US Agencies Warn of Knowledge Distillation Campaigns Using LLM API Gateways

NSA, CISA and the FBI issued advisory AA26-251A describing large-scale knowledge distillation campaigns that extract model capabilities through native APIs, cloud providers, third-party aggregators and proxy relays. The article argues that self-hosted LLM API gateways, which front multiple upstream models, are a likely chokepoint and that organizations should first locate such systems on their own networks. It notes that asset search engines like ZoomEye can find gateway panels, such as those from the New API project, by their banners or titles. The advisory recommends detection and mitigation, targeted response changes and cross-organization intelligence sharing. The author cautions that a detected panel shows software presence only, not confirmed misuse or compromise.