White House Names China's AI Distillation A National Security Threat

Let me tell you what the White House just put on paper.

This week, the Office of Science and Technology Policy released a memo. The title sounds dry. It is called Adversarial Distillation of American AI Models. Inside the building, they refer to it as NSTM-4. And what it says, in plain English, is that the United States government now has evidence that China is running an industrial scale operation to clone American artificial intelligence.

Not steal weights. Not break into a data center. Something far more interesting and, in some ways, much harder to stop. They are typing into the chatbot.

The memo was signed by Michael Kratsios. He runs the OSTP. He is the most senior science and technology official in the White House. And the words he chose are not the usual diplomatic hedging. He calls the campaigns deliberate. He calls them industrial scale. He says foreign actors are using tens of thousands of proxy accounts, with jailbreaking techniques layered on top, to siphon off the outputs of frontier AI models built by American labs.

The technique has a name. It is called distillation. And if you have followed the AI industry at all in the last year, you have heard it before. Every major lab in the United States has been quietly accusing Chinese labs of doing this for months. Now the federal government has gone ON THE RECORD.

What changed this week is the tone. Until now, the accusations came from private companies. OpenAI accused DeepSeek of running obfuscated traffic through third party routers. Anthropic accused DeepSeek and Moonshot and MiniMax. Google has been quietly tracking Chinese researchers extracting Gemini outputs at scale. The administration mostly stayed in the background. As of this week, that has changed. The federal government is no longer reading along. It is putting its name on the indictment, and the language it is using is the language of state level intelligence loss.

Here is the receipt the memo leans on the hardest. Earlier this year, Anthropic published an internal investigation into a coordinated campaign run against its Claude models. The numbers are stunning. Anthropic identified roughly 24,000 fraudulent accounts engaged in what it calls extraction at scale. Those accounts generated more than 16 million exchanges with Claude. The traffic was traced to three Chinese AI labs you have probably heard of. MiniMax. Moonshot AI. And DeepSeek.

MiniMax alone ran more than 13 million exchanges through Claude. Moonshot ran more than three million, focused on reasoning, tool use, and coding. DeepSeek ran the smallest volume on Anthropic's models, around 150,000 exchanges, concentrated tightly on logic and alignment. All three labs allegedly used commercial proxy services to bypass the geographic restriction Anthropic places on customers in China. They did not steal any source code. They did not break in. They simply BOUGHT API access through layers of intermediaries and ran a giant data harvesting operation through the front door.

That is the case the White House is now formalizing as a national security concern.

So what is distillation, in practice. Why does it matter. And why is the federal government suddenly treating this like a counterintelligence problem.

Distillation is, fundamentally, a way of transferring capability from a strong model into a weaker one. The strong model, called the teacher, generates a very large number of carefully chosen responses. The weaker model, called the student, learns to mimic those responses. If you do it well, the student starts to approximate the teacher on the tasks the queries were chosen to surface. The result is a smaller, cheaper model that performs at a level its training budget should not have purchased.

Distillation as a technique is not new. It is not illegal. American labs do it INTERNALLY all the time. The legal and political question is what happens when you do it across the wall, on a model you do not own, using accounts that explicitly violate the terms of service of the model you are extracting from.

What changed is the scale. A research team using distillation on a competitor's API once or twice a week is annoying but tolerable. A state level operation running tens of thousands of accounts continuously, around the clock, is something else entirely. It is the difference between shoplifting and a heist crew. The OSTP memo lands hard on that distinction. The campaigns it describes were not curiosity driven. They were industrialized.

The Kratsios memo argues, essentially, that the answer is national security harm. The reasoning has three layers. First, distilled models can match the teacher on enough benchmarks to confuse the market about who is actually leading the frontier. Second, distillation strips the safety training and the careful alignment that the teacher was trained to enforce. And third, at industrial scale, this transfers years of American research and tens of billions of dollars of compute into adversary hands at almost no cost.

Kratsios told reporters that foreign entities who build on such fragile foundations should have little confidence in the integrity and reliability of the models they produce. Translation. The student looks like the teacher until it is asked something the teacher was carefully trained to refuse, and then it falls apart in unpredictable ways. That is a safety story, but it is also a marketing story. The administration is openly framing distillation not just as theft but as a quality and trust problem in the resulting Chinese models.

Now look at the timing. The memo dropped this week. The very next day, DeepSeek announced DeepSeek V4. A new flagship model that, according to early benchmarks, gets within a handful of points of frontier American systems at a fraction of the cost. Was that timing an accident. Almost certainly not. And the Trump and Xi summit is now scheduled for next month in Beijing, less than three weeks away. A summit where AI controls and semiconductor controls are the central agenda items.

The White House did not put this memo out into a vacuum. It put it out as the leading edge of a negotiating position.

Now let's talk about what actually happens next. Because the most honest part of this story is that nobody has a clean answer.

The memo itself is, at this stage, not a regulation. It is a directive to the federal apparatus. It tells the executive branch to share threat intelligence with frontier AI companies. It tells agencies to coordinate on technical defenses, like smarter rate limiting and detection of coordinated proxy traffic. It tells lawyers and diplomats to develop accountability options. None of those steps, on their own, stop a Chinese lab from buying API credits through a third country.

Retired NSA director Paul Nakasone, one of the few public voices the administration is listening to on this, has floated three categories of response. New export controls on the compute and chips Chinese labs need to retrain a distilled student. Formal diplomatic protests through State and Commerce. And tailored technology restrictions, which is a polite way of saying targeted sanctions on the specific labs and their funding networks.

Each of these is HARDER than it sounds. Export controls have been in place against Chinese chip access for years, and Chinese frontier labs have continued to scale anyway. Diplomatic protests against Beijing have produced almost nothing during this entire AI cycle. And targeted sanctions on labs like DeepSeek and MiniMax run straight into the fact that they are deeply embedded with Chinese state backed funds.

The deeper problem is structural. The American AI labs being distilled from also need the largest commercial markets to fund their next wave of models. They want every developer in the world on their API. They cannot easily wall off their own product without slowing their own growth. And they cannot easily detect a well funded adversary running tens of thousands of stealth accounts through commercial proxies. Anthropic admitted in its own write up that it took months to map the campaign. Months in which the data was ALREADY OUT.

The administration also says it wants to preserve legitimate open source AI development. But the line between legitimate research collaboration and adversarial extraction is, by design, fuzzy. A Chinese researcher fine tuning Llama 4 on her laptop is not a national security event. A coordinated campaign of tens of thousands of commercial accounts is. The space between those two cases is where policy will actually get written, and it is going to be uncomfortable.

The reaction from Beijing has been predictable. Chinese officials have rejected the framing, argued that distillation is a normal part of AI development, and characterized the memo as a political maneuver to set the agenda for the upcoming summit. They are not entirely wrong about the last point.

For the AI industry inside the United States, the message is the one that has been quietly true for two years. The frontier is now being defended like infrastructure. The labs are now defended like banks. The federal government is treating extraction of model behavior as a category of intelligence loss.

So where does this leave things. The White House just told the world that the AI race is now a counterintelligence story. The named adversaries are DeepSeek, MiniMax, and Moonshot AI. The platform of attack is the chatbot itself. The next move belongs to the administration and to the labs they are about to share threat intelligence with. The move after that belongs to whoever sits across the table in Beijing next month.

This is the moment the AI cold war stopped being a metaphor.

Stay sharp.

Jane Sterling, Sterling Intelligence.