House bill would have NIST write standards to stop AI distillation attacks

A bipartisan bill aimed at model copying

Two members of the US House have introduced a bill that would make the federal standards agency write guidance on stopping AI distillation attacks. Rep. Pat Harrigan, a North Carolina Republican, and Rep. George Whitesides, a California Democrat, introduced the AI Cyber Defense Act on 22 October 2026. It has been numbered H.R. 10873 and, according to Ripon Advance, referred to the House Science, Space, and Technology Committee.

The bill directs the National Institute of Standards and Technology, known as NIST, to work with private AI developers on voluntary standards for detecting and preventing distillation attacks. It also creates an AI Cybersecurity Roundtable that would bring together technology companies and the operators of critical infrastructure such as power grids, hospitals, water systems and banks to agree best practices for using AI in cyber defence.

NIST would have 180 days after the bill becomes law to start engaging industry and to set up the roundtable. The standards and best practices that come out of the process would be published so that any company or infrastructure operator could use them. Nothing in the bill as described would make the standards mandatory.

What a distillation attack is

Distillation itself is an ordinary machine learning technique: a smaller student model is trained on the outputs of a larger teacher model, and many companies use it on their own models to make cheaper versions. It becomes an attack when someone queries another company's model at scale, usually against its terms of service, and uses the answers and reasoning to train a rival model without paying for the original research.

The issue has been building for months. OpenAI has accused Moonshot AI of a distillation campaign against its models, and Anthropic has described classifiers and other defences it uses against distillation. As CyberScoop notes, the US government and Anthropic, OpenAI and Google have accused Chinese firms including Moonshot, DeepSeek and Alibaba of systematic copying, through campaigns that experts say rely on hundreds of burner and resold accounts and thousands to millions of prompts.

Stolen credentials make the problem worse. When attackers get hold of paying customers' API keys, they can run extraction prompts on someone else's account, which is one reason the OpenCode breach of saved provider keys was treated as a distillation risk as well as a security incident.

Harrigan's argument: a cheap way to keep up

In an interview with CyberScoop, which saw the bill before release, Harrigan said it is incredibly expensive for the US industry to maintain its lead, which he put at six to 12 months, and that distillation lets rivals keep their own spending low. He said he believes countries such as China may be choosing to stay six to 12 months behind on purpose.

"Let us burn really hot and for 5 to 10% of the spend, they can just distill and steal," he said, adding that they could keep doing so until the US market falters and then leapfrog it. Those percentages are his estimate, not a figure from the bill or a cited study.

Whitesides framed it as buying time. "Every month we keep China and other adversaries from stealing our progress is a month we gain to build the safeguards this technology needs," he said, adding that the bill helps stop the theft of American AI models and protects infrastructure operators as AI makes cyberattacks faster, cheaper and harder to stop.

Who is shut out, and a discrepancy

The bill excludes entities of concern from the private-sector group that would help write the standards. Here the published accounts differ. The press release from Harrigan's office and the summary quoted by Ripon Advance list five countries: China, Russia, Iran, North Korea and Cuba. CyberScoop's report, based on the bill text it saw, lists four, without Cuba, and says the bill defines entities of concern as any foreign person or organisation headquartered in those countries or operating under the direction of a company based there.

CyberScoop also reports that the NIST director could designate further people or organisations as entities of concern. We could not retrieve the full bill text from Congress.gov on 24 October 2026, so we cannot yet say which list is correct. We will update this article if the text settles it.

The hard part: defining the attack

According to CyberScoop, NIST's first job would be to define what a distillation attack is and to separate it from the sharing that happens around open-weight and open-source models. That line is not easy to draw. Developers routinely train small models on outputs from larger open models, and researchers publish datasets generated by commercial models. A definition that is too broad could cover normal research; one that is too narrow would miss the large-scale extraction campaigns the bill is aimed at.

Detection is technically difficult too. Companies watch for unusual query patterns, clusters of related accounts and prompts designed to pull out step-by-step reasoning, and some limit what reasoning they show. Shared standards could help smaller model providers that lack the security teams of the biggest labs, which is one practical case for NIST's involvement.

There is also an awkward backdrop that CyberScoop points out: American AI companies themselves face lawsuits from media organisations, artists and other creators who say their work was used to train commercial models without permission or payment. Arguments about who may learn from whose outputs cut in more than one direction.

What happens next

The bill is at the first stage of the process and needs committee action and votes in both chambers before it could become law. Its approach, voluntary standards written with industry, is a light touch compared with export rules, and it arrives as other governments move too: China has proposed export controls on 23 AI technologies, including large models and agents.

For AI developers, the practical effect would come later: a NIST document they could point to when designing defences and a forum where model makers and infrastructure operators compare notes. For now, H.R. 10873 is a marker that model copying has moved from a dispute between companies to a question Congress wants the federal government to help answer.