Joint Cybersecurity Advisory AA26-251A describes industrial-scale model extraction campaigns. This guide maps the evidence requirements so your organization can demonstrate that its integrity and access controls were operating.
Who this is for: CISOs and security engineers at organizations operating frontier AI models or APIs. Federal compliance teams responding to the advisory. Assessors reviewing model integrity controls. Risk officers evaluating exposure to extraction-based threats at AI model providers and enterprises consuming AI services.
CRITICAL ASSESSOR NOTICE: SWT3 witness anchors record that a governance event occurred and capture its computational factors. They do not replace assessor judgment. The assessor must independently verify that the substance of each control implementation meets the requirements of the applicable framework. Anchors provide the evidence trail; the assessor determines whether that evidence is sufficient.
On September 8, 2026, the National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation published Joint Cybersecurity Advisory AA26-251A. The advisory documents industrial-scale knowledge distillation campaigns targeting U.S. frontier AI models, running since at least late 2024.
The advisory describes three primary extraction methods:
The advisory characterizes these campaigns as systematic and sustained, generating billions of tokens across millions of exchanges. It describes the extraction activity as forming a core component of the threat actors' AI development strategy rather than a supplementary data source.
Scope note: This guide addresses the compliance and evidence dimensions of the advisory. Model extraction is a universal risk that affects any organization operating frontier AI models, regardless of geography or the origin of the threat. The evidence requirements described here apply equally to model providers worldwide. SWT3 witnesses that controls are operating; the specific tools an organization deploys to detect and prevent extraction are outside the scope of this protocol.
The natural response to an extraction advisory is to focus on security: deploy detection tools, tighten rate limits, improve account verification. That work is necessary. But it is not sufficient for compliance.
Security tools answer the question: "Are we protected?" Compliance requires answering a different question: "Can we prove our controls were operating?"
The distinction matters because regulatory frameworks, audit standards, and federal procurement requirements increasingly demand evidence, not assertions. An organization that deploys sophisticated extraction detection but cannot produce an audit trail demonstrating that those controls were active on a specific date, for a specific model, at a specific clearing level, has a governance gap that an assessor or investigator will identify.
The advisory is relevant to two categories of organizations:
Most organizations responding to the advisory will focus on deploying or improving detection capabilities. These tools are valuable, but they operate in real time and produce alerts. They do not inherently produce the kind of durable, cryptographically verifiable evidence that satisfies an audit or regulatory review.
The evidence gap has three dimensions:
| Dimension | Detection Tools | Witness Evidence |
|---|---|---|
| Temporality | Real-time alerts that may or may not be retained | Immutable, timestamped attestation records with cryptographic fingerprints |
| Continuity | Evidence of incidents detected, not of controls operating during quiet periods | Continuous attestation that controls were active, including periods with no incidents |
| Verifiability | Tool logs that an assessor must trust at face value | Anchors that an assessor can independently verify against the witness ledger |
The most challenging question an assessor can ask is not "Did you detect any extraction attempts?" but rather "Can you prove your access controls and model integrity checks were operating continuously between your last assessment and today?" Witness evidence answers that question. Detection alerts alone do not.
The following SWT3 procedures map directly to the control areas identified in the advisory. Each procedure records evidence that a specific category of control was operating at a specific time.
Records cryptographic attestation of model weight file hashes at deployment and at regular intervals. In the context of the advisory, this witnesses that the model being served has not been tampered with or replaced, and that the weights match the version that was security-evaluated.
Relevant to: Detecting unauthorized model replacement or degradation that could result from a successful extraction and re-deployment scenario.
Verify that weight integrity attestations are produced on a regular cadence, not only at deployment. An attestation at deployment time proves initial integrity; ongoing attestations prove sustained integrity.
Records the full configuration of adapters, fine-tunes, and modifications applied to a model. In an extraction context, this documents the exact model configuration being served, creating a baseline against which unauthorized modifications can be detected.
If the organization serves multiple model variants (different fine-tunes for different customers or use cases), verify that each variant has its own adapter stack attestation. An extraction campaign may target a specific variant.
Records identity verification events for entities accessing the model. The advisory describes fraudulent account creation as a primary attack vector. AI-ID.1 witnesses that identity verification controls were operating, including account creation validation, credential checks, and geographic access controls.
Focus on the cadence and coverage of identity attestations. Verify that the organization produces identity evidence for all access paths, not only the primary API. The advisory describes proxy infrastructure specifically designed to bypass geographic restrictions.
Records that access control mechanisms (rate limits, usage quotas, tier restrictions) were enforced at a specific time. The advisory describes techniques designed to circumvent per-account rate limits through distributed account creation. This attestation witnesses that the controls themselves were functioning, regardless of whether they were being circumvented.
An important nuance: access control attestation does not prove that controls were effective against a sophisticated adversary. It proves the controls were active. The assessor must separately evaluate whether the control design is adequate for the threat environment described in the advisory.
Records that audit logging infrastructure was operating and capturing relevant events. In an extraction investigation, the audit trail is the primary evidence source for reconstructing what happened, when, and through which access paths.
Verify that audit trail attestations cover the full event taxonomy: account creation, authentication, API calls, rate limit triggers, and anomaly alerts. An audit trail that only captures successful requests misses the failed attempts that characterize extraction reconnaissance.
Records the complete lineage of a model from training through deployment. For organizations responding to the advisory, the provenance chain demonstrates that the model being served is the authentic artifact, not a compromised or substituted version. It also supports forensic analysis by documenting every modification in the model's lifecycle.
Provenance becomes especially important if the organization suspects a successful extraction. The provenance chain establishes what was in production at the time of the suspected extraction, supporting incident response and any subsequent investigation.
The advisory describes extraction campaigns targeting frontier model capabilities. The sensitivity of the model's capabilities and the data it processes should determine the level of governance evidence required.
| Clearing Level | Extraction Risk Profile | Evidence Requirements |
|---|---|---|
| L0 (Analytics) | Models processing non-sensitive data with general capabilities | Basic access control and audit trail attestation |
| L1 (Standard) | Models with commercially valuable capabilities or business data access | Identity, access control, and audit attestation |
| L2 (Sensitive) | Models with proprietary reasoning capabilities or access to regulated data | Full procedure set: integrity, identity, access, audit, and provenance |
| L3 (Classified) | Frontier models with national security implications or classified data access | Complete governance chain with continuous attestation and incident response evidence |
The advisory's description of campaigns generating "billions of tokens across millions of exchanges" suggests that the targeted models fall into the L2 and L3 categories. Organizations operating models at these clearing levels should be producing evidence from all six procedures mapped above.
When reviewing an organization's response to the advisory, assessors should evaluate the evidence chain rather than the specific tools deployed. Tools change; evidence requirements do not.
Common gap: Organizations that invest heavily in detection tools but do not produce continuous attestation evidence. Detection without attestation means the organization can say "we looked for extraction attempts" but cannot say "we can prove our controls were operating on every day between assessments." Assessors should specifically probe for this gap.