NIST would work with AI companies to define “distillation attacks,” in which a rival trains its model on another model’s answers, and to set out how to detect and prevent them.
Reps. Pat Harrigan (R-N.C.) and George Whitesides (D-Calif.) introduced the AI Cyber Defense Act on Oct. 22, a bill that would have the National Institute of Standards and Technology (NIST) work with AI companies to define “distillation attacks” and write voluntary standards for detecting and preventing them.
Distillation is when a smaller or less advanced AI model sends a more capable model large numbers of questions, collects the answers, and uses them to train itself to do similar tasks.
AI developers and their suppliers would help write distillation standards
Within 180 days of the bill becoming law, the NIST director would have to invite private-sector AI companies to work with NIST on the definition and the standards.
The bill defines these companies as businesses that develop, train, deploy, sell, or license AI systems. It also counts businesses that supply substantial computing power, data, or technical services for building or running AI systems.
The standards would exclude companies based in or controlled from China, Russia, Iran, North Korea, or Cuba. The NIST director could also exclude other foreign persons or companies. The exclusion would never apply to U.S. citizens or permanent residents.
The standards would be voluntary, with no deadline to finish them
The bill would not require any company to adopt the standards. It sets no penalty for ignoring them and authorizes no additional funding for NIST’s work.
NIST would have 180 days to invite companies to start work on the standards. The bill sets no deadline for finishing them. Once they’re finished, NIST would have up to a year to publish them on its website.
A second group would write standards for using AI in cyber defense
The bill would also have NIST set up an AI Cybersecurity Roundtable within 180 days of the bill becoming law. The roundtable would write voluntary standards and best practices for using AI to defend against cyberattacks. NIST would publish them within one year of setting up the roundtable.
NIST would invite members from the same group of AI companies mentioned above, as well as owners and operators of critical infrastructure. Federal law defines critical infrastructure as systems and assets so vital that losing them would weaken national security, the economy, or public health or safety.
Congress and federal agencies have already targeted distillation
In July, Whitesides and Rep. Bob Latta (R-Ohio) introduced the House version of a bill from Sens. Jim Banks (R-Ind.) and Adam Schiff (D-Calif.). It would let rival AI companies share information about distillation and other foreign espionage without violating antitrust law.
In September, the National Security Agency, the Cybersecurity and Infrastructure Security Agency and the FBI accused six China-based AI companies of distilling American models. The six include DeepSeek, Moonshot AI and Alibaba. The agencies said the companies collected answers from Anthropic’s Claude, OpenAI’s GPT, Google’s Gemini and xAI’s Grok through millions of exchanges, then used them to train their own models.
The agencies said some distillation is legitimate. They called this activity improper because the companies hid it and broke the U.S. providers’ terms of use. Some intermediary services the companies used hid the origin of the requests, letting them bypass limits on which countries could use the models. China’s Commerce Ministry rejected the accusations.
The bill now goes to the House science committee
The House referred the bill, H.R. 10873, to the House Science, Space, and Technology Committee. To become law, it must pass the House and the Senate and be signed by the president.
