On September 8, 2026, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the Federal Bureau of Investigation released a joint cybersecurity advisory, catalogued as AA26-251A. It makes an unusually specific claim: that six China-based artificial intelligence companies have, since at least late 2024, run what the agencies call industrial-scale distillation campaigns against US frontier models, extracting billions of tokens across millions of requests to help train their own systems. The document names the firms, names the US models it says were targeted, and closes with a set of defensive recommendations, one of which has drawn as much attention as the accusation itself.
This piece walks through three things in order: what model distillation actually is, what the advisory does and does not assert, and why its central recommendation is being debated rather than simply adopted.
What distillation means, in plain terms
Knowledge distillation is an established and, in most contexts, entirely legitimate machine learning technique. In its textbook form, a large and capable model, the teacher, generates outputs, and a smaller model, the student, is trained to imitate them. The student learns not just the teacher's final answers but the shape of its reasoning, and it can end up far cheaper to run while retaining much of the teacher's behavior. Labs distill their own models constantly. The technique is not the controversy.
What the advisory describes is a different arrangement. Instead of a lab distilling a model it owns, the agencies allege that Chinese firms queried competitors' commercial models at scale, through native APIs, third-party aggregators and what the advisory calls transfer stations, and used those responses as training data for their own models. That crosses two lines at once. It typically violates the terms of service of the model being queried, and it converts a rival's expensive training run into a cheap input for a competitor. The distinction the advisory is drawing is between distilling a model you are allowed to use as a teacher and distilling one you are not.
Distillation is not the controversy. Distilling a model you are not allowed to use as a teacher is.
The distinction at the center of AA26-251A
Who and what the advisory names
The six firms named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. On the other side of the ledger, the advisory lists an extensive set of US models it says were used as teachers, spanning four families: Claude, GPT, Gemini and Grok. The breadth is part of the point. This is not framed as one firm copying one model, but as a sustained pattern across most of the American frontier.
Gemini
DeepSeek
Qwen
MiniMax
OpenAI
Anthropic
Google
xAIThe advisory names four US model families as distillation targets
Distinct model versions from each US family listed in AA26-251A as targets. A count of breadth, not of token volume.
Source: joint advisory AA26-251A (NSA, CISA, FBI), model list as reproduced in Unite.AI coverage, September 2026.
The advisory also lays out a rough chronology. It dates DeepSeek's activity to the late 2024 to mid-2025 window, describes Moonshot AI operating from mid-2025 onward, places Alibaba, MiniMax and StepFun activity across late 2025 into early 2026, and puts Z.AI's by mid-2026. Read together, these are overlapping rather than sequential, which is what the agencies mean by campaign rather than incident.
Six overlapping campaigns across roughly two years
Approximate distillation windows the advisory attributes to each named firm.
Source: joint advisory AA26-251A (NSA, CISA, FBI), September 8, 2026. Windows shown are approximate.
The DeepSeek portion is where the advisory gets most concrete, and it connects to an argument that has followed the company since early 2025. DeepSeek's widely cited training cost of roughly $5.6 million for its headline model became a symbol of Chinese efficiency. The agencies argue that figure is misleading precisely because it excludes the cost of the data, and that a meaningful share of that data was, in their telling, acquired by distilling models that others spent far more to build. Whether or not one accepts the framing, it reframes the efficiency story as a question about what is and is not counted in a training budget.
The recommendation that is being debated
The advisory does not stop at attribution. It recommends that US AI developers deploy behavioral monitoring to spot suspected distillation, and then, in the language that has drawn the most scrutiny, deploy targeted response changes that subtly alter responses to suspected malicious distillation attempts. It goes further and suggests companies avoid informing users suspected of malicious distillation when their responses are altered.
