Chinese military researchers use US AI models to develop defence systems

Beijing. Chinese military researchers have used outputs from advanced United States artificial intelligence models developed by OpenAI and Anthropic to train domestic AI systems aimed at strengthening China’s defence capabilities, according to a Reuters review of more than 80 Chinese academic papers and patents.

The findings provide a rare insight into how military and security-linked institutions in China are using leading US AI technologies to accelerate the development of specialised systems, despite Washington’s efforts to restrict Beijing’s access to advanced chips and other strategic technologies.

The documents reveal widespread use of a technique known as “model distillation”, where outputs from powerful AI systems are used to train smaller, specialised models that require less computing power and can operate locally.

Reuters’ review, which included research compiled by the Washington-based Jamestown Foundation, found that the method has been adopted by researchers linked to the People’s Liberation Army (PLA) and other military institutions.

The papers suggest Chinese defence institutions view advanced US AI models as a source of technical knowledge and a means of narrowing the gap with American competitors.

The controversy centres not on distillation itself, which is widely used across the technology industry, but on allegations of unauthorised extraction of capabilities from US AI models.

The issue has emerged as a major point of tension ahead of US-China discussions on AI governance and safety. US officials have accused some Chinese entities of using distillation to obtain capabilities from American models, potentially violating intellectual property rights and weakening export controls.

China has rejected the allegations, accusing Washington of pursuing AI “hegemonism” and arguing that US companies have also benefited from similar practices.

Chinese developers have also denied claims that their AI progress depends on foreign models. AI start-up Moonshot recently rejected allegations by the Trump administration that its Kimi K3 model was developed through distillation, saying it relied on its own innovations.

From cyber warfare to surveillance

Sunny Cheung, a Jamestown Foundation fellow who analysed more than 60 papers, said Chinese military scientists were attempting to capture the reasoning processes of Western AI models and adapt them for surveillance, cyber warfare and tactical decision-making.

“Teaching a model the right answer is one thing, but teaching it the reasoning behind the answer is much harder,” Mr Cheung said.

He said the research showed Chinese military-linked institutions were attempting to transfer advanced reasoning capabilities from Western models into smaller systems that could be controlled and deployed domestically.

Reuters verified the academic literature and identified an additional two dozen military-linked cases.

One paper published last year by researchers from PLA Unit 96941, a Beijing-based military intelligence and cyber warfare unit, described using OpenAI’s GPT-3.5 to process sensitive military source code.

The researchers said commercial AI models could not be used directly for classified information because of security concerns. Instead, they used GPT-3.5 to summarise software code and trained a domestic AI model using those summaries, allowing it to operate within Chinese military networks.

The White House, Pentagon, China’s foreign ministry, the PLA and OpenAI did not respond to requests for comment.

Wide military applications

Chinese researchers have applied distillation techniques in areas ranging from social media monitoring to battlefield systems, according to the Reuters review.

At North University of China, which has close links to the country’s weapons industry, researchers used Anthropic’s Claude 3 Haiku to generate synthetic data for a text classification system designed for social media monitoring and content moderation.

Anthropic said it does not provide commercial access to Claude in China or to Beijing-controlled companies. The company warned that distilled models could lose the original systems’ safety protections, potentially allowing sensitive capabilities to be transferred beyond its control.

A 2024 paper from the PLA’s National University of Defense Technology described using distillation to reduce the size of an image-processing model for use on unmanned aerial vehicles.

The system allowed drones to analyse live video, support navigation and assist targeting decisions in real time, even when communication links were disrupted.

Researchers at China’s Academy of Military Sciences have also used distillation to operate target-recognition models on tactical equipment during simulated maritime operations involving drones, ships and unmanned submarines, according to a study published earlier this year.

Benefits and limitations

China has promoted AI model distillation as part of efforts to compete with the US in advanced artificial intelligence while facing restrictions on access to high-performance computing resources.

Government programmes have supported “model lightweighting” and edge computing technologies, allowing AI systems to operate on devices such as drones, satellites and other equipment with limited processing capacity.

However, experts warn that distillation has limitations.

As Chinese AI systems improve, military researchers have also examined the possibility that the same techniques could be used against their own models.

In January, researchers at the Army Engineering University published a paper on “data-free distillation”, a method of extracting a model’s capabilities without direct access to its internal parameters.

They proposed defensive measures aimed at hiding the logical information that can be revealed through a model’s outputs.

Trevor Koverko, co-founder of AI data company Sapien, said distilled models inherit only selected capabilities and cannot fully match the intelligence of the original systems.

“It is best understood as transferring selected capabilities into a