Chinese military researchers have used outputs from leading US artificial intelligence models developed by OpenAI and Anthropic to train domestic AI systems for defense purposes, according to a Reuters review of more than 80 Chinese academic papers and patents compiled with the Washington-based Jamestown Foundation.

The previously unreported findings offer a rare glimpse into how military and security-linked institutions in China are using a technique known as 'model distillation' — in which outputs from a powerful AI system train smaller, specialized models that can run locally without the enormous computing power needed to build frontier AI from scratch — as a shortcut despite Washington's efforts to restrict Beijing's access to advanced chips.

Researchers linked to the People's Liberation Army and other military institutions use distillation widely, the papers show, and see US models as both a source of technical insight and a way to close the gap with American rivals. The practice has become a major flashpoint ahead of US-China talks on AI governance: US officials accuse some Chinese entities of extracting capabilities from American models, undermining export controls and infringing intellectual property, while Beijing rejects the accusations as 'hegemonism' and argues US firms have done the same. Chinese startup Moonshot last week denied Trump administration claims that its Kimi K3 model was built using distillation.

Concrete cases include a paper by researchers in PLA Unit 96941, a military intelligence and cyber-warfare unit in Beijing, describing the use of OpenAI's GPT-3.5 to summarize sensitive military source code before training a domestic model to run entirely within Chinese military networks; researchers at the North University of China, which has close ties to the weapons industry, using Anthropic's Claude 3 Haiku to generate synthetic training data for social media monitoring; a 2024 paper from the PLA's National University of Defense Technology distilling an image-processing model for real-time drone navigation and targeting; and researchers at the China Academy of Military Sciences running target recognition on tactical hardware in simulated maritime operations. Anthropic said it provides no commercial access to Claude in China and uses monitoring systems to detect policy violations.

Experts caution that distilled models inherit only selected capabilities and cannot fully replicate frontier intelligence. 'Teaching a model the right answer is one thing, but teaching it the reasoning behind the answer is much harder,' said Sunny Cheung, a Jamestown fellow who analyzed more than 60 of the papers. Chinese military researchers are also studying distillation as a threat to themselves: in January, Army Engineering University researchers published work on 'data-free distillation' and proposed defenses to mask hidden logical information exposed in model outputs.

Sources