Chinese military researchers have been utilizing outputs from leading US artificial intelligence models, including those developed by OpenAI and Anthropic, to train domestic AI systems aimed at advancing China’s defense capabilities. A comprehensive Reuters investigation of more than 80 Chinese academic papers and patents has uncovered widespread use of a technique known as “model distillation.” EastFrontier has previously explored the broader context of China’s technological self-reliance drive. This practice allows Chinese institutions to leverage cutting-edge American AI as a strategic shortcut, despite Washington’s stringent export controls designed to restrict Beijing’s access to advanced chips and strategic technologies.
The previously unreported findings offer a rare glimpse into how military and security-linked entities in China are navigating US restrictions. Model distillation involves using the outputs from a powerful, frontier AI system to train smaller, specialized models. These distilled models can then be deployed locally without the enormous computing requirements needed to build frontier AI systems from scratch. The research, compiled in part by the Washington-based Jamestown Foundation, reveals that this technique is widely employed by researchers affiliated with the People’s Liberation Army (PLA) and other military institutions.
Distilling Strategic Capabilities for the PLA
The academic papers suggest that Chinese defense institutions view leading US AI models not only as a source of technical insight but also as a crucial mechanism to close the capability gap with American rivals. Sunny Cheung, a Jamestown fellow who analyzed over 60 of the papers, noted that Chinese military scientists are systematically capturing the reasoning steps of Western models to adapt them for surveillance, cyber warfare, and tactical decision-making. “Teaching a model the right answer is one thing but teaching it the reasoning behind the answer is much harder,” Cheung explained.
One notable paper published last year by researchers in PLA Unit 96941, a military intelligence and cyber-warfare unit in Beijing, detailed the use of OpenAI’s GPT-3.5 to process sensitive military source code. Because third-party models were deemed unsuitable for handling classified information directly, the researchers used GPT-3.5 to summarize software code. They then trained a domestic model on those summaries, allowing it to run entirely within secure Chinese military networks.
From Social Media Monitoring to Tactical Drones
The applications of distilled models span a wide range of military and security functions. At the North University of China, which maintains close ties to the country’s weapons industry, researchers used Anthropic’s Claude 3 Haiku to generate synthetic training data. This data was used to build a text classification model designed for social media monitoring and content moderation. Anthropic has stated that it does not provide commercial access to Claude in China and uses monitoring systems to detect policy violations, warning that distilled models may lose the original systems’ safety safeguards.
Furthermore, a 2024 paper from the PLA’s National University of Defense Technology described using distillation to shrink an image-processing model for deployment on unmanned aerial vehicles (UAVs). This allows drones to analyze live video and support navigation and targeting decisions in real-time, even when communications are severed. Similarly, researchers at China’s Academy of Military Sciences used distillation to run a target-recognition model on tactical hardware during simulated maritime operations involving drones, ships, and unmanned submarines. As the US and China prepare for talks on AI governance, the issue of unauthorized extraction and model distillation has emerged as a major flashpoint in the ongoing tech war.
Beijing’s Denial and the Broader Implications
China has firmly rejected the accusations, characterizing Washington’s stance as pursuing AI “hegemonism” and pointing out that US firms have engaged in similar training practices. Chinese developers have also disputed claims that their AI advances rely on foreign models. Moonshot AI last week denied allegations by the Trump administration that its Kimi K3 model was built using distillation, stating it was driven by proprietary innovations. The dispute centers on unauthorized extraction, not distillation itself, which is a widely used industry practice across the global AI community.
The Reuters findings carry significant weight as both governments prepare for bilateral AI governance discussions. US officials have accused certain Chinese entities of using distillation to extract capabilities from American AI models, potentially undermining export controls and infringing intellectual property rights. Trevor Koverko, co-founder of AI data company Sapien, offered a measured assessment of the technique’s limits: distilled models remain less capable than their teacher models, and the practice is “best understood as transferring selected capabilities into a cheaper, locally controlled system, not achieving independence from frontier AI.”
Nevertheless, the systematic scale of the practice documented by Reuters, spanning surveillance, cyber warfare, drone targeting, and tactical decision-making, suggests that model distillation has become a cornerstone of China’s military AI development strategy, one that export controls on chips alone are ill-equipped to address.