A federal advisory just told US model providers to serve degraded models to suspected distillers — and to vary it so quality evaluation cannot detect it

What the advisory alleges

The factual core, briefly, because it is the least surprising part.

The agencies say the activity has run since late 2024, that it moved billions of tokens across millions of requests, and that the Chinese government is likely aware. Methods: fraudulent accounts, bulk premium subscription harvesting, native APIs, remote cloud providers, and gray-market proxy resellers the advisory calls transfer stations — services that resell frontier access at a discount while bypassing geographic restrictions and obscuring who is asking.

For readers following this thread, none of it is new in kind. It escalates Anthropic’s June accusation against Alibaba, the Claude Code tracking detail that followed in July, and the White House’s Moonshot/Kimi K3 claim and sanctions threat. What is new is the institutional weight: three agencies, one document, six named companies.

The recommendation nobody led with

The advisory gives US providers three immediate defensive approaches. One and three are unremarkable — comprehensive detection of anomalous prompts and accounts, and cross-organization intelligence sharing across model providers, cloud platforms, and API aggregators.

Mitigation two is the one to read twice:

Deploy targeted response changes that subtly alter responses to suspected malicious distillation attempts — such as differential privacy or serving degraded models — varied across requests to complicate quality evaluations.

Take that clause apart. The recommendation is not to block. Blocking is visible: you get an error, you file a ticket, you find out. The recommendation is to keep serving while making the output worse, and to randomize the degradation so that measuring quality does not reveal it.

That is not an incidental property. It is the stated design goal. The countermeasure is specified to defeat exactly the method — run a benchmark, compare scores — that any competent buyer would use to check whether they are getting what they paid for.

Against an actual distillation operation, this is clever policy. Poisoned training data is a far better outcome than a blocked account that simply re-registers, and it raises the adversary’s cost in the right currency. The logic is sound.

The problem is the aperture.

The signature describes your agent fleet

Set the mitigation beside the advisory’s own detection indicators:

• Shared accounts used from multiple IP addresses and user agents → a CI pipeline on rotating runners; a team behind one org key; anything containerized.
• Sustained usage around the clock without human variation → the definition of an automated agent. Machine traffic does not have human variation. That is the point of it.
• Anomalous subscription-to-usage ratios → a small team running a high-volume pipeline. Two seats, forty million tokens a day.
• New subscriptions immediately running at maximum usage → every backfill, every migration, every load test on a new account.
• Third-party aggregators obfuscating user metadata → any neutral routing gateway, which is increasingly how sensible teams buy inference.

Four of five describe ordinary, legitimate, high-volume production usage. The fifth describes the architecture the market has been converging on all year.

Be precise about the claim here, because the distinction matters: there is no evidence any US provider is degrading legitimate customers, none has announced such a practice, and providers have obvious commercial reasons not to. The advisory recommends; it does not report. Real distillation operations look different in aggregate than a startup’s backfill, and provider fraud teams are not naive.

But three things are now true at once. A federal advisory has formally endorsed silent quality degradation as a countermeasure. The published signature for triggering it includes behaviors that are indistinguishable from normal automation. And the document specifies no notification requirement, no appeal path, and no guidance whatsoever for the downstream buyers who would absorb a false positive. That combination is what changes, and it changes something specific: model quality moved from assumed to unverified.

Why your existing evaluation will not catch it

Most teams check model quality one of two ways, and the advisory’s phrasing defeats both.

Public benchmarks were already weak evidence for your workload, and they are weaker here — anything public is plausibly special-cased, which is precisely why independent evaluators moved to private test sets when Artificial Analysis rebuilt its index. A degradation applied per-account does not show up in anyone’s public leaderboard, because the leaderboard is not running on your account.

Aggregate internal metrics — average quality score, thumbs-up rate, eval pass rate over a week — are exactly what varied across requests is designed to survive. Randomized per-request degradation shows up as slightly wider variance, not as a step change, and variance is the one thing nobody alerts on.

What actually works is dull and cheap:

1. A private canary set. 30–50 fixed prompts with known-good reference outputs, scored automatically, run on a schedule. Private, versioned, never published.
2. Two paths, same model. Run the identical set through a second route — different key, different region, or a gateway — and diff the scores. A delta between two paths hitting the same nominal model is a real signal; drift in a single path is not, because the model changes underneath you anyway.
3. Alert on variance, not just the mean. The specified countermeasure widens the distribution before it moves the average.

None of this is exotic. Most teams running agents in production want it for ordinary regression reasons, and the outage-correlation lesson from 3 September already argued for two live paths. This advisory just added a second reason to build it.

What it means for Chinese open weights

A narrower question, worth separating cleanly from the above.

Running Qwen, GLM, or a DeepSeek model on your own hardware is not what the advisory targets. It addresses extraction from US APIs; it says nothing about deploying the resulting weights, and self-hosting open weights is neither alleged nor prohibited anywhere in the document.

What shifts is provenance risk. Three agencies naming six vendors, on top of July’s White House accusations, is a documented federal position — and it raises the odds of downstream sanctions or Entity List action touching a model line somebody has already built on. That is a real consideration for anyone whose contracts or export posture care where a model came from, and it applies to the open-weight price floor that GLM 5.3 Flash and Qwen Flash Next established and to the capability questions GLM 5.3 raised in August.

The proportionate response is not to rip out working deployments. It is to know which ones you could replace, how fast, and at what cost — and to keep the abstraction layer that makes the answer “a config change” rather than “a quarter.”

What to do about it

1. Build the canary set this month. Private prompts, reference outputs, scheduled runs, variance alerting. It is a day of work and it is the only thing that answers the question.
2. Keep two live paths to your critical model. Not for failover alone — for the comparison. A quality delta between paths is your detection mechanism.
3. Make your account obviously legitimate. Real business entity, accurate contact details, seat count that bears some relationship to volume, and a heads-up to your provider before a large backfill or load test. The signature that flags you is behavioral; the context that clears you is administrative.
4. Ask your provider directly, in writing. Do you implement response degradation for accounts flagged as suspicious, and will you notify us if our account is flagged? It is a fair procurement question with a documented federal advisory behind it, and the answer belongs in your contract.
5. Treat gateways as measurement and portability, not anonymity. The advisory flags aggregators and recommends cross-provider intelligence sharing. Route through one because it lets you move and compare — and pick tooling on that basis, whether you are choosing coding tools or comparing Claude against ChatGPT.
6. Separate the geopolitics from the deployment decision. Named-vendor risk is a procurement and provenance question. It is not a reason to abandon open weights, and conflating the two produces worse decisions than either concern alone.

The bottom line

The accusation in AA26-251A is the part that will be argued about, and it is largely a continuation of a fight that has been running since June. The durable change is one sentence of recommended mitigation.

A US federal advisory has now told model providers that a reasonable response to a suspected bad actor is to keep taking their money and quietly serve them a worse model, randomized so they cannot measure it — with no notification, no appeal, and no word to the buyers who might be caught by a signature that reads like ordinary automation.

Almost certainly this will never touch you. But “almost certainly” is a posture, not a measurement, and until last week nobody official had suggested that the quality of a paid API response was a variable providers should deliberately make unverifiable.

Quality you cannot measure is quality you are taking on trust. Build the canary set.

Questions or corrections? Email Pick Right. Want the full list? See all news.