On September 8th, 2026, the NSA, CISA, and the FBI published a joint advisory about Chinese AI companies extracting capabilities from American models.[1] It runs to eighteen pages, names six companies, and is mostly what you’d expect. One recommendation isn’t, and I think it’s the most important thing in it. If you buy tokens from an American AI lab, it’s about you.
The second of the three things the advisory asks American AI companies to do right away is this:
“Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.”[2]
Page fourteen says what that looks like:
“Reducing reasoning depth, presenting correct information with different reasoning, or stylistic inconsistencies may evade detection while reducing training usefulness.”
And right after that, it says who shouldn’t be told:
“Avoid informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model.”[3]
Why should you care if you’re not a Chinese lab? Because of how a provider is supposed to spot one. The advisory tells providers to monitor “immediate maximum usage from new accounts, and enterprise-scale throughput patterns”, and lists “usage optimized for cache maximization versus task diversity”.[4] That describes a lot of ordinary production traffic, for example, a batch job moved to a new account that runs one cached prompt over a large corpus at full volume from day one. Vendors tell you to cache: OpenAI’s guide says “Keep the prefix stable.”[5] And distillers often come in on somebody else’s account: the proxy services they route through, Anthropic says, “often use stolen API credentials belonging to legitimate companies or individuals”.[6] Degrade that traffic, and the company paying for the key gets the worst answers, with nothing in the advisory saying anyone should tell it.
Google and Anthropic have both publicly said that they make what distillers get less useful. What matters is whether they tell the account. Anthropic’s help page for its newest models says it does, at least when a safeguard blocks a request, distillation attempts included: in its apps “you’ll see a notice explaining that the model switched, and the response will be labeled with the model that answered”, and on the API the response comes back with a stop reason.[7] Google’s Gemini API documentation, which never mentions distillation, reserves the right to change “which model answers a specific request” and says Google “may reach out to you through email”, not that it will.[8] So ask your account manager two questions. Do you alter answers for accounts you suspect? Would you tell me if I were one of them?
Who says so?
The advisory’s central claim is that distillation “is not a supplement to these companies’ AI model development, but the critical core of it.”[9] It names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, and says they have processed “billions of tokens across millions of exchanges/requests” since at least late 2024.
So what’s the evidence? The eight references are all public: three come from companies that say they were targeted (Anthropic, Google and OpenAI), and the rest are a NIST taxonomy, a trade article, two White House memoranda and a post on X.[10] Nothing in the list is the agencies’ own work (for example, telemetry, a seizure, or an indictment), and the White House memo on distillation says the government “has information” without showing any of it. StepFun, Z.AI, and GPT-oss-20b appear in none of them.
Is the distillation happening? It may well be. Anthropic’s February post is specific in a way the advisory isn’t: about 24,000 fraudulent accounts and more than 16 million exchanges, attributed to three labs.[11] Compared with that, the advisory adds three more company names, longer lists of the models it says were used, detection signals, mitigations, and one instruction.
And most of what it recommends only works while the model sits behind an API, which it never says.
Twelve of the seventeen measures only work at the front door
The advisory makes seventeen recommendations: eleven from a MITRE catalog, three in its own prose, and three from a NIST taxonomy.
Twelve of them do nothing unless the attacker’s requests hit infrastructure the provider runs, i.e., rate limiting, authenticated access, logging, output obfuscation, ensembles, query detection, and input sanitization.[12]
Picture the same model downloaded and running on somebody else’s hardware. What’s left? There’s no quota to enforce, no log to write, no answer to degrade, and no way to know whose inference it is. Two measures survive the download, and they’re the same idea filed under two frameworks: safety training baked into the weights before release.[13] Anyone who holds the weights and is willing to tweak could strip that out, and the advisory doesn’t discuss it.
On the weights themselves, there’s exactly one line, AML.M0001:
“Limit Model Artifact Release: Limit release of data, algorithms, architectures, and model checkpoints.”[14]
Search the eighteen pages for “weights”, “open-weight”, “open source” or “publicly available,” and you get nothing; “checkpoint” shows up once, inside that one line.[15]
MITRE’s own catalog is less shy. One of its entries, AML.M0017, spells the assumption out:
“Deploying AI models to edge devices can increase the attack surface of the system. Consider serving models in the cloud to reduce the level of access the adversary has to the model.”[16]
The advisory copied ten identifiers from that catalog and skipped this one. Oops.
Exhibit A was a free download
The Moonshot section lists eighteen models the advisory says the company used “to distill SFT optimization, reinforcement learning (RL), software engineering, and math capabilities”. Most are what you’d expect (six Claude variants, several GPT and Gemini releases, Grok Code Fast-1), and one of them is GPT-oss-20b.[17]
GPT-oss-20b is OpenAI’s own open-weight model, released in August 2025 under the Apache 2.0 license. It isn’t gated; it was downloaded about 6.5 million times in the last thirty days, and its license permits the use described in the advisory.[18]
So what in the document reaches that row? Almost nothing. That leaves AML.M0001 (limit what you release), and OpenAI decided the other way thirteen months ago.
February’s version had a clause for customers
The idea wasn’t the agencies’. On February 12th, Google wrote that its defenses “can degrade student model performance” [19], and on February 23rd, Anthropic described what it was building: “Product, API and model-level safeguards designed to reduce the efficacy of model outputs for illicit distillation, without degrading the experience for legitimate customers”[20]
That last clause is as close as either post comes to a promise: legitimate customers aren’t meant to pay for the defense.
Both posts are in the advisory’s reference list [10], and the agencies changed two things: the promise shrinks to “lower-to-no legitimate user risk”, and next to it sits an instruction not to tell. The degradation was publicly proposed by vendors and defended on its merits. The instruction not to tell is the agency’s own.
