What is AI knowledge distillation, and why is it a security concern?

Knowledge distillation is a legitimate training technique where a smaller model learns from the outputs of a larger one. The CISA/NSA/FBI advisory describes a malicious variant: Chinese companies systematically queried US frontier models billions of times to extract proprietary reasoning capabilities, then used that data to train their own models, violating terms of service and reducing their own legitimate R&D costs.

Which Chinese AI models were named in the advisory?

The advisory names six companies: DeepSeek, Moonshot AI (maker of Kimi K3), Alibaba (Qwen family), MiniMax, StepFun, and Z.AI. It states all six extracted data from US frontier models including Claude, GPT, Gemini, and Grok, likely with Chinese government awareness.

Should enterprises stop using Chinese open-weight models like DeepSeek V4 or Kimi K3?

The advisory does not tell enterprises what to deploy, but it directly affects how risk-sensitive organizations should evaluate these models. Enterprises in regulated industries, those handling sensitive IP, or those subject to government contracting requirements should now treat the advisory as a formal risk input in their AI vendor assessment process.

What should enterprise AI teams do in response to this advisory?

Three actions are most urgent: review all AI vendor contracts for IP indemnification clauses, audit which Chinese-origin models your teams have deployed or fine-tuned on proprietary data, and add this advisory to your AI governance documentation as a supply chain risk factor. For organizations that use US frontier models as APIs, the advisory recommends detecting anomalous usage patterns and cross-sharing intelligence with other model providers.

Does this affect Abacus.AI Smaug, which is built on Kimi K3 and DeepSeek?

Abacus.AI Smaug Agentic is built on Kimi K3, and Smaug Flash is built on DeepSeek V4 Flash. Both base models are named in the advisory. Enterprises considering Smaug or similar third-party fine-tunes of named models should treat the advisory as an additional risk factor for their open-weight deployment decisions.

NSA/CISA: China Is Stealing US AI Models at Scale

On September 8, 2026, the National Security Agency, Cybersecurity and Infrastructure Security Agency, and Federal Bureau of Investigation jointly released cybersecurity advisory AA26-251A, naming six China-based AI companies as having conducted “industrial-scale knowledge distillation campaigns” against US frontier AI models since at least late 2024. The advisory is the most authoritative government statement yet on what has been an open industry secret: that several leading Chinese AI models were built substantially on capabilities extracted from American systems.

The companies named are DeepSeek, Moonshot AI (Kimi K3), Alibaba (the Qwen family), MiniMax, StepFun, and Z.AI. All six, the advisory states, extracted billions of tokens across millions of API requests from US frontier models, including Claude, GPT, Gemini, and Grok, and they likely did so with Chinese government awareness.

What the Advisory Actually Says

The advisory distinguishes legitimate distillation, a recognized technique where a smaller model learns from a larger one, from what these companies allegedly did: systematic, high-volume extraction of restricted proprietary functionality specifically to avoid building those capabilities from scratch. The report describes it not as a supplement to legitimate R&D but as “the critical core” of these companies’ AI development strategy.

DeepSeek’s often-cited $5.6 million training cost figure is specifically called misleading. The advisory states it excludes the actual cost of the distilled data, which was obtained through millions of targeted queries rather than legitimate compute.

The six named companies used a common playbook, according to the report: distributing requests across multiple accounts, platforms, and API aggregators to evade detection; routing through proxies and gray-market API resellers to bypass geographic restrictions; and timing requests to avoid tripping individual provider rate limits.

Company-by-Company Summary

Company	US Models Targeted	Capabilities Extracted
DeepSeek	Claude 3.7-4.5, Gemini 2-2.5, GPT-4 to GPT-5, Grok 4	Agentic capabilities, reasoning, legal specialization, writing via chain-of-thought
Moonshot AI (Kimi K3)	Claude Opus 4.1, Claude Fable 5, GPT-4o to GPT-5 Pro, Gemini 2.5, Grok Code	Software engineering, math, RL optimization, SFT tuning
Alibaba (Qwen)	Claude 4, Claude Sonnet, GPT-5	Software engineering, customer service dialogue, image/character creation
MiniMax	Claude Sonnet 4, Claude Opus 4.5, Gemini 2.5	Reasoning, RL, multimodal generation
StepFun	Claude Opus 4.1-4.5, Claude Haiku 4.5, GPT-5 to GPT-5.2	Coding agents, agentic functions
Z.AI	GPT-5.5, Claude Opus 4.8	Chain-of-thought reasoning

Source: CISA Advisory AA26-251A, September 8, 2026.

Enterprise AI Strategy Risk: Why China AI Distillation Changes the Calculus

This advisory arrives at a moment when many enterprise teams have already deployed open-weight models from the named companies, or are evaluating them. The advisory does not carry the force of a trade restriction or export control. But it changes the risk calculus in three concrete ways.

