Today, the National Security Agency (NSA), in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), released a joint Cybersecurity Advisory China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies to raise awareness of knowledge distillation campaigns targeting U.S. frontier artificial intelligence (AI) companies.
Knowledge distillation is a machine learning technique that involves training a less capable AI model on the outputs of a larger, more capable one. While it’s a valid training method, it can be misused to attempt to acquire capabilities from competitors in less time and with less cost than developing them legitimately.
China-based AI companies have conducted systematic efforts to extract proprietary functions and capabilities from U.S. AI models since at least late 2024, exploiting multiple access pathways—including native application programming interfaces (APIs), cloud providers, third-party aggregators, shared premium subscriptions, and proxy networks, to evade detection, bypass geographic restrictions, and obscure activity.
The advisory details observed tactics, techniques, and procedures (TTPs) associated with these industrial-scale distillation campaigns, including premium subscription tier exploitation, centralized request routing infrastructure, automated request metadata sanitization, and systematic quota and cost optimization. Immediate actions for U.S. AI companies entail:
- Implement comprehensive detection and mitigation: Detect anomalous and malicious prompts, accounts, networks and behaviors.
- Deploy targeted response changes: Subtly alter responses for suspected malicious distillation attempts.
- Establish cross-organization intelligence sharing: Correlate activity across model providers, cloud platforms and API aggregators.
The full advisory offers more TTPs and recommended actions.
