Washington's Fix for AI Theft: Quietly Dumb Down Answers

Looking at the draft against the source, I’ll check names, numbers, headings, and glossary terms.

Page 13 of the Advisory Spells Out the Defense Playbook

On September 8, the US National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI) issued a joint cybersecurity advisory. It says six Chinese AI companies have been running industrial-scale knowledge distillation¹ campaigns against US frontier models. The document is numbered AA26-251A, and the full text is publicly available with no distribution restrictions.

The story itself isn’t new. It has circulated in tech communities for a while; in April, Elon Musk admitted in court that xAI had used OpenAI’s models for distillation, and in July, the Treasury Secretary raised the possibility of sanctions. But this is the first time three intelligence and security agencies have put their names on a formal document naming specific companies and listing specific models.

Coverage back home has focused almost entirely on the list of companies and the scale involved. But this document isn’t an indictment—it’s a defense playbook. More than half of it is devoted to what US AI companies should do, and the second recommendation reads like this: for requests suspected of being distillation attempts, subtly alter the response. Shorten the depth of reasoning, present the correct conclusion through different logic, or vary the writing style—anything to degrade the response’s value as training data. The advisory even cites, as one example, responding with a “less sophisticated, downgraded model.”

And there’s one more sentence attached. Don’t tell the affected user that the model has been downgraded. The reasoning: telling them would let them refine their evasion techniques and figure out when to expect training to resume. Instead, it separately instructs that AI safety researchers and third-party evaluators should be notified of the change.

Explicitly specifying who gets notified means everyone else, by definition, doesn’t. Paying corporate customers around the world using the API are that “everyone else.”

---

The Six Companies and Their Model List

Let’s first lay out what the document actually claims.

The advisory names six Chinese companies: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. Since late 2024, they extracted billions of tokens through millions of requests across multiple versions of Claude, GPT, Gemini, and Grok, and the advisory assesses it’s highly likely the Chinese government was aware of this.

According to the advisory, DeepSeek targeted 14 models in total to train R1 and V3—Claude Sonnet 3.7, 4, and 4.5, Claude Opus 4.1, Gemini 2.5 Pro and Flash, the GPT-4 family, GPT-5, and Grok 3 Mini and 4. What was extracted is also specified in detail: things like legal-domain optimization, API rule-based tasks, writing assisted by chain-of-thought² drafts, Q&A optimization, and agentic capabilities. The advisory points out that DeepSeek’s publicly disclosed training cost of $5,600,000 is misleading—it excludes the real cost of the data obtained through distillation.

For Moonshot AI, the table alone lists 17 US models. It states that Kimi K3 used data from Anthropic’s Claude 5, and Kimi K2 used GPT-4o data.

The MiniMax section has a somewhat different character. To boost the M2 model’s chain-of-thought reasoning and code-review capabilities, it used Claude Code, Claude Sonnet 4, Opus 4.5, and Gemini 3 Pro, among others—and two more things are noted here. One: Claude Code was used directly for internal development work. Two: they attempted, via prompt injection, to make Claude Code believe it was itself a MiniMax product. There’s also an observation that whenever a new Claude model launched, requests shifted over to it within 24 hours.

The access routes are also laid out: official APIs, cloud providers, third-party aggregators that automatically strip user information, and gray-market proxies known as “transfer stations.” These resell access to frontier models for a fraction of list price. StepFun, it says, built pools of per-employee accounts to run concurrent sessions and spread the load so quotas wouldn’t run dry.

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companicisa.gov

From Contract Violation to Threat Taxonomy

The quietest but biggest shift in this document is one of form.

Until now, distillation was a terms-of-service issue — a matter of blocking accounts or pursuing civil claims because someone violated a service’s usage terms. But this advisory maps distillation activity onto MITRE ATLAS³. It assigns numbers by stage of the attacker lifecycle: infrastructure acquisition, model access, execution and defense evasion, reconnaissance, collection, exfiltration, and impact. This is the exact grammar used to describe state-sponsored hacking.

Among the techniques catalogued here are prompt injection and jailbreaking. A flagship example is a prompt designed to get a model to spill its hidden chain of thought. What red-team researchers and prompt engineers have routinely done up to now has, under certain conditions, been assigned an attack-technique number.

