CISA Warns AI Companies of Malicious Knowledge Distillation Campaigns

The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA) and FBI released a joint cybersecurity advisory Tuesday, warning of China-based artificial intelligence (AI) companies using industrial-scale knowledge distillation campaigns to acquire capabilities from U.S. AI models.

According to CISA, the China-based companies are training their AI models using the outputs of larger, stronger U.S. AI models, extracting restricted proprietary functionalities and capabilities in less time with fewer costs. The China-based companies are avoiding detection by using multiple remote cloud providers and third-party aggregators that automatically jumble user metadata. This tactic violates the U.S. companies’ terms of service.

The advisory lists DeepSeek, Moonshot AI, Alibaba, MiniMax, STepFun and Z.AI as some of the known actors extracting information from U.S. frontier AI models, including Claude, GPT, Gemini and Grok.

The advisory recommends U.S. AI companies implement detection and mitigation strategies, including monitoring subscription-to-usage ratios, immediate maximum usage from new accounts and enterprise-scale throughput patterns.

CISA also recommends subtly changing responses for suspected malicious distillation attempts to weaken the knowledge they extract and sharing information between model providers, cloud platforms and API aggregators to reveal malicious actors.

“CISA is committed to promoting the secure use of AI while fostering the innovation crucial to America’s global competitiveness,” said CISA Acting Director Nick Andersen. “We strongly urge AI companies to take immediate steps to safeguard their platforms against knowledge distillation campaigns that threaten to close the gap in advancements made by American companies.”