The United States government has issued its most detailed accusation yet against Chinese artificial intelligence firms, naming six companies it says have been conducting coordinated, industrial-scale attacks to extract capabilities from US frontier AI models.
What Happened
In a joint statement released Tuesday, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) alleged that six Chinese AI firms have been attacking US models since at least late 2024. The accused companies are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI — all major players in China's rapidly growing AI ecosystem.
The agencies claimed these firms "likely" acted with "Chinese government awareness" when extracting capabilities from US models, including variants of Claude, GPT, Gemini, and Grok. Stolen AI capabilities "form the core — not merely a supplement — of China's AI development strategy," the agencies said.
How the Attacks Work
The accused firms employed several sophisticated techniques to drain knowledge from US models:
- Bulk fake accounts: Purchasing tens of thousands of fraudulent API accounts, routing requests through proxy networks to evade geographical restrictions, and executing coordinated queries in the thousands to millions on similar topics over days to months. - Prompt injection and jailbreaking: Crafting prompts that force models to reveal hidden chain-of-thought reasoning. For example, "DeepSeek employed prompts instructing models to imagine and articulate the internal reasoning behind completed responses and write it out step by step." - Synthetic training data generation: Collecting extracted outputs to build synthetic training datasets, allowing Chinese firms to dramatically shorten development timelines and reduce compute costs.
DeepSeek was accused of "extensive malicious distillation" across Claude, Gemini, GPT, and Grok, targeting agentic functions, assistant capabilities, writing optimization, question-and-answer optimization, and chain-of-thought reasoning. Moonshot AI reportedly switched between models from multiple US firms to extract fine-tuning techniques, reinforcement learning, software engineering, and math capabilities.
The Controversial Fix: Secret Model Downgrades
Perhaps the most striking aspect of the statement is the recommended mitigation strategy. The agencies urged US AI firms to:
1. Improve detection of mass distillation campaigns by flagging accounts with anomalous subscription-to-usage ratios and new accounts immediately hitting maximum usage. 2. Subtly degrade responses for suspected accounts — by altering reasoning patterns, adding stylistic inconsistencies, or reducing reasoning depth. 3. Secretly switch suspected accounts to inferior models without informing the users. The agencies explicitly recommended that firms "avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model."
The agencies acknowledged these measures could frustrate legitimate users who get caught up in the policing, potentially receiving shorter responses or degraded capabilities without explanation. OpenAI faced backlash last year for a similar routing issue when its system defaulted to less capable models unless users explicitly prompted for better reasoning.
China Responds
China rejected the accusations. "China's Ministry of Foreign Affairs spokesperson Mao Ning said that US agencies should be working on strengthening AI cooperation with China, 'rather than making groundless accusations,'" NBC News reported. She attributed China's rapid AI progress to "the result of high-level scientific and technological self-reliance."
The accusations come as China's Ministry of Industry and Information Technology released a plan to sharply expand intelligent computing capacity over the next five years, and just ahead of a meeting between US and Chinese leaders on September 24.
Why It Matters
This represents a significant escalation in the US government's engagement with AI intellectual property protection. The recommended mitigations — particularly secret model downgrades — raise fundamental questions about transparency, user trust, and the boundaries of defensive measures in the AI industry. If implemented broadly, these strategies could affect how AI services are delivered globally, not just to suspected adversaries.
