Appearance
US-China AI Distillation Dispute Escalates
In a significant escalation of U.S.-China technological tensions, three leading U.S. intelligence and cybersecurity agencies—the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Bureau of Investigation (FBI)—issued a joint advisory in September 2026 warning that Chinese state-sponsored actors are targeting U.S. artificial intelligence systems through a technique known as knowledge distillation. The advisory claims that Chinese hackers and research institutions are systematically extracting capabilities from advanced American AI models by feeding them carefully crafted queries and using the outputs to train competing models, effectively stealing billions of dollars in AI research and development investment. The Chinese government has firmly rejected the allegations, calling them baseless and accusing the United States of engaging in technological fearmongering to justify its own restrictive trade policies.
Background
- Knowledge distillation is a legitimate machine learning technique in which a smaller, more efficient "student" model is trained to replicate the performance of a larger, more powerful "teacher" model, typically developed by the same organization.
- The U.S. has increasingly restricted China's access to advanced AI technologies in recent years, including export controls on high-end AI chips, restrictions on Chinese investment in U.S. AI startups, and limits on academic collaboration.
- China has made AI a national strategic priority, investing tens of billions of dollars in AI research and development and aiming to become a global leader in artificial intelligence by 2030 as part of its "New Generation Artificial Intelligence Development Plan."
Key facts
| Item | Detail |
|---|---|
| Issuing agencies | NSA, CISA, FBI |
| Date of advisory | September 2026 |
| Technique cited | Knowledge distillation |
| Target | U.S. AI models and systems |
| Alleged perpetrator | Chinese state-sponsored actors |
| Chinese response | Rejects allegations as baseless |
| Context | U.S.-China tech rivalry |
| Industry affected | AI / technology sector |
Highlights
What Is AI Knowledge Distillation and Why Does It Matter?
Knowledge distillation is a well-established technique in the AI research community that involves training a smaller, leaner "student" model to mimic the behavior and outputs of a larger, more capable "teacher" model. In legitimate use cases, companies use distillation to create lightweight versions of their own models that can run efficiently on edge devices like smartphones or IoT sensors. However, the U.S. agencies warn that Chinese actors are applying this technique to models they do not own—specifically, large language models and other AI systems developed by U.S. companies. By systematically querying these models through their public APIs and collecting the outputs, bad actors can effectively reverse-engineer much of the model's knowledge and capabilities, creating competing models at a fraction of the original development cost. This technique is particularly concerning because it does not require breaking into computer systems or stealing code directly; it exploits the very accessibility that makes AI services valuable to customers.
China's Rejection of the Allegations
The Chinese government has swiftly and firmly rejected the U.S. allegations, with officials from the Ministry of Foreign Affairs and the Ministry of Industry and Information Technology describing the joint advisory as unfounded and politically motivated. Chinese representatives argue that knowledge distillation is a standard, openly published research technique used by AI scientists around the world, including in the United States. They point out that China has its own robust AI research ecosystem, with top universities, tech companies like Alibaba and Baidu, and government research institutions all investing heavily in original AI development. Chinese officials also note that the United States has increasingly restricted China's access to AI hardware, software, and research collaboration, yet still accuses China of stealing technology—a contradiction they say reveals the real motive: suppressing China's legitimate technological progress to maintain American dominance.
Industry positioning & impact
The U.S.-China AI distillation dispute sits at the intersection of national security, intellectual property protection, and the global competition for technological leadership in artificial intelligence. For the U.S. AI industry, the warning from three major agencies raises difficult questions about how to balance the commercial imperative of making AI models accessible to customers—often through paid APIs—with the risk of those models being used to train competing systems. AI companies are already grappling with how to implement rate limiting, output watermarking, and query pattern analysis to detect potential distillation attacks, but these measures can also degrade the user experience for legitimate customers.
The dispute is likely to further strain U.S.-China technological relations and could lead to additional restrictions on how U.S. AI companies operate in the Chinese market or provide services to Chinese users. It may also accelerate the bifurcation of the global AI ecosystem into separate American and Chinese spheres, with different models, standards, and supply chains serving different geopolitical blocs. This technological decoupling could have significant economic consequences, as both countries stand to lose the benefits of collaboration, shared research, and integrated supply chains.
For the broader AI research community, the controversy highlights a fundamental tension at the heart of modern AI development: the techniques that make AI more accessible, efficient, and democratic—such as distillation, fine-tuning, and API access—are also the techniques that make intellectual property harder to protect. As AI models become more capable and more economically valuable, finding the right balance between openness and protection will be one of the defining challenges of the AI era.
Related reading
For a deeper understanding of how knowledge distillation works and its legitimate applications in AI development, see our technical explainer on model compression techniques and their role in deploying AI on edge devices. Readers following U.S.-China tech relations may also want to explore our analysis of the chip export control regime and its impact on the global semiconductor industry and AI development landscape.
