Chinese military researchers used outputs from OpenAI and Anthropic models to train domestic defense systems, according to a review of more than 80 academic papers and patents.
Key Points:
- A review of more than 80 Chinese papers and patents found military-linked institutions distilling US frontier models into smaller local systems.
- One PLA cyber warfare unit fed GPT-3.5 sensitive military source code, then trained a domestic model on the summaries.
- Anthropic said it sells no commercial access in China and warned distilled copies can lose the original safeguards.
Model Distillation Across 80 Chinese Papers
The review of Chinese academic papers and patents, compiled in part with the Washington-based Jamestown Foundation, surfaced the practice across institutions tied to the People's Liberation Army. Reviewers identified an additional two dozen military-linked case studies.
The documents describe model distillation, a method that converts outputs from a powerful system into training data for smaller models that run on modest hardware.
One paper from PLA Unit 96941, a military intelligence and cyber warfare unit in Beijing, described feeding OpenAI's GPT-3.5 sensitive military source code and keeping the summaries it produced. The team then trained a domestic model on that material so the finished tool could operate entirely inside Chinese military networks, away from foreign servers.
The White House, the Pentagon, China's foreign ministry, the PLA and OpenAI did not respond to requests for comment.
Also Read: AI Infrastructure, Payday Lender's Desperate $1B Pivot To Dominate Data Centers
Sunny Cheung On Stolen AI Reasoning
Sunny Cheung, a Jamestown fellow who analyzed more than 60 of the papers, said Chinese military scientists are systematically capturing the reasoning steps of Western systems.
He told reporters the work feeds surveillance, cyber warfare and tactical decision-making. Teaching a model the right answer is one thing, Cheung said, while moving the reasoning behind that answer into a smaller system is far harder.
Researchers at the North University of China, an institution linked to the country's weapons industry, used Anthropic's Claude 3 Haiku to generate synthetic training data for a social media monitoring tool. Anthropic said it sells no commercial access to Claude inside China, runs monitoring systems that flag policy violations, and warned that distilled copies may shed the safeguards built into the original.
Distillation Limits And Export Control Gaps
Trevor Koverko, co-founder of AI data company Sapien, said distilled models remain weaker than the systems they copy. He called the practice a transfer of selected capabilities into a cheaper, locally controlled system rather than independence from frontier AI.
Central and local governments in China have meanwhile funded model lightweighting and edge computing, steering subsidies toward software that runs on drones, satellites and other constrained devices.
Pressure over the technique has been building for months, and Treasury Secretary Scott Bessent threatened sanctions in July on Chinese firms his department deems guilty of distillation. Startup Moonshot denied last week that its Kimi K3 model relied on the method, while Beijing has accused Washington of pursuing AI hegemonism and pointed to similar practices at American firms.
Read Next: Foldable iPhone Rumors Get Specific: $2,500, No Face ID, No Telephoto