For nearly two years, DeepSeek’s $5.6 million number has helped sell one of the most dazzling stories in artificial intelligence. The Chinese company appeared to have built a frontier-level model for a fraction of what American firms were spending. A new federal cybersecurity advisory says the bargain came with a rather large missing bill.
China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary functionalities and capabilities of U.S. frontier AI models. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) (hereafter referred to as the authoring agencies) are releasing this joint Cybersecurity Advisory to alert organizations about these malicious activities and techniques and recommend mitigations to reduce their potential impact. Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024. DeepSeek has conducted organized campaigns since at least 2024 targeting reasoning capabilities, specialized optimizations, and domain-specific functions to train its R1 and V3 models. Alibaba leveraged industrial-scale distillation to improve the company’s Qwen family of AI models. Moonshot AI, MiniMax, Stepfun, and Z.AI also engaged in malicious knowledge distillation of
DeepSeek’s own technical report said its V3 model required 2.788 million Nvidia H800 GPU hours for full training. The figure helped fuel the idea that Chinese engineers had found a vastly cheaper road to the frontier. DeepSeek did achieve real engineering efficiencies, but the new U.S. assessment says the famous cost figure leaves out something crucial.
The NSA, FBI, and Cybersecurity and Infrastructure Security Agency say six China-based AI companies conducted industrial-scale campaigns to extract capabilities from American frontier models.
The agencies named DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. They say the companies obtained billions of tokens through millions of exchanges and requests involving variants of Claude, GPT, Gemini, and Grok since at least late 2024, likely with Chinese government awareness.
From the NSA:
Today, the National Security Agency (NSA), Federal Bureau of Investigation (FBI), and Cybersecurity and Infrastructure Security Agency (CISA) released the Cybersecurity Advisory (CSA), “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies.”
China-based artificial intelligence (AI) companies are engaging in aggressive, industrial-scale distillation activities that systematically extract restricted proprietary functionalities and capabilities of U.S. frontier AI models with the purpose of training their own, according to the report. While distillation is recognized as a legitimate and useful technique in AI research, China-based companies’ use of distillation against U.S. models enables Chinese AI models to continually close the technology gap without expending high research and development costs and resources, including for compute, electricity, and foundational research, required for producing frontier AI models. Advances of Chinese AI models, consequently, enhances its military and cyberattack capabilities that could be used against the U.S. and our Allies.
This CSA provides background on AI knowledge distillation, how to detect if a model is being distilled, the sophisticated tactics, techniques, and procedures (TTPs) being used, and best practices for mitigation.
China-based AI companies deliberately distribute operations across the vast global AI ecosystem, including multiple AI model providers, cloud platforms, and infrastructure to avoid single-point detection. They also attempt to systematically distill the best capabilities and proprietary features of U.S. frontier models to train their China-based AI models. The U.S.-China competition in the frontier AI race has major national security implications since frontier AI models can pose significant risks to critical infrastructure, military, economic, and technology domains.
This activity impacts the public sector, industry, and foreign partner systems, as well as National Security Systems throughout the Defense Industrial Base and Department of War, either actively leveraging AI or adopting AI software or tools (such as large and small language models).
Collaboration across the broader AI ecosystem, including among cloud providers, application programming interfaces aggregators, and infrastructure providers, can enable coordinated defense against industrial-scale AI knowledge distillation campaigns. Cybersecurity analysts and other network defenders in the AI ecosystem are advised to use the guidance to detect any related activity and implement the listed mitigations to prevent these TTPs from being used successfully.
Distillation itself is legitimate. Developers can train a smaller model using outputs from a stronger one, saving time and computing power. The federal advisory says the Chinese campaigns crossed into something far different: fraudulent accounts, gray-market proxy services called “transfer stations,” regional restriction evasion, jailbreak prompts, metadata sanitization, and coordinated routing designed to make large-scale extraction harder to detect.
DeepSeek gets special attention. The agencies say it ran an organized campaign against U.S. frontier models while developing R1 and V3, targeting reasoning, legal specialization, writing, agent functions, and other capabilities.
Then comes the sentence that punctures the bargain-basement legend: the government calls DeepSeek’s publicly quoted $5.6 million training cost “misleading” because it excludes the true cost of data allegedly acquired through extensive malicious distillation.
Private-sector evidence had already pointed in the same direction. Anthropic said in February that DeepSeek, Moonshot AI, and MiniMax generated over 16 million exchanges with Claude through about 24,000 fraudulent accounts. Anthropic said those operations targeted reasoning, coding, tool use, computer vision, and other valuable capabilities while violating access restrictions and terms of service.
None of this means Chinese AI companies lack talented engineers. Nor does it mean every improvement in a Chinese model came from an American system. The federal allegation is more specific and more damaging: large-scale extraction wasn’t merely incidental to development.
The advisory says it became a critical part of how these companies tried to close the gap.
American companies have poured enormous sums into chips, electricity, researchers, training, safety work, and foundational research. If the agencies are right, Chinese competitors found ways to harvest some of the resulting capabilities without carrying the same development burden.
The consequences are bigger than who builds the better chatbot. The government warns that stronger Chinese frontier models can improve military research and cyberattack capabilities aimed at the United States and its allies.
DeepSeek’s engineering achievements may still be genuine. Its $5.6 million miracle, however, now comes with a federal footnote large enough to swallow the headline.
China’s AI race is becoming a national-security fight over technology Americans spent years and billions developing. PJ Media VIP gives us room to follow the stories others leave behind. Save 60% with promo code FIGHT.