The agencies do give a reason for it in the next sentence: “Informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training.”[3] The distillers know the defenses exist, if not when one hits them. Google and Anthropic said so in February, and in April the White House warned that, as defenses improve, distillers “should have little confidence in the integrity and reliability of the models they produce”.[21] And page 10 says China-based entities already run test pipelines that separate “service issues from defensive data degradation”, which is why page 14 suggests changes subtle enough to get past them. A change built to fool a lab’s test pipeline would fool a customer’s tests too. So the silence keeps two groups in the dark: the distillers and the paying customers.
Two sentences on, the advisory concedes what this costs: “In contrast, AI safety researchers and third-party evaluators should be informed of model changes while still applying strong distillation mitigations.”[3] Why tell the evaluators? Because the defense changes what they would measure, even if the carve-out only means to mark researchers as friends.
What about you, as a buyer? The notice covers “AI safety researchers and third-party evaluators”. Not you. And I wouldn’t count on your own tests to cover it: in a survey LangChain ran at the end of 2025, 22.8% of the respondents with agents already in production said they weren’t evaluating them.[22]
Who does the section cover? It’s headed “Response alteration for suspected distillation activity”, it opens on “high-confidence malicious distillation requests”, and its implementation paragraph starts “When suspecting a malicious distillation campaign”. None of the three names a nationality. The instruction not to tell comes twice: first for China-based users, then, right after the agencies’ reason, “Instead, alter responses to users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns without informing them.”[23] Read with the sentence before it, which may be intended only for Chinese users. Read on its own, it covers anyone the provider has “confirmed”, by a standard the advisory never gives.
The advisory knows this can catch the wrong people. In its section on sharing indicators, it says correlated activity justifies degradation “with lower-to-no legitimate user risk”.[24] It gives no false-positive rate anywhere.[25] The providers’ own safety filters suggest it wouldn’t be zero: Anthropic says of its improved biology safeguards that “there will inevitably remain false positives”, and OpenAI says its agent’s safeguards “will sometimes accidentally prevent safe uses of the product”.[26] Those aren’t distillation detectors, but Anthropic calls the blocking safeguards that catch distillation attacks “intentionally broad”.[7] Some paying customers would likely get worse answers by mistake. The agencies know it, and what they offer those customers is a better guess about who they are, not a warning.
The last time Washington degraded a service, it said so
The United States deliberately degraded the civilian GPS signal until midnight on May 1st, 2000, and the point is how it stopped. The President announced it: “The United States will stop the intentional degradation of the Global Positioning System (GPS) signals available to the public beginning at midnight tonight. We call this degradation feature Selective Availability (SA).”[27]
So the degradation had a name, a directive behind it, a 2006 deadline, and a President announcing it would end early. And Washington kept the capability and said so in the same statement: “We have demonstrated the capability to selectively deny GPS signals on a regional basis when our national security is threatened.”
Two things in Washington’s favor: it ran GPS itself, whereas here it only advises private firms about their own products, and Selective Availability was fixable with differential GPS, so candor cost less than it looks. Still, the GPS error was global, bounded, published, and correctable, and an altered answer is none of those.
I’ve mapped the off switches in the AI stack before, as three: chips, cloud, and models.[28] What the three have in common is that you can see them. A revoked license, a suspended tenant, or a blocked region each leaves a record that someone can point to.
Degrading answers for accounts a provider suspects is a fourth lever, underneath the other three, and it leaves no record the customer can see. GPS shows the government understood that people whose service it degrades should be told. The 2026 recommendation pulls the same lever and says to tell only the evaluators.
What the agencies would say, and where they’re right
The agencies have a good answer, and it starts with what kind of document this is.
A joint cybersecurity advisory is written for defenders about controls. This one opens by granting that distillation is “recognized as a legitimate and useful technique in AI research”, and it recommends instead of requiring.[29] Focusing on the serving path is the genre doing its job. So is the sourcing: an unclassified product cites open material by convention, so the reference list shows what convention produces, not what the agencies know. And the threat it documents really does run through APIs.
Nor do the two White House memoranda it cites go after the weights: the one on distillation says the United States “will continue to foster a vibrant open-source ecosystem built on firm foundations”, and saves its fire for models “derived from acts of malicious exploitation”.[30] And degrading answers isn’t obviously wrong either. On the advisory’s own account, these are fraudulent accounts, opened in breach of the terms of service, and a provider that makes its product less useful to someone abusing it is enforcing a contract.
Washington has also told private firms to keep quiet about suspects before: a bank that reports a suspicious transaction may not tell the customer. But the bank hides the report, not what happens to you, because a blocked wire or a closed account is hard to miss. And on September 2nd, six days before this advisory, five federal agencies said a bank may tell a customer that a restriction or closure “may be related to suspected fraud or other suspicious activity”.[31] This advisory wants its changes to “avoid triggering obvious alerts”.
Anyone who has run an API bill will raise the strongest objection of all: you could never verify these outputs anyway. Models get swapped behind a stable name, quantization changes, requests get routed by load, and safety filters move. The vendors admit some of it: OpenAI didn’t proactively announce the GPT-4o update it pulled from ChatGPT in April 2025, “because we expected this to be a fairly subtle update”, and Anthropic’s docs say the weights under a model ID are fixed, but “the serving infrastructure around the model can change over time”.[32]
Fair point, and I wouldn’t promise anyone the same answer twice from a hosted model. But a change that hits every customer is one thing: somebody notices, and OpenAI began rolling that update back three days later. A change that is deliberate, aimed at particular accounts, built to be hard to spot (for example, shallower reasoning that still lands on the right answer), and recommended by three agencies, with a note not to mention it is another, and a buyer shouldn’t treat the two alike.
