What is AI distillation? The new threat facing western tech giants as US accuses Chinese firms of ‘aggressively’ copying frontier models

The US has accused Chinese companies of stealing AI capabilities via "aggressive, malicious and targeted" distillation at an industrial scale.

Distillation is a technique by which one model is trained on the outputs of a stronger or better model, but it can be abused to extract features and capabilities more quickly and at a lower cost than doing the work from the ground up.

A joint advisory from the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation warns that China is abusing this technical capability to unpick AI models, saying that distillation of US systems is core to the country's AI development strategy.

"While 'distillation' is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models," the advisory noted.

OpenAI accused DeepSeek of model distillation back in January 2025, just weeks after DeepSeek made waves when it arrived with an AI model that cost significantly less to develop.

Anthropic raised the issue in February of this year, accusing three AI labs – all also named in the new American alert, including DeepSeek – of extracting capabilities from Claude via distillation.

Industrial-scale AI distillation

The American agencies said that DeepSeek, Alibaba, and other Chinese AI developers had extracted billions of tokens across millions of queries from frontier AI models, including those from Anthropic, OpenAI, Google and xAI since late 2024.

The advisory suggested that was "likely with Chinese government awareness."

Distillation runs via multiple pathways, including making use of APIs, cloud providers, and third-party aggregators to avoid being detected.

"China-based AI companies achieve cost savings for their industrial-scale distillation campaigns through bulk procurement of the US AI companies’ premium subscriptions shared across teams of developers," the alert explained.

The purpose is to speed up development while reducing costs, the agencies said.

"China-based AI companies that conduct industrial-scale distillation against US AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model," the document noted.

The alert urged US AI companies to fight back by rolling out detection and mitigation systems to spot malicious distillation behavior, disrupt the benefits of these attacks by altering responses, and sharing information across the industry to better spot such campaigns.

China's response

The Chinese commerce ministry denied the allegations, but also countered that the US had "extensively distilled Chinese models," according to a Reuters report.

A spokesperson for the Chinese foreign ministry told the news agency: "We hope the US will earnestly implement the important consensus reached by the leaders of both countries and refrain from making false ​accusations and smearing China."

This isn't the first time the American government has accused China of stealing AI from its own companies, with the issue raised repeatedly earlier this year, but comes ahead of the Chinese president Xi Jinping visiting the US later this month.

Does distillation matter?

One expert said the distillation debate highlights the commodification of AI.

“This isn't about someone copying the smart kids' homework, it's what they chose to copy: coding, software engineering, reasoning, and agentic capabilities," said Cris Thomas, Security Advocate at Semgrep.

"That's why you shouldn't build your security strategy around who has the smartest model this week. Models will get better, cheaper, copied, distilled, and commoditized."

He added: "The interesting question isn't who owns the model, it's what you can make that model do when you give it deep code context, deterministic analysis, and a way to check its own work. The model is increasingly becoming a commodity. Knowing how to turn it into a security tool is not."

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.