The joint advisory alleged that Chinese AI firms routed distillation requests through native APIs, remote cloud providers, and third-party aggregators that automatically obfuscate user metadata to avoid detection

Overview Debates Related claims Topics Sources

Distillation is legitimate competition, not intellectual property theft

AI model distillation from competitor outputs constitutes intellectual property theft

The joint advisory stated that the distillation campaigns were conducted "likely with Chinese government awareness," though it did not claim that Chinese intelligence played a direct role

In early 2026, OpenAI stated that DeepSeek had inappropriately based its model on ChatGPT by using OpenAI's data

The joint advisory accused DeepSeek of running an organized campaign since late 2024 to feed synthetic training data into its R1 and V3 models, calling DeepSeek's widely cited $5.6 million training figure misleading because it excludes the cost of distilled data

The joint advisory recommended that U.S. model providers monitor for anomalous prompts, usage spikes, and immediate maximum usage from new accounts to detect distillation campaigns

The FBI, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency issued a joint advisory on September 8, 2026, accusing six China-based AI companies of running industrial-scale campaigns to systematically extract proprietary features from leading U.S. models

The joint advisory named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI as the six Chinese firms conducting the systematic distillation campaigns

The joint advisory alleged that the Chinese companies targeted U.S. frontier models including Anthropic's Claude, OpenAI's GPT, Google's Gemini, and xAI's Grok, with activity dating back to at least late 2024

The Chinese government has previously responded to U.S. intellectual property allegations by accusing U.S. companies of distilling Chinese models and issuing veiled threats of retaliation against potential U.S. bans

The joint advisory recommended that U.S. companies subtly alter or degrade responses to suspected malicious queries to reduce the payoff for companies conducting industrial-scale distillation

The joint advisory stated that Chinese AI firms used a gray market of proxies known as "transfer stations" to bypass geographic restrictions, breach terms of use, and evade safeguards

In February 2026, Anthropic accused DeepSeek, Moonshot AI, and MiniMax of creating approximately 24,000 fraudulent accounts and sending over 16 million prompts to its Claude model

AI companies should be allowed to distill competitors' models