Bipartisan House bill proposes NIST guidance on AI distillation and cyber defence

US Representatives Pat Harrigan, a Republican from North Carolina, and George Whitesides, a Democrat from California, introduced the AI Cyber Defense Act on October 22. The proposal would ask the National Institute of Standards and Technology to work with industry on model-security guidance and defensive uses of AI. It is proposed legislation, not an enacted protection or a mandatory security standard already in force.

The sponsor’s original announcement identifies two connected aims: addressing AI distillation attacks and improving cybersecurity for critical infrastructure. The official introduced text of H.R. 10873 records referral to the House Committee on Science, Space, and Technology.

Standards would follow enactment

The text would require NIST to seek engagement with private-sector AI stakeholders within 180 days after enactment. That work would establish a definition of distillation attacks and voluntary standards and best practices for detecting and preventing them. Publication would follow within one year after those standards and practices are established. These are contingent deadlines in a bill, not a calendar that has already started running.

A separate AI Cybersecurity Roundtable would develop voluntary standards and best practices for defensive use of AI. Its intended participants include AI companies and operators of critical infrastructure. The proposal brings model security and practical cyber defence into the same legislative package without showing that either problem has been solved.

Independent reporting identifies a boundary to resolve

CyberScoop’s reporting corroborates the proposal and includes an interview with Harrigan. It notes the challenge of defining attacks while distinguishing them from legitimate sharing and collaboration around open models. That boundary matters: a label alone cannot establish whether a particular transfer of knowledge is harmful or unauthorised.

The sponsors argue that coordinated guidance would protect innovation and critical services. Those are policy aims. The checked text and reporting do not demonstrate the effectiveness of future voluntary standards or identify the final definitions NIST would adopt.

The new event is the introduction of a federal bill with a defined institutional process. Whether it advances through Congress, how participants shape its guidance and whether resulting practices reduce real incidents remain separate questions for later evidence.