China’s Adversarial AI Distillation
of U.S. Frontier Models
American innovation sets the frontier. Explore how Chinese firms may be extracting those capabilities—and what it takes to protect the lead.
Claude exchanges attributed to four Chinese AI firms by Anthropic.
Fraudulent accounts cited across Anthropic’s February and June disclosures.
Within a day, MiniMax reportedly redirected nearly half its traffic to a new Claude release.
The scale of extraction
Industrial scale.
Frontier targets.
The report describes coordinated campaigns aimed at reasoning, coding, and tool use. Select a firm to explore the alleged activity behind the numbers.
| Entity | Exchanges | Focus |
|---|---|---|
| Alibaba / Qwen | 28.8M+ | Agentic reasoning, software engineering, long-horizon tasks |
| MiniMax | 13M+ | Agentic coding, tool orchestration |
| Moonshot AI | 3.4M+ | Agentic reasoning, coding, computer vision |
| DeepSeek | 150,000+ | Reasoning and reasoning traces |
Click a bar or use Tab + Enter to inspect a campaign.
Provider-reported allegation
Alibaba / Qwen
Anthropic attributed exchanges through almost 25,000 fraudulent accounts to Alibaba-affiliated operators. The reported targets included agentic reasoning, software engineering, and long-horizon tasks.
Reported activity: April 22–June 5, 2026. The source figure also notes Alibaba’s denial of a separate GPU-supply allegation.
How to read these numbers
These are provider-reported allegations, not independently verified counts. The company figures are lower bounds and cover differing reporting windows. The report separately states an aggregate of “at least 44.8 million” exchanges and roughly 49,000 accounts. The listed company thresholds sum to 45.35 million; this companion preserves the report’s headline and each printed figure rather than presenting a newly calculated total. Bar lengths use the printed thresholds on a linear scale.
The key distinction is authorization. Distillation is a standard development technique. The report’s concern is systematic extraction using deception or access-control circumvention to reproduce a competitor’s capabilities.
Follow the capability
From model access
to lasting capacity.
“Transfer stations” sit between users and frontier-model providers. The report traces how this access can feed competing models and, ultimately, state systems.
Stage 01 / Access
An intermediary masks origin.
Transfer stations provide proxy access to American frontier models. The report describes these relays as a way to obscure who is using a service and bypass geographic and identity restrictions.
This diagram illustrates the overall mechanism; it is not a traced chain for every model.
The changing capability gap
A lead measured
in fewer points.
The report’s Epoch Capabilities Index chart shows rapid convergence. Move through six snapshots to see how the gap changes—and where the evidence has limits.
DeepSeek-R1 closes in.
DeepSeek-R1 brings the Chinese frontier to approximately three points of the U.S. frontier. Documented government integrations cluster in 2025 and 2026, after this jump.
| Snapshot | U.S. ECI ≈ | China ECI ≈ | Gap ≈ |
|---|---|---|---|
| September 2023 | 126 | 100 | 26 |
| May 2024 | 132 | 126 | 6 |
| September 2024 | 136 | 129 | 7 |
| January 2025 | 142 | 139 | 3 |
| August 2025 | 150 | 142 | 8 |
| November 2025 | 154 | 145 | 9 |
Values and timing are visually approximated; connecting lines guide the eye and are not a complete release history. ECI aggregates performance across more than 50 benchmarks. Chart credit: Epoch AI (CC BY).
From commercial models to state systems
The pathways
are not all the same.
DeepSeek and Qwen have documented state use and research. MiniMax and Moonshot have indirect ties. Filter the evidence, then open a card for the details.
Documented deploymentAI in police
workflows.
Hytera’s intelligence, command,
and execution platform
DEEPSEEK MoE
workflows.
and execution platform
The report describes three modules: radio transcription into incident logs; dispatch files linked to body-camera feeds and facial-recognition checks; and spoken queries converted into database searches and response plans.
Why it matters: AI helps officers act on information collected by existing systems. Hytera announced the integration in February 2025.
Documented deploymentLocal models.
No API to revoke.
National University of Defense Technology
People’s Liberation Army
DEEPSEEK
No API to revoke.
People’s Liberation Army
NUDT describes local DeepSeek deployment for political and ideological education, physically isolated from the internet and accompanied by content-review mechanisms.
Why it matters: A locally deployed open-weight model does not require an ongoing relationship with the original provider.
Patent / researchVoice and gesture
for unmanned systems.
Military Intelligence Research Institute
PLA Academy of Military Sciences
QWEN · MODEL UNSPECIFIED
for unmanned systems.
PLA Academy of Military Sciences
A patent describes using tracked hand gestures and speech-to-text commands to control unmanned platforms, with an unspecified Qwen model.
Evidence boundary: A patent establishes described research or a proposed system. It does not by itself verify operational deployment.
Patent / researchSimulating the spread
of misinformation.
NUDT School of Information
and Communication
QWEN2.5-0.5B-INSTRUCT
of misinformation.
and Communication
A patent describes small models acting as distinct network users, with misinformation seeded at one node to observe how it spreads.
Why it matters: The report assesses that many inexpensive model instances could help researchers test messages at scale. This is a research pathway, not proof of a deployed influence operation.
Indirect pathwayA leadership link
to surveillance.
MiniMax leadership’s prior roles
at SenseTime
MINIMAX
to surveillance.
at SenseTime
Three senior leaders, including MiniMax’s chief executive, previously worked at SenseTime. The report also discusses consumer-data collection and potential legal-access mechanisms.
Evidence boundary: The report identifies no documented PRC government adoption of MiniMax. Personnel ties and potential state access are indirect pathways.
Indirect pathwayState-backed capital.
A distribution channel.
Moonshot investors and
China Mobile’s MoMA platform
MOONSHOT / KIMI
A distribution channel.
China Mobile’s MoMA platform
The report describes state-backed investors and China Mobile’s inclusion of Kimi in a model platform intended for government-affairs and other applications.
Evidence boundary: These are financing and distribution ties. The report identifies no evidence of direct PLA or Ministry of Public Security adoption of Moonshot.
Open weights can be copied and deployed locally. The report argues that capability gains can therefore diffuse beyond the developer’s control. Documented adoption of a model does not establish the provenance of every capability inside it.
Why it matters
From revocable
access to durable
capability.
Threat reports already describe AI-assisted surveillance, influence, and cyber activity. SCSP warns that distillation could move these capabilities into models that U.S. providers cannot monitor or revoke.
These cases illustrate uses and risks of AI. They are not, by themselves, evidence that the activities were enabled by distillation.
01Surveillance & network mapping
Surveillance & network mapping
Likely China-origin actors researched U.S. think tanks and officials, analyzed Uyghur protest materials, drafted dissident commentary, and worked on a claimed social-media monitoring tool.
Limit: OpenAI attributed the activity only to likely China-origin actors. The report presents it as an illustration of potential surveillance capability.
02Intimidation & transnational repression
Intimidation & transnational repression
An account linked to Chinese law enforcement described overseas intimidation, impersonation, forged documents, and monitoring workflows involving DeepSeek-R1, Qwen2.5, and YOLOv8.
Limit: The descriptions referred to hundreds of personnel and thousands of fake accounts, but OpenAI could not verify the full scope.
03Faster reconnaissance & scripting
Faster reconnaissance & scripting
APT5- and APT15-associated accounts used AI for reconnaissance, scripting, and infrastructure profiling. Google reported similar activity by more than 20 PRC-backed groups.
Limit: Neither provider found fundamentally novel capabilities. The significance was the potential to increase operational speed and scale.
04From assistance to orchestration
From assistance to orchestration
The report cites Claude use across 12 of 14 MITRE ATT&CK tactics in one campaign. In a later case, GTG-1002 reportedly targeted roughly 30 entities, with Claude performing 80–90% of tactical work.
Limit: These are provider-reported findings. Humans retained decisions about escalation and exfiltration.
The policy response
Protect the frontier.
Compete in the open.
The report pairs stronger protection against extraction with a competitive American open-weight ecosystem. Explore its three recommendations.
Recommendation 01 / Legal clarity
Clarify the Economic
Espionage Act.
The report calls for clearer treatment of systematic harvesting of proprietary outputs or reasoning traces to reproduce model capabilities for a foreign government.
- Direct the Department of Justice to distinguish adversarial distillation from authorized research and ordinary use.
- Give prosecutors a clearer basis for pursuing deception and access-control circumvention in state-linked campaigns.
Recommendation 02 / Collective defense
Make threat sharing durable.
Raise the cost of access.
Institutionalize government–industry sharing on distillation attacks so it persists across administrations, and turn shared intelligence into defensive standards.
- Support a NIST-led AI Distillation Defense Framework covering access controls, detection, and response.
- Extend defenses beyond frontier labs to smaller providers, cloud platforms, and API aggregators.
- Build on existing detection-information sharing through the Frontier Model Forum.
Recommendation 03 / Competitive alternatives
Support a U.S.
open-weight ecosystem.
Offer a credible American alternative to low-cost Chinese open models through research funding, compute access, and procurement preferences.
- Keep the open tier deliberately below the protected frontier.
- Evaluate capabilities before release and monitor U.S.-origin weights for adversarial adaptation.
- Recognize that once weights are published, no open model can be kept from the PLA.
The report’s conclusion
“Innovation alone is not an advantage.
Protected innovation is.”
SCSP’s argument is to raise the cost of extraction while ensuring the open tier the world builds on is competitive, American, and transparent.