The advisory concludes that individual companies can’t handle this alone, so it adds a third recommendation: model providers, cloud platforms, and API aggregators should cross-reference activity data with one another. And it explicitly names “allied nations” within the scope of this coordination. This is exactly why this sentence matters for readers in Korea. If any kind of request comes through, call logs held by domestic cloud providers and resellers could become material for cross-referencing.

Running the Detection Signals Against a Korean Office

This is the crucial part. The advisory lays out indicators for spotting distillation accounts, and every one of them is behavioral — none of them are about nationality or identity. Lay the document’s indicators side by side with the daily operations of a domestic team, and here’s what you get.

Detection signal from the advisory	Equivalent situation in a Korean workplace
Single account accessed from multiple IPs/User-Agents	Team-shared accounts, mixed remote/office work
24-hour continuous calls with no human idle time	Overnight batch pipelines, cron jobs
New subscription jumps straight to max usage	Full-throttle proof-of-concept in the first week of adoption
Abnormal ratio of API usage to seat count	Structure with few seats but heavy server-side calls
Routed through third-party aggregators/relays	Payment workarounds via routers or resellers
Optimized for cache hit rate over task diversity	Prompt caching — a vendor-recommended cost-saving technique
Route-switching based on price/rate changes	Multi-provider cost-optimization routing
Large volumes of repeated calls with similar prompts	Running eval sets, bulk classification, synthetic data generation

Of the eight, six are standard practice for domestic dev teams trying to save money. The remaining two arise naturally from payment structures or work arrangements.

Let me clear up one misunderstanding here. This table doesn’t mean domestic companies are doing distillation. It means behavior-only detection can’t tell purposes apart. Using Claude Sonnet to classify 100,000 internal documents and using the same model to extract training data look nearly identical in the call logs. You can’t tell them apart without reading the prompts — and reading the prompts creates a whole different problem.

One thing remains unpublished. Whether domestic teams building their own models are using large commercial models’ outputs as training data — and if so, to what extent — there’s no confirmed information on this. The consortiums participating in the government’s sovereign AI foundation model project released their models starting late last month, but the data procurement pipeline wasn’t disclosed in detail. That seems like a question worth asking.

What Silent Degradation Actually Produces

Let me go back to the second recommendation in the advisory.

When a company buys an API, it’s actually buying two things: a model of a certain performance level, and the predictability that this performance will hold steady. Without the latter, there’s no way to verify the former. Yet the advisory recommended lowering response quality for suspect accounts without notification—and went so far as to suggest varying the change on every request, so that the other side can’t detect the degradation through quality evaluation.

To be fair, the advisory didn’t recommend this lightly. In explaining differential privacy⁴, it clearly stated that noise and utility trade off against each other, and it noted that theoretical setups often fail to predict actual accuracy loss in practice. It attached the caveat that careful tuning and empirical auditing are necessary. It also said that only when confidence rises through cross-referencing multiple sources can degradation be justified without harming legitimate users.

The problem is that the party who sets the confidence threshold is the model provider itself. The customer has no way to notice when a false positive occurs. There’s no signal to distinguish whether a slightly shallower response came from a model update, a difference in the prompt wording, or a degradation measure. When a pipeline that worked fine yesterday produces subtly worse output today, we used to suspect our own prompt. Now there’s one more suspect on the list—but no new tool to check it with.

This isn’t a compliance problem. It’s an observability problem. And observability problems have ways of being addressed.

Oswarld’s Lens

First, a disclosure. Until recently, I worked as the Korean market partner for MiniMax, one of the six companies named in this advisory. My conclusion is that I should treat what’s written in the advisory with exactly the same weight as I would for the other five. The passage describing how Claude Code was made to believe it was a MiniMax product is one of the heaviest technical claims in this document, and cutting it because of my past relationship would shortchange readers. With that disclosed, let me give you my read. I’m a GTM partner, not a technical one, so I genuinely don’t know the details of the training process. But this incident carries real weight for Korean companies too. Put simply, this is functionally a plan to make AI quietly dumb itself down whenever it suspects it’s being used suspiciously from another country.

The addressee field of this advisory lists American AI companies, but the entities whose terms actually change are every one of those companies’ customers. The US government didn’t issue sanctions against Chinese firms. Instead, it asked American AI companies to monitor and screen their own customers. It’s a structure that pushes regulation down into the supply chain, and in structures like this, cost always flows downward. Account screening gets tighter, requests to explain usage patterns increase, and the status of traffic routed through aggregators becomes ambiguous.

