Washington has vowed to curb what it sees as the unauthorized extraction of intellectual property from United States-developed artificial intelligence models, sharpening its stance just as China’s DeepSeek unveiled its latest system.

The White House Office of Science and Technology Policy (OSTP) said on Thursday, April 23),that information indicated that foreign entities, principally based in China, are engaged in deliberate, industrial-scale campaigns to distill US frontier AI models.

“Leveraging tens of thousands of proxy accounts to evade detection and using jailbreaking techniques to expose proprietary information, these coordinated campaigns systematically extract capabilities from American AI models, exploiting American expertise and innovation,” Michael Kratsios, an assistant to the president for science and technology director, OSTP, said in a memorandum for the heads of US government departments and agencies. 

“Models developed from surreptitious, unauthorized distillation campaigns like this do not replicate the full performance of the original,” he said. “They do, however, enable foreign actors to release products that appear to perform comparably on select benchmarks at a fraction of the cost.”

He added that these distillation campaigns also allow those actors to deliberately strip security protocols from the resulting models and undo mechanisms that ensure those AI models are ideologically neutral and truth-seeking.

According to the memorandum, the Trump administration will:

• share intelligence with US AI companies on attempts by foreign actors to carry out unauthorized, industrial-scale distillation, including tactics used and actors involved;
• enable closer coordination across the private sector to counter such activities;
• partner with industry to develop best practices to detect, mitigate and remediate industrial-scale distillation, and to strengthen defenses;
• explore measures to hold foreign actors accountable for industrial-scale distillation campaigns.

The warning came before the launch of DeepSeek V4 on Friday, April 24, highlighting growing concern in Washington over how Chinese developers are narrowing the gap with US frontier models.

DeepSeek, a Zhejiang-based company, has been explicit about its methods. In late January 2025, it said it used knowledge distillation techniques to train its V3 model, a process often likened to a student learning by asking a teacher many questions and absorbing the answers.

In a research paper published on Friday, the company said it had advanced that approach with a technique known as On-Policy Distillation (OPD) to train V4, drawing on the outputs of 10 separate “teacher” models. In practical terms, OPD allows a model to first generate its own responses before consulting multiple teachers to refine and correct them, accelerating the learning cycle.

DeepSeek said the V4 model inherited its design from DeepSeek-V3 but underwent a series of modifications.

“Through the expansion of reasoning tokens, DeepSeek-V4-Pro-Max demonstrates superior performance relative to GPT-5.2 and Gemini-3.0-Pro on standard reasoning benchmarks,” the company said. “Furthermore, DeepSeek-V4-Flash-Max achieves comparable performance to GPT-5.2 and Gemini-3.0-Pro, establishing itself as a highly cost-effective architecture for complex reasoning tasks.”

The company said DeepSeek V4’s performance only lags about 3 to 6 months behind state-of-the-art frontier models, such as GPT-5.4 and Gemini-3.1-Pro.

OpenAI released GPT-5.2 in December, while Google launched Gemini 3.0 Pro last November.

‘Distillation attacks’

In January 2025, the debut of DeepSeek V3 sent shockwaves through Wall Street, as investors reacted to the strong performance of a low-cost Chinese AI model that appeared to rival US systems.

During a US Senate meeting on January 29 that year, Commerce Secretary Howard Lutnick said DeepSeek was able to build its models “dirt cheap” by purchasing large quantities of Nvidia chips via third countries and drawing on data from Meta’s open platform.

However, US President Donald Trump said in February 2025 that the development of cheaper AI was an inevitable technological shift and could ultimately benefit the US, adding that lower costs would be a very good development. 

Criticism in Washington over Chinese AI firms’ use of distillation techniques cooled for almost a year before reports of industrial-scale distillation activity, often described as “distillation attacks,” reignited the debate in recent months.

In a memorandum sent on February 12 to the US House Select Committee on China, OpenAI said DeepSeek had used distillation techniques as part of what it described as ongoing efforts to “free-ride on the capabilities developed by OpenAI and other US frontier labs.”

The company added that it had identified “new, obfuscated methods” intended to bypass safeguards designed to prevent misuse of its models’ outputs. The memo indicated that attempts to curb such activity have not fully succeeded.

Anthropic said in a report on February 23 that it has identified industrial-scale campaigns by three Chinese AI laboratories, including DeepSeek, Moonshot and MiniMax, to illicitly extract Claude’s capabilities to improve their own models. 

“These labs generated over 16 million exchanges with Claude through approximately 24,000 fraudulent accounts, in violation of our terms of service and regional access restrictions,” the company said.

“Distillation can also be used for illicit purposes: competitors can use it to acquire powerful capabilities from other labs in a fraction of the time and at a fraction of the cost that it would take to develop them independently,” it said.

The report said such “distillation attacks” follow a repeatable pattern. Attackers gain access via proxy services that resell usage at scale, using networks of fraudulent accounts to evade detection. They then send large volumes of structured prompts to extract capabilities or build datasets, with thousands of near-identical prompts across coordinated accounts targeting high-value functions.

A prompt is the input or instruction given to an AI model to guide its response. The report gave an example used by distillation attackers: “You are an expert data analyst combining statistical rigor with deep domain knowledge. Your goal is to deliver data-driven insights, not summaries or visualizations, grounded in real data and supported by complete and transparent reasoning.”

On April 16, the US House Select Committee on China held a hearing titled “China’s Campaign to Steal America’s AI Edge,” where lawmakers accused Chinese firms of purchasing Nvidia’s high-end chips via third countries and using distillation to extract data from US AI models.

“Chinese labs are resorting to unauthorized distillation attacks to extract information from our best AI models” said Select Committee on China chairman John Moolenaar. “Since they don’t have enough AI chips to develop the models on their own, they prefer to simply steal them from their American competitors. Anthropic, OpenAI, and Google have all verified that this is happening.”

Moolenaar said Congress must pass legislation to stop China’s multiprong effort to legally and illegally acquire American technology for use against the US.

Ascend 950PR

Commenting on the White House’s accusation against Chinese firms’ alleged theft of US AI intellectual property, Chinese Foreign Ministry spokesperson Guo Jiakun said the claims are groundless and are deliberate attacks on China’s development and progress in the AI industry.

“We urge the US to respect facts, discard bias, stop its containment of China’s sci-tech development, and choose the course of action conducive to sci-tech exchanges and cooperation between China and the US,” he said. 

Earlier this month, a group of bipartisan US lawmakers introduced the Multilateral Alignment of Technology Controls on Hardware (MATCH) Act to try to block Chinese chipmakers from accessing ASML’s deep-ultraviolet (DUV) immersion lithography systems.

Lawmakers are now extending that focus beyond hardware, calling for measures to prevent Chinese firms from distilling US AI models.

These developments came after Beijing’s push to discourage domestic technology firms from purchasing Nvidia H200. Lutnick said on Wednesday, April 22, that no H200 chips had yet been sold to Chinese companies, citing difficulties those firms face in securing approval from the Chinese government. It has been three months since Trump approved the exports of the AI chip to China. 

A Henan-based technology columnist writes that Chinese AI firms remain keen to purchase Nvidia’s H200 chips but are wary that orders could be disrupted if US policy shifts abruptly. He says DeepSeek V4 and Huawei Technologies’ newly launched Ascend 950PR chips are likely to form the backbone of China’s emerging AI ecosystem.

On March 22, Huawei introduced the Ascend 950PR, saying the chip delivers 2.87 times the performance of the H20 and approaches that of H200. Media reports said the company plans to ship about 750,000 units this year.

Read: US lawmakers seek to block China’s DUV lithography access

Follow Jeff Pao on X at @jeffpao3