Political and geopolitical view of AI distillation

Key figures · 8 figures

Key findings · 10 findings

1. Distillation is now a named category in US national security policy — but naming has not produced sanctions

   OSTP memorandum NSTM-4, 'Adversarial Distillation of American AI Models,' issued by OSTP under Director Michael Kratsios on April 23, 2026, is the first US policy instrument to formally classify systematic capability extraction from frontier models as a national security threat. It found that foreign entities, principally in China, are running 'deliberate, industrial-scale campaigns' using tens of thousands of proxy accounts, and committed the executive branch to threat-intelligence sharing with industry, joint defensive best practices, and exploration of accountability measures. NSPM-11, signed June 5, 2026, then directed the national security enterprise to help secure US models against distillation attacks. Naming has not yet become enforcement: no Chinese AI lab has been sanctioned or Entity Listed specifically for distillation as of early September 2026. In June 2026 the administration held off publishing an expanded blacklist covering DeepSeek and 100+ other flagged firms, reportedly to avoid escalating with Beijing, and DeepSeek was absent from the Pentagon's June 2026 1260H expansion that added Alibaba and Baidu. Treasury Secretary Bessent's July 21, 2026 warning that Washington could sanction overseas models found to have stolen from US firms remained a threat.

   Sources nextgov.com · whitehouse.gov · justsecurity.org · cnbc.com · cnbc.com · cnbc.com

2. The legal core of the accusation is breach of contract, not IP theft — and that is a weaker peg than the rhetoric implies

   US copyright law does not protect purely machine-generated outputs, and OpenAI's own terms assign output rights to the user, so a copyright claim against a distiller is difficult. Trade secret theory is available but unsettled: it depends on whether querying an API counts as acquisition by 'improper means.' The theory that actually fits is contract — OpenAI's terms bar using Output 'to develop models that compete with OpenAI' — plus, where fraudulent accounts and evaded geo-restrictions are involved, the Computer Fraud and Abuse Act. H.R. 8283 mirrors this: its definition of a 'model extraction attack' turns on circumventing access controls, using fraudulent credentials, or violating terms of service. The symmetry argument has never gone away either: because copyright does not protect bare machine outputs and terms of service are private contracts, critics — including a Cornell tip sheet published within days of OpenAI's January 2025 statement — note that training on publishers' content also violated those publishers' terms. The asymmetry the labs rely on is jurisdictional and contractual rather than moral, which is why the fight migrated to export controls, sanctions and procurement bans rather than the courts.

   Sources govinfo.gov · law.asia · justsecurity.org · copyright.gov · news.cornell.edu · futurism.com

3. Building federal sanctions on top of private terms of service is the central critique of the 2026 bills

   ITIF's July 28, 2026 analysis of H.R. 8283 argues the bill leans too heavily on terms-of-service violations — private contracts that vary provider to provider — as the trigger for federal designation, and that an 'AI Model Extraction Attackers List' built on unverified corporate disclosures raises due-process concerns. It recommends narrowing the definition to intentional account fraud, requiring public evidentiary summaries, and adding safe harbours for open-source development, academic research and security testing. The Institute for Law & AI makes a parallel argument: policymakers should first ask how much distillation actually contributes to the capability gap before locking in restrictions.

   Sources itif.org · law-ai.org · lawfaremedia.org

4. Disclosure moved from anecdote to numbers — and the numbers keep growing

   January 2025 accusations were qualitative: Microsoft security researchers observed suspected DeepSeek-linked individuals exfiltrating data via the OpenAI API, and David Sacks cited 'substantial evidence' without detailing it. By February 2026 the labs published counts: Anthropic attributed 150,000+ exchanges to DeepSeek, 3.4 million to Moonshot AI and 13 million to MiniMax across ~24,000 fraudulent accounts; Google's Threat Intelligence Group disrupted a cluster of 100,000+ prompts aimed at coercing Gemini reasoning traces. By June 2026 Anthropic put a single Alibaba-linked campaign at 28.8 million exchanges. The trend line of disclosed volume is the single most concrete input to the policy debate.

   Sources anthropic.com · techinformed.com · d1e00ek4ebabms.cloudfront.net · cloud.google.com

5. Export controls and distillation policy are the same argument in two registers

   Anthropic's public position is that distillation 'reinforces the rationale for export controls,' because harvested exchanges are only useful if the distiller has compute to train on them. Dario Amodei made the compute-asymmetry argument in January 2025. The counter-current is commercial: the Biden AI Diffusion Rule (Jan 15, 2025) was rescinded before its May 15, 2025 enforcement date; the GAIN AI Act, which would have required US customers be served first, passed the Senate as an NDAA amendment in October 2025 but was dropped from the final FY2026 NDAA; and in January 2026 H200 and MI325X exports moved from presumption of denial to case-by-case review with a 25% tariff.

