Two of today’s stories are really one story about who controls the data flowing through a frontier model. Washington’s joint advisory naming six China-based labs as industrial-scale distillers — the first time US intelligence has formally put its name on what US labs had been alleging privately since February — also recommends that model providers serve suspected distillers subtly degraded output, which turns terms-of-service enforcement into a runtime feature the API has to implement. The same day, the Navier-Stokes saga hardened from a credit fight into the question researchers have been dreading: OpenAI concedes it cannot rule out that de-identified data from the scooped team’s own sessions helped train the model that beat them. When the enforcement lever on the way in is behavioral detection and the way out admits your work can feed a competitor’s model, the engineering job changes: you build for a world where the model you rent serves you versioned responses, and the sessions you generate are a training-data liability.
The API just became the distillation detector
What happened. On September 8, the FBI, NSA, and CISA released cybersecurity advisory AA26-251A, the first intelligence-community document to formally name the accused: DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, extracting “billions of tokens across millions of exchanges” from variants of Claude, GPT, Gemini, and Grok since at least late 2024. It details the mechanics — gray-market proxy “transfer stations” that defeat geographic blocks, premium subscriptions shared across teams of developers, chain-of-thought extraction, automated failover when a pathway gets blocked — and recommends three actions for US labs. The second one is the sentence that matters: “subtly alter responses for suspected malicious distillation attempts to attenuate the payoffs.” It also calls DeepSeek’s $5.6M training-cost claim “misleading” because it omits the data acquired through distillation.
Why it matters. The accusation list is geopolitics; the degradation recommendation is product. Asking a provider to detect suspicious accounts and serve them lossy output turns enforcement into a runtime behavior with real false-positive economics, and the trust-floor lesson about single-dependency routing now applies upstream of the socket: an API aggregator, a shared enterprise seat, an eval or monitoring farm hammering benchmarks, a CI job with high throughput — every one of these is volume- and pattern-indistinguishable from an aggressive distiller, and the whole point of “subtle” is that you cannot tell when you have been moved to the lossy lane. If providers implement attenuation, the operator risk is not the named six; it is the legitimate heavy tenant who now rides on a suspicion model with no appeals process. And the $5.6M footnote is the one to keep for the open-vs-closed ledger: the cheap-China-lab cost figure never included the distilled data it effectively took on credit — the hidden cost this column has been asking to see itemized since the open-weights price war started.
Source: cisa.gov
Doing research on a rented model makes you the training set
What happened. Yesterday’s Navier-Stokes story gained a sharper edge. Tristan Buckmaster, the NYU mathematician whose year-long collaboration with Anthropic’s Levent Alpöge was scooped, says he asked OpenAI two questions: when their first prompt had been sent (answer, per Buckmaster, “in the past few days” — after rumors of his team’s work had reached OpenAI), and whether the internal model had been trained on, or had access to, the Codex sessions where the pair had stored a year of drafts. Buckmaster reports that on access the answer was that the model “did not look up user data,” and on training he “did not get an answer.” OpenAI’s own disclosure concedes the open door: “While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models.”
Why it matters. That “cannot rule out” sentence is the load-bearing disclosure, because it confirms the general mechanism exists — de-identified usage data can feed training — while declining to rule out that it happened here. It moves the dispute out of credit and into the mundane operational question every agent builder now carries: the output of your agents is training signal to the vendor whose model you rent, and that vendor is the one building the model that can solve your open problem first. This is the harness rule generalized from cost to confidentiality. Simon Willison’s restatement is the version worth holding: if you partially solve a hard problem with a rented model, what are the odds your work influences training such that a later model helps someone else finish it first? This stops being paranoia the moment you multiply it across 4.9 million agent messages and 300 billion output tokens — the observed scale of this one race. Nobody in the loop got a straight answer to the question that decided who wins a Millennium Prize, and that is the ceiling you should expect for your own research data until a lab publishes a training-data governance answer on the record.
Source: simonwillison.net, openai.com
Neuron steering became a knob — and knobs get turned both ways
What happened. Nous Research’s “Model Neuroscience” release introduces contrastive neuron attribution: a method that finds the roughly 0.1% of MLP neurons whose activations most distinguish one behavior from another — their case study is refusal, harmful versus benign prompts — using as few as eight pairs of contrastive prompts, no gradient training, and no weight modification, just forward passes. Ablating the discovered circuit at high strength redirected the behavior: refusal rates fell by over 50% on a standard jailbreak benchmark while output quality held across steering strengths. The paper is on arXiv as 2605.12290.
Why it matters. This is interpretability graduating from analysis into control. Residual-stream steering degrades a model when pushed hard, which is why it never became an operator tool; CNA’s claim is that you can flip a specific behavioral circuit at strength without dragging the rest of the model sideways — the difference between a lab demo and a knob you could plausibly expose per tenant. The engineer’s caution is reciprocal, and it is the real takeaway: anything you can find and ablate, someone else can find and ablate. An alignment property that lives in a discoverable, removable circuit is a single-switch failure mode, and the same family of technique that lets a provider attenuate your lane per the advisory above is what lets anyone else edit away a model’s guardrails after the fact. Finding the circuit is now cheap; deciding who is allowed to turn the knob is the work that is not solved.
Source: nousresearch.com, arxiv.org
The Rest
- Google wrote the largest check it has ever written in Europe — €13 billion (~$15.1B) into Finnish AI data centers and clean-energy infrastructure across Hamina, Kajaani, Muhos, and Vaala, spent in 2027–28, the hyperscaler extending yesterday’s sovereign-capital lane with its own balance sheet rather than Mistral’s. blog.google
- Lighthouse Attention is a training-only trick that deletes itself — Nous’ selection-based hierarchical attention runs the forward+backward pass ~17× faster than cuDNN SDPA at 512K context on a single B200, then a brief dense resumption converts the checkpoint back to a normal attention model that matches dense-from-scratch at the same token budget. Removable sparsity: no kernel change at inference because there is no sparsity at inference. nousresearch.com
- DeepMind ran the first double-blind frontier eval — Gemini Flash-Lite tested against confidential MLCommons safety benchmarks sealed with Google Cloud’s Confidential Computing, so the evaluator cannot see the weights and Google cannot see the prompts ahead of time; the credibility problem with self-reported benchmark numbers finally gets a plumbing answer. deepmind.google
- The open-stack summit we flagged yesterday lands tomorrow — the small Presidio room where “open” means hardware, local inference, and verifiable compute now books up directly across from the state’s first named distillation advisory, which sharpens everything that room argues about. opensourceaisummit.org
What I’m watching
How US labs actually build the attenuation detector out of the advisory, because a suspicion model with a bad false-positive thesis will eat more legitimate heavy traffic than it deters — watch for the first provider to publish a definition of “suspected” instead of keeping it implicit. And the Grok 4.7 clock still holds: no model card, no pricing, and Musk’s roughly-ten-day window puts a drop around September 11–12, at which point the numbers-are-out verdict this column promised follows immediately.