For years, the technological competition between the United States and China over artificial intelligence has been framed primarily around semiconductors: which GPUs can be exported, who controls lithography machines, how much compute capacity Beijing manages to purchase, and how quickly the Chinese industry can build domestic alternatives. On September 8, Washington made a second front explicit: APIs.
NSA, FBI, and CISA published a joint advisory accusing six Chinese companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — of conducting, since at least late 2024, high-volume “knowledge distillation” campaigns against U.S. frontier models. According to the agencies, the companies allegedly extracted billions of tokens across millions of requests, using outputs from models such as Claude, GPT, Gemini, and Grok to accelerate the development of their own capabilities.
This is an allegation from the U.S. government, not a judicial ruling. The named companies should therefore not be treated as though legal liability has already been established. But the technical scope of the advisory is notable because it details an issue that AI labs have been debating for some time: a model accessible via an API does not expose its weights, but it can still reveal an enormous amount of its behavior to anyone querying it enough times with the right strategy.
What “distilling” a model really means
Distillation did not originate as a malicious technique. It is a common method in machine learning: a larger, more expensive model, often called a teacher, generates outputs used to train a smaller model, the student. The goal can be to reduce costs, latency, and power consumption while retaining a significant portion of the original system's capabilities.
The problem changes when the teacher belongs to another company, its use to train a competitor is prohibited by the terms of service, and the queries are designed to systematically extract proprietary capabilities. This is the distinction the U.S. agencies emphasize.
According to the advisory, the campaigns did not merely consist of a few thousand experimental prompts, but rather an organized, industrial-scale operation. The agencies point to billions of tokens and millions of exchanges, with queries targeting reasoning, coding, agentic capabilities, writing, dataset optimization, and other specialized tasks.
In practice, if a lab has a very capable model but cannot view a competitor's weights, it can still attempt to build a massive collection of input-output examples. That collection then becomes training material.
APIs become a strategic surface
For AI companies, APIs have so far primarily served as a commercial channel: the way developers and enterprises pay to access a model. But the advisory highlights their second role: they are also a security perimeter.
Every legitimate request inevitably reveals something about the model's behavior. If an actor manages to multiply those requests and systematically vary the tasks, they can build an increasingly precise map of the system's capabilities. The line between normal heavy usage and an extraction campaign is not always obvious.
U.S. agencies also allege that the cited operators used various routes to bypass controls and restrictions, including native APIs, remote cloud providers, third-party aggregators, and a proxy network described in the advisory as “transfer stations”. The objective was reportedly to conceal the identity or origin of the requests and distribute traffic across multiple accounts and intermediaries.
If this technique becomes widespread, labs will need to treat the protection of model capabilities much like defense against fraud and scraping: not just authentication, but behavioral analysis, cross-account correlation, dynamic rate limits, and threat indicator sharing among providers.
Distillation complicates the meaning of “frontier”
A frontier model demands massive investments in research, data, infrastructure, and compute. If part of its capabilities can be transferred more rapidly to competing systems via large volumes of synthetic output, the first-mover time advantage may diminish.
This lies at the strategic core of the American allegations. The NSA, FBI, and CISA argue that these campaigns allow Chinese companies to bridge the technological gap while bypassing a portion of the research and compute costs required to build certain capabilities from scratch.
Yet the issue is not black and white. The entire AI industry relies on synthetic data, outputs from other models, and teacher-student learning techniques. Many open-source models are explicitly distilled. The controversial line emerges from the combination of unauthorized access, breach of contractual terms, circumvention of controls, and the sheer scale of the activity.
This makes it difficult to automatically apply traditional categories such as “theft.” Reuters described the advisory as an allegation of malicious copying of AI technology, but the legal challenge will hinge on contracts, access methods, and applicable laws. The technique itself is not illegal.
Why the DeepSeek case had already opened the debate
The debate over distillation had already flared up when DeepSeek showcased models capable of competing with far more expensive Western systems. Since then, US labs have tightened controls over the use of their APIs for generating training datasets.
The 2026 advisory marks a leap forward because it shifts the topic from a commercial dispute to national security. It is no longer just a company claiming a competitor violated its terms of service: three federal agencies are now describing the phenomenon as a coordinated campaign on an industrial scale.
The agencies even go so far as to state that the activities took place “likely with Chinese government awareness.” This is a significant yet measured phrasing: it denotes an intelligence assessment rather than public evidence of a direct order from the Chinese government.
An arms race in anti-distillation systems
Countermeasures could change how we interact with APIs. To detect a distillation campaign, a provider must determine whether numerous seemingly routine requests are part of a unified pattern. This drives an increase in telemetry gathering, fingerprinting, account analytics, and traffic origin monitoring.
This is where a trade-off emerges. The more a service seeks to prevent systematic extraction, the more aggressive it may become in profiling users. Researchers, startups, or major clients making numerous legitimate requests could be mistaken for distillers. Protecting proprietary capabilities can thus clash with openness, privacy, and ease of use.
Techniques designed to make extracted datasets less useful are also likely to emerge: controlled variations in responses, statistical watermarks, query pattern detection systems, and specific limits for particularly informative task categories. But every defense will come at the cost of quality or friction.
AI geopolitics is no longer just about hardware
The United States has sought to slow Chinese access to advanced chips because compute is a relatively controllable physical resource: GPUs, interconnects, manufacturing equipment, and data centers can be subjected to licensing and export controls.
A model's knowledge is far harder to contain. Once a system is made available on the internet, every output potentially becomes a small piece of information about what it has learned. Crossing a border does not require physically moving a chip: an API call is enough.
This does not render semiconductor controls useless. It means that AI industrial policy will need to address hardware and model access simultaneously. Restricting compute while leaving the door wide open to extracting capabilities from cutting-edge models can reduce the effectiveness of the former.
The risk of a more closed AI network
The simplest response would be to drastically restrict access. But that would also be a loss for the American ecosystem, which built part of its strength precisely on the global distribution of APIs and developer tools.
If every foreign customer is viewed as a potential distillation vector, AI risks fragmenting into national blocs. Models could be distributed with differing capabilities depending on geography, along with more aggressive limits and stricter identity verification.
The paradox is obvious: the United States wants to protect its lead, but that lead also depends on businesses and developers around the world using its models. A system that is too closed could push users and markets toward alternatives.
The real question is how much value can be extracted from the output
Beyond the diplomatic clash, the advisory raises a technical question fundamental to the entire industry: how much of a proprietary model can be reconstructed by observing enough of its responses?
If the answer is "a lot," closed weights are not enough to protect a competitive advantage. If, however, distillation mostly replicates surface-level behavior without transferring deeper capabilities, the risk may be far more limited than the political rhetoric suggests.
The reality is likely somewhere in the middle and depends on the specific capability. Well-defined, repeatable tasks may be easier to distill; emergent capabilities, robustness, and generalization may require vastly more work.
This is why the tech war over APIs has only just begun. The most advanced models must be accessible enough to generate revenue and become industry standards, yet not so queryable that they inadvertently turn into teachers for their own competitors.
