H.R. 8283

[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 8283 Introduced in House (IH)]

<DOC>

119th CONGRESS
2d Session
H. R. 8283

To prevent foreign adversaries from threatening the national security 
of the United States by extracting key technical features of closed-
source, American-owned artificial intelligence models, and for other 
purposes.

_______________________________________________________________________

IN THE HOUSE OF REPRESENTATIVES

April 15, 2026

Mr. Huizenga (for himself and Mr. Moolenaar) introduced the following 
bill; which was referred to the Committee on Foreign Affairs

_______________________________________________________________________

A BILL

To prevent foreign adversaries from threatening the national security 
of the United States by extracting key technical features of closed-
source, American-owned artificial intelligence models, and for other 
purposes.

Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

This Act may be cited as ``Deterring American AI Model Theft Act of 
2026''.

SEC. 2. SENSE OF CONGRESS.

It is the sense of Congress that--
(1) artificial intelligence (AI) models owned by United 
States private sector companies are essential for advancing 
United States economic and national security interests;
(2) many of the most advanced AI models owned by United 
States companies are ``closed-source models'' whose unique 
technical characteristics are not openly shared or published;
(3) the unauthorized acquisition of model capabilities, 
such as model weights, model architectures, and other technical 
characteristics of closed-source AI models by entities of 
concern through model extraction attacks represents a threat to 
the national security and foreign policy interests of the 
United States, as well as the intellectual property rights and 
economic competitiveness of United States companies;
(4) the United States Government, in cooperation with 
private owners of closed-source AI models, should take steps to 
identify, punish, and deter model extraction attacks on the 
protected capabilities of closed-source models by entities of 
concern;
(5) model extraction attacks against American closed-source 
AI models allow foreign adversaries a short cut to acquiring 
advanced AI capabilities; and
(6) authorized model training practices that adhere to the 
terms of service or are otherwise consistent with contractual 
terms set by the owners of closed-source AI models are a 
legitimate research method that play an important role in AI 
research and are fundamentally distinct from model extraction 
attacks defined in this Act.

SEC. 3. DEFINITIONS.

