Massive Relay Server Network Facilitates China's Bypass of U.S. AI Model Restrictions
An estimated 80,000 relay servers are enabling users in China to circumvent regional bans and access U.S. artificial intelligence models, facilitating illicit activities and model distillation.
A vast ecosystem of approximately 80,000 relay servers is actively helping users in China bypass geographic restrictions imposed on leading U.S. artificial intelligence models. This network, identified by cybersecurity firm Team Cymru, is designed to circumvent the terms of service of frontier model providers, thereby enabling a range of fraudulent and illicit activities.
Scott Fisher, Senior Principal Engineer at Team Cymru, stated that this uncovered ecosystem is explicitly built to break the terms of service of frontier model providers, facilitating fraud and illicit operations. This discovery follows a joint advisory issued earlier this month by the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI), which warned about Chinese AI firms engaging in large-scale knowledge distillation campaigns to extract capabilities from prominent U.S. AI models.
The relay servers, also referred to as transfer stations, function by pooling AI accounts and distributing their own access keys to customers. This setup allows multiple users to access frontier models through a single server. From the perspective of the AI model provider, only the relay server is visible, effectively masking the true identity and location of the end-users. This obfuscation significantly hinders the providers' ability to enforce regional bans, monitor usage patterns, and detect abusive behavior.
Model distillation, as described by Fisher, represents one of the most significant forms of abuse facilitated by this network. Instead of independently investing in the research, data, and computational resources required to develop advanced AI models, malicious actors can query a more powerful 'teacher' model at scale. They then collect the outputs from these queries and use them to enhance a less capable, cheaper 'student' model. This process allows for the transfer of a teacher model's capabilities at a substantially reduced cost compared to independent development, which is why major AI model providers strictly prohibit using their outputs for training competing models.
The majority of these relay servers operate using tools such as Claude Relay Service or its successor, sub2api. Both of these tools were developed and published on GitHub by an individual known as Wei-Shaw. The latest version of sub2api includes features for user management, per-user billing, a module that converts subscriptions into API access, and a prompt-auditing capability. The sub2api project has seen significant adoption, with over 8,000 forks on GitHub and a Telegram channel boasting nearly 7,000 subscribers.
Further analysis of the sub2api GitHub page reveals 26 commercial sponsors. Fifteen of these sponsors are involved in selling access to AI models via relays, seven offer residential proxy services, and two provide accounts for AI services. The remaining two sponsors include a content delivery network optimized for relay traffic and a reseller of image and video generation services.
Team Cymru's investigation suggests that the entities selling AI account access obtain their credentials through the exploitation of promotional offers and potentially through credential or token theft. During an eight-day scanning period, researchers confirmed the existence of 10,867 relays, a number that subsequently surged to over 80,000. Of the initial 10,867 relays, 9,456 were running sub2api, and 1,353 were using the older Claude Relay Service. These relays were distributed across 457 different networks, with no single hosting provider accounting for more than approximately 11% of the total.
In one specific cluster examined by the researchers, hosted with several Virtual Private Server (VPS) providers in the U.S., over 4,000 IP addresses from China and Hong Kong connected to 304 relays. Over an eight-day period in late August, this cluster processed approximately 14 terabytes of uploaded data and more than 7 terabytes of downloaded data. Seventeen relays directly sent traffic to Anthropic's API, uploading about 81 GB and downloading about 1.4 GB, a ratio of 58 to 1. While this high volume of data transfer to Anthropic's API could indicate automated, large-scale querying, the researchers could not inspect the prompts or model responses to definitively confirm whether the activity involved model distillation or another form of abuse. Team Cymru has shared the identified relay IP addresses with the affected AI providers and plans to continue its efforts to detect new relays.