The memo did not come from a courtroom. It did not arrive as a sanctions notice or an indictment. It was a communication from the White House Office of Science and Technology Policy — and its language was blunter than anything Washington has produced on artificial intelligence in years. China, it said, is conducting “deliberate, industrial-scale campaigns” to steal the core intellectual property of America’s most advanced AI systems. The charge was not hypothetical. The evidence, officials say, is already in hand.

The document, authored by OSTP Director Michael Kratsios and distributed to federal agency heads on April 23, 2026, describes a methodical extraction operation: tens of thousands of proxy accounts, jailbreaking techniques, and coordinated API queries designed to systematically drain proprietary AI models of their learned capabilities. The practice is called distillation. And in its legitimate form, it is entirely legal — even useful. What Kratsios is alleging is something else entirely.

Section 01

What Distillation Actually Means — And Why It Matters

Distillation, in the context of large language models, is the process of using a more powerful “teacher” model to train a smaller, cheaper “student” model. Done openly, with licensed data and disclosed methods, it is a legitimate tool of the AI industry. The problem Kratsios identifies is when distillation is done covertly — when foreign actors flood commercial AI APIs with millions of queries, using the responses to reconstruct the model’s behavior patterns without ever paying for the underlying research or respecting the intellectual property that produced it.

The memo is careful to note that the resulting models are not perfect copies. They cannot fully replicate the performance of the originals. But they can, as Kratsios put it, “appear to perform comparably on select benchmarks at a fraction of the cost.” That distinction — appearing capable versus being capable — is precisely what makes the practice so commercially damaging. A foreign competitor does not need to match GPT-5 or Claude 4 on every metric. It only needs to match them well enough to sell to markets that cannot tell the difference.

Section 02

DeepSeek Was the Warning Shot. Washington Is Only Now Firing Back.

For those paying attention, the accusation arrives late. In early 2025, China’s DeepSeek model generated what many Western analysts called an AI “Sputnik moment” — a demonstration that Chinese labs could produce frontier-grade outputs at a fraction of Western development costs. The explanation, according to Anthropic, was not a Chinese engineering breakthrough. It was extraction. Anthropic publicly accused Chinese actors of using mass-proxy distillation to siphon key behavioral data from its Claude models. The accusation was noted, then largely absorbed without a coordinated government response.

That response — boilerplate, measured, almost bored — tells its own story. Beijing has navigated IP theft accusations for decades. The playbook is well-rehearsed: deny specifics, assert principled commitments, wait for the next news cycle. What is different in April 2026 is the institutional weight behind the accusation. This is not a company filing a complaint. This is the White House Office of Science and Technology Policy, sending a formal memo to every federal agency head, stating on the record that it has evidence of systematic extraction at national scale.

Section 03

The Security Dimension Washington Isn’t Emphasizing Enough

Buried in the economic language of the memo is a finding that deserves considerably more attention than it has received. Kratsios warns that distillation campaigns do not merely replicate AI capabilities — they also allow foreign actors to “deliberately strip security protocols from the resulting models and undo mechanisms that ensure those AI models are ideologically neutral and truth-seeking.” In plain English: a distilled Chinese model derived from Claude or Gemini can be stripped of its safety guardrails, its content moderation, its resistance to harmful outputs — and deployed without them.

This transforms what might otherwise be a trade dispute into a national security concern of the first order. An AI system built on stolen American capabilities but freed from American safety architecture is not merely a cheaper product. It is a different kind of weapon — one that carries the intellectual fingerprints of Western R&D investment while serving entirely different strategic ends. The implications for information warfare, autonomous systems, and adversarial deployment scenarios are not addressed in the memo. They should be.

Intelligence Digest

Key Actors, Figures & Stakes at a Glance

Section 04

The Contradiction at the Heart of U.S. AI Policy

One year ago, the Trump administration reversed its own restrictions and allowed Nvidia to sell H20 semiconductor chips to Chinese buyers — in exchange for a 15 percent revenue cut. The H20 is not the most advanced chip Nvidia produces, but it is powerful enough to run meaningful AI workloads. The decision drew bipartisan criticism and contradicted the administration’s stated goal of denying China the hardware infrastructure to build competitive AI systems.

That contradiction does not disappear because Kratsios issued a memo. If the White House is serious about protecting American AI from systematic extraction, the policy architecture must be coherent across all its components — chip sales, API access controls, export licensing, and international legal frameworks. An administration that profits from selling AI-capable hardware to the same country it accuses of running AI theft campaigns at industrial scale will struggle to make that accusation land with either allies or adversaries.

Section 05

Three Weeks From Beijing: Is This a Warning or a Negotiating Position?

The timing of the memo is impossible to read as coincidental. The Trump-Xi summit, originally scheduled for late March and now set for May 14, is intended to address a range of technology and trade disputes. AI intellectual property theft — and specifically the question of what access Chinese entities should have to American frontier models — is expected to be a central agenda item. The memo does not emerge from a vacuum of principled indignation. It is a calibrated pre-summit signal, issued at sufficient volume to be heard in Beijing without triggering the kind of escalation that would poison the meeting before it starts.

That calculation reveals something important about how Washington is framing this issue. The accusation of industrial-scale theft is serious enough to mobilize domestic political support — the House Judiciary Committee held a dedicated hearing on Chinese IP theft just one day before the memo was published — but the proposed countermeasures remain deliberately vague. Entity list additions. Possible sanctions. Information sharing with AI companies. These are not emergency responses. They are negotiating chips, offered in advance of a summit where the real terms will be determined behind closed doors.

Whether Beijing reads the memo as a genuine red line or as a familiar American pressure tactic before talks will go a long way toward determining what, if anything, changes. China’s AI ambitions are not contingent on distillation campaigns. They are built on sovereign investment, domestic talent, and a long-horizon strategy that Washington has been aware of for a decade. The question is no longer whether China will compete in AI. It is whether the United States is prepared to enforce the terms under which that competition takes place.