In this Act:
(1) Appropriate congressional committees.--The term 
``appropriate congressional committees'' means--
(A) the Committee on Foreign Affairs of the House 
of Representatives; and
(B) the Committee on Banking, Housing, and Urban 
Affairs in the Senate.
(2) Closed-source ai model.--The term ``closed-source AI 
model'' means any artificial intelligence model with the 
following characteristics:
(A) Proprietary key technical information such as 
underlying model weights that are necessary to 
reproduce and independently recreate the model that are 
not willingly shared with third parties or otherwise 
made publicly available by the owner of the model.
(B) Access and use governed by terms of service or 
contractual agreements that are established by the 
owner of the model.
(C) Access that is provided via an Application 
Program Interface (API) or other consumer-facing, 
owner-controlled interfaces without enabling third 
parties to obtain, modify, or host the closed-source AI 
model on their own data servers or other technology 
unless specifically authorized by the owner of the 
closed-source AI model.
(3) Country of concern.--The term ``country of concern'' 
means--
(A) the People's Republic of China, including the 
Hong Kong and Macau Special Administrative Regions;
(B) the Russian Federation; and
(C) any other foreign country--
(i) listed in Country Group D:5 under 
Supplement No. 1 to part 740 of the Export 
Administration Regulations, as published on 
January 1, 2026, that is designated by the 
Secretary of State as a country of concern for 
purposes of this section and for which notice 
of such designation has been published in the 
Federal Register; and
(ii) designated by the Secretary of State 
pursuant to the assessment described in 
subsection (b) or (e) of section 4 of this Act.
(4) Entity of concern.--The term ``entity of concern'' 
means any foreign person or entity that--
(A) is located or headquartered in, or the ultimate 
parent company of which is headquartered in, a country 
of concern;
(B) is operating under the direction or control of 
any entity located or headquartered in, or the ultimate 
parent company of which is headquartered in, a country 
of concern; or
(C) is conducting or attempting to conduct a model 
extraction attack against closed-source AI models owned 
by United States persons and outside of authorized 
model training practices.
(5) Export.--The term ``export'' has the meaning given that 
term in section 1742(3) of the Export Control Reform Act of 
2018 (50 U.S.C. 4801(3)).
(6) Foreign person.--The term ``foreign person'' means a 
person that is not a United States person.
(7) Fraudulent account network provider.--
(A) In general.--The term ``fraudulent account 
network provider'' means any foreign entity that 
knowingly and intentionally creates, obtains, 
maintains, sells, brokers, or otherwise provides access 
to accounts that allow entities of concern to access 
closed-source AI models that they would otherwise be 
prohibited from accessing due to location restrictions 
in the terms of service or contractual agreements 
created by the owner of the closed-source AI model.
(B) Exception.--An entity that creates or transmits 
location information to enable persons within countries 
of concern to access the internet for purposes of 
freedom of expression is not considered, on the basis 
of this activity alone, a fraudulent account network 
provider.
(8) Good.--The term ``good'' has the meaning given that 
term in section 16 of the Export Administration Act of 1979 (50 
U.S.C. App. 2415)(as continued in effect pursuant to the 
International Emergency Economic Powers Act (50 U.S.C. 1701 et 
seq.)).
(9) In-country transfer.--The term ``in-country transfer'' 
has the meaning given that term in section 1742(6) of the 
Export Control Reform Act of 2018 (50 U.S.C. 4801(6)).
(10) Item.--The term ``item'' has the meaning given that 
term in section 1742(7) of the Export Control Reform Act of 
2018 (50 U.S.C. 4801(7)).
(11) Model extraction attack.--
(A) In general.--The term ``model extraction 
attack'' means the unauthorized extracting of a closed-
source AI model's capabilities to replicate, develop, 
train, or improve another AI model, where such 
querying--
(i) circumvents technical, contractual, or 
other access controls, identity verification 
requirements, or geographic access restrictions 
implemented by the model's owner;
(ii) is conducted through fraudulent, 
misrepresented, or unauthorized credentials; or
(iii) violates the terms, conditions, or 
restrictions governing access to or use of the 
model, as established by the owner or 
authorized provider, that specifically prohibit 
the use of model outputs or interactions to 
replicate, develop, train, or improve another 
AI model.
(B) Inference of purpose.--For purposes of 
subparagraph (A), the purpose of querying may be 
inferred from the totality of circumstances, 
including--
(i) the volume, structure, pattern, 
coordination, or timing of the querying 
activity;
(ii) the concentration of queries on 
specific model capabilities;
(iii) the use of multiple accounts in a 
coordinated matter; or
(iv) the correlation of querying activity 
within the development timeline of another AI 
model.
(C) Exclusion.--Model training activities conducted 
in compliance with the terms, conditions, and 
restrictions governing access to and use of the closed-
source AI model, or otherwise conducted within a 
permitted exception or the express authorization of the 
owner of the closed-source AI model, are not model 
extraction attacks.
(12) Operating committee for export policy.--The term 
``Operating Committee for Export Policy'' means the Operating 
Committee for Export Policy referred to in section 1763(c) of 
the Export Control Reform Act of 2018 (50 U.S.C. 4822(c)).
(13) Owner.--The term ``owner'' means, with respect to a 
closed-source AI model, the person or entity that--
(A) holds intellectual property rights (including 
trade secret, copyright, patent, or other proprietary 
rights), contractual rights, or a combination thereof, 
sufficient to authorize or restrict third-party access 
to, use of, extraction from, or reproduction of such 
closed-source AI model, or any version, instance, or 
deployment thereof, whether such rights were obtained 
through development, acquisition, assignment, license, 
or otherwise; and
(B) is a United States person.
(14) Reexport.--The term ``reexport'' has the meaning given 
that term in section 1742(9) of the Export Control Reform Act 
of 2018 (50 U.S.C. 4801(9)).

SEC. 4. ASSESSMENT OF MODEL EXTRACTION ATTACKS AND FRAUDULENT ACCOUNT 
NETWORK PROVIDERS.

