China taps US AI models to train defense systems

China taps US AI models to train defense systems

AI RACE: Chinese military researchers distill US models to create smaller and more secure versions, but an expert said these models have limited capabilities

Chinese military researchers have used outputs from leading US artificial intelligence (AI) models developed by OpenAI and Anthropic to train domestic AI systems to advance China’s defense capabilities, according to a Reuters review of more than 80 Chinese academic papers and patents.

The previously unreported findings offer a rare glimpse into how military and security-linked institutions in China are leveraging cutting-edge US AI models as a shortcut to developing specialized systems of their own, despite Washington’s efforts to restrict Beijing’s access to advanced chips and other strategic technologies.

The documents show widespread use of a technique known as “model distillation,” in which outputs from a powerful AI system are used to train smaller, specialized models that can be deployed locally without the enormous computing requirements needed to build frontier AI systems from scratch. Reuters’ review, which included research compiled by the Washington-based Jamestown Foundation and shared exclusively with the news agency, showed distillation is widely used by researchers linked to the Chinese People’s Liberation Army (PLA) and other military institutions.

Miniature figurines and the Claude logo are pictured in an illustration taken on Monday last week.

The papers suggest Chinese defense institutions see leading US AI models as both a source of technical insight and a way to close the gap with American rivals.

The dispute centers on unauthorized extraction, not distillation itself, a widely used industry practice.

The issue has emerged as a major flashpoint ahead of US-China talks on AI governance and safety. US officials have accused some Chinese entities of using distillation to extract capabilities from American AI models, potentially undermining export controls and infringing intellectual property rights.

China has rejected the accusations, saying Washington is pursuing AI “hegemonism” while arguing that US firms have engaged in similar practices.

Chinese developers have also disputed claims that their AI advances rely on foreign models. AI start-up Moonshot last week denied allegations by US President Donald Trump’s administration that its Kimi K3 model was built using distillation, saying it was driven by proprietary innovations.

Sunny Cheung (張?陽), a Jamestown fellow who analyzed more than 60 of the papers, said Chinese military scientists are systematically capturing the reasoning steps of Western models to adapt them for surveillance, cyberwarfare and tactical decisionmaking.

“Teaching a model the right answer is one thing, but teaching it the reasoning behind the answer is much harder,” Cheung said.

“These papers show Chinese military-linked researchers are trying to transfer that expensive, proprietary reasoning from Western models into smaller systems they can control and deploy locally,” he said.

Reuters verified the academic literature and identified an additional two dozen military-linked case studies.

One paper published last year by researchers in PLA Unit 96941, a military intelligence and cyberwarfare unit in Beijing, described using OpenAI’s GPT-3.5 to process sensitive military source code.

The researchers said third-party models were unsuitable for handling classified information. To overcome that limitation, they used GPT-3.5 to summarize software code and trained a domestic model on those summaries to run entirely within Chinese military networks.

The White House, Pentagon, the Chinese Ministry of Foreign Affairs, the PLA and OpenAI did not respond to requests for comment.

Chinese researchers have used distillation for purposes ranging from content monitoring to military deployment, Reuters’ and Jamestown’s review of the papers showed.

At the North University of China, which has close links to the country’s weapons industry, researchers used Anthropic’s Claude 3 Haiku to generate synthetic training data for a text classification model for social media monitoring and content moderation.

Anthropic said it does not provide commercial access to Claude in China or to Beijing-controlled firms and uses monitoring systems to detect policy violations.

The company added that distilled models may lose the original systems’ safety safeguards, potentially allowing sensitive capabilities to be transferred to models beyond its control.

A 2024 paper from the PLA’s National University of Defense Technology described using distillation to shrink an image-processing model for deployment on uncrewed aerial vehicles, allowing drones to analyze live video and support navigation, and targeting decisions in real time even when communications are cut.

Similarly, researchers at China’s Academy of Military Sciences used distillation to run a target-recognition model on tactical hardware during simulated maritime operations involving drones, ships and uncrewed submarines, a study published earlier this year showed.

China has embraced distillation as it seeks to compete with the US in frontier AI while facing constraints on advanced computing resources due to Washington’s export controls on high-end chips. Central and local governments have promoted “model lightweighting” and edge computing, directing subsidies and research funding toward technologies that enable AI models to run on drones, satellites and other devices with limited processing power.

However, experts caution that distillation has significant limitations. As Chinese AI models close the gap with their US counterparts, military researchers are also examining distillation as a potential security risk.

In January, researchers at the Army Engineering University published a paper on the threat of “data-free distillation,” a method of reverse-engineering a model’s capabilities without direct access to its core parameters.

To counter that vulnerability, they proposed defense mechanisms designed to mask the hidden logical information exposed in a model’s public outputs.

Distilled models also inherit only selected capabilities and cannot fully replicate the broad intelligence of frontier systems.

Trevor Koverko, cofounder of AI data company Sapien, said distilled models remain less capable than their teacher models.

“It is best understood as transferring selected capabilities into a cheaper, locally controlled system, not achieving independence from frontier AI,” he said.