Summary

Directs the State and Commerce Departments to identify foreign actors that steal or reconstruct U.S. closed-source AI model capabilities, publish a public list of attackers, issue best-practice guidance, set up a confidential information-sharing channel with model owners, and pursue trade controls and sanctions (Entity List additions and IEEPA blocking) against identified actors. Requires interagency assessments and regular reporting to Congress on origins, methods, scale, impacts, and detection approaches, with deadlines for initial findings and follow-up reports.

• Requires a rapid interagency assessment to identify foreign actors and fraudulent account networks that perform model-extraction attacks on U.S. closed-source AI models.
• Directs Commerce to publish best-practice guidance and set up a voluntary, confidential information-sharing channel with U.S. model owners.
• Creates a public "AI Model Extraction Attackers List" to be maintained and published for up to five years, while protecting confidential owner data.
• Mandates an End-User Review Committee vote to consider adding identified actors (and major affiliates) to the Commerce Department’s Entity List within statutory deadlines.
• Authorizes the President, via IEEPA, to block property and prohibit transactions with identified entities, with narrow humanitarian and diplomatic exceptions.
• Defines key terms (closed-source model, model extraction attack, fraudulent account network provider, country of concern) to set legal scope and ties many definitions to export-control law.
• Requires regular reporting to Congress: initial findings within roughly 210 days and annual updates for three years.
• Excludes authorized research/training that follows terms of service from the model-extraction definition to protect legitimate uses.