Chinese AI Companies Running Malicious Distillation Campaigns Against US Firms: DoD CSA

The U.S. Department of Defense's Clinger-Cohen Act (CSA) office has released a cybersecurity advisory detailing malicious distillation campaigns by Chinese AI companies against U.S.-based AI firms. The PDF report, published September 8, 2026, outlines how these campaigns exploit AI systems to extract model weights and proprietary knowledge.

Key Details from the Report

• Campaign Targets: The advisory names major US AI players, including OpenAI, Anthropic, and Google, as primary targets of distillation attacks.
• Methodology: Attackers use API access to repeatedly prompt target models to generate outputs that are then used to train rival models, effectively stealing the distilled knowledge without authorization.
• Specific Exploits: The report cites vulnerabilities in /v1/completions endpoints that lack rate limiting, enabling model extraction attacks. It also flags open-source frameworks like PyTorch and Hugging Face's transformers for potential supply chain compromises.
• Mitigation Steps: Recommendations include implementing differential privacy, adding output watermarking, and enforcing strict rate limits on API calls.

The advisory follows a HN thread discussing the implications, with 18 points and 17 comments as of now. Many commenters note that distillation is a known risk in the AI community, but this is the first time a US government agency has officially attributed such campaigns to Chinese state-affiliated entities.

The report includes technical indicators of compromise and recommended detection mechanisms, such as monitoring for unusual API call volumes and anomalies in output distributions. It also advises companies to audit their model access logs for patterns consistent with distillation attempts.

For developers using AI APIs, this underscores the need for robust logging and anomaly detection to protect proprietary models.