The US government voiced its discomfort about model copying by naming companies for the first time. The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Tuesday.
It accuses six Chinese companies of waging "industrial-scale" distillation attacks against US frontier models.
The companies named
The agencies list DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI. According to the advisory the activity has run since at least late 2024, and the firms "likely" acted with "Chinese government awareness". Targeted systems include variants of Claude, GPT, Gemini and Grok.
- Distillation means sending systematic queries to a strong model and training a smaller one on its outputs.
- The agencies say the method markedly shortens both the timeline and the cost of training a frontier model.
- The advisory implies the savings could run to billions of dollars.
The six names cover almost the whole of China's AI scene. DeepSeek and Alibaba are known for open-weight models, Moonshot and MiniMax for long-context systems, Z.AI for coding models. The advisory imposes no sanctions on their products; it only recommends behaviour to US providers.
The suggested countermeasure is contested
The striking part of the advisory is not the accusations but the behaviour it recommends to US companies. The agencies advise providers to identify suspect users and route those users, without telling them, to less capable models.
It is presented as a security measure, but in practice it means a service provider degrading the product without informing the customer. When the same criterion misfires, the person affected could be an ordinary developer wiring up an automation.
The suggestion also puts the providers' own credibility at risk. When a user cannot tell why an answer got worse, they attribute it to the model's general quality. The cost of the measure then falls on the ordinary subscriber rather than the intended target.
The evidence problem remains
Distillation is technically hard to prove. Showing from the outside that one model's outputs trained another usually rests on access logs and prompt patterns. The agencies do not detail what evidence they relied on.
| Claim in the advisory | Basis given |
|---|---|
| Six firms ran distillation | Agency assessment, no detail shared |
| With government awareness | Qualified with the word "likely" |
| A cost advantage was gained | General training cost comparison |
That vagueness matters, because the accusation arrives as an intelligence assessment rather than a technical finding. The first responses from the Chinese side were short statements rejecting the claims.
What it means for a developer in Turkey
Open-weight models from several of the named companies are widely used in Turkey too. The advisory does not ban their use, but it lays groundwork for US-based providers to tighten access policies.
The practical upshot is that depending on a single provider in a corporate project has become riskier. The possibility that an account is quietly downgraded to a weaker model is reason enough to keep a measurable quality test.