References
The joint advisory on AI knowledge distillation threats is published on the websites of the National Security Agency (nsa.gov), the Cybersecurity and Infrastructure Security Agency (cisa.gov), and the Federal Bureau of Investigation (fbi.gov). The official Chinese government response can be found in press briefings published on the Ministry of Foreign Affairs of the People's Republic of China website at fmprc.gov.cn. For technical background on knowledge distillation in machine learning, the original paper by Hinton, Vinyals, and Dean (2015) is available on arXiv at arxiv.org.
Buying advice & audience
If you are an AI developer or technology leader concerned about the potential for knowledge distillation-based intellectual property theft, there are several practical steps you can take to protect your AI models. First, implement robust API access controls including rate limiting, usage quotas, and anomaly detection to identify and block unusual query patterns that may indicate an attempted distillation attack. Second, consider adding watermarking or fingerprinting techniques to your model outputs so that you can trace leaked capabilities back to their source if they appear in competing models. Third, carefully consider which model capabilities to expose through public APIs versus reserving the most sensitive features for private deployments or enterprise customers with stronger contractual protections.
For businesses that use AI services from U.S. providers, the dispute may have implications for cost and availability. If AI companies are forced to implement stricter access controls and security measures, it could lead to higher API prices, more restrictive usage terms, or reduced access for certain geographic regions. Businesses should diversify their AI service providers when possible and stay informed about developments in AI security and regulation.
If you are an investor in AI companies, the distillation dispute underscores both the enormous value of leading AI models and the challenges of protecting that value in an increasingly competitive global market. Companies with strong AI security measures, defensible data advantages, and regulatory moats may be better positioned to maintain their competitive edge than those whose competitive advantage rests primarily on model architecture that can be reverse-engineered through distillation or other techniques.
FAQ
What is knowledge distillation in AI?
Knowledge distillation is a machine learning technique where a smaller, more efficient "student" model is trained to replicate the outputs and behavior of a larger, more powerful "teacher" model. The process involves feeding the same inputs to both models and training the student model to produce outputs that match the teacher model's outputs as closely as possible. This allows the smaller model to achieve performance close to that of the much larger model while requiring far fewer computational resources to run. Originally developed to make large models practical for deployment on edge devices, knowledge distillation is now widely used in AI research and industry for model compression, transfer learning, and efficiency optimization.
What are the U.S. agencies alleging about China and AI distillation?
The NSA, CISA, and FBI are alleging that Chinese state-sponsored actors are using knowledge distillation techniques to effectively steal capabilities from U.S.-developed AI models. According to the joint advisory, Chinese actors systematically query American AI models through their public application programming interfaces (APIs), collect the outputs, and use those outputs to train their own competing AI models. The agencies claim this allows China to replicate billions of dollars worth of AI research and development investment at a fraction of the cost, without having to train models from scratch or invest in the massive computing infrastructure required to develop frontier AI systems.
How has China responded to the AI distillation allegations?
China has firmly and categorically rejected the U.S. allegations, calling them baseless, politically motivated, and without factual foundation. Chinese officials argue that knowledge distillation is a standard, openly published research technique used by AI researchers worldwide, including in the United States, and that China's AI progress is the result of its own substantial investments in research and development, not theft. They point to China's world-class AI research institutions, its top-tier AI talent pool, and the billions of dollars the country has invested in AI as evidence of legitimate technological advancement. Chinese representatives also accuse the United States of using national security concerns as a pretext to suppress China's technological development and maintain its own technological dominance.
Is knowledge distillation illegal or a form of hacking?
Knowledge distillation itself is a legitimate and widely used AI research technique that is not inherently illegal or malicious. It is commonly used by tech companies, academic researchers, and AI developers for legitimate purposes such as making models more efficient, deploying them on edge devices, and improving model performance. Whether a specific use of knowledge distillation constitutes intellectual property theft or illegal hacking depends on the circumstances, including whether the perpetrator has authorized access to the target model, what terms of service apply, and whether any computer security laws have been violated. Using publicly available APIs within their stated terms of service to query a model is generally not considered hacking, though it may violate terms of service or raise intellectual property concerns depending on the jurisdiction and the specific facts of the case.
What can AI companies do to protect against distillation attacks?
AI companies can take several measures to protect their models from potential knowledge distillation-based IP theft. First, they can implement API rate limiting and usage quotas to make it more difficult and expensive for bad actors to extract enough outputs to train a competing model. Second, they can deploy anomaly detection systems that identify unusual query patterns, such as systematically probing the model with diverse inputs in a short period of time. Third, some companies are exploring output watermarking techniques that subtly mark model outputs so they can be traced if they appear in a competing model. Fourth, companies can carefully tier their model offerings, reserving the most advanced capabilities for enterprise customers with stronger contractual protections rather than exposing them through public APIs. Finally, legal teams can update terms of service to explicitly prohibit using model outputs to train competing AI systems.