On September 9th, China’s commerce ministry said the accusations have “no basis in fact or law”, that distillation is “a neutral technical means” used by model makers worldwide, American ones included, and that if Washington moves against Chinese AI companies “in the name of fighting distillation”, China “will resolutely take countermeasures”.[33]
A rule for the Pentagon, advice for everyone else
I’ve argued before that rules bind the people who were never the threat.[28] This advisory is what the next step looks like.
Inside the administration, the direct route has reportedly been tried and has gone nowhere. Axios reported in July 2026, citing sources close to the administration, that during 2025 it considered an executive order, an Entity List designation, an agency advisory, and Commerce rules to restrict Chinese models, and killed every one; the same piece reports the momentum coming back.[34] In August, Axios reported that an unpublished White House framework says nothing in it should be read as restricting open models once they’re released.[35]
Executive Order 14409 of June 2nd, 2026, may appear to close that route. It says nothing in its section “shall be construed to authorize” a mandatory licensing, preclearance, or permitting requirement for new models. That’s a rule about how to read one section, not a ban on rulemaking, and the subsection above it orders agencies to design a voluntary framework in which developers could give the government up to thirty days with a covered frontier model before releasing it to other trusted partners.[36] So machinery aimed at the model itself has been ordered, just not made mandatory.
Congress went further, but only for government systems and Pentagon contractors. The Defense Authorization Act signed in December 2025 orders DeepSeek’s AI out of Pentagon systems, bars Pentagon contractors from using it on their contract work, and bans the DeepSeek app from intelligence-agency systems. The Senate’s bill for next year would add Zhipu, Moonshot, MiniMax and Alibaba, among others.[37] For a company deploying these models in its own business, I can’t find a rule: the Federal Register for 2026 has no document naming DeepSeek, Moonshot, MiniMax, StepFun or Zhipu,[38] and Senator Hawley’s S. 321, which would ban importing AI “developed or produced in the People’s Republic of China”, hasn’t moved since it went to committee.[39]
The Entity List binds too. In January 2025, under the previous administration, the Commerce Department put ten companies on it, seven of them carrying the Zhipu name, on the basis that they advance Chinese military modernization through AI research; the advisory’s own table gives Z.AI the Chinese name of the first of them.[40] But that’s an export control: it requires a license for items subject to US export rules when going to Zhipu, and does nothing to address an American company downloading GLM weights and serving them in its own business.
So, beyond those, no rule applies to the weights. What arrived instead is a recommendation, in a document that binds nobody, that providers quietly degrade answers for accounts they suspect. That’s slower than a rule, and it leaves no public record.
If I were buying tokens today
I’d do two things.
The first is a test. You can’t prove from outside that you get the model the vendor sells, but you can look for a weaker one: take a fixed set of prompts from your real traffic, hold the parameters, and run each prompt several times a day from your production account and from one registered and paid for separately and ramped up slowly (new accounts at full use and shared payment details are both on the advisory’s watch list). Compare scores, not single answers. Single answers change for innocent reasons (OpenAI’s caching guide says “identical requests are not guaranteed to produce identical outputs”), while a weaker model should show up in the scores. Shallower reasoning that still lands on the right answer may not, but it may show up as a lower average in the reasoning tokens that OpenAI, Anthropic, and Google report.[42] A change aimed at one account can appear as a gap between the two; a model update appears in both. A 2024 academic test found that 11 of 31 commercial Llama endpoints produced outputs that didn’t match Meta’s released weights. I’d keep it small because accounts sending identical prompts are also on that list.
The second is a clause. OpenAI’s standard agreement already promises an email and a right to walk away if an update “materially reduces the Services’ functionality”. Limiting your account falls under another section, which asks only for “reasonable efforts to notify” and allows it “without prior notice to the extent reasonably necessary”.[43] Ask for the first promise to cover the second case. If that sounds like a big ask, it’s what Washington demands for itself: its national security AI memo tells the national security enterprise to make sure, “through contractual clauses or other means”, that no vendor can “disable or degrade, or materially modify without Federal Government knowledge and approval” the AI its people depend on.[30]
And there’s one setup where the question never comes up: a model you run yourself, the simplest arrangement in which you can show nothing was altered, because you served it. That used to be an argument about cost and control; now it’s also about proving what your own system did.
In June, I wrote that “the tighter Washington shuts its door, the more of the world’s usage walks out the back.”[44] That was about Washington gating its own frontier models; quietly degraded answers could send buyers the same way.
Leave the API alone, and the extraction carries on on the agencies’ own account. Act on the API as this advisory recommends, and the instruction not to tell turns the American product into one a buyer can’t easily check from the outside, even when applied narrowly. Meanwhile, a model already published as open weights, like GPT-oss-20b, is untouched because there’s no interface to access it.
Most of what Washington advises against distillation works only at the American API, and its advice there is to degrade answers quietly for accounts the provider suspects. In 2000, the President announced when the degradation would stop. If this one starts on your account, it’s built not to be noticed.
Notes
[1] NSA, CISA and FBI, joint cybersecurity advisory AA26-251A, “China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies“, released September 8th, 2026. The record copy is the 18-page PDF, U/OO/6059854-26, TLP:CLEAR, marked Ver 1.0; media.defense.gov returns HTTP 403 to automated fetch, and the copy read for this piece is theWayback Machine captureof September 9th, 2026. PDF and HTML were compared in full and agree on every passage quoted here.
[2] Theadvisory, Executive summary, page 2: “The authoring agencies recommend U.S. AI companies take three immediate actions”, of which the second is “Deploy targeted response changes: Subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs to companies conducting industrial-scale distillation campaigns.” The other two are detection and mitigation, and cross-organization intelligence sharing.