Vendor due diligence just became more formal. Risk and legal teams at regulated enterprises now have a government document that explicitly describes the IP and compliance exposure of using these models. That document belongs in AI governance frameworks, alongside vendor security assessments and data processing agreements. The advisory’s existence means ignoring the issue is no longer a defensible position in a board-level discussion or a procurement review.

Fine-tune risk is compounded. Enterprises that have fine-tuned Qwen, Kimi K3, DeepSeek, or MiniMax models on proprietary internal data have layered their own IP onto a base that the US government now says was itself built on extracted foreign IP. That creates a complicated ownership situation if IP disputes or regulatory actions follow.

The “open-weight means I control it” argument now has a counterweight. A common defense of deploying Chinese open-weight models was that self-hosting eliminates data exfiltration risk. That remains technically true. But the advisory adds a second category of risk: the provenance risk of the model weights themselves, separate from operational data-handling. Enterprise CISOs need to decide how to weigh that.

The Advisory Touches Directly on Previously Reported Stories

Enera’s readers will recognize several threads from recent coverage. In July, the White House called out Moonshot AI specifically for extracting Claude Fable 5 data to train Kimi K3. Today’s advisory formalizes and expands that accusation, naming 18 US models Moonshot queried to train both Kimi K2 and Kimi K3. Our earlier analysis of the Kimi K3 IP accusations and what they mean for open-weight risk outlined the governance exposure at the model level. This advisory confirms and escalates it.

Similarly, our coverage of DeepSeek’s $74B pre-IPO valuation noted that the company’s low-cost story relied on training economics that were disputed. The advisory now provides an official government account of what was happening: much of the training data cost was effectively borne by US AI companies through unauthorized API extraction.

What Enterprises Should Do Now

The advisory directs its three recommended mitigations at US AI model providers, but enterprises have their own set of actions to take:

Audit your AI vendor stack for named models. This means every internal deployment, API integration, and fine-tuned model that touches Qwen, DeepSeek, Kimi K3, MiniMax, StepFun, or Z.AI products. Document which use cases they serve and what data they process.

Review contracts for IP indemnification. When building on open-weight models, IP indemnification terms are either absent or limited. Enterprises that require this protection should build it into their AI governance policy as a gate for production deployment.

Update AI risk registers. The advisory is a formal, citable government document. Add it to your AI governance framework as a supply-chain risk factor alongside existing model cards and vendor security assessments. Regulated industries (financial services, healthcare, government contracting) should elevate this to compliance teams now.

Model the reputational exposure. For enterprises that market to US federal agencies or operate in sensitive sectors, deploying AI built on models the NSA and CISA have named creates a reputational and procurement risk, even absent any specific regulatory action.

Engage your AI provider. If your enterprise uses US frontier models via API, contact your provider to understand how they are implementing the advisory’s recommended mitigations: anomaly detection on accounts, targeted response changes for suspected distillation, and cross-provider intelligence sharing.

A Note on Abacus.AI Smaug

Also released today, September 10, Abacus.AI launched three open-weight models, Smaug Agentic (based on Kimi K3), Smaug Flash (based on DeepSeek V4 Flash), and Smaug Mini (based on Qwen3.8 27B), each fine-tuned for enterprise agentic workloads. The base models for Smaug Agentic and Smaug Flash are both named in the advisory. Enterprises evaluating Smaug should treat the advisory as an additional due-diligence factor for those base models, separate from Abacus.AI’s own fine-tuning methodology.

Smaug Flash shows meaningful benchmark gains over its DeepSeek base (61.1 versus 46.8 on LiveBench agentic coding; 38.83 versus 25.1 on AutomationBench), and Smaug Mini over Qwen3.8 27B (50.5 versus 33.4 on JobBench). The technical work is real. The provenance question is now also real, and enterprise teams need to hold both simultaneously.

What Comes Next

The advisory is primarily directed at US AI companies rather than enterprise buyers. Its three mitigations (detection, targeted response changes, and cross-provider intelligence sharing) are operational recommendations for model providers. But the downstream effect on enterprise AI strategy is substantial.

If US AI companies begin implementing the recommended mitigations at scale, the cost and quality advantage of models built substantially on distilled US IP may narrow over time, as the data tap tightens. That could shift the open-weight economics that have made some of these models attractive in the first place.

Enterprises that have built production workflows on named models should develop contingency roadmaps. Not because a near-term regulatory action is likely, but because the advisory is the clearest signal yet that the US government views the current situation as an ongoing national security concern, and policy action tends to follow such signals.

AI-native enterprises need AI governance frameworks that treat model provenance, not just model performance, as a first-class decision criterion. If your current vendor evaluation process does not include a provenance assessment, talk to Enera about building one.