assurance systems capable of detecting output degradation within a 24-hour window, allowing them to dynamically route around compromised pathways. Moreover, implementing silent downgrades risks catching legitimate users in the security net. If an ordinary researcher, developer, or consumer is mistakenly flagged by an overly aggressive heuristic algorithm, they could experience stunted capabilities, shorter answers, or lowered prediction precision without explanation—a misstep that previously generated severe public backlash when tested by major providers.

Chronology of Escalating Tensions

The public confrontation between Washington and Beijing over artificial intelligence extraction is the culmination of months of mounting tensions and corporate complaints.

• Late 2024 to Early 2025: Leading US artificial intelligence laboratories increasingly observed anomalous, high-volume query patterns originating from overseas infrastructure. Companies began privately briefing federal agencies on systematic attempts to clone core reasoning and structural capabilities.
• August 2025: OpenAI publicly accused DeepSeek of improper data usage practices following the sudden rollout of new model architectures. Concurrently, industry-wide scrutiny intensified as automated routing and fallback mechanisms faced public criticism for unintentionally degrading user experiences.
• February 2026: Google publicly reported that malicious actors had bombarded its Gemini models with over 100,000 targeted prompts in an apparent cloning attempt.
• June 2026: Anthropic publicly asserted that Alibaba had orchestrated the largest-ever intellectual property extraction attack against Claude, calling for severe regulatory and potential criminal responses.
• July 2026: The US government formally warned that a comprehensive crackdown on industrial-scale AI theft was imminent, drawing immediate pushback from Chinese diplomatic representatives.
• September 2026: The NSA, CISA, and FBI released their joint advisory, naming the six specific Chinese corporations and detailing the technical mechanics of the alleged distillation campaigns.

Diplomatic Fallout and Official Responses

The release of the joint advisory provoked swift and vehement denials from the People’s Republic of China, which characterized the allegations as baseless and politically motivated.

Mao Ning, a spokesperson for the Chinese Ministry of Foreign Affairs, rebuked the American agencies during a press briefing, asserting that Washington should focus on fostering international technological cooperation rather than propagating groundless accusations. Mao defended China’s rapid advancements in the artificial intelligence sector as the direct result of high-level scientific and technological self-reliance, rather than illicit extraction.

Earlier statements from Chinese diplomatic officials echoed these sentiments, accusing the US administration of orchestrating a politically motivated smear campaign rooted in systemic prejudice. Furthermore, official state media outlets, including The People’s Daily, pointed out that numerous American AI startups and research institutions frequently utilize foreign models—including those developed in China—for comparative research, training, and cost-effective operational tasks. Beijing warned that it would take all necessary measures to safeguard the legitimate rights and interests of its domestic technology sector if subjected to material harm or further unilateral sanctions.

The timing of the advisory is particularly sensitive, arriving just ahead of high-level diplomatic engagements between US and Chinese leadership. Concurrently, China’s Ministry of Industry and Information Technology released an ambitious strategic roadmap aimed at quadrupling the nation’s intelligent computing capacity over the next five years, signaling that Beijing intends to aggressively pursue domestic infrastructure independence regardless of Western export controls or security warnings.

Broader Implications for the Global AI Landscape

The ongoing dispute over model distillation highlights a fundamental vulnerability in the current paradigm of commercial artificial intelligence development. Because frontier models must interact with the public via inference APIs to generate revenue and utility, they are inherently exposed to observation and querying by sophisticated competitors.

As US intelligence and cybersecurity agencies press for tighter domestic controls, information sharing, and defensive model degradation, the industry faces a delicate balancing act. Over-zealous policing risks alienating legitimate enterprise and consumer customers through degraded performance and privacy intrusion. Conversely, failing to adequately secure proprietary architectures threatens to erode the competitive lead currently held by American technology firms, potentially accelerating global technological parity at a fraction of the traditional cost.

Ultimately, the confrontation underscores that artificial intelligence has firmly transitioned from an academic and commercial frontier into a critical domain of national security, where intellectual property protection, state-sponsored industrial policy, and geopolitical rivalry are inextricably linked.