AI Counterintelligence

AI counterintelligence is the protection of strategically valuable AI capabilities, infrastructure, and relationships from foreign intelligence collection. Its perimeter includes private laboratories, cloud providers, semiconductor firms, contractors, and startups, rather than only classified government facilities. David Feith calls the point at which a private company’s work becomes strategically significant the counterintelligence threshold: government needs a way to recognize that transition and offer useful threat intelligence, investigative support, and security assistance before an adversary acts. His proposed compact pairs those government capabilities with laboratory obligations covering privileged access, monitoring, third-party security, and incident response. This is a policy proposal, not an established federal framework. ¹

Three collection channels

Insiders and cyber intrusion target artifacts. Model weights, training infrastructure, chip designs, source code, and operational know-how can be copied directly. The Linwei Ding case gives a concrete insider example: a federal jury convicted the former Google engineer in January 2026 on seven counts of economic espionage and seven counts of trade-secret theft after he uploaded more than 2,000 pages of confidential AI material to a personal cloud account while secretly pursuing China-based ventures. The stolen material covered TPU and GPU systems, chip-interconnect and orchestration software, and SmartNIC technology. The two groups of charges are distinct: trade-secret theft under 18 U.S.C. §1832 does not require the foreign-benefit element that economic espionage under §1831 adds. DOJ described it as the first conviction on AI-related economic-espionage charges. ²

API extraction targets behavior rather than files. Adversarial distillation uses a model’s outputs as synthetic training data, so useful capabilities can move without any theft of the weight artifact. A September 2026 NSA–CISA–FBI advisory attributes industrial-scale campaigns since late 2024 to six China-based AI companies, describing fraudulent account pools, geographic-restriction proxies, routing across providers, chain-of-thought elicitation, and automated quality checks. Those are government assessments and attributions, not independent court findings; the advisory itself distinguishes legitimate research distillation from campaigns that evade access controls and violate terms of use. Recommended defenses include account and throughput anomaly detection, query limits, coordinated revocation, response degradation for high-confidence malicious campaigns, and intelligence sharing across model providers, clouds, and aggregators. ³

Relationships and access can bypass technical boundaries. Recruitment, undisclosed affiliations, investment, partnerships, and personal access can expose strategy or create later collection opportunities without an initial technical intrusion. On November 4, 2026, three House committee chairs requested a closed briefing from NVIDIA CEO Jensen Huang about the company’s espionage defenses and his interactions with Megaspeed executive Alice Huang, whom the letter calls a publicly reported PRC intelligence asset. The letter documents congressional concern and a request for testimony; it does not establish the underlying allegation, demonstrate that information was compromised, or adjudicate anyone’s conduct. ⁴

Defensive architecture

RAND’s Security Level 3 supplies an implementation baseline for the artifact-theft side. It maps 140 standard and 122 supplemental controls from NIST SP 800-53 to 31 attack vectors, including credential compromise, physical access, supply-chain compromise, malicious insiders, extortion, and model distillation. The controls apply across development, production, backup, and supporting cloud systems. RAND proposes a voluntary, incremental 6–12 month implementation, with defense in depth produced by many-to-many mappings between controls and threats. SL3 addresses operational capacities OC1–OC3, including organized cybercrime and insiders; it explicitly does not claim to stop OC4–OC5 foreign intelligence services and leading nation-state operations. ⁵

The standard’s own evidence also limits its confidence. Only five external participants attended RAND’s main workshop, and nine people voted in its threat and implementation polls. Participants rated human-intelligence threats as their leading concern and identified cost, slower development, fragmented ownership, and coordination as more severe obstacles than a shortage of AI-security expertise. SL3 is therefore best read as an auditable starting control set, not as proof that completing a checklist yields resistance to a state intelligence service. ⁶

Artifact security and output security need different telemetry. Weight protection emphasizes centralized storage, least privilege, controlled copies, egress restriction, supplier access, integrity checks, and theft-focused red teaming. Distillation defense instead depends on identity, account-pool and query-pattern analysis, provider-spanning correlation, and output-level responses. A defense plan that monitors only file egress misses the second channel; one that watches only API abuse misses insiders and supply-chain access. Feith’s broader proposal adds classified threat sharing and government investigative support because individual firms cannot independently match a foreign service’s intelligence picture. ^{7 8}

Open questions

• Where should the counterintelligence threshold sit, and how can government offer assistance without turning ordinary research companies into an informal classified sector?
• How should labs preserve publication, mobility, and foreign collaboration while monitoring undisclosed affiliations and anomalous insider behavior?
• When is API distillation ordinary learning from public or paid outputs, and when do deception, account fraud, or control evasion make it an intelligence operation?
• Can response degradation remain compatible with honest service for evaluators and ordinary customers? The joint advisory says researchers and third-party evaluators should be informed of model changes even when suspected malicious distillers are not.
• Which claims of compromise are supported by primary evidence, and which remain official allegations? Congressional attention is a signal of institutional concern, not a substitute for attribution evidence.

Related

• threat-modeling — AI counterintelligence supplies adversary classes and collection channels that belong in a laboratory’s trust boundaries and attack trees.
• model-backdoors — weight theft exports capability; poisoned weights are an inbound integrity threat and require a different control objective.
• llm-inference-provider-landscape — providers, clouds, and aggregators are both additional attack surface and the correlation points needed to detect distributed distillation.
• reproducible-builds — artifact integrity and provenance complement confidentiality controls but cannot prevent an authorized insider from copying a genuine artifact.

Sources

• David Feith 2026 — A New Counterintelligence Map for the AI Age
• Jair Aguirre, Phillip Robertson, Steven F. Comer, Matthew J. Malone, and Wesley Hurd 2026 — Achieving AI Model Weight Security Level 3 (SL3)
• Brian J. Mast, John Moolenaar, and Eric A. “Rick” Crawford 2026 — Letter to Jensen Huang on NVIDIA Security Protocols and Foreign Adversary Espionage
• NSA, CISA, and FBI 2026 — China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies
• U.S. Department of Justice 2026 — Former Google Engineer Found Guilty of Economic Espionage and Theft of Confidential AI Technology

Footnotes

1. David Feith 2026 — A New Counterintelligence Map for the AI Age ↩

2. U.S. Department of Justice 2026 — Former Google Engineer Found Guilty of Economic Espionage and Theft of Confidential AI Technology ↩

3. NSA, CISA, and FBI 2026 — China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies ↩

4. Brian J. Mast, John Moolenaar, and Eric A. “Rick” Crawford 2026 — Letter to Jensen Huang on NVIDIA Security Protocols and Foreign Adversary Espionage ↩

5. Jair Aguirre, Phillip Robertson, Steven F. Comer, Matthew J. Malone, and Wesley Hurd 2026 — Achieving AI Model Weight Security Level 3 (SL3) ↩

6. Jair Aguirre, Phillip Robertson, Steven F. Comer, Matthew J. Malone, and Wesley Hurd 2026 — Achieving AI Model Weight Security Level 3 (SL3) ↩

7. David Feith 2026 — A New Counterintelligence Map for the AI Age ↩

8. NSA, CISA, and FBI 2026 — China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies ↩