So I think the practical task here isn’t compliance — it’s instrumentation. Let me suggest three things.

First, build your own regression test set. It’s enough to lock in 30-50 prompts you actually use in your work, define quality standards for the expected output, and run them periodically. This isn’t about catching degradation — it’s about catching change. Whether it’s a model update or an enforcement action, you need your own record before you can even have that conversation.

Second, simplify your routing. If you’re mixing multiple resellers and routers to save on price, now is the time to weigh those savings against the uncertainty around account status — because the advisory specifically names aggregators and proxies as evasion vectors.

Third, account hygiene. Splitting shared team accounts into individually authenticated ones, and separating server calls from human accounts, will by itself eliminate two or three of the flagged indicators. Honestly, this third point is the pattern I see most often — surprisingly many companies are using various AI tools through shared accounts. In most cases, that’s actually a violation of the terms of service.Let me be clear about the limits here too. This is a recommendation, not an obligation. There’s no confirmation of which companies, if any, are actually applying response degradation, and while Anthropic and Google have previously published material related to distillation detection, neither has stated that they’ve implemented degradation measures. All that’s certain at this point is that a formal recommendation to do so exists, in writing.

Closing

The names of six companies and the list of hundreds of models are the most eye-catching part of this piece, but they’re not what actually changes your day-to-day work. What changes your day-to-day work is the design choice that detection looks at behavior, not identity, and the choice that the response is silent degradation, not a blocked request with a notice. Put these two together, and normal users end up caught in the same net — with no way of knowing they’re in it.

That’s not to say you should cut off your API access. It’s just that one assumption we’ve taken for granted has quietly weakened, so it’s worth building your own way to check that assumption yourself. Instrumentation, after all, is what you build precisely when trust starts to wobble.

---

💬 Reader, have you noticed lately that the same prompt gives you shallower answers than before? Let me know in the comments what kind of task it was.

📨 If your team shares a single account for API access, send this piece to that colleague.

Looking good—no Hangul, numbers match, structure matches. No edits needed.

References & Further Reading

Primary sources

• NSA, CISA, FBI, “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies (AA26-251A)”, September 8, 2026. ··· This is the source for every quote and table in this piece. The full 18-page document is public, and the detection indicators and mitigations on pages 11–14 matter most for practitioners.
• CISA, “CISA, NSA and FBI Warn of China-Based AI Companies Targeting US AI Models”, September 8, 2026. ··· This is the official press release accompanying the advisory. It summarizes the three immediate actions recommended.

Background

• CyberScoop, “Feds accuse China of ‘systematic’ distillation of U.S. AI models”, September 8, 2026. ··· This piece situates the advisory in context, including the similar claims made by the White House Office of Science and Technology Policy back in June.

Related past issues

• Musk in Court: “Everyone Does It” (Issue 93)
• Why Did Jensen Huang Praise a Chinese Model? (Issue 158)
• The Legal AI OpenAI Backed Was Secretly a Chinese Model (Issue 208)

Publishing Notes

Key Visual Prompt

The author is Oswarld (Kwangseob Ahn). Current roles: Adjunct Professor at Sejong University, Strategy Consultant at INLEVEL9. Career, research, books, and recent work are kept current on the About page. Latest · July 2026: HEMA-2: A Consolidation-Aware Tri-Memory Architecture with Multi-Channel Scheduling for Lifelong Conversational AI.

📝 Glossary

Footnotes

1. Knowledge Distillation: A technique for training a smaller model using a larger, higher-performing model’s outputs as ground truth. It’s a legitimate research method, but harvesting another company’s model outputs at scale raises terms-of-service and intellectual property problems. ↩

2. Chain of Thought (CoT): The step-by-step reasoning process a model works through before producing an answer. American frontier models generally don’t expose this process directly to users. ↩

3. MITRE ATLAS: A public framework that categorizes attack techniques targeting AI systems, step by step. Think of it as the AI-focused counterpart to ATT&CK, the well-known cyberattack taxonomy. ↩

4. Differential Privacy: A technique that mixes calculated noise into outputs so individual data points can’t be traced back. More noise means stronger protection but lower accuracy. ↩