Deterring American AI Model Theft Act of 2026
- Sponsor
- Rep. Huizenga, Bill [R-MI-4]
- Committees
- Foreign Affairs Committee (primary)
- Last action
- Apr 22, 2026
Bottom line
The bill establishes a framework for the U.S. government to detect, deter, and sanction foreign entities engaged in the unauthorized extraction of American closed-source AI model capabilities.
What it actually does
This bill mandates the U.S. government to identify and deter foreign adversaries, specifically entities from countries like China and Russia, from stealing proprietary information from American-owned closed-source Artificial Intelligence (AI) models through 'model extraction attacks.' It requires assessments of such attacks and fraudulent account networks, establishes a public list of attackers, and authorizes the imposition of export controls and economic sanctions against identified entities to protect U.S. economic and national security interests.
Proponents argue
Proponents argue that the unauthorized acquisition of advanced AI capabilities by foreign adversaries through model extraction attacks poses a significant threat to U.S. national security, economic competitiveness, and intellectual property. They contend that this bill is essential to safeguard American innovation, prevent adversaries from gaining a shortcut to advanced AI, and ensure the U.S. maintains its leadership in AI development by providing tools to identify and punish those who engage in such theft.
Opponents contend
Opponents might argue that the definitions of 'model extraction attack' and 'entity of concern' could be overly broad, potentially chilling legitimate AI research or inadvertently impacting entities not directly involved in adversarial actions. Concerns could also be raised about the practical challenges of accurately detecting and attributing such attacks, the potential for diplomatic repercussions from sanctions, and the administrative burden on U.S. agencies without explicit funding.
The bill is relatively short and clearly structured, making it accessible for an informed reader to understand its core provisions within a reasonable timeframe.
Section 2
Sense of Congress on AI Model Theft
This section outlines Congress's view that U.S.-owned closed-source AI models are vital for national security and economic interests. It states that unauthorized acquisition of these models' technical characteristics by 'entities of concern' (e.g., model weights, architectures) through 'model extraction attacks' is a threat. It emphasizes the need for the U.S. government to identify, punish, and deter such attacks, distinguishing them from legitimate, authorized AI training practices.
Supporters argue
Supporters argue this section clearly articulates the national security imperative behind the bill, setting the stage for the subsequent operative provisions and signaling a strong commitment to protecting American AI innovation.
Critics contend
No specific opposition is typically raised against a 'Sense of Congress' provision, as it primarily states legislative intent rather than enacting direct policy.
Tradeoffs
This section balances the recognition of AI's importance with the need to protect proprietary aspects, implicitly acknowledging the tension between open research and national security concerns.
Section 3
Key Definitions for AI Model Protection
This section defines critical terms used throughout the Act. Key definitions include 'closed-source AI model' (proprietary, API-accessed, owner-controlled), 'country of concern' (initially China, Russia, and others on Export Administration Regulations Country Group D:5 list), 'entity of concern' (foreign persons/entities linked to countries of concern or conducting model extraction attacks), and 'model extraction attack' (unauthorized querying to replicate an AI model, circumventing controls or violating terms of service, with purpose inferred from activity patterns). It explicitly excludes authorized training practices.
Section 4(a)-(f)
Assessment and Reporting of Model Extraction Attacks
This provision mandates the Secretary of State, in coordination with the Operating Committee for Export Policy, to conduct an assessment within 180 days to identify entities of concern engaged in model extraction attacks or acting as fraudulent account network providers. The assessment must identify countries of origin, methods used, economic/national security consequences, and U.S. government assistance efforts. A report is due to Congress within 210 days, with annual updates for three years. It also requires routine assessments and establishes an information-sharing mechanism for AI model owners with the Department of Commerce.
Section 4(g)-(h)
AI Model Extraction Attackers List and Public Guidance
This provision requires the Secretary of State to maintain and publicly publish an 'AI Model Extraction Attackers List' of individuals and entities identified as having conducted or directed model extraction attacks in the past year. This list will be published on a Department of State website for up to five years, with safeguards for confidential information. Additionally, the Secretary of Commerce must publish a public report on best practices to detect, prevent, and respond to model extraction attacks, also protecting confidential industry information.
Section 5(a)
Addition to Entity List for Model Extraction
This provision mandates that the Under Secretary of Commerce for Industry and Security, in coordination with the End-User Review Committee, determine whether entities identified as having conducted or facilitated model extraction attacks (or their affiliates with 50% or more ownership) should be added to the Entity List maintained by the Bureau of Industry and Security. This determination is to be made by majority vote of the Committee.
Section 5(b)
Sanctions for Model Extraction Attacks
This provision authorizes the President, through the Secretary of State, to block and prohibit all transactions in property and interests in property of identified entities of concern (those conducting model extraction attacks or facilitating them via fraudulent account networks). These sanctions are imposed under the International Emergency Economic Powers Act (IEEPA). The section includes exceptions for international obligations, humanitarian assistance (e.g., food, medicine), and U.S. intelligence/law enforcement activities. Violators are subject to IEEPA penalties.
The bill allows the purpose of querying (i.e., whether it constitutes a 'model extraction attack') to be inferred from the totality of circumstances, including volume, structure, pattern, coordination, timing of activity, concentration of queries, use of multiple accounts, or correlation with another AI model's development timeline.
Section 3(11)(B)
Why it matters:This is standard legislative practice for defining complex technical terms, but its significance for enforcement and potential for broad interpretation could be overlooked.
Case for: Proponents argue that allowing inference of purpose is essential because direct evidence of intent in cyberattacks is often difficult to obtain. This flexibility enables enforcement against sophisticated and clandestine extraction efforts.
Case against: Critics might argue that inferring purpose could lead to subjective determinations or accusations based on circumstantial evidence, potentially targeting legitimate researchers or entities whose activities coincidentally resemble extraction patterns.
Estimated impact: Significantly impacts the scope and enforceability of the entire Act, determining how easily an activity can be classified as a prohibited 'model extraction attack.'
The definition of 'country of concern' includes any foreign country listed in Country Group D:5 under Supplement No. 1 to part 740 of the Export Administration Regulations (EAR), as published on January 1, 2026, that is designated by the Secretary of State. The definition of 'entity of concern' includes any foreign person or entity 'operating under the direction or control of' an entity headquartered in a country of concern.
Section 3(3)(C) and Section 3(4)(B)
Why it matters:This is standard legislative drafting to leverage existing legal frameworks and avoid redundancy, but it requires specialized knowledge to fully understand the scope of affected countries and entities.
Case for: Proponents argue that linking to established export control lists and including 'direction or control' language ensures consistency with existing U.S. national security policy and provides broad coverage to prevent circumvention by proxies.
Case against: Critics might argue that relying on external, evolving regulations makes the bill's scope less transparent and that the 'direction or control' clause could be interpreted very broadly, potentially ensnaring entities with tenuous connections to countries of concern.
Estimated impact: Significantly expands the potential reach of the bill beyond explicitly named countries (China, Russia) to any country on the D:5 list and any entity globally that is deemed to be under the influence of a country of concern.