That is a meaningful shift in what a public advisory is asking for. Most defensive guidance tells operators to detect, block or rate-limit. This one asks them to consider degrading output quality silently for accounts they suspect, without telling those accounts. The security logic is straightforward: if a distiller does not know its teacher's answers are being poisoned, the data it steals becomes less useful, and it cannot easily adapt. The tension is equally straightforward. A provider that quietly alters answers for suspected accounts is, by construction, sometimes going to alter answers for accounts it has misjudged, and the person on the other end has been told nothing.
The advisory itself lists the behavioral signals it wants providers to watch for, and they are broad. It flags round-the-clock usage without the idle periods a human would produce, new subscriptions that jump immediately to maximum usage rather than ramping up, single accounts accessed from many IP addresses and user agents, and unusual ratios between subscription and API traffic. Each of those describes a plausible distiller. Each also describes plausible legitimate customers: an automated pipeline, a well-funded startup that adopts a tool aggressively on day one, a team sharing a seat, a company with a bursty batch workload.
Why the details matter more than the headline
There are two readings of this advisory that a careful observer can hold at once. The first is that it documents a real and costly problem. Terms-of-service violations at scale, if they are happening as described, transfer the value of expensive research to firms that did not pay for it, and the national-security framing follows from who is alleged to benefit. The second is that the recommended remedy asks private companies to make quiet, unappealable judgments about their own customers, using signals that do not cleanly separate a distiller from a demanding but legitimate user. Both readings can be true. The advisory can correctly describe a problem and still propose a defense whose costs land partly on innocent accounts.
For the companies actually running frontier APIs, the practical questions are narrower and harder than the headline. How confident does a suspicion have to be before answers are altered? Is there any path for a wrongly flagged customer to notice, contest or recover, given that the advisory suggests not telling them? And how does a provider reconcile silent output tampering with the reliability its paying enterprise customers were promised? None of those questions have answers in the advisory, because they are operational choices left to each provider.
What it means for teams that depend on these APIs
For an organization building on top of frontier models rather than defending them, the useful takeaway is not alarm but awareness. The advisory makes explicit something that was always structurally true: when your product depends on a single external model accessed through a single provider, that provider's own risk decisions, including how aggressively it monitors and how it responds to what it monitors, become part of your reliability surface. A pipeline that trips a behavioral heuristic could, under the regime the advisory describes, receive quietly degraded output without any error to catch.
That is one more argument for the same discipline that applies whenever critical infrastructure sits outside your control: keep the application layer able to move. Systems designed to route across providers rather than commit to one, the way Metir AI treats the underlying model as a swappable choice rather than a fixed dependency, reduce how much any single provider's policies, monitoring or incidents can silently shape your results. That does not resolve the policy debate the advisory has opened, and it is not meant to. It is a hedge against concentration, which is a separate and more durable concern than any single advisory.
What to watch next
Three things are worth following. The first is whether any of the named firms respond substantively, since the advisory names them directly and, as of publication, carries no on-record reply. The second is whether major US providers confirm they are adopting the silent-alteration recommendation, decline it, or say nothing, because their choice will set a norm for how the industry treats suspected abuse. The third is whether the behavioral signals the advisory published start showing up in providers' own abuse policies, which would move this from a government recommendation to a de facto standard for how frontier APIs police their traffic. AA26-251A is a short document, but the questions it raises about detection, attribution and quiet remediation are likely to outlast the specific accusations in it.
Sources:
- NSA, CISA, FBI Warn China-Based AI Firms Distill US Frontier Models (Unite.AI, Sept 2026)
- China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (advisory text mirror)
- US accuses Chinese AI firms of distilling American models (Quartz, Sept 9, 2026)
- US Distillation Advisory AA26-251A: What AI Model Buyers Should Do (Digital Applied, Sept 2026)
- US Agencies Accuse Six Chinese AI Firms of Industrial-Scale Distillation (Being Guru, Sept 2026)
Image credits
Header and in-body photograph: aerial view of the National Security Agency headquarters at Fort Meade, Maryland, a US federal government work in the public domain, via Wikimedia Commons.