US Advisory Names Six Chinese AI Firms, Then Tells Providers to Quietly Degrade Their Answers
NSA, CISA and the FBI published advisory AA26-251A on September 8, naming DeepSeek, Alibaba and four others. The recommended mitigation is not an account ban but an unannounced drop in answer quality, and the detection signatures do not separate a distillation campaign from a production agent running around the clock.
- NSA, CISA and the FBI named six Chinese AI firms over industrial-scale distillation.
- The recommended response is not a ban but silently downgrading the answers they get.
- All four detection signatures also match a well-run production agent fleet.
The National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI issued joint cybersecurity advisory AA26-251A on September 8, 2026. It alleges that DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have been pulling "billions of tokens across millions of exchanges and requests" out of Claude, GPT, Gemini, and Grok since late 2024 to train their own models.
That much was expected. Anthropic published a report naming DeepSeek, Moonshot AI, and MiniMax back in February 2026, and every major provider already bans training a competing model on its outputs in the API terms of service. What is new here is the mitigation a US government agency is recommending. It does not say to cut off suspect accounts. It says not to tell them, and to lower the quality of what they get.
What distillation is, and what the advisory objects to
Distillation means throwing a large volume of questions at a strong model, collecting the answers, and using them to teach a smaller one. It is closer to mass-photocopying a top student's exam paper and drilling another student on it. The advisory itself concedes up front that distillation is "recognized as a legitimate and useful technique in AI research." What it objects to is the scale and the evasion.
Here is what the document alleges company by company.
- DeepSeek: distilled from 12 models across the Claude, Gemini, GPT, and Grok families between late 2024 and mid-2025 to train R1 and V3. The list names Claude Opus 4.1, Gemini 2.5 Pro Preview, GPT-5, and Grok 4 explicitly
- Alibaba: industrial-scale distillation used to improve the Qwen family
- Moonshot AI: targeting Claude and the GPT-5 family from at least mid-2025
- MiniMax, StepFun, Z.AI: between late 2025 and early 2026
The advisory flatly calls DeepSeek's published $5.6 million training cost a "misleading" figure, on the grounds that it excludes the real cost of the data obtained through malicious distillation. It does not publish the underlying data behind that judgment.
The evasion route it identifies is grey-market API proxies the document calls "transfer stations," resellers that pass frontier-model access along at a fraction of list price. Citing industry reporting, the advisory says these proxy networks run tens of thousands of fraudulent accounts at once and interleave distillation traffic with legitimate customer requests. The StepFun entry adds that employees ran multiple sessions in parallel and spread the load so no single quota ran dry.
Do not notify, and lower the answer quality
The advisory gives providers three immediate actions: detect anomalous accounts and behavior, modify responses on suspect traffic, and cross-reference activity with each other. The second one is the one worth reading twice.
The stated method is to answer distillation requests with a "less sophisticated, downgraded model." The implementation guidance spells out how.
When malicious distillation campaigns are suspected, vary the degree of response modification across requests to complicate response quality assessment, while ensuring subtle variations do not trigger obvious alerts. Reducing reasoning depth, presenting correct information with different reasoning, or introducing stylistic inconsistency can degrade training utility while evading detection.
Do not notify users from China-based AI companies suspected of distillation campaigns that they have been switched to an inferior model. [...] Instead, modify responses without notification to confirmed users.
Read together, the design intent is clear: the point is to keep the other side from being able to measure that quality dropped at all. The same section adds that AI safety researchers and third-party evaluators should be told about model changes. Ordinary API customers are not on that list.
Running the detection signatures against your own account
The advisory defines four new TTPs and attaches detection signatures to each. Every one of them is behavioral. They watch usage patterns rather than forensic markers like hashes or IP ranges. And those patterns overlap with a production agent fleet that is working exactly as designed.
| Advisory detection signature | Normal operation with the same shape |
|---|---|
| Sustained 24-hour usage with no human-like variation or idle periods | CI pipelines that run overnight, batch ticket triage on a schedule |
| New subscriptions hitting maximum usage immediately, with no ramp-up | A team migrating from another provider and carrying its existing load over on day one |
| Accounts shared across multiple IPs and user agents | Workers in several regions plus developer laptops all using one org key |
| Usage optimized for cache maximization rather than task diversity | Cost tuning that pins a shared prefix to raise the cache hit rate |
| Coordinated routing shifts in response to pricing or rate changes | A model router that switches providers on unit price |
| Unusually high immediate hit rates from newly created accounts | A new workspace brought up with the company's existing prompt templates |
The fourth row stings the most. Squeezing cost out of a prefix cache is an optimization the providers themselves recommend. devlery has covered a coding agent that reached a 99.82% cache hit rate, and also a single PR that cost $41 because the same file was billed again across 470 turns. Skip the cache and you burn money. Use it and you match a signature.
The advisory contains no false-positive caveat, not one line. It offers no criterion for separating legitimate research and enterprise usage from malicious distillation. It says to modify responses only in high-confidence cases and only for confirmed users, yet the only instrument it supplies for reaching that confidence is the signature list above. There is no mechanism described for registering your own account as an exception in advance.
What this changes for a developer outside the US
Three things are worth separating.
| Item | Detail |
|---|---|
| Legal weight | This is an advisory, not a regulation. No provider is obliged to follow it, in the US or anywhere else |
| Regional reach | The advisory carries no regional exception clause. Anthropic, OpenAI, and Google serve APAC customers through the same accounts and the same abuse-detection stack, so a provider that switches this policy on applies it to an account in Singapore or Sydney on the same terms as one in San Francisco |
| Using Chinese models | The advisory does not tell anyone to stop using DeepSeek or Qwen. It contains no recommendations for organizations that merely use AI |
That last row is the most commonly misread. The document is addressed to model providers, not to their customers. Whether you self-host GLM-5.3-Flash under MIT or run the K2 Horizon open-weight family, the advisory has nothing to say about it. Government moves against the DeepSeek app are a separate matter with a separate rationale: Italy's data protection authority blocked it nationwide in January 2025, and Australia banned it from government devices in February 2025, both over data handling rather than distillation.
The side that could change quietly is the accounts using American models. If providers adopt this advisory, they gain one more option beyond terminating an account for a terms violation: blurring the answers instead. Anthropic already bans accounts it suspects of large-scale distillation, while stating that platform enforcement alone has limits once an adversary splits accounts and changes tactics. Filling that gap is what a federal agency is now recommending unannounced quality degradation for.
Why to build a regression set now
Start by opening the TTP list and counting how many rows your current API keys match. If you have overnight batches, a pinned cache prefix, and a router that switches on unit price, that is already three. Matching does not mean anything will happen to your account. It is still different from not knowing whether you match.
If you do match rows, build a regression set of 20 to 30 fixed prompts, run the same inputs weekly, and record output length and reasoning step counts. Because the modification the advisory recommends is deliberately varied per request and tuned not to trip alerts, proving a quality drop after the fact without a baseline is effectively impossible. The practical change this document leaves developers is not the six company names. It is that there is now a reason to instrument your own answer quality.