Chinese military and security-linked researchers have tapped outputs from leading U.S. artificial intelligence systems to train homegrown models intended for defence and security use, according to a review of over 80 Chinese academic papers and patents.
The review, which incorporated research compiled by the Washington-based Jamestown Foundation and examined more than 80 documents, found widespread use of a process known as model distillation. In distillation, outputs produced by a powerful AI are used as training material for smaller, specialised models that can run locally without the massive computing resources needed to build frontier AI systems from the ground up.
Those findings provide a window into how institutions linked to China’s military - including units and universities with ties to the People’s Liberation Army - are adopting distilled models to support tasks such as content monitoring, cyber operations, surveillance and tactical decision-making. The documents suggest researchers view leading U.S. AI systems both as a technical reference and as a source of advanced reasoning they can transfer into systems deployable on Chinese networks and hardware.
Scope and methods identified
The papers reviewed show distillation being applied across diverse projects. Investigators identified use cases in which outputs from U.S. models were employed to generate synthetic training data, summarize technical materials, or produce labels and reasoning chains that then trained more compact domestic systems.
Analysts who examined the material said Chinese researchers are not only teaching models the final answers but are also attempting to capture the underlying reasoning steps of Western systems - a more technically demanding objective. "Teaching a model the right answer is one thing but teaching it the reasoning behind the answer is much harder," said Sunny Cheung, a Jamestown fellow who analysed over 60 of the papers. "These papers show Chinese military-linked researchers are trying to transfer that expensive, proprietary reasoning from Western models into smaller systems they can control and deploy locally."
Concrete cases cited in the literature
- Processing sensitive code: A paper published last year by researchers in PLA Unit 96941, a Beijing-based military intelligence and cyber-warfare unit, described using OpenAI's GPT-3.5 to process sensitive military source code. The team judged third-party models unsuitable for handling classified information directly, so they used GPT-3.5 to summarize software code and then trained a domestic model on those summaries to run entirely within Chinese military networks.
- Social media monitoring: At the North University of China, which has links to the country's weapons industry, researchers used Anthropic's Claude 3 Haiku to create synthetic training material for a text classification model aimed at social media monitoring and content moderation.
- Drone image processing: A 2024 paper from the PLA's National University of Defense Technology described using distillation to reduce the size of an image-processing model so it could run on unmanned aerial vehicles. Smaller models enabled drones to analyse live video and support navigation and targeting decisions in real time, even when communications were interrupted.
- Tactical hardware for maritime scenarios: Researchers at China's Academy of Military Sciences published work showing they used distillation to operate a target-recognition model on tactical hardware during simulated maritime operations involving drones, ships and unmanned submarines.
Debate and official responses
The use of distillation has become a point of contention in U.S.-China discussions over AI governance and safety. U.S. officials have accused some Chinese entities of employing distillation techniques to extract capabilities from American models, with concerns that such practices could undercut export controls and infringe intellectual property rights. Beijing has rejected those accusations, accusing Washington of pursuing AI "hegemonism" and saying U.S. firms have engaged in similar practices.
Industry reactions in China have varied. AI startup Moonshot denied recent U.S. government allegations that its Kimi K3 model was built using distillation, saying instead that the model was driven by proprietary innovations.
The White House, the Pentagon, China’s foreign ministry, the PLA and OpenAI did not respond to requests for comment on the record.
Benefits sought and constraints faced
Chinese researchers and policy makers have embraced distillation partly because it offers a way to advance specialised capabilities while avoiding the enormous computing demands associated with training frontier models from scratch. Washington's export controls on high-end chips and other strategic technologies have constrained access to advanced computing resources, prompting Chinese central and local governments to promote "model lightweighting" and edge computing. Those policies have included subsidies and research funding to enable AI models to run on drones, satellites and other devices with limited processing power.
At the same time, experts underscore limits to what distillation can achieve. Distilled models inherit selected capabilities from teacher systems but do not replicate the full breadth of intelligence of a frontier AI. Trevor Koverko, co-founder of AI data company Sapien, said distilled models are best understood as transferring particular capabilities into smaller, locally controlled systems rather than producing full independence from frontier AI.
Security concerns and countermeasures
Researchers have also highlighted distillation as a potential security vulnerability. In January, authors from the Army Engineering University published a paper on the threat posed by "data-free distillation," a technique that could reverse-engineer a model's capabilities without direct access to its internal parameters. To mitigate that risk, they proposed defence mechanisms aimed at masking the hidden logical information that can be revealed through a model's public outputs.
Anthropic, whose Claude model is cited in the documents, said it does not provide commercial access to Claude in China or to Beijing-controlled firms and that it deploys monitoring systems to detect policy violations. The company warned that distilled models might lose original safety safeguards, potentially allowing sensitive capabilities to be transferred to systems outside its control.
Implications drawn from the literature
The reviewed documents portray distillation as a pragmatic engineering choice for China’s defence-oriented institutions - a method to bring selected advanced capabilities into operational use on constrained hardware and closed networks. The literature spans efforts to use Western models as a source of labelled data, summaries and reasoning traces that can be embedded into compact systems designed for monitoring, navigation, targeting and other tactical tasks.
At the same time, the material recognizes the technical and defensive limits of such an approach. Distilled systems inherit only parts of what teacher models can do, and the process can expose sensitive logical information that defenders seek to protect. The tension between capability transfer and safeguarding intellectual and security-sensitive content remains a focus of ongoing technical and policy debate.
Conclusion
Academic papers and patents reviewed show that Chinese military-linked researchers have systematically used outputs from leading U.S. AI models to construct smaller, deployable systems tailored to surveillance, cyber-warfare and tactical operations. While distillation offers a cost-effective route to operational capability on constrained hardware, it brings limits in scope and raises questions about intellectual property, export controls and security - issues that continue to surface in international discussions on AI governance and safety.