(a) In General.--Not later than 180 days after the date of the 
enactment of this Act, the Secretary of State, in coordination with 
each agency that is a member of the Operating Committee for Export 
Policy, shall complete an assessment to determine--
(1) which, if any, entities of concern have conducted or 
are currently conducting model extraction attacks against 
closed-source AI models owned by United States entities; and
(2) which, if any, entities of concern are fraudulent 
account network providers.
(b) Matters To Be Included.--The assessment required by subsection 
(a) shall include the following:
(1) A determination of which entities of concern--
(A) have either previously or are currently 
engaging in model extraction attacks; or
(B) are fraudulent account network providers.
(2) A determination of which, if any, countries model 
extraction attacks have originated from and where fraudulent 
account network providers exist.
(3) An identification of which, if any, agencies or 
instrumentalities of governments of countries of concern have 
provided or are providing material assistance to entities 
identified pursuant to paragraph (1).
(4) An analysis of the methods employed by entities of 
concern identified pursuant to paragraph (1), including--
(A) the role of fraudulent account network 
providers in model extraction attacks, including, to 
the extent possible, the physical location of 
fraudulent account network provider offices and data 
centers; and
(B) a determination, to the extent possible, of the 
number of attempted model extraction attacks that 
occurred in the previous two calendar years from the 
date on which the Secretary of State begins the 
assessment pursuant to subsection (a)(1).
(5) An examination of the strengths and weaknesses of 
various detection approaches that can be used to determine 
whether a model extraction attack has occurred or is occurring.
(6) An assessment of the economic and national security 
consequences of successful model extraction attacks by entities 
of concern that occurred in the previous two calendar years 
from the date on which the Secretary of State begins the 
assessment pursuant to subsection (a)(1).
(7) Steps detailing how the United States Government is 
assisting owners of closed-source AI models that have been the 
target or victim of model extraction attacks in detecting model 
extraction attacks, deterring future model extraction attacks, 
and punishing entities of concern that engage in model 
extraction attacks or are fraudulent account network providers.
(8) A diplomatic strategy to leverage United States allies 
and partners in detecting and preventing model extraction 
attacks by entities of concern.
(c) Public Consultation.--In conducting the assessment required by 
subsection (a), the Secretary of Commerce, in coordination with each 
agency that is a member of the Operating Committee for Export Policy, 
shall consult with owners of closed-source AI models that have been the 
targets or victims of model extraction attacks, whose participation in 
this consultation shall be voluntary, other companies, academic 
experts, industry fora, and other appropriate entities to--
(1) identify patterns of attacker behavior and methods to 
better inform United States Government and private sector 
efforts to detect model extraction attacks;
(2) develop best practices for defending against model 
extraction attacks; and
(3) develop best practices for identifying fraudulent 
account network provider activities that facilitate model 
extraction attacks.
(d) Report.--
(1) In general.--Not later than 210 days after the date of 
the enactment of this Act, the Secretary of Commerce, in 
coordination with each agency that is a member of the Operating 
Committee for Export Policy, shall submit to the appropriate 
congressional committees a report that contains the findings of 
the assessment. The Secretary of Commerce shall, annually for 3 
years, submit to the appropriate congressional committees an 
updated report with any additional entities of concern 
identified pursuant to subsection (b)(1).
(2) Form.--The report required by this subsection shall be 
submitted in unclassified form, but may contain a classified 
annex.
(e) Routine Assessment.--The Secretary of Commerce, in coordination 
with each agency that is a member of the Operating Committee for Export 
Policy, shall routinely assess for--
(1) model extraction attacks directed against owners of 
closed-source AI models that occur after the date of completion 
of the assessment required by this section;
(2) fraudulent account network providers that facilitate 
model extraction attacks after the date of completion of the 
assessment required by this section; and
(3) any material changes related to other matters specified 
in subsection (b).
(f) Industry Coordination.--The Secretary of Commerce, in 
coordination with each agency that is a member of the Operating 
Committee for Export Policy, shall establish an information sharing 
mechanism that allows owners of closed-source AI models to voluntarily, 
quickly, and confidentially share information about model extraction 
attacks and fraudulent account network providers with the Department of 
Commerce.
(g) AI Model Extraction Attackers List.--
(1) In general.--The Secretary of State, in coordination 
with each agency that is a member of the Operating Committee 
for Export Policy, shall--
(A) maintain a list, to be known as the ``AI Model 
Extraction Attackers List'', that displays information 
about specific individuals and entities of concern, 
that the assessment required by subsection (a) and 
routine assessment described in subsection (e) identify 
as having conducted or directed model extraction 
attacks in the past year; and
(B) publish such list on a publicly available 
website of the Department of State for up to 5 years.
(2) Protection of confidential information.--The Secretary 
of State may not, in publishing the list required by paragraph 
(1) on a publicly available website of the Department of State, 
disclose confidential information provided by owners of closed-
source AI models without the express permission of said owner.
(h) Public Guidance.--Not later than 210 days after the date of the 
enactment of this Act, the Secretary of Commerce, in coordination with 
each agency that is a member of the Operating Committee for Export 
Policy, shall publish a report comprising of best practices to detect, 
prevent, and respond to model extraction attacks.
(1) Public access.--The report required by this subsection 
shall be publicly available.
(2) Protection of confidential information.--In making the 
report required by this subsection publicly available, the 
Secretary of Commerce, in coordination with each agency that is 
a member of the Operating Committee for Export Policy, shall 
not disclose confidential information provided by owners of 
closed-source AI models without the express permission of said 
owner.

