How Chinese Military Researchers Are Using U.S. AI Models to Train Defense Systems

In the escalating technological competition between the United States and China, physical hardware has long been the primary battleground. Washington has implemented stringent export controls designed to prevent Beijing from acquiring the advanced microchips necessary to train frontier artificial intelligence systems from scratch.[1][2]

However, a comprehensive review of more than 80 recent Chinese academic papers and patents reveals that physical embargoes are struggling to contain the spread of intangible software capabilities.[1][3]

Researchers affiliated with the People's Liberation Army (PLA) and other Chinese state security institutions have successfully utilized the outputs of leading American AI models—including those developed by OpenAI and Anthropic—to train their own specialized domestic defense systems.[1][4]

The mechanism driving this cross-border transfer of capability is a widely used industry technique known as "model distillation."[2][5]

To understand model distillation, consider the relationship between a master teacher and a student. Frontier AI models, which require billions of dollars and massive data centers to train, act as the master teacher. They possess broad, generalized reasoning capabilities.

Instead of attempting to replicate the master teacher's vast knowledge base from scratch, researchers can use the frontier model to generate highly specific, high-quality synthetic data. This data is then fed into a much smaller, specialized "student" model.[2]

The resulting distilled model requires a fraction of the computing power to run and can be deployed locally on secure, air-gapped military networks or even embedded in edge devices like drones and tactical vehicles.[5]

The evidence of this practice was compiled by the Washington-based Jamestown Foundation and shared in an exclusive review by Reuters.[1]

The documents indicate that Chinese defense institutions view leading U.S. models as both a vital source of technical insight and a highly efficient shortcut to narrow the technological gap with American competitors.[2][4]

For example, researchers at the North University of China, an institution with close ties to the domestic weapons industry, reportedly used Anthropic's Claude 3 Haiku model to generate synthetic training data. This data was used to refine a text classification model designed for social media monitoring and content moderation.[1]

Other papers detail the use of models like OpenAI's GPT-3.5 to summarize complex software code, which is then used to train localized models that operate entirely within Chinese military networks for intelligence processing and tactical simulations.[1]

Sunny Cheung, a fellow at the Jamestown Foundation who analyzed more than 60 of the papers, noted that teaching a model the correct answer is relatively simple, but transferring the underlying reasoning process is significantly more difficult.[5]

"These papers show Chinese military-linked researchers are trying to transfer that expensive, proprietary reasoning from Western models into smaller systems they can control and deploy locally," Cheung observed.[5]

The revelation underscores a fundamental vulnerability in current technology containment strategies. While the U.S. can restrict the shipment of physical Nvidia GPUs, it is vastly more difficult to police the outputs generated by cloud-based APIs or open-weights models that are freely downloadable.

The dispute now centers on the unauthorized extraction of capabilities. While model distillation is a standard and legitimate practice within the commercial AI industry for optimizing software, U.S. officials argue that using it to siphon proprietary reasoning from American models violates terms of service and infringes on intellectual property rights.[2][4]

Furthermore, security analysts warn that distilled models often strip away the safety guardrails embedded in the original frontier systems, allowing high-risk capabilities to be transferred to models that operate entirely beyond the oversight of the original developers.[5]

Chinese entities have strongly pushed back against these characterizations. Beijing has accused Washington of pursuing "AI hegemonism," arguing that American technology companies routinely engage in similar data-scraping and distillation practices to build their own systems.[4][5]

Prominent Chinese AI startups, such as Moonshot AI, have also publicly denied allegations from U.S. officials that their flagship models rely on illicit distillation, maintaining that their systems are the product of proprietary domestic innovation.[4][6]

As the U.S. and China prepare for upcoming bilateral talks on AI governance and safety, the porous nature of digital borders remains a central challenge. The widespread use of model distillation suggests that the proliferation of advanced AI capabilities will be defined not just by who controls the hardware, but by who can most effectively harness the data flowing through the cloud.[2][3]