China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

MITRE Techniques

• [T1583 Acquire Infrastructure] Acquire Infrastructure – Actors maintain sustained extraction infrastructure and use gray-market “transfer stations” to support scalable access (‘China-based entities establish and maintain sophisticated infrastructure supporting sustained extraction operations’ / ‘a gray market of API proxies, or “transfer stations,” which resell access’).
• [T1078 Valid Accounts] Valid Accounts – Bulk premium subscriptions and shared accounts are used to access frontier AI services at scale (‘procure bulk premium AI subscription services’ / ‘shared accounts from multiple IPs/user agents’).
• [T1091 Replication Through Removable Media] Replication Through Removable Media – Not mentioned.
• [T1586 Compromise Accounts] Compromise Accounts – Fraudulent or obfuscated accounts are created to access inference APIs (‘creation of fraudulent accounts that are not registered to legitimate users’ / ‘create user accounts obfuscating their country of origin’).
• [T1190 Exploit Public-Facing Application] Exploit Public-Facing Application – Public APIs are abused for large-scale query submission and model access (‘exploit AI model inference APIs’ / ‘the creation of fraudulent accounts’).
• [T1027 Obfuscated Files or Information] Obfuscated Files or Information – Third-party aggregators and sanitization mechanisms hide user metadata to avoid detection (‘automatically obfuscate user metadata’ / ‘automated sanitization to systematically remove organizational identifiers’).
• [T1566 Phishing] Phishing – Not mentioned.
• [AML.T0065 LLM Prompt Crafting] LLM Prompt Crafting – Prompts are crafted to force models to reveal hidden reasoning and bypass restrictions (‘imagine and articulate the internal reasoning’ / ‘inserting prompts specifically designed for jailbreaking’).
• [T1213 Data from Information Repositories] Data from Information Repositories – High-volume output collection is used to build synthetic datasets from model responses (‘systematically collect outputs to generate synthetic training datasets’).
• [T1020 Automated Exfiltration] Automated Exfiltration – Continuous API querying and automated routing move model outputs into training corpora (‘collecting U.S. frontier LLMs’ inferences into datasets’).
• [T1498 Network Denial of Service] Network Denial of Service – Not mentioned.
• [T1497 Virtualization/Sandbox Evasion] Virtualization/Sandbox Evasion – Not mentioned.