US names 6 AI distillers—and the signature matches your agent fleet
AA26-251A hands labs a distillation-detection playbook, and cron fleets plus cache-tuned traffic fit it—inviting silent throttling. Plus a free finance LLM.
Copy markdown
The six named, and what they siphoned
The joint CISA/NSA/FBI advisory AA26-251A names DeepSeek, Moonshot, Alibaba, MiniMax, StepFun and Z.AI as running industrial-scale distillation since late 2024—harvesting chain-of-thought traces, fine-tuning data and RL rollouts from US frontier models. The pipeline runs through APIs, aggregators, resold “transfer stations” and premium seats.
The detection list is a photo of your best practices
The flagged signals read like a normal agent stack: 24/7 usage with no human idle periods, new subscriptions immediately at max throughput, one service key hitting from many IPs, and traffic tuned for prompt-cache hits over task diversity. That’s scheduled cron fleets and standard FinOps—the exact caching that providers’ own pricing rewards.
The part that costs you: silent downgrades
The advisory urges providers to route suspected accounts to “downgraded,” less-capable models and to vary the degradation to evade detection—with no billing note, status-page incident, or support flag. If your fleet matches the profile, you could pay full rate for quietly worse output and never see it in a changelog.
Do this now: make your fleet legible
Log per-request quality—latency, refusal and regression rates—so a silent model swap shows up in your dashboards, not your users’ bug reports. Add human-like variance and idle windows to scheduled jobs, and tie keys to real, gradually-ramped accounts rather than one maxed service seat.
Elsewhere: a free, finance-tuned open model
inclusionAI shipped Ling-3.0-flash-Fin—a 124B-parameter MoE with just 5.1B active per token, post-trained for filings, valuation and research. Weights are on Hugging Face and there’s a free tier live on OpenRouter, so you can wire it into a document-analysis agent this weekend without a bill.
Elsewhere: vLLM triples throughput on million-token GLM
vLLM’s new Hybrid HiSparse offloading pushes GLM-5.3 to roughly 19–25 concurrent requests on an 8×H200 node at 1M-token context—up from 5–6 with standard KV offload. Long-context agents that were memory-bound just got several times cheaper to serve.