[3] Theadvisory, “Implementation strategies”, a subsection of “Response alteration for suspected distillation activity”, pages 13 and 14. Two sentences separate the passages quoted here: “Informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training.” and “Instead, alter responses to users confirmed to be querying frontier models specifically for malicious knowledge distillation campaigns without informing them.”
[4] Theadvisory, executive summary, page 2, the first of the three immediate actions: “monitor subscription-to-usage ratios, immediate maximum usage from new accounts, and enterprise-scale throughput patterns”. And “Novel TTP 4: Systematic quota and cost optimization”, which starts on page 12 and whose detection indicators on page 13 include “usage optimized for cache maximization versus task diversity”. Quoted verbatim from the record-copy PDF, September 10th, 2026; pages rechecked September 11th, 2026.
[5] OpenAI, “Prompt caching“ guide, retrieved September 11th, 2026: “Keep the prefix stable.” Anthropic and Google publish equivalent guidance.
[6] Anthropic, “Detecting and countering misuse of AI: September 2026“, dated September 10th, 2026 in thePDF, section “Illicit distillation and scaled abuse”, retrieved September 11th, 2026: “These labs generally access Anthropic’s models by routing requests through proxy services, also known as “transfer stations.”“ Of those proxy services: “They will often use stolen API credentials belonging to legitimate companies or individuals to give unauthorized entities access to US frontier models.” On its response: “When we are confident that a set of requests are associated with an illicit distillation campaign or other unauthorized use of Claude, we block the request and ban the associated accounts”, and “when we detect signals of potential abuse, like the unauthorized resale of Claude or accounts operating from unsupported countries like China, Russia, and Iran, our systems can require users to verify their identity to retain access.” The report does not mention the advisory, and gives no false-positive rate. The same section: “Zhipu eventually gave up trying to target Fable after Anthropic’s cyber safeguards degraded Zhipu’s attacks.”
[7] Anthropic Help Center, “Why Claude switched models in your conversation with Fable 5 or Fable 5.1“, undated, retrieved September 11th, 2026. The blocking triggers listed include “Distillation attacks on Fable 5 and Fable 5.1, including attempts to extract the model’s summarized thinking”, and “These blocking safeguards are intentionally broad”. On the API, “Until fallbacks are configured, the model will return a 200 response with a stop reason”.
[8] Google, Gemini API “Abuse monitoring“, last updated June 9th, 2026, retrieved September 11th, 2026: “Temporary usage limits: We may limit your access to the Gemini API by adjusting rate limits or changing which model answers a specific request, for example.” The page promises an appeal link for suspension or account closure: “If we reach out to you regarding a suspension or account closure, we will also provide a link where you can appeal.” Google Threat Intelligence Group, “GTIG AI Threat Tracker: From Prompting to Autonomy – The Evolution of Adversarial AI“, September 8th, 2026, retrieved September 11th, 2026: “we have deployed real-time defenses designed to degrade the performance of unauthorized “student” models and detect attempts to clone proprietary logic”, “we have developed and successfully deployed numerous methods to both lower the utility of these campaigns, and block the accounts responsible”, and “we have developed techniques to identify Gemini-distilled models, enabling us to trace the provenance of models derived from our technology”. The post says nothing about notifying accounts and does not mention the advisory. The abuse-monitoring page lists, before usage limits, “Get in touch: We may reach out to you through email to understand your use case and explore ways to bring your usage into compliance.” It does not mention distillation.
[9] Advisory, Attribution section, page 3. The second quotation, “billions of tokens across millions of exchanges/requests”, is in the executive summary on page 1, in a sentence that opens “Likely with Chinese government awareness”.
[10] Theadvisory, References, retrieved September 10th, 2026. The eight listed sources are Anthropic’s distillation post, Google’s GTIG AI Threat Tracker, NIST AI 100-2e2025, OpenAI’s “RE: Updated Stakes for American-Led, Democratic AI”, an article in The Decoder on the gray market in Claude tokens, National Security Presidential Memorandum 11, National Science and Technology Memorandum 4 (”Adversarial Distillation of American AI Models”), and a post on X by the Office of Science and Technology Policy. The OpenAI item is a memo, not a letter to an agency: its header reads “To: US House Select Committee on Strategic Competition between the United States and the Chinese Communist Party / From: OpenAI / Date: February 12, 2026 / Re: Updated Stakes for American-Led, Democratic AI” (OpenAI CDN PDF, retrieved September 10th, 2026;Wayback capture), and the receiving committee’s own hearing record ofApril 16th, 2026confirms it: “In February 2026, OpenAI delivered a memo to this Committee”. The advisory’s hyperlink for the item points not at OpenAI but at aBloomberg-hosted copy, whose first page is identical. Read in full for this piece: the Anthropic and Google posts, the OpenAI memo,The Decoder’s article, NSPM-11, NSTM-4 and the post on X, which is from the account@mkratsios47, July 22nd, 2026, read through a mirror of X’s API: “We have information that Moonshot AI distilled Anthropic’s Fable for the development of its K3 model.” NIST AI 100-2e2025 was read by the desk’s fact-check the same day. Search of all eight, September 11th, 2026: StepFun, Z.AI, Zhipu and gpt-oss appear in none of them. The account @mkratsios47 is that of Michael Kratsios, Director of the Office of Science and Technology Policy.NSTM-4, April 23rd, 2026, is a scanned PDF, read by optical character recognition: “the United States government has information indicating that foreign entities, principally based in China, are engaged in deliberate, industrial-scale campaigns to distill U.S. frontier AI systems.” OpenAI’s memo on its own practice: “We proactively remove users who appear to be attempting to distill our models to develop competitive models to OpenAI.”
