Deterring American AI Model Theft Act of 2026

This bill aims to prevent foreign adversaries from stealing key technical features of closed-source, American-owned artificial intelligence (AI) models through model extraction attacks. It requires assessments, reports, and lists of attackers, and authorizes sanctions and entity list additions against those involved.

Sec. 3, Definitions: Defines key terms including 'closed-source AI model' (a proprietary AI model not publicly shared, accessed via API or owner-controlled interfaces), 'country of concern' (China, Russia, and certain other countries designated by the Secretary of State), 'entity of concern' (foreign persons or entities linked to a country of concern or conducting model extraction attacks), 'model extraction attack' (unauthorized querying to replicate or improve another AI model by circumventing controls or violating terms), and 'fraudulent account network provider' (foreign entities that knowingly provide accounts to help entities of concern access closed-source AI models they are otherwise blocked from).

Sec. 4, Assessment of model extraction attacks and fraudulent account network providers: Requires the Secretary of State, within 180 days, to assess which entities of concern have conducted model extraction attacks or are fraudulent account network providers. The assessment must include determinations of entities, origin countries, government assistance, methods, detection approaches, economic and national security consequences, U.S. government assistance to owners, and a diplomatic strategy. The Secretary of Commerce must consult with AI model owners and others, submit a report to Congress within 210 days, and update it annually for three years. The Secretary must also routinely assess for new attacks and providers, establish an information-sharing mechanism, maintain a public 'AI Model Extraction Attackers List' for up to 5 years, and publish best practices guidance.

Sec. 5, Deterring model extraction attacks and fraudulent account network providers: Requires the Under Secretary of Commerce for Industry and Security to determine, within 210 days, whether entities identified as conducting or facilitating model extraction attacks should be added to the Entity List. Authorizes the President, through the Secretary of State, to block and prohibit all property transactions of such entities under the International Emergency Economic Powers Act, with exceptions for international obligations, humanitarian assistance, and U.S. intelligence, law enforcement, and national security activities. Violations are subject to penalties under that Act.