Google says its flagship artificial intelligence chatbot, Google Gemini, has been targeted by “commercially motivated” actors attempting to replicate its capabilities through large-scale prompting campaigns, including one effort that queried the system more than 100,000 times. In a report released Thursday, Google said it has faced a growing number of so-called “distillation attacks,” described as repeated prompts designed to extract a chatbot’s underlying logic and internal processes. The company referred to the activity as “model extraction,” in which attackers probe the system to uncover patterns that could help them build or enhance competing AI models.
Google believes the campaigns are primarily driven by private companies and researchers seeking a competitive edge. A spokesperson said the attacks appear to originate from multiple countries but declined to provide further details.
John Hultquist, chief analyst at Google’s Threat Intelligence Group, said the scale of the attacks suggests similar tactics are likely to spread across the industry, particularly as smaller firms deploy custom AI systems.
“We’re going to be the canary in the coal mine for far more incidents,” Hultquist said, declining to name specific suspects.
Google said it considers distillation attempts to be intellectual property theft. Technology firms have invested billions of dollars in developing large language models and treat the architecture and reasoning capabilities of their systems as highly valuable proprietary assets.
Major AI systems remain vulnerable to such tactics, Google noted, because they are widely accessible online despite safeguards designed to detect and block abusive activity.
The issue echoes past industry tensions. Last year, OpenAI, the company behind ChatGPT, accused Chinese rival DeepSeek of conducting distillation attacks to improve its own models.
According to Google, many of the recent attempts sought to expose the algorithms that enable Gemini to “reason,” or determine how to process and respond to information.
Hultquist warned that as companies increasingly train proprietary AI systems on sensitive or strategic data, they may face similar risks.
“Let’s say your LLM has been trained on 100 years of secret thinking of the way you trade. Theoretically, you could distill some of that,” he said.