SEC. 5. DETERRING MODEL EXTRACTION ATTACKS AND FRAUDULENT ACCOUNT 
NETWORK PROVIDERS.

(a) Addition Consideration for Entity List.--Not later than 210 
days after the date of the enactment of this Act, the Under Secretary 
of Commerce for Industry and Security, in coordination with each agency 
that is a member of the End-User Review Committee, shall make a 
determination by majority vote of the Committee on whether entities 
identified as having conducted model extraction attacks or having 
facilitated them via fraudulent account networks after the date of the 
completion of the assessment required under section 4 of this Act 
(identified pursuant to subsection (e) of such section), or any 
affiliate of such entity (to be determined by ownership of 50 percent 
or more in the aggregate, directly or indirectly), should be added to 
the Entity List maintained by the Bureau of Industry and Security of 
the Department of Commerce under Supplement No. 4 to part 744 of title 
15, Code of Federal Regulations, or any successor regulations.
(b) Sanctions Described.--
(1) In general.--The President, acting through the 
Secretary of State, may, pursuant to the International 
Emergency Economic Powers Act (50 U.S.C. 1701 et seq.), block 
and prohibit all transactions in all property and interests in 
property of entities of concern identified pursuant to 
subsections (b)(1) and (e) of section 4 if such property and 
interests in property are in the United States, come within the 
United States, or are or come within the possession or control 
of a United States person.
(2) Exceptions.--
(A) Exception to comply with international 
obligations.--Sanctions under this subsection shall not 
apply with respect to the admission of an alien if 
admitting or paroling the alien into the United States 
is necessary to permit the United States to comply with 
the Agreement regarding the Headquarters of the United 
Nations, signed at Lake Success June 26, 1947, and 
entered into force November 21, 1947, between the 
United Nations and the United States, or other 
applicable international obligations.
(B) Exception relating to the provision of 
humanitarian assistance.--Sanctions under this 
subsection may not be imposed with respect to 
transactions or the facilitation of transactions for--
(i) the sale of agricultural commodities, 
food, medicine, or medical devices;
(ii) the provision of humanitarian 
assistance;
(iii) financial transactions relating to 
humanitarian assistance; or
(iv) transporting goods or services that 
are necessary to carry out operations relating 
to humanitarian assistance.
(C) Exception for intelligence, law enforcement, 
and national security activities.--Sanctions under this 
subsection shall not apply to any authorized 
intelligence, law enforcement, or national security 
activities of the United States.
(3) Penalties.--A person that violates, attempts to 
violate, conspires to violate, or causes a violation of this 
subsection or any regulation, license, or order issued to carry 
out that subsection shall be subject to the penalties set forth 
in subsections (b) and (c) of section 206 of the International 
Emergency Economic Powers Act (50 U.S.C. 1705) to the same 
extent as a person that commits an unlawful act described in 
subsection (a) of that section.
<all>