Google’s flagship AI chatbot Gemini has been targeted by commercially motivated actors attempting to clone it through repeated prompts, with one campaign exceeding 100,000 queries, the company reported.
In a Thursday report, Google described the activity as “distillation attacks” or “model extraction”, where attackers probe the system for patterns and logic to replicate or enhance their own AI models. The company attributes most attempts to private firms or researchers seeking competitive advantage. A spokesperson told NBC News the attacks appear to originate worldwide, but no further details on suspects were provided.
John Hultquist, chief analyst for Google’s Threat Intelligence Group, warned that the Gemini incidents may foreshadow similar attacks on smaller companies’ custom AI tools. He said, “We’re going to be the canary in the coal mine for far more incidents,” and declined to name suspects. Google classifies distillation as intellectual property theft, noting that billions of dollars have been invested in developing large language models, and the internal algorithms of top models are considered highly valuable proprietary assets.
Despite detection and blocking mechanisms, major large language models (LLMs) remain vulnerable because they are accessible to anyone on the internet. OpenAI previously accused Chinese rival DeepSeek of conducting distillation attacks to improve its models. Many of the prompts used in the attacks on Gemini were designed to extract the algorithms that enable it to “reason” and process information. Hultquist added that as organizations train custom LLMs on sensitive data, they expose proprietary strategies. He illustrated, “Let’s say your LLM has been trained on 100 years of secret thinking of the way you trade. Theoretically, you could distill some of that.”
The report underscores growing concern in the AI industry about model extraction and the need for stronger safeguards against intellectual property theft. Google noted that the frequency of distillation attacks has risen sharply in recent months, prompting the firm to enhance monitoring and response capabilities. The company said its detection systems flag anomalous query patterns, but attackers adapt to bypass safeguards.
Google emphasized that the proprietary architectures and training data of large language models represent significant competitive advantage, and unauthorized extraction undermines that advantage. The report also highlighted that other industry players have faced similar threats, with OpenAI publicly accusing DeepSeek of using extracted data to refine its own models. Google’s threat intelligence team continues to track global activity and advise partners on mitigation strategies.