[11] Anthropic, “Detecting and preventing distillation attacks“, February 23rd, 2026: “These labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts”. The three labs named there are DeepSeek, Moonshot and MiniMax; the advisory of September names six.
[12] Author’s count from the advisory, verified independently by a second pass over the same document. The seventeen are eleven MITRE ATLAS bullet entries (ten unique identifiers, AML.M0015 printed twice with different descriptions), three prose subsections under “Mitigations”, and three NIST AI 100-2e2025 items. The three prose subsections are the third-level headings “Behavioral detection and monitoring”, “Response alteration for suspected distillation activity” and “Cross-organization information sharing and ecosystem coordination”; “Implementation strategies” is a fourth-level heading inside the second of them, not a section of its own, and the three map one-to-one onto the three immediate actions on page 2. Twelve require the request to reach provider-operated infrastructure: AML.M0015 twice, M0004, M0019, M0024, M0002, M0006, all three prose subsections, and the NIST differential-privacy and prompt-formatting items. Counting only unique identifiers gives 11 of 16; every defensible recount leaves a majority.
[13] Advisory, AML.M0003 (”Use adversarial training and defensive distillation to increase jailbreak difficulty”) and the NIST pre- and post-training interventions. Both describe safety properties trained into the weights, which travel with the artifact and can be removed by fine-tuning; the advisory does not address removal. OpenAI’sgpt-oss model card: “Once they are released, determined attackers could fine-tune them to bypass safety refusals or directly optimize for harm without the possibility for OpenAI to implement additional mitigations or to revoke access.”
[14] Advisory, MITRE ATLAS mitigations, page 15.
[15] Author’s search of the record-copy PDF text and, independently, of the CISA HTML rendering, case-insensitively, September 10th, 2026. Counts identical in both: “weight” as a substring 0, “open source” 0, “open-source” 0, “publicly available” 0, “checkpoint” as a substring 1. The word “publicly” does appear twice, both as “publicly quoted”, about DeepSeek’s training cost.
[16] MITRE ATLAS mitigation AML.M0017, “AI Model Distribution Methods”, read from MITRE’sATLAS data release v2026.08on September 11th, 2026. That release carries thirty-nine mitigation identifiers, and itsrelease notessay “39 mitigations”. The advisory cites ten of them, AML.M0035 included, and AML.M0017 is not among the ten. An earlier read of the deprecateddist/ATLAS.yaml, which “will no longer be updated”, counted thirty-five and lacked AML.M0035; the text of AML.M0017 is the same in both.
[17] Theadvisory, Moonshot AI section, page 4, continuing to page 5, and again in Table 1 on page 6. Table 1’s version of the list omits GPT-4o, so the prose carries eighteen models and the table seventeen. Two of the eighteen entries, “Gemini 2.5 Flash-Image” and “Nano Banana”, are the same model (Google, August 26th, 2025), so the prose list covers at most seventeen distinct models.
[18] Hugging Face API record foropenai/gpt-oss-20b, retrieved September 10th, 2026: licence apache-2.0, created August 4th, 2025, gated false, 6,551,191 downloads in the trailing thirty days. Confirmed independently against OpenAI’sgpt-oss model card: “We release the model weights, inference implementations, tool environments, and tokenizers under an Apache 2.0 license.”
[19] Google Threat Intelligence Group, “GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use“, February 12th, 2026, the second entry in the advisory’s reference list, retrieved September 11th, 2026: “Google continuously detects, disrupts, and mitigates model extraction activity to protect proprietary logic and specialized training data, including with real-time proactive defenses that can degrade student model performance.” Reducing the fidelity of model outputs was in MITRE’s ATLAS catalogue well before either post (AML.M0002, created April 2023, cited by the advisory).
[20] Anthropic, “Detecting and preventing distillation attacks“, February 23rd, 2026, under “Countermeasures”, retrieved September 10th, 2026.
[21] The White House’sNSTM-4, “Adversarial Distillation of American AI Models”, April 23rd, 2026, read by optical character recognition of the scanned PDF on September 11th, 2026: “As methods to detect and mitigate industrial-scale distillation grow more sophisticated, foreign entities who build their AI capabilities on such fragile foundations should have little confidence in the integrity and reliability of the models they produce.” The advisory, page 10: “China-based entities deploy production-grade automated quality assurance pipelines with multi-modal validation, enabling rapid detection of degraded outputs and differentiation of service issues from defensive data degradation.”
[22] LangChain, “State of Agent Engineering“, retrieved September 11th, 2026: a public survey run from November 18th to December 2nd, 2025, “We received 1340 responses”, 63% of them in technology. Overall, “not evaluating” is 29.5%, and 22.8% among teams with agents in production; 52.4% run offline evaluations on test sets. The respondents chose themselves, and LangChain sells evaluation tools.
[23] Advisory, “Response alteration for suspected distillation activity” and its “Implementation strategies” subsection, pages 13 and 14. The section’s triggers are “high-confidence malicious distillation requests” and “When suspecting a malicious distillation campaign”; neither carries a nationality qualifier. One sentence separates the China-scoped sentence from the unscoped one quoted here: the advisory’s stated reason for the secrecy.
[24] Advisory, “Cross-organization information sharing and ecosystem coordination”, page 14; two more sentences follow it.
[25] Author’s search of the record-copy PDF and the CISA HTML rendering, September 10th, 2026: “false positive” appears 0 times, “error rate” 0 times, and the document contains no percentage or rate figure of any kind. Its treatments of wrongly flagged customers are qualitative: under AML.M0002 on page 15, “Reduce fidelity of responses (withhold logits/confidences, shorten responses, targeted redaction). Balance security with user experience.”, and “lower-to-no legitimate user risk” in “Cross-organization information sharing and ecosystem coordination”.
[26] Anthropic, “Improving Fable 5’s biology safeguards“, August 7th, 2026: of the improved classifier: “There will inevitably remain false positives”. Of the launch version it replaces: “We knew this would be frustrating for legitimate biology users: it would result in a high number of false positives in the near term, where users asking biology-related questions would have their requests blocked and sent to a less capable model.” OpenAI, “ChatGPT Agent System Card“, July 17th, 2025: “This means that our safety mitigations will sometimes accidentally prevent safe uses of the product.” Both retrieved September 11th, 2026. Both describe safety classifiers for biological risk, not distillation detectors, and neither gives a false-positive rate on live traffic.
[27] The White House, Office of the Press Secretary, “Statement by the President Regarding the United States’ Decision to Stop Degrading Global Positioning System Accuracy“, May 1st, 2000, retrieved September 10th, 2026 from the National Archives’ frozen copy of the Clinton White House site. The accuracy figure is the statement’s own: civilian users “will be able to pinpoint locations up to ten times more accurately than they do now”, a 10x improvement, quoted rather than derived. The statement records the March 1996 Presidential Decision Directive behind the policy, the commitment to discontinue Selective Availability by 2006, and that the decision followed a recommendation by the Secretary of Defense in coordination with State, Transportation, Commerce and the Director of Central Intelligence. On the error’s shape: the White House fact sheet of the same day, “Improving the Civilian Global Positioning System (GPS)“, says the United States used Selective Availability “to globally degrade the civilian GPS signal”, that “Previously, a GPS-based car navigation could give the location of the vehicle to within a hundred meters”, and that the policy was to make “both the signal and the receiver design specification available to the public completely free of charge”. GPS.gov’sSelective Availability FAQ(updated October 2001, read through the Wayback Machine) says “Selective Availability was a global degradation of the GPS service. It could not be applied on a regional basis.”, and, asked whether differential GPS was more accurate once SA ended, “No. There should not be much change in the accuracy of DGPS.” Both retrieved September 11th, 2026.
[28] “Access, Disable, Destroy“, March 7th, 2026, which mapped the three-switch model over chips, cloud and models, and coined governance for the governed: “all of it is governance for the governed. Rules for the rule-followers.” And “Objects That Struck the Data Center“, March 2nd, 2026: “Open-source model weights are not scarce — they are infinitely copyable at zero marginal cost.”
[29] Advisory, Purpose section and executive summary.
[30] Advisory, References.NSPM-11, “Artificial Intelligence in the National Security Enterprise”, June 5th, 2026, retrieved September 11th, 2026, tells the national security enterprise to “adapt commercial or open-source AI technologies” and to “ensure, through contractual clauses or other means, that no commercial entity or adversary possesses the capability to prevent use of, disable or degrade, or materially modify without Federal Government knowledge and approval, an AI system that our men and women depend on for their missions”.NSTM-4, “Adversarial Distillation of American AI Models”, April 23rd, 2026, read by optical character recognition of the scanned PDF on September 11th, 2026: “Consistent with America’s AI Action Plan, the United States will continue to foster a vibrant open-source ecosystem built on firm foundations”, and “there is nothing open about supposedly open models that are derived from acts of malicious exploitation”.
[31] 31 U.S.C. 5318(g)(2)(A)(i),Cornell LII, retrieved September 11th, 2026: a financial institution that reports a suspicious transaction may not “notify any person involved in the transaction that the transaction has been reported”. Board of Governors of the Federal Reserve System, FDIC, FinCEN, NCUA and OCC, “Joint Statement on Suspicious Activity Report Confidentiality Considerations Regarding Communications with Customers“, issued with SR 26-5 on September 2nd, 2026, which lists as permitted “Notifying a customer that a delay, limitation, or restriction on an account or service or closure of an account may be related to suspected fraud or other suspicious activity”. On what the confidentiality has cost customers: GAO-18-263, February 26th, 2018, read through theWayback Machinebecause gao.gov refuses automated fetch, estimated from its survey that “93 percent of Southwest border banks terminated accounts because of the filing of SARs”, and reported that people it met in three border communities said banks “terminated the accounts of longtime established customers, sometimes without notice or explanation”. The joint statement also says: “This statement does not alter existing Bank Secrecy Act (BSA) legal or regulatory requirements or establish new supervisory expectations.”
[32] OpenAI, “Expanding on what we missed with sycophancy“, May 2nd, 2025, read in a browser on September 11th, 2026 because openai.com refuses automated fetch: “On April 25th, we rolled out an update to GPT-4o in ChatGPT that made the model noticeably more sycophantic”, “We began rolling that update back on April 28th”, and “Because we expected this to be a fairly subtle update, we didn’t proactively announce it.” Anthropic, “Model IDs and versioning“, retrieved September 11th, 2026: “Model weights are fixed for a given ID, but the serving infrastructure around the model can change over time. This infrastructure includes components such as the request router, safety classifiers, and sampling logic.”
[33] Ministry of Foreign Affairs of the People’s Republic of China, “Foreign Ministry Spokesperson Mao Ning’s Regular Press Conference on September 9, 2026“, retrieved September 11th, 2026. AFP’s question: “Yesterday, the U.S. Cyber Defense Agency accused top Chinese AI labs, including DeepSeek and Moonshot of stealing the capabilities of U.S. models.” China’s Ministry of Commerce, “商务部新闻发言人就美发布中国人工智能企业对美蒸馏活动相关网络安全公告答记者问“ (spokesperson’s answer on the US advisory on Chinese AI companies’ distillation), September 9th, 2026, 21:28, retrieved September 11th, 2026. The originals, in the author’s translation: “美方所谓中国人工智能企业从事”工业规模”蒸馏美模型的指控，于事无凭，于法无据” (the US accusation that Chinese AI companies engage in “industrial-scale” distillation of US models has no basis in fact or law); “蒸馏是人工智能领域各个模型间互相学习的通行做法，本质是中性技术手段，包括美企在内的全球模型企业都在用” (distillation is a common practice by which AI models learn from one another, in essence a neutral technical means, used by model companies worldwide, American ones included); “中方开源模型向包括美企在内的全球企业开放” (China’s open-source models are open to companies worldwide, American ones included); “如果美方以打击蒸馏为名，实施遏压中国人工智能企业的行动，中方必将坚决采取措施予以反制” (if the United States acts to suppress Chinese AI companies in the name of fighting distillation, China will resolutely take countermeasures). The ministry also says that American firms’ own model reports disclose extensive distillation of Chinese models (”美企有关模型研发报告也披露，其大量蒸馏中国模型”); that is the ministry’s claim, not checked here.
[34] Axios, “The secret Trump administration battle to fight Chinese AI”, July 20th, 2026, read via theWayback captureof the same day: “Administration officials keen on keeping regulation from stifling innovation killed all of those efforts”, and “ban momentum is picking up again.” Axios attributes the account to “knowledgeable sources” and “a source close to the administration”. Unnamed sources; reported, not confirmed.
[35] Axios, August 5th, 2026,via the Wayback Machine: “The White House does not plan to publicly release the framework, which explicitly says nothing in it should be interpreted as restricting open models once they’ve been released”. The same piece reports the question “far from resolved”. Bloomberg reported the same development on the same date; only its opening paragraphs are readable without a subscription, so Axios is the source read in full here. The August 5th piece gives no source for the framework’s text beyond “Axios first reported”. Unnamed sources; reported, not confirmed.
[36] Executive Order 14409, “Promoting Advanced Artificial Intelligence Innovation and Security”, signed June 2nd, 2026, published at91 FR 34565, Sec. 3(c). The disclaimer is scoped to that section; Sec. 3(b) orders agencies to “design a voluntary framework with AI developers” through which developers could give the government access to covered frontier models “for a period of up to 30 days before they plan to release such models to other trusted partners”. CBS News, “White House framework for testing AI models remains hidden as concerns about threats mount“, September 10th, 2026, retrieved September 11th, 2026: “The White House finalized the framework by the beginning of August, following an executive order President Trump signed in June”; “Neither the administration nor the companies are required to release the results of the reviews or even say if they participated”; “Last week, OpenAI CEO Sam Altman said the company had submitted its powerful new Astra model for review”.
[37] Public Law 119-60, the National Defense Authorization Act for Fiscal Year 2026, enacted December 18th, 2025,text at GovInfo, retrieved September 11th, 2026. Sec. 1532: the Secretary of Defense “shall require the exclusion and removal of covered artificial intelligence from the systems and devices of the Department of Defense”, and “no contractor may, during the period of performance of such contractor under a contract with the Department of Defense, use covered artificial intelligence with respect to the performance of a contract with the Department”; “covered artificial intelligence” means “any artificial intelligence, or successor artificial intelligence, developed by the Chinese company DeepSeek” or by High Flyer. Sec. 1532(a)(2) lets the Secretary extend this by guidance to any “covered artificial intelligence company”, which includes companies on the Consolidated Screening List or “domiciled in a covered nation”. Sec. 6604, “Prohibition on use of DeepSeek on intelligence community systems”, covers “the DeepSeek application or any successor application or service”. The Senate’s bill for fiscal year 2027,S. 4784 as reported(Report No. 119-127), Sec. 1651, amends Sec. 1532 to add AI “developed by the Chinese company” Baidu, Zhipu AI, Moonshot AI, 01.AI, “Mistral-rival Minimax”, Alibaba and Tencent, and to make the guidance mandatory; itsbill-status recordshows a motion to proceed on July 27th, 2026. The House passed its own bill, H.R. 8800, on July 22nd, 2026, by 216 to 212; its text does not name these companies.
[38] Two independent registries, searched September 10th, 2026. The document leg is the author’s queries against theFederal Register documents API, publication dates January 1st to September 10th, 2026: DeepSeek 0, Moonshot AI 0, MiniMax 0, StepFun 0, Zhipu 0, “Z.ai” 0, Qwen 0, “Kimi K3” 0 (rerun September 11th, 2026, same counts); “open-weight” 2, both promotional notices. The independent confirmation is theeCFR search APIover codified Title 15, which returns 0 for DeepSeek, Moonshot, MiniMax, StepFun and Qwen, and 9 for Zhipu; published documents and codified text are separate corpora. The nine are dated versions of one codified section, the Entity List at 15 CFR part 744, Supplement No. 4 (the API describes its result as “Changes to sections matching ‘Zhipu’ in Title 15”, rechecked September 11th, 2026), which is the export control the piece goes on to describe, not a restriction on deployment. The one plausible counterexample, GSA’s proposed rule on large language model acquisition of June 17th, 2026, was read in full and contains no occurrence of “China” or “foreign adversary”. Two limits on what this shows, found at the checking stage: “Alibaba” returns four 2026 documents, among them the Defense Department’s “Notice of Availability of Designation of Chinese Military Companies“, 91 FR 35189, June 10th, 2026, which lists “Alibaba Group Holding Limited”; and neither registry shows statutes, so the Federal Register search cannot see the defence law in note [37]. The claim the body rests on this note is therefore limited to deployment by a company in its own business.
[39] H.R. 1121, “No DeepSeek on Government Devices Act“, 119th Congress, as introduced: “To prohibit the use of DeepSeek by the executive agencies, and for other purposes”, sponsored by Mr. Gottheimer. Its section 2 directs the Office of Management and Budget to require removal of the DeepSeek application from federal agency information technology. Action history from theGovInfo bill-status record, retrieved September 10th, 2026: two actions, both on February 7th, 2025, introduced and referred to House Oversight and Government Reform, and nothing since. The same record shows the Senate companion, S. 765, read twice and referred to Homeland Security and Governmental Affairs on February 27th, 2025, with no action after that. The congress.gov page carries the same history; it is not linked because it returns HTTP 403 to automated retrieval. Senator Hawley’s S. 321, the “Decoupling America’s Artificial Intelligence Capabilities from China Act of 2025”,as introduced: “the importation into the United States of artificial intelligence or generative artificial intelligence technology or intellectual property developed or produced in the People’s Republic of China is prohibited”. Itsbill-status record, retrieved September 11th, 2026, shows it introduced, read twice and referred to the Committee on the Judiciary on January 29th, 2025, and nothing since. The No DeepSeek bill’s approach was enacted for intelligence-agency systems in Public Law 119-60, Sec. 6604 (note [37]).
[40] Bureau of Industry and Security, Entity List addition,90 FR 4617, January 16th, 2025, four days before the change of administration on January 20th, 2025, retrieved September 10th, 2026. The rule adds eleven entities under eleven entries; ten of them are named in one determination, “because these entities advance the People’s Republic of China’s military modernization through the development and integration of advanced artificial intelligence research”, and the eleventh, a lithography company, in a separate one. Seven of the ten carry the Zhipu name: Beijing Zhipu Huazhang, Beijing Zhipu Future, Beijing Zhipu Linghang, Beijing Zhipu Qingyan, Hangzhou Zhipu Huazhang, Shanghai Zhipu Huanyu and Shenzhen Zhipu Future. The other three are Beijing Lingxin Intelligent, Beijing Yuanyin Intelligent and Nanjing Zhihu Information Technology. The advisory’s Table 1 prints 北京智谱华章科技有限公司 against its Z.AI row, which transliterates to Beijing Zhipu Huazhang Technology Co., Ltd., the first company on the January 2025 list; the match is the author’s, and the advisory does not mention the Entity List. The Beijing Academy of Artificial Intelligence was added onMarch 28th, 2025. Both entries remain in the current eCFR, Part 744, Supplement No. 4, retrieved September 10th, 2026.
[41] Chris Lehane, OpenAI, “The AI policy window is open. We need to act.“, September 9th, 2026. openai.com returns HTTP 403 to automated fetch; read via theWayback captureof September 10th, 2026. Author’s search of the full text, same date: “distill” 0, “China” 0, “Chinese” 0, “CISA” 0, “FBI” 0, “advisory” 0. OpenAI is a signatory to the July open letter, which it joined after the launch roster of 25; the post says “As we affirmed in signing the Open Weights and American AI Leadership letter”.
[42] On innocent variation: OpenAI’sprompt caching guide: “Prompt caching does not change how the model generates output tokens. The model generates a new response using the cached prefix, so identical requests are not guaranteed to produce identical outputs.” Anthropic’sprompt caching documentation: “The response you receive is identical to what you would get if prompt caching were not used.” On reasoning tokens: OpenAI’sreasoning guidesays reasoning tokens “are billed as output tokens” and reports them inoutput_tokens_details.reasoning_tokens; Anthropic’sadaptive thinking documentation: “the model evaluates each request and decides for itself whether to think and how much”, and “To see how many billed output tokens were spent on internal reasoning, read usage.output_tokens_details.thinking_tokens in the response”; Google’sGemini thinking guide, last updated September 9th, 2026, reportstotal_thought_tokens. Because thinking is adaptive, single counts vary; the test compares averages. Artificial Analysis, “Launching the Endpoint Accuracy Index: Same Model, Different Accuracy“, August 4th, 2026, on open-weight endpoints: “Endpoints that score below the reference generally produce fewer output tokens per task. Output limits and reduced reasoning effort show up directly in token usage”. Irena Gao, Percy Liang and Carlos Guestrin, “Model Equality Testing: Which Model Is This API Serving?“, ICLR 2025: applied to “commercial inference APIs from Summer 2024 for four Llama models”, the test found “11 out of 31 endpoints serve different distributions than reference weights released by Meta”, using “an average of just 10 samples per prompt”; a statistical test against published weights, which closed models don’t have. The watch-list items are in the advisory: page 2, “immediate maximum usage from new accounts”; page 8, “multiple accounts with similar registration details and payment methods”; page 9, “identical or similar prompt texts”. All retrieved September 11th, 2026.
[43] OpenAI, “Services Agreement“, version v.010126, retrieved September 11th, 2026. Section 2.3: “If an OpenAI update materially reduces the Services functionality, OpenAI will notify Customer at the Account email address.” Section 8.2, on limiting or suspending access: “OpenAI will use reasonable efforts to notify Customer before limiting to or suspending the Services pursuant to the preceding sentence but may do so without prior notice to the extent reasonably necessary.” Section 2.3 continues: “Within five business days of receipt of this notice, Customer may choose to terminate the Agreement by providing thirty days written notice.” Section 8.2’s grounds: “(a) it is required to do so by law; (b) Customer violates the Agreement or OpenAI Policies; or (c) doing so is necessary to prevent or terminate a Security Emergency.” Section 12.1 warrants that the Services “will conform in all material respects with the Documentation”.
[44] “Too Dangerous for You, Free for Everyone“, June 28th, 2026.