Key points
- The AI Cyber Defense Act tasks NIST with defining distillation attacks and creating defensive standards.
- Sponsors argue distillation allows adversaries to steal US innovation at a fraction of the development cost.
- The legislation specifically targets threat actors from Russia, China, Iran and North Korea.
US artificial intelligence companies face a new legislative effort to protect their proprietary models from systematic theft. A bipartisan House bill, the AI Cyber Defense Act, seeks to establish federal guidance on defending against distillation attacks. This measure aims to help maintain the technological lead held by American firms against foreign competitors.
Rep. Pat Harrigan and Rep. George Whitesides sponsor the legislation, which was shared exclusively with CyberScoop. The bill directs the National Institute of Standards and Technology to develop voluntary industry standards. These standards will focus on preventing distillation attacks originating from four specific nations: Russia, China, Iran and North Korea.
The economics of model theft
Harrigan told CyberScoop that maintaining a six to twelve month lead in AI development is incredibly expensive for US companies. Distillation attacks provide adversaries with an incentive to steal rather than innovate. This dynamic allows foreign entities to keep their own spending low while copying advanced models.
The representative explained that countries like China may choose to hold back on full AI investment. They might bet on drifting behind US companies while those firms perform arduous research. This strategy allows adversaries to wait for the US market to falter before accelerating their own efforts.
Strategic concerns for US industry
Harrigan expressed concern that adversaries view the US industry as an engine they can exploit. He stated that for five to ten percent of the spend, foreign actors can distill and steal models. They can do this until the US market falters, then turn into high gear to leapfrog American capabilities.
This approach allows adversaries to avoid expending resources on early-stage research. By waiting for the US to burn hot and spend heavily, they can capture the benefits of innovation without the initial costs. This creates a significant strategic risk for the long-term competitiveness of US AI firms.
Our take on the response
The legislation requires NIST to first define what constitutes a distillation attack. This definition must separate malicious copying from legitimate sharing and collaboration in open-source communities. Clear definitions are essential for creating effective voluntary standards that protect innovation without stifling it.
The bill aims to convene industry stakeholders on defensive cyber practices. By establishing best practices, the government hopes to raise the cost and difficulty of stealing AI models. This coordinated approach seeks to level the playing field for US companies investing heavily in research and development.
What affected people can do
Teams should review their model access controls to ensure only authorised personnel can interact with proprietary systems. Monitor for unusual patterns in API usage or data extraction requests that might indicate automated scraping. Verify the identities of all users accessing sensitive model outputs, as attackers often use burner accounts. Check whether internal policies clearly distinguish between legitimate open-source collaboration and prohibited model distillation activities.
What to do and how to stay safe: AI Cyber Defense Act
- Implement strict access controls and authentication for all AI model interfaces and APIs.
- Monitor for anomalous usage patterns, such as high-volume queries from new or suspicious accounts.
- Regularly audit user permissions and revoke access for accounts that are no longer required.
- Educate staff on the differences between legitimate open-source collaboration and malicious model extraction.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is a distillation attack?
A distillation attack occurs when one AI model is trained on the output data and reasoning of another, usually more powerful model.
Which countries are targeted by the AI Cyber Defense Act?
The bill specifically targets distillation attacks from foreign entities in Russia, China, Iran and North Korea.
Who sponsors the AI Cyber Defense Act?
The bill is sponsored by Rep. Pat Harrigan, R-N.C., and Rep. George Whitesides, D-Calif.