Newsletters
Chinese military-linked researchers used outputs from leading U.S. artificial intelligence models developed by OpenAI and Anthropic to train domestic systems for surveillance, cyberwarfare, drones and tactical operations, according to a Reuters review of more than 80 Chinese academic papers and patents.
The findings show how institutions connected to China’s People’s Liberation Army and other security bodies are using advanced U.S. models to develop smaller, specialized systems despite Washington’s restrictions on Beijing’s access to high-end chips and other strategic technologies.
Reuters reviewed research compiled by the Washington-based Jamestown Foundation and shared exclusively with the news agency. It also identified about two dozen additional military-linked case studies.
The documents showed widespread use of “model distillation,” a technique in which outputs from a powerful AI system are used to train smaller models that require less computing power and can operate locally.
Distillation is widely used across the AI industry. The dispute centers on the unauthorized extraction of capabilities from proprietary systems rather than the technique itself.
The papers indicate that Chinese defense institutions view leading U.S. models as both a source of technical knowledge and a way to narrow the gap with American competitors.
Sunny Cheung, a Jamestown Foundation fellow who analyzed more than 60 papers, said Chinese military scientists were attempting to capture the reasoning processes of Western models for surveillance, cyberwarfare and tactical decision-making.
“Teaching a model the right answer is one thing, but teaching it the reasoning behind the answer is much harder,” Cheung said.
He said the researchers were seeking to transfer costly proprietary reasoning into smaller systems they could control and deploy locally.
A paper published last year by researchers from PLA Unit 96941, a Beijing-based military intelligence and cyberwarfare unit, described using OpenAI’s GPT-3.5 to process sensitive military source code.
The researchers said external models were unsuitable for handling classified information. They used GPT-3.5 to summarize software code and trained a domestic model on those summaries so it could operate entirely within Chinese military networks.
At the North University of China, which has close links to the country’s weapons industry, researchers used Anthropic’s Claude 3 Haiku to generate synthetic training data for a text-classification model designed for social media monitoring and content moderation.
Anthropic said it does not offer commercial access to Claude in China or to companies controlled by Beijing and uses monitoring systems to detect policy violations.
The company warned that distilled models could lose the original systems’ safety safeguards, potentially transferring sensitive capabilities to systems outside its control.
The White House, Pentagon, Chinese Foreign Ministry, PLA and OpenAI did not respond to Reuters’ requests for comment.
A 2024 paper from the PLA’s National University of Defense Technology described reducing the size of an image-processing model for use on unmanned aerial vehicles.
The distilled system allowed drones to analyze live video and support navigation and targeting decisions in real time, including when communications were disrupted.
Researchers at China’s Academy of Military Sciences also used distillation to run a target-recognition model on tactical hardware during simulated maritime operations involving drones, ships and unmanned submarines, according to a study published earlier this year.
China’s central and local governments have promoted “model lightweighting” and edge computing as the country competes with the U.S. while facing restrictions on advanced computing resources.
Government subsidies and research funding have supported technologies that allow AI models to operate on drones, satellites and other devices with limited processing power.
The issue has become a major point of tension ahead of U.S.-China talks on AI governance and safety.
U.S. officials have accused some Chinese entities of using distillation to obtain capabilities from American models, potentially weakening export controls and infringing intellectual property rights.
China has rejected the allegations, accusing Washington of pursuing AI “hegemonism” and arguing that U.S. companies have used similar practices.
Chinese developers have also disputed claims that their advances depend on foreign models.
AI startup Moonshot last week denied Trump administration allegations that its Kimi K3 model was created through distillation, saying the system was based on proprietary innovations.
Chinese military researchers are also studying distillation as a potential security threat as domestic AI systems become more capable.
In January, researchers at the Army Engineering University published a paper on “data-free distillation,” a technique used to reverse-engineer a model’s abilities without access to its internal parameters.
They proposed defenses intended to conceal logical information revealed through a model’s public outputs.
Experts said distilled models can reproduce selected capabilities but cannot fully match the broad intelligence of frontier systems.
Trevor Koverko, co-founder of AI data company Sapien, said distilled systems remain less capable than the models used to train them.
“It is best understood as transferring selected capabilities into a cheaper, locally controlled system, not achieving independence from frontier AI,” Koverko said.
Set as preferred source
Set as preferred source
2 min read
1 min read