   Sources anthropic.com · darioamodei.com · wiley.law · nextgov.com

6. Private corporate policy has become de facto foreign policy

   OpenAI blocked API traffic from unsupported regions including mainland China on July 9, 2024, then introduced Verified Organization ID checks for frontier API access in April 2025. Anthropic went furthest: on September 5, 2025 it barred service to companies more than 50% owned by entities in China, Russia, Iran and North Korea regardless of where those subsidiaries operate, accepting a revenue hit it described as in the low hundreds of millions of dollars. These access rules, not statutes, are what H.R. 8283 would convert into a designation trigger — which is precisely why critics call the mechanism circular.

   Sources semafor.com · rte.ie · help.openai.com · restofworld.org

7. Evidence quality is contested, and at least one White House accusation drew expert pushback

   On July 22, 2026 OSTP Director Kratsios accused Moonshot AI of distilling Anthropic's Fable to build Kimi K3 and of obtaining export-controlled Nvidia servers. Researchers including Nathan Lambert (Allen Institute for AI) and Braden Hancock (Laude Institute) publicly doubted that distillation alone could explain K3's capabilities on that timeline — Fable had been publicly available only since July 1 — and no supporting evidence was published. Earlier, US officials alleged DeepSeek trained V4 on smuggled Blackwell GPUs; Nvidia called the claim farfetched and DeepSeek's V4 preview shipped optimised for Huawei Ascend silicon. Accusation-without-published-evidence is a recurring pattern.

   Sources cyberscoop.com · techcrunch.com · technologyreview.com

8. China's response has moved from denial to mirror-imaging

   The Chinese Embassy in Washington called US allegations groundless and framed them as attacks on China's AI development. On July 27, 2026 the Ministry of Commerce went further, accusing 'many American AI enterprises' of distilling Chinese models — naming none and supplying no evidence — calling US actions 'double standards' and 'AI hegemony,' and promising 'all necessary measures' if Chinese firms were sanctioned. Separately, FT reported that MOFCOM was consulting Alibaba, ByteDance and Zhipu on adding model weights, key training data and chip designs to China's technology export catalogue, which would make Chinese open weights themselves a licensed export.

   Sources implicator.ai · techrepublic.com · cnbc.com

9. The EU regulates capability, not provenance — which leaves distillation largely untouched

   EU AI Act GPAI obligations began applying August 2, 2025, backed by a Code of Practice published July 10, 2025 with Transparency, Copyright, and Safety & Security chapters; Commission enforcement powers, including fines up to EUR 15 million or 3% of global turnover, went live August 2, 2026. None of this creates a distillation-specific offence. Europe's actual friction with Chinese models has run through GDPR instead — Italy's Garante ordered DeepSeek's chatbot blocked in early 2025, and Berlin's commissioner found its transfer practices unlawful — while self-hosted open weights on EU servers sidestep the transfer question entirely.

   Sources artificialintelligenceact.eu · ec.europa.eu · privacylaws.com · pinsentmasons.com

10. A grey market for API access is the practical enforcement problem

    Extraction at the scale the labs describe requires access the labs have formally denied. Reporting on China's 'transfer station' economy describes tens of thousands of internet-facing servers running reseller billing panels that proxy OpenAI, Anthropic, Google and other Western models into China, sometimes at roughly a tenth of list price. Anthropic says a single proxy network managed more than 20,000 fraudulent accounts. H.R. 8283 responds by defining a 'fraudulent account network provider' as a designation target in its own right — with a carve-out for services that enable internet access for freedom of expression.

    Sources chinatalk.media · deeplearning.ai · govinfo.gov

Charts · 5 charts

Tables · 6 tables

Timeline · 47 events

1. 7 October 2022 policy

   BIS imposes advanced computing export controls on China

   Cuts off A100/H100-class GPUs. Nvidia responds with China-specific A800 and H800 parts with reduced interconnect bandwidth. This is the compute-asymmetry baseline that later distillation arguments rest on.

   Source: congress.gov

2. 17 October 2023 policy

   BIS closes the A800/H800 workaround

   The October 2023 update captures the China-tailored parts. Nvidia then announces H20, L20 and L2 for the Chinese market.

   Source: cset.georgetown.edu

3. 9 July 2024 product

   OpenAI blocks API traffic from unsupported regions including mainland China

   Developers in China had been reaching the API through VPNs; OpenAI began blocking that traffic. Microsoft's Azure China joint venture continued serving eligible customers, an early illustration of how corporate access policy fragments.

   Source: restofworld.org

4. 27 December 2024 research

   DeepSeek V3 is reported to self-identify as ChatGPT

   Widely reported behaviour in which V3 described itself as a version of ChatGPT. Later cited by the House Select Committee and by AFPI testimony as circumstantial evidence of OpenAI-derived training data.

   Source: techcrunch.com

5. 15 January 2025 policy

   AI Diffusion Rule published

   Biden-era framework imposing worldwide tiered licensing on advanced computing, with enforcement scheduled for May 15, 2025. OpenAI's March filing would later propose banning PRC-produced models within its Tier 1 country group.

   Source: wiley.law

6. 28 January 2025 policy

   David Sacks says there is 'substantial evidence' DeepSeek distilled OpenAI models

   The White House AI and crypto czar told Fox News that DeepSeek 'distilled knowledge out of OpenAI models,' without detailing the evidence, and predicted US labs would move to block copycat models.

   Source: bloomberg.com

7. 29 January 2025 legal

   Microsoft and OpenAI confirm they are investigating a DeepSeek-linked group

   Microsoft security researchers had observed individuals believed linked to DeepSeek exfiltrating large volumes of data through the OpenAI API in autumn 2024. OpenAI said it takes 'aggressive, proactive countermeasures' and knows PRC-based companies are constantly trying to distill leading US models.

   Source: bloomberg.com

8. 29 January 2025 policy

   Dario Amodei publishes 'On DeepSeek and Export Controls'

   Argues DeepSeek's efficiency does not undermine export controls but makes them more important, and that a substantial share of DeepSeek's fleet was pre-ban, unbanned or likely smuggled. Sets the compute-asymmetry frame the labs still use.

   Source: darioamodei.com

9. 29 January 2025 policy

   Senator Hawley introduces S. 321, the Decoupling America's AI Capabilities from China Act

   Would prohibit US persons from exporting AI technology or IP to China or importing Chinese-developed AI, bar joint research, and impose penalties of up to 20 years. Referred to Judiciary and not advanced.

   Source: congress.gov

10. 30 January 2025 legal

    Italy's Garante orders DeepSeek's chatbot blocked

    The first national-level public block, on data-protection rather than security grounds, after DeepSeek failed to address the regulator's questions about its privacy policy and transfers.

    Source: privacylaws.com

11. 31 January 2025 policy

    Texas becomes the first US state to ban DeepSeek on state devices

    Opens a wave of state-level restrictions that reached at least seven states by April 2025, plus agency-level bans elsewhere.

    Source: statetechmagazine.com

12. 4 February 2025 policy

    Australia bans DeepSeek on government devices

    Followed within weeks by South Korea suspending app-store downloads and Taiwan restricting public-sector use.

    Source: thecable.ng

13. 13 March 2025 policy

    OpenAI's OSTP filing calls DeepSeek 'state-subsidized' and 'state-controlled'

    In its response to the AI Action Plan RFI, OpenAI recommended considering bans on PRC-produced models in Tier 1 countries, citing security risk and risk of IP theft, and pointed to distillation against its terms of service. OpenAI later softened the framing, saying it was proposing export-rule changes rather than usage restrictions.

    Source: techcrunch.com

14. 14 April 2025 product

    OpenAI introduces Verified Organization ID checks for frontier API access

    Government-ID verification gates access to the most capable models, with one ID per organisation per 90 days. An access-control response to extraction rather than a legal one.

    Source: help.openai.com

15. 16 April 2025 policy

    House Select Committee on the CCP publishes 'DeepSeek Unmasked'

    Bipartisan report calling DeepSeek a 'profound threat,' alleging data routing through China Mobile-linked infrastructure, likely unlawful distillation of US models, and export-control circumvention. Recommends expanding and better enforcing export controls.

    Source: chinaselectcommittee.house.gov

16. 13 May 2025 policy

    BIS announces rescission of the AI Diffusion Rule

    Two days before it would have taken effect, with an instruction not to enforce pending formal rescission. The administration argued it would stifle US innovation and undermine diplomacy; a replacement rule was promised.

    Source: wiley.law

17. 25 June 2025 policy

    No Adversarial AI Act introduced

    Sens. Rick Scott and Gary Peters, with House Select Committee members, propose a Federal Acquisition Security Council list of foreign-adversary AI and a ban on executive-agency use with narrow research carve-outs.

    Source: congress.gov

18. 10 July 2025 policy

    European Commission publishes the final GPAI Code of Practice

    Three chapters — Transparency, Copyright, Safety and Security — as a voluntary route to compliance with obligations applying from August 2, 2025. Formally approved on August 1.

    Source: artificialintelligenceact.eu

19. 23 July 2025 policy

    White House releases 'Winning the Race: America's AI Action Plan'

    Over 90 federal actions across innovation, infrastructure and international pillars. Notably promotes open-source and open-weight models and calls for exporting the full American AI stack — a posture in tension with the case for restricting model access.

    Source: whitehouse.gov

20. 26 July 2025 policy

    China unveils a Global AI Governance Action Plan and proposes a world AI cooperation body

    Announced at the World AI Conference in Shanghai: a thirteen-point roadmap, an International Open Source AI Cooperation Initiative, and a proposed organisation headquartered in Shanghai. The counter-offer to US-led restriction.

    Source: technode.com

21. 2 August 2025 policy

    EU AI Act obligations for general-purpose AI providers begin to apply

    Applies to models placed on the market on or after this date. Commission enforcement, including model access and recalls, deferred one year to August 2, 2026.

    Source: ec.europa.eu

22. 11 August 2025 policy

    Nvidia and AMD reported to agree a 15% China revenue share for export licences

    Commerce began issuing H20 licences days after Jensen Huang met President Trump. A novel instrument: export policy priced rather than prohibited.

    Source: fortune.com

23. 5 September 2025 product

    Anthropic bars entities majority-controlled from China, Russia, Iran and North Korea

    Applies worldwide to subsidiaries and joint ventures regardless of where they operate. Anthropic cited legal compulsion to share data with authoritarian states and estimated a revenue impact in the low hundreds of millions of dollars.

    Source: semafor.com

24. 9 October 2025 policy

    Senate passes its NDAA including the GAIN AI Act

    Would require US chipmakers to prioritise American customers before selling advanced AI chips abroad. Opposed by Nvidia, the Semiconductor Industry Association and the White House AI adviser; supported by Microsoft and Americans for Responsible Innovation.

    Source: nextgov.com

25. 18 December 2025 policy

    FY2026 NDAA signed without the GAIN AI Act

    The chip-allocation mandate was stripped in conference. Ten days earlier the President had directed that H200-class exports to approved customers be permitted in exchange for a federal surcharge.

    Source: nextgov.com

26. 15 January 2026 policy

    BIS moves H200 and MI325X exports to case-by-case review; 25% tariff applies

    Replaces the presumption of denial for China and Macau destinations, with third-party lab testing and a cap on the China share relative to US customers. The proclamation imposing a 25% duty was signed the previous day.

    Source: cnbc.com

27. 22 January 2026 policy

    South Korea's AI Basic Act takes effect

    The first comprehensive national AI framework outside the EU, with generative-AI and high-impact obligations, a National AI Committee, an AI Policy Center and an AI Safety Research Institute. It does not address distillation.

    Source: cooley.com

28. 12 February 2026 legal

    OpenAI memo to the House Select Committee and Google GTIG report land the same day

    OpenAI's 'Updated Stakes for American-Led, Democratic AI' accused Chinese companies including DeepSeek of using sophisticated, multi-stage pipelines. Google's Threat Intelligence Group reported disrupting Gemini extraction activity, including a cluster of more than 100,000 prompts aimed at coercing reasoning behaviour, and framed the threat as global rather than China-specific.

    Source: cdn.openai.com

29. 23 February 2026 legal

    Anthropic publicly discloses industrial-scale distillation attacks

    Names DeepSeek, Moonshot AI and MiniMax: over 16 million exchanges through roughly 24,000 fraudulent accounts, with MiniMax accounting for over 13 million. Calls for coordinated industry, cloud-provider and policymaker response and argues the episode reinforces the case for chip export controls.

    Source: anthropic.com

30. 26 March 2026 policy

    Chip Security Act reported out of House Foreign Affairs 42-0

    Would require location-verification mechanisms on covered chips before export, with reporting to Commerce if a chip's location changes. Bipartisan but not enacted.

    Source: congress.gov

31. 7 April 2026 market

    OpenAI, Anthropic and Google agree to share distillation threat intelligence

    Coordination routed through the Frontier Model Forum, responding to the AI Action Plan's call for an industry information-sharing centre. The companies sought antitrust comfort before trading notes.

    Source: techbrew.com

32. 15 April 2026 policy

    H.R. 8283, the Deterring American AI Model Theft Act of 2026, is introduced

    Reps. Huizenga and Moolenaar. Defines a 'model extraction attack' as unauthorized extraction of a closed-source model's capabilities where the querying circumvents access controls, uses fraudulent credentials, or violates terms prohibiting output-based training. Explicitly exempts training that complies with terms of service.

    Source: govinfo.gov

33. 16 April 2026 policy

    House Select Committee hearing: 'China's Illicit Campaign to Steal and Subvert American AI Technology'

    Testimony from AFPI's Yusuf Mahmood collating the OpenAI, Google, Anthropic and xAI disclosures and arguing that consistent lag behind the American frontier is itself evidence of a distillation-driven development model.

    Source: docs.house.gov

34. 22 April 2026 policy

    H.R. 8283 ordered reported 43-0

    Unanimous House Foreign Affairs vote, alongside a package of export-control measures. The bill has not received a floor vote as of September 2026.

    Source: congress.gov

35. 23 April 2026 policy

    OSTP issues NSTM-4, 'Adversarial Distillation of American AI Models'

    Signed by Director Michael Kratsios. Finds foreign entities principally in China running deliberate, industrial-scale campaigns using tens of thousands of proxy accounts and jailbreaking to expose proprietary information, and that the resulting models strip safety protocols. Commits to intelligence sharing with industry, joint best practices and exploration of accountability measures.

    Source: nextgov.com

36. 24 April 2026 policy

    State Department cables posts worldwide to raise distillation with foreign counterparts

    Instructs diplomats to discuss concerns over adversaries' extraction and distillation of US AI models, naming DeepSeek, Moonshot AI and MiniMax. The Chinese Embassy called the allegations groundless.

    Source: cnbc.com

37. 24 April 2026 product

    DeepSeek releases a preview of V4

    A trillion-parameter-class open model, notable as DeepSeek's first optimised for domestic Chinese accelerators such as Huawei Ascend. US officials alleged it was trained on smuggled Blackwell GPUs; Nvidia called that farfetched.

    Source: technologyreview.com

38. 5 June 2026 policy

    President signs NSPM-11 on AI in the national security enterprise

    Four pillars — adoption, adaptation, assurance, accountability — with Section 4(c) directing protection of advanced AI systems against malicious distillation attacks. Rescinds and replaces the prior administration's NSM-25.

    Source: whitehouse.gov

39. 8 June 2026 policy

    Pentagon adds Alibaba, Baidu, BYD and Unitree to the 1260H list

    Sixty-five entities added, bringing the list to 188. Procurement prohibitions take effect June 30, 2026. DeepSeek was not added.

    Source: cnbc.com

40. 10 June 2026 legal

    Anthropic tells Senate Banking that Alibaba ran the largest known distillation attack against it

    Letter to Chairman Tim Scott and Ranking Member Elizabeth Warren alleging 28.8 million-plus exchanges through nearly 25,000 fraudulent accounts between April 22 and June 5, 2026, targeting agentic reasoning, software engineering and long-horizon tasks. Asks Congress to enable threat-information sharing, close chip loopholes and penalise responsible PRC labs.

    Source: d1e00ek4ebabms.cloudfront.net

41. 17 June 2026 policy

    US holds off blacklisting DeepSeek and 100-plus other flagged firms

    An inter-agency committee had approved DeepSeek for Entity List addition, but publication was delayed, reportedly to avoid escalating tensions with Beijing. A State Department official said DeepSeek has supported Chinese military and intelligence operations.

    Source: cnbc.com

42. 6 July 2026 market

    Alibaba bars employees from using Anthropic products

    Announced 6 July 2026, effective 10 July 2026: staff were told to uninstall Anthropic models and agent products and use Alibaba's own assistant. Alibaba denied using proprietary model outputs to train its models and denied Chinese government involvement.

    Source: cnbc.com

43. 21 July 2026 policy

    Treasury Secretary Bessent threatens sanctions over AI model theft

    Said the US is finding watermarks of American large language models inside Chinese systems and has the ability to sanction overseas models that steal from US companies. The same day, FT reported MOFCOM consulting Alibaba, ByteDance and Zhipu on export controls covering model weights, key training data and chip designs.

    Source: cnbc.com

44. 22 July 2026 legal

    Kratsios accuses Moonshot AI of distilling Anthropic's Fable to build Kimi K3

    The OSTP director also alleged Moonshot obtained export-controlled Nvidia servers. No supporting evidence was published; researchers including Nathan Lambert and Braden Hancock publicly doubted distillation alone could explain K3's capabilities on that timeline, noting Fable had been publicly available only since July 1 — about two weeks.

    Source: cyberscoop.com

45. 24 July 2026 policy

    Open-weights letter launches with ~25 signatories, later exceeding 270

    Nvidia, Meta, Microsoft and Amazon were among roughly 25 companies signing at launch on July 24, 2026; OpenAI and Google were absent on the day and appeared on the signatory list around July 26. The count passed 150 by July 28 and later exceeded 270. Signatories argue open weights are essential to American AI leadership and that closed-model concentration is a systemic risk. Dario Amodei published a rebuttal on July 27 accepting open weights in general but arguing the most powerful frontier weights carry irreversible national security risk.

    Source: images.nvidia.com

46. 27 July 2026 policy

    China's Ministry of Commerce counter-accuses American AI firms of distilling Chinese models

    Called US allegations factually and legally unsupported and an act of 'AI hegemony,' promised 'all necessary measures' if Chinese firms are sanctioned, and defended distillation as a widely used industry technique. No companies were named and no evidence was supplied.

    Source: implicator.ai

47. 2 August 2026 policy

    EU AI Act enforcement powers go live

    The AI Office can now request information and documentation, obtain model access for evaluation, require corrective measures, and fine GPAI providers up to EUR 15 million or 3% of global turnover. Its stated preferred first tool remains technical compliance dialogues.

    Source: ec.europa.eu

Glossary · 16 terms

Distillation

Training a smaller or cheaper student model on the outputs of a larger teacher model. Legitimate and standard when the teacher's licence permits it; the policy fight is about doing it to a closed model in breach of its terms.

Adversarial distillation

The term adopted by OSTP memorandum NSTM-4 (April 23, 2026) for systematic extraction of a frontier model's capabilities via large volumes of constructed queries, typically through proxy accounts that evade access controls.

Model extraction attack

The statutory term in H.R. 8283: unauthorized extracting of a closed-source model's capabilities to replicate, develop, train or improve another model, where the querying circumvents access controls, uses fraudulent credentials, or violates output-training terms.

AI Model Extraction Attackers List

The public list H.R. 8283 would have the Secretary of State maintain, naming individuals and entities assessed to have conducted model extraction attacks, as a predicate for sanctions or Entity Listing.

Fraudulent account network provider

A category defined in H.R. 8283 covering foreign entities that create, sell or broker accounts allowing entities of concern to reach models they are barred from, with a carve-out for services enabling internet access for freedom of expression.

Entity List

The Commerce/BIS list imposing licence requirements, usually with a presumption of denial, on exports to named foreign parties. Repeatedly floated for Chinese AI labs; not applied to DeepSeek as of September 2026.

Section 1260H list

The Pentagon's annual list of Chinese military companies. Listing bars Department procurement contracts. Alibaba, Baidu, BYD and Unitree were added in June 2026.

IEEPA

The International Emergency Economic Powers Act, the authority under which a president can declare a national emergency and impose blocking sanctions. The main vehicle proposed for sanctioning distillation actors.

AI Diffusion Rule

The January 15, 2025 BIS framework creating worldwide tiered licensing for advanced computing. BIS announced its rescission on May 13, 2025, before its May 15 enforcement date.

GPAI obligations

The EU AI Act duties on providers of general-purpose AI models — technical documentation, copyright policy, training-data summary, and systemic-risk duties above a compute threshold — applying from August 2, 2025 and enforceable from August 2, 2026.

Code of Practice (GPAI)

The voluntary EU compliance instrument published July 10, 2025, with Transparency, Copyright, and Safety and Security chapters. Signing it is a presumption-of-conformity route, not a legal obligation.

Open weights

Model parameters published for download and self-hosting. Central to the policy paradox: the US AI Action Plan promotes open weights while distillation policy tries to restrict capability diffusion.

Sovereign AI

A state's pursuit of domestically controlled compute, models and data. In 2026 the practical question is whether a country's sovereign stack sits on US closed models, US open weights, or Chinese open weights.

Transfer station economy

The grey market of proxy servers and reseller billing panels that resell access to Western frontier models inside China, sometimes at a fraction of list price. The practical delivery mechanism behind alleged extraction campaigns.

Military-civil fusion

China's policy of integrating civilian technology development with military modernisation, invoked by US officials to argue that capabilities distilled by commercial Chinese labs reach the PLA.

Frontier Model Forum

The industry body founded in 2023 by Anthropic, Google, Microsoft and OpenAI, used from April 2026 as the channel for sharing distillation threat intelligence between labs.

Sources · 100 sources

Every figure on this page comes from one of these primary sources. Compiled 4 September 2026.

1. Detecting and preventing distillation attacksAnthropic · 23 February 2026 · blog
2. Letter to Senate Banking Committee on illicit access to American AI models by Alibaba-affiliated operatorsAnthropic · 10 June 2026 · filing
3. H.R. 8283, Deterring American AI Model Theft Act of 2026 (introduced text)US Government Publishing Office · 15 April 2026 · law
4. H.R. 8283 bill page and statusCongress.gov · 22 April 2026 · law
5. National Security Presidential Memorandum NSPM-11The White House · 5 June 2026 · law
6. Winning the Race: America's AI Action PlanThe White House · 23 July 2025 · law
7. China's Illicit Campaign to Steal and Subvert American AI Technology (testimony of Yusuf Mahmood)US House Select Committee on the CCP · 16 April 2026 · filing
8. OpenAI response to the OSTP/NSF RFI on the AI Action PlanOpenAI · 13 March 2025 · filing
9. OpenAI calls DeepSeek 'state-controlled,' calls for bans on 'PRC-produced' modelsTechCrunch · 13 March 2025 · news
10. AI Czar Sacks Says 'Evidence' DeepSeek Leaned On OpenAI's ModelsBloomberg · 28 January 2025 · news
11. Microsoft Probing If DeepSeek-Linked Group Improperly Obtained OpenAI DataBloomberg · 29 January 2025 · news
12. OpenAI says DeepSeek may have 'inappropriately' used its models' outputAxios · 29 January 2025 · news
13. On DeepSeek and Export ControlsDario Amodei · 29 January 2025 · blog
14. Moolenaar, Krishnamoorthi unveil report on DeepSeekUS House Select Committee on the CCP · 16 April 2025 · filing
15. S. 321 Decoupling America's Artificial Intelligence Capabilities from China ActCongress.gov · 29 January 2025 · law
16. H.R. 3447 Chip Security ActCongress.gov · 15 May 2025 · law
17. S. 1705 Chip Security ActCongress.gov · 8 May 2025 · law
18. S. 3150 GAIN AI Act of 2025Congress.gov · 6 November 2025 · law
19. S. 2177 No Adversarial AI Act (text)Congress.gov · 25 June 2025 · law
20. H.R. 1121 No DeepSeek on Government Devices ActCongress.gov · 7 February 2025 · law
21. US Export Controls and China: Advanced Semiconductors (CRS R48642)Congressional Research Service · August 2025 · filing
22. Explainer: The Commerce Department's October 2023 Export Controls UpdateCSET, Georgetown · October 2023 · blog
23. BIS Rescinds AI Diffusion Rule and Issues GuidanceWiley Rein · 14 May 2025 · blog
24. Nvidia says it will record $5.5 billion charge tied to H20 processorsCNBC · 15 April 2025 · news
25. Nvidia, AMD to pay 15% of China chip revenue to US governmentFortune · 10 August 2025 · news
26. Trump administration clears way for Nvidia H200 chip sales to ChinaCNBC · 14 January 2026 · news
27. AI export control bill passes Senate as NDAA amendmentNextgov/FCW · 9 October 2025 · news
28. Bill prioritizing American customers for AI chips not expected to make it into final NDAANextgov/FCW · December 2025 · news
29. White House accuses China of deliberate, industrial-scale campaigns to steal US AI modelsNextgov/FCW · 23 April 2026 · news
30. US State Department orders global warning about alleged China AI theftCNBC · 25 April 2026 · news
31. Anthropic accuses Alibaba of campaign to 'brazenly' and 'illicitly' extract Claude capabilitiesCNBC · 24 June 2026 · news
32. China's Alibaba bans Anthropic AI for employees after distillation accusationCNBC · 6 July 2026 · news
33. Bessent says U.S. could sanction China over AI model 'theft'CNBC · 21 July 2026 · news
34. US holds off blacklisting China's DeepSeek and 100+ firmsCNBC · 17 June 2026 · news
35. Pentagon expands list of China military-linked firms to include Alibaba, Baidu, BYDCNBC · 9 June 2026 · news
36. Anthropic, OpenAI among firms facing new scrutiny under EU AI Act enforcementCNBC · 3 August 2026 · news
37. Commission starts enforcing AI Act rules and new transparency obligationsEuropean Commission · 2 August 2026 · law
38. Overview of the General-Purpose AI Code of PracticeEU AI Act explorer · 10 July 2025 · docs
39. EU AI Act rules on GPAI models under DeepSeek reviewPinsent Masons · 2025 · blog
40. White House accuses Moonshot AI of distilling Anthropic's modelCyberScoop · 22 July 2026 · news
41. Experts say exploiting Anthropic's Fable isn't how Kimi K3 got so goodTechCrunch · 23 July 2026 · news
42. Three reasons why DeepSeek's new model mattersMIT Technology Review · 24 April 2026 · news
43. The Case for Imposing Costs on China's AI Distillation CampaignsJust Security · 2026 · blog
44. From Diagnosis to Deterrence: The Emerging U.S. Response to DistillationJust Security · 2026 · blog
45. Responding to AI Distillation Without PanicInstitute for Law & AI · 2026 · blog
46. How to Fix the AI Model Theft Bill Before It Becomes LawITIF · 28 July 2026 · blog
47. Adversarial Distillation: China's Campaign to Extract American AI CapabilitiesCenter for a New American Security · 2 June 2026 · paper
48. AI Distillation Attacks: Executive and Congressional Action Can Go FurtherInstitute for AI Policy and Strategy · 2026 · paper
49. Trade Secrecy Meets Generative AICamilla Alexandra Hrdy, SSRN · 2025 · paper
50. Dispute over AI model distillation tech in OpenAI-DeepSeek caseLaw.asia · 2025 · blog
51. Copyright Office report on copyrightability of AI-generated materialUS Copyright Office · January 2025 · law
52. 'Ironic, hypocritical' of big tech to call out DeepSeekCornell University · January 2025 · news
53. OpenAI hit with mockery over DeepSeek complaintFuturism · January 2025 · news
54. Why DeepSeek's new AI model thinks it's ChatGPTTechCrunch · 27 December 2024 · news
55. Anthropic blocks sales of AI to Chinese firmsSemafor · 5 September 2025 · news
56. US AI giant Anthropic bars Chinese-owned entitiesRTE · 5 September 2025 · news
57. OpenAI Terms of UseOpenAI · 2025 · docs
58. Anthropic Consumer Terms of ServiceAnthropic · 2025 · docs
59. Meta Llama 3 Community LicenseMeta · 2024 · docs
60. Llama 3.3 70B Instruct model cardMeta / Hugging Face · December 2024 · docs
61. API Organization VerificationOpenAI · April 2025 · docs
62. OpenAI to cut off API access in China on July 9Rest of World · June 2024 · news
63. OpenAI accuses DeepSeek of malpractice ahead of AI launchRest of World · 2026 · news
64. These States Have Banned DeepSeekStateTech Magazine · April 2025 · news
65. New York state bans DeepSeek from government devicesNBC News · 10 February 2025 · news
66. Italy and South Korea ban DeepSeek and start investigationPrivacy Laws & Business · February 2025 · news
67. Governor Stitt bans DeepSeek on all state-owned devicesState of Oklahoma · March 2025 · law
68. South Korea's AI Basic Act: Overview and Key TakeawaysCooley · 27 January 2026 · blog
69. AI Watch: Global regulatory tracker - JapanWhite & Case · 2025 · blog
70. UK Sovereign AI UnitOECD.AI · 2025 · docs
71. China proposes new global AI cooperation organization, headquarters planned in ShanghaiTechNode · 29 July 2025 · news
72. China launches Shanghai-based AI governance body with 29 founding nationsCaixin Global · 17 July 2026 · news
73. China Accuses US AI Firms of Distilling Chinese ModelsImplicator.ai · 27 July 2026 · news
74. China Considers Export Controls on AI Models, Training Data and Chip TechnologyTechRepublic · July 2026 · news
75. Google disrupts Gemini model extraction attemptsTechInformed · 16 February 2026 · news
76. OpenAI, Anthropic, Google join forces against ChinaTech Brew · 7 April 2026 · news
77. How to Buy Cheap Claude Tokens in ChinaChinaTalk · 2026 · news
78. Inside the Gray Market for LLM AccessDeepLearning.AI, The Batch · 2026 · news
79. Open Weights and American AI Leadership (open letter)Multi-company coalition · 24 July 2026 · filing
80. Gulf AI infrastructure and the limits of technological sovereigntyIISS · June 2026 · paper
81. Which Countries Have Banned DeepSeek Already?Tech.co · 2025 · news
82. DeepSeek and Chinese AI Models: GDPR Data Transfer ComplianceAI Policy Desk · June 2026 · blog
83. Report: Commerce Department bans use of DeepSeek on government devicesPYMNTS · February 2025 · news
84. Three States Ban DeepSeek Use on State Devices and NetworksNational Law Review · February 2025 · news
85. South Korea joins Italy, Australia in banning DeepSeekThe Cable · February 2025 · news
86. Nvidia expects to lose billions in revenue due to H20 chip licensing requirementsTechCrunch · 28 May 2025 · news
87. Nvidia announces financial results for 1st quarter fiscal 2026HPCwire · 28 May 2025 · filing
88. H.R. 9363, AI Security and Innovation ActHouse Science, Space and Technology Committee · 25 June 2026 · law
89. CBO cost estimate, H.R. 9363Congressional Budget Office · 2026 · law
90. President Trump orders narrowly targeted 25% Section 232 tariff on certain advanced semiconductorsWhite & Case · January 2026 · law
91. BlnBDI press release: DeepSeek apps reported to Apple and GoogleBerlin Commissioner for Data Protection and Freedom of Information · 27 June 2025 · law
92. Nvidia and 24 other companies sign open-weights letterTom's Hardware · 24 July 2026 · news
93. Open weights, American AI leadership letter: OpenAI absentThe Next Web · 25 July 2026 · news
94. Taiwan bans DeepSeek in the public sectorTaipei Times · 2 February 2025 · news
95. H.R. 4142 No Adversarial AI Act (introduced)GovInfo · 25 June 2025 · law
96. House Foreign Affairs markup documents, H.R. 8283 (April 22, 2026)Congress.gov · 22 April 2026 · law
97. Distillation, experimentation and integration: adversarial use of AIGoogle Threat Intelligence Group · 12 February 2026 · blog
98. Updated Stakes for American-Led, Democratic AI (memo to House Select Committee)OpenAI · 12 February 2026 · filing
99. Anthropic Commercial Terms of ServiceAnthropic · 2025 · docs
100. Anthropic Usage PolicyAnthropic · 2025 · docs