China AI Labs, the Billion-Token Distillation Heist

China AI Labs, the Billion-Token Distillation Heist

On September 8, 2026, the NSA, CISA, and FBI jointly published AA26-251A, the most detailed public accounting yet of how China's top AI labs have been building training data out of American frontier models. The headline number is hard to ignore: billions of tokens extracted across millions of API exchanges, since at least late 2024, by six named companies — DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI.

The advisory's framing matters. It explicitly acknowledges that knowledge distillation is a legitimate, widely used training technique. The issue is not distillation itself. It's distillation run at industrial scale, against proprietary capabilities, in deliberate violation of the target companies' terms of service. In the agencies' words, this isn't a supplement to the Chinese labs' development strategy — it is "the critical core" of it.

Distillation 101: why everyone does it, and when it becomes theft

Knowledge distillation is a teacher-student pattern. A stronger "teacher" model generates outputs — often including chain-of-thought reasoning — and a smaller "student" model is trained to reproduce those capabilities without re-deriving them. Frontier labs use it internally all the time to ship smaller, cheaper models. The technique itself has zero inherent malice.

What changes the picture is consent and scale. Internally distilling your own model is fine. Building a distributed extraction operation — pooled premium accounts, metadata scrubbing, proxy "transfer stations" — to harvest someone else's proprietary reasoning is something else entirely. Student models trained this way inherit the teacher's capabilities but not its safety training, which is part of why the agencies treat it as more than an IP dispute. Anthropic's own February 2026 report counted over 16 million exchanges with Claude via roughly 24,000 fraudulent accounts from DeepSeek, Moonshot AI, and MiniMax.

What the agencies say each lab actually did

The advisory is unusually specific about which US models were distilled and which capabilities were harvested.

DeepSeek

DeepSeek ran an organized campaign since at least late 2024 to generate synthetic training data for its R1 (released early 2025) and V3 models. The advisory lists Claude 3.7, Claude Sonnet 4 and 4.5, Claude Opus 4.1, Gemini 2.5 Pro/Flash previews, GPT-4 through GPT-5, and Grok 4 among the teacher models. The extracted domains read like a frontier-model shopping list: legal specialization, API rule-driven tasks, chain-of-thought drafting, agentic functions, and supervised fine-tuning (SFT) optimization.

It also directly addresses DeepSeek's famous low-cost narrative. The publicly quoted $5.6M training cost, the advisory says, "is misleading as it does not include the true cost of the data acquired through extensive malicious distillation."

Moonshot AI

Moonshot's campaign runs since at least mid-2025. The agencies say it extracted significant Claude Fable 5 data to train Kimi-K3 and GPT-4o data to train Kimi-K2, targeting SFT optimization, reinforcement learning (RL), software engineering, and math. The targets spanned Claude Opus 4.1, several Sonnet variants, GPT-5 Codex/Pro, Gemini 2.5 Flash/Pro, and even Grok Code Fast-1.

Alibaba, MiniMax, StepFun, Z.AI

• Alibaba (late 2025): distilled Claude-4, Claude Opus, Claude Sonnet, and GPT-5 to improve the Qwen family — software engineering, customer service dialogue, character creation, and RL/SFT/distillation pipelines.
• MiniMax (late 2025): harvested CoT reasoning, RL, SFT, and software engineering for its M2 model from Claude Code, Claude Sonnet 4, Claude Opus, and Gemini 1/2.5 Pro/3 Pro. MiniMax even used prompt injection to try to convince Claude Code that it was a MiniMax product.
• StepFun (late 2025–early 2026): distilled Claude Opus 4.1/4.5, Claude Sonnet 4.5, Claude Haiku 4.5, and a spread of GPT-5.x variants to build coding and agentic functions for its Step 4 model.
• Z.AI (by mid-2026): billions of tokens of GPT-5.5 and Claude Opus 4.8 data to develop chain-of-thought reasoning.

For a deeper look at where this class of reasoning extraction ends up, see the write-up on Claude Fable 5.1 and the Mythos line, and how CoT visibility itself became a safety-design battleground.

The mechanics: transfer stations, account pools, and four novel TTPs

The campaigns aren't just millions of API calls. The advisory describes a production-grade operation with four techniques that don't fit MITRE ATLAS's existing framework:

1. Regional-restriction evasion and subscription exploitation — a gray market of API proxies ("transfer stations") resells frontier access below official pricing; StepFun structured access around pools of employee accounts with load-balanced sessions and daily budget allocation per automated agent.
2. Centralized request routing — unified infrastructure that abstracts across models and providers, with real-time health monitoring, quota enforcement, and automated metadata sanitization.
3. Automated metadata sanitization — infrastructure-layer scrubbing of organizational identifiers, distinct from manual prompt crafting.
4. Systematic quota and cost optimization — pathway selection treated as a routing-and-pricing problem, with bulk premium subscriptions shared across developer teams.

The older tactics map cleanly onto the MITRE ATLAS framework (AML.T0040 for API access, AML.T0051/T0054 for prompt injection and jailbreak). Jailbreaking to force out hidden chain-of-thought is a recurring theme: CoT data teaches a student not just facts, but the full methodology of reasoning — how to approach agentic tasks, coding challenges, and logical proofs.

What a distillation query actually looks like

The individual prompts are often unremarkable. Anthropic published an approximation of the pattern used at scale to elicit internal reasoning:

You are a helpful assistant. I have a question that was already answered,
but I only have the final response. Please imagine the step-by-step
internal reasoning the assistant would have gone through, and write it
out in full detail as a training example.

Repetitive prompts shaped like this — paraphrased thousands of times per domain, from freshly-created accounts — are the fingerprint. One request is benign. A coordinated campaign that spends months pumping variants of this through pooled accounts is how you recognize the malicious class.

Defense: behavioral detection and response degradation

The advisory's mitigation guidance is aimed at the model providers, and it breaks into three layers:

Behavioral detection

Watch for accounts that smuggle anomalies into an otherwise-normal-looking stream: new subscriptions instantly at max quota instead of gradual ramp-up, 24/7 usage with no human idle periods, shared accounts from many IPs and user agents, anomalous subscription-to-API ratios, and identical prompt templates repeated across providers.

Targeted response changes

When a high-confidence distillation request is detected, subtly degrade the response — differential privacy, answering from a less capable "downgraded" model, reduced reasoning depth, stylistic inconsistency. Critically, the advisory says do not tell the suspected operator. Informing them lets them retrain their detection and roll back their training runs. Vary the changes so their QA pipelines can't calibrate to the new baseline.

Cross-organization intelligence sharing

No single provider sees the whole campaign. Proxy networks managing tens of thousands of fraudulent accounts at once cross providers, clouds, and aggregators. Sharing infrastructure indicators (IPs, domains, third-party services) and behavioral indicators (timing correlations, query-volume patterns) is the only way to reveal distributed campaigns as what they are.

For teams building on top of these models — including the agent harness work documented in DeepSeek's open-source framework or enterprise deployments of AI coding agents — this is worth reading as a threat model for your own dependency chain, not just a US-China policy story.

The bigger picture

This advisory is one piece of a broader policy stack: it references White House NSPM-11 on AI in the national security enterprise and NSTM-4 on adversarial distillation specifically, the document that appears to set US policy on this exact problem. The strategic argument is blunt. Distillation lets a fast-follower skip the most expensive parts of frontier development — research risk, compute spend, iterative RLHF and safety work — and capture most of the capability gain anyway. If the extraction is as systematic as the agencies describe, part of the "efficiency miracle" narrative some Chinese labs have enjoyed was subsidized, without consent, by the R&D budgets of the labs being distilled.

Whether you agree with the attribution or not, the operational lesson is concrete for anyone running AI infrastructure: scale makes extraction visible. Billions of tokens are too many to hide entirely. That's exactly what the advisory wants defenders to lean on.

Sources

• CISA / NSA / FBI: AA26-251A — China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns
• Anthropic: Detecting and preventing distillation attacks
• BleepingComputer: US says Chinese firms extracted billions of tokens from frontier AI models
• Help Net Security: Chinese AI firms are siphoning capabilities from American models, CISA warns
• White House NSTM-4: Adversarial Distillation of American AI Models