Mapping Self-Hosted LLM API Gateways: What the CISA Distillation Advisory Means for Asset Owners The advisory published by NSA, CISA and the FBI (AA26-251A) describes industrial-scale knowledge distillation campaigns run through native APIs, cloud providers, third-party aggregators and a gray market of proxy relays it calls "transfer stations". For organizations that operate model-serving infrastructure, the practical question is narrower: which of the systems that front frontier-model APIs ...