US names six Chinese AI firms in industrial-scale model copying accusation

The National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI issued a joint alert accusing six Chinese AI companies of running industrial-scale campaigns to copy the capabilities of leading US AI models. The firms named are DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI. The agencies said the activity has been going on since at least late 2024 and targeted variants of Anthropic's Claude, OpenAI's GPT, Google's Gemini, and xAI's Grok.

The practice at the center of the accusation is called distillation, in which a newer, cheaper model is trained by learning from the outputs of a more advanced one. The agencies said this is common across the AI industry, but argued the scale and coordination of the Chinese campaigns went far beyond legitimate research or development use. Their assessment: distillation is not a supplement to how these companies build models, but the core of their strategy. They said the firms likely acted with Chinese government awareness, though they stopped short of claiming that Chinese intelligence services were directly involved.

This was described as the Trump administration's most detailed accusation yet on the subject, following months of scattered claims from individual companies. OpenAI had previously accused DeepSeek of using ChatGPT data improperly, Google said it was flooded with attempts to clone Gemini without naming a suspect, and Anthropic argued Alibaba should face criminal punishment over what it called the largest cloning attack yet on Claude. In April, the White House Office of Science and Technology Policy had already flagged distillation as a critical issue in an internal memo.

According to the agencies, one common method involves creating swarms of fake accounts, not tied to real users, that are used to bulk-buy access to US model subscriptions. These accounts then fire off large numbers of near-identical prompts on the same topics, ranging from thousands to millions of queries, in patterns the agencies said far exceed anything a legitimate research team would need. To get around regional access restrictions, the campaigns reportedly route requests through networks of proxy servers, described as a gray market, so the true origin of the traffic is hidden.

A second method involves prompt injection, where attackers craft specific instructions to trick a model into revealing information it would not normally share. The agencies gave a specific example: DeepSeek allegedly used prompts instructing a model to imagine and write out, step by step, the internal reasoning behind a response it had already completed. This effectively pulls out a model's hidden reasoning process, which companies do not want exposed since it represents part of what makes the model valuable.

Each firm was accused of targeting different capabilities. DeepSeek allegedly pursued a broad range including agentic functions, writing and question-answering optimization, and chain-of-thought reasoning, in what the agencies said was an effort to cut its own compute and research costs. Moonshot AI allegedly switched between different US models to distill fine-tuning techniques, reinforcement learning, software engineering, and math capabilities. Alibaba, MiniMax, StepFun, and Z.AI were described as more narrowly focused on copying particular models from Anthropic and OpenAI.

Alongside the accusations, the agencies issued recommendations for US AI firms, and one stands out for how it would work in practice. They suggested that firms detect accounts suspected of running distillation campaigns and then subtly downgrade the answers those accounts receive, for instance by giving correct information but with different reasoning, adding stylistic inconsistencies, or cutting back how much a model reasons through a problem. Firms could also quietly switch flagged accounts to a weaker, less capable model entirely. Critically, the agencies recommended doing this without telling the user any change had happened.

Other recommendations focus on detection rather than deception. Agencies want firms to watch for subscription accounts with unusual usage patterns, such as new accounts that immediately hit maximum usage, which they said suggests bulk deployment using pre-built templates rather than an individual user experimenting. They also called for stronger identity verification and closer tracking of enterprise subscriptions, along with more information-sharing between firms and allied governments so that patterns spotted by one company can be recognized industry-wide rather than investigated as isolated incidents.

The agencies acknowledged this approach faces real obstacles. Some Chinese firms reportedly can detect within a day when a more capable model becomes available and switch to it, and have automated systems that can tell the difference between a genuine service problem and a deliberate degradation of output. Legitimate users could also get caught in the same net, receiving shorter responses, weaker capabilities, or extra noise in their outputs without warning. The agencies pointed to OpenAI's own experience last year, when its automatic routing system was found to default to less capable model variants unless users added phrases like 'think harder' to their prompts, prompting a fast reversal after user backlash.

China's response was swift and came through multiple official channels. A Ministry of Foreign Affairs spokesperson, Mao Ning, said China's AI development is the result of high-level scientific and technological self-reliance and called on the US to strengthen cooperation with China rather than make what she called groundless accusations. China's Commerce Ministry separately dismissed the claims and accused the US of seeking a monopoly over the AI industry, warning that if the US suppresses Chinese AI companies under the pretext of targeting distillation, China will take resolute countermeasures.

A spokesperson for the Chinese Embassy went further, accusing the Trump administration of running a smear campaign rooted in prejudice, and calling on US officials to respect the facts and stop discrediting China's AI achievements. State media outlet People's Daily quoted another Ministry of Foreign Affairs spokesperson arguing that many US AI companies have themselves used Chinese models for distillation during their own research and training, and that many US startups seek access to Chinese models because they are more affordable and capable enough for many tasks. That spokesperson warned China would take all necessary measures in response to any action causing material harm to its interests.

The dispute arrives just weeks before Chinese President Xi Jinping is due to visit the US for a meeting with President Trump on September 24, which is expected to cover AI among other topics. US Treasury Secretary Scott Bessent said in Dallas that the Chinese distill US models and can never get ahead of the US. None of the six named Chinese firms had responded to requests for comment from the outlets that reported the story.