White House warns of Chinese firms stealing US AI technology through distillation
The White House is stepping up coordination with US AI companies to counter what it describes as "industrial-scale campaigns" by foreign actors to copy American AI advances. Michael Kratsios, Director of Science and Technology Policy, outlined the threat in an internal memo citing new intelligence about exploitation by "foreign entities, principally based in China."
The copying method, called distillation, works by reverse-engineering AI models. Foreign firms operate thousands of accounts on US AI platforms to appear as normal users, then systematically extract information about how the models work and apply those findings to their own systems.
What the White House plans to do
Kratsios said the administration will take four steps:
- Share intelligence with US AI companies about distillation tactics and the actors behind them
- Improve coordination between the government and companies to fight the attacks
- Develop best practices for identifying and stopping distillation campaigns
- Explore ways to hold foreign actors accountable
The memo did not specify concrete enforcement actions or timelines.
Named targets and responses
Anthropic has already identified three Chinese AI labs conducting distillation: Deepseek, Moonshot, and MiniMax. OpenAI has separately accused Deepseek of copying its technology.
Deepseek released its AI model last year at a reported cost of only a few million dollars-a fraction of what competitors spend. The company claimed the low cost reflected efficient development, not borrowed technology.
China's US embassy rejected the White House characterization, calling it "unjustified suppression of Chinese companies" and stating that China's AI development stems from "its own dedication and effort as well as international cooperation."
The security challenge for developers
Distillation exploits a fundamental weakness: once an AI model is deployed publicly, users can interact with it and observe its behavior. Coordinated accounts can test edge cases and extract patterns that reveal how the model works internally.
Kratsios warned that foreign models built on such "fragile foundations" should not be trusted for reliability or security. As detection methods improve, he suggested, these copied systems will become increasingly unstable.
For development teams, the implication is direct: understanding generative AI and LLM security now includes defending against coordinated extraction attempts, not just traditional cybersecurity threats.
The companies accused have not responded to requests for comment. Deepseek is expected to release a new version of its model soon.
Your membership also unlocks:
