The NSA, CISA, and FBI published advisory AA26-251A on September 8, 2026, naming DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI for extracting billions of tokens across millions of requests from U.S. frontier models including variants of Claude, GPT, Gemini, and Grok. Knowledge distillation is a machine learning technique that trains a less capable model using the outputs of a larger, more capable one; while a valid training method, CISA said it can be misused to acquire capabilities from competitors in less time and with less cost than developing them legitimately. The advisory describes tactics, names companies, and recommends mitigations. The mitigation section is the problem.
U.S. companies should track individual subscriptions with enterprise-scale throughput, accounts deviating from legitimate patterns, and new accounts immediately at maximum usage versus a gradual ramp-up or with consistent quota exhaustion. That is a list of behavioral signals. Sustained 24/7 usage with no idle time. A new subscription going straight to maximum throughput. One account hitting the API from multiple IPs. Usage optimized for cache hits rather than task diversity. Every indicator describes a well-run production agent fleet.
The signature for distillation is the signature for a CI pipeline
The 120-route construction ERP at coenconstruction.com calls GPT-4o for document extraction and change-order summarization through a CI job that runs on a schedule. The job goes to maximum throughput because the FinOps team optimized batch sizes last quarter. The traffic comes from multiple IPs because the deployment runs across three AWS availability zones. The calls are cache-optimized because the prompts are versioned and stable. Every indicator in the advisory matches.
Thepunchlist.ai runs a classifier every morning at 04:00 UTC. It pulls punch-list photos from three customer S3 buckets, runs them through GPT-4o vision for item extraction, writes results to Postgres, and triggers email notifications. The account has no idle time because construction runs 24/7 and the workload is scheduled. The account ramped to maximum usage on day one because the customer onboarded with three years of historical photos. The prompts hit cache because the system prompt is identical across all images. The usage pattern is a perfect match for the distillation signature the federal advisory tells labs to detect.
The advisory does not distinguish between industrial extraction and optimized production workloads. Sustained 24/7 usage with no idle periods, a new subscription that goes straight to maximum throughput, one account hitting the API from many IPs, and usage optimized for cache hits rather than task diversity — that description appears in coverage analyzing the threat model. It is also an exact description of what happens when a platform team does FinOps work correctly.
The mitigation is to serve a weaker model and not tell the account
Response changes can include differential privacy or serving downgraded models for suspected distillation requests, the advisory states, and companies should vary those changes across requests to complicate response quality evaluations. The advisory recommends avoiding informing China-based AI company users suspected of distillation campaigns of a switch to a downgraded model, because informing malicious distillers would enable them to improve their defense evasions and indicate when to roll back training. The headline mitigation is silent downgrade based on behavioral detection with no notification to the account.
If OpenAI follows the guidance and my construction ERP hits the behavioral thresholds, the API will start serving gpt-3.5-turbo-instruct instead of gpt-4o. The model ID in my logs will still say gpt-4o. The response will return status 200. The extraction accuracy will silently degrade until a customer calls to ask why half the line items are missing from the change-order summary. The model ID does not tell you the capability set and the federal guidance now says the provider should not tell you when the capability set changes in response to detection.
Estimate.pro calls Claude Sonnet through AWS Bedrock for bid-item extraction and cost-code mapping. The integration hit production in June. Usage ramped from zero to twelve million tokens a day in three weeks because customers load historical bid sets when they onboard. If Anthropic applies the CISA mitigation and silently serves Claude Haiku instead of Sonnet, I will not know until accuracy drops and a support ticket arrives. The advisory creates an impossible debugging path. The model ID is stable. The prompt has not changed. The API returns 200. The output quality degraded. There is no log entry that says the provider downgraded your account because your usage pattern matched the distillation signature.
The behavioral signature for industrial distillation is identical to the signature for a well-optimized production workload.
The indicators are behavioral not forensic
You cannot send the provider a compliance attestation or a corporate registration to prove you are not a distiller. The NSA, CISA, and FBI advisory AA26-251A tells AI providers to flag accounts by 24/7 usage, instant maximum throughput, and cache-optimized traffic — an exact description of a production agent fleet; its recommended mitigation is an undisclosed model downgrade engineered to defeat quality measurement. The detection is behavioral. The mitigation is silent. The guidance says not to notify the account because notification would help adversaries improve evasion.
The advisory is written entirely for the labs. It prescribes detection measures, mitigation strategies, and cross-organization intelligence sharing for providers. It prescribes nothing for the customers who buy from them. The headline recommendation is to serve suspected accounts a weaker model without telling them. That operational guidance makes sense if the goal is to disrupt nation-state distillation campaigns without revealing detection methods. It makes production debugging impossible when your legitimate workload fits the profile.
The 120-route ERP runs document extraction through a scheduled job. The traffic is cache-optimized, multi-region, 24/7, and at maximum throughput. Every behavioral indicator matches. If the provider follows the CISA guidance and silently downgrades the account, the first signal will be a customer email saying the change-order summary missed three line items. The logs will show the correct model ID. The API will return 200. The model has a twin and the API does not tell you which one you are calling. And now there is a federal advisory recommending that labs make that silence a feature when behavioral signals cross a threshold that describes FinOps success as much as it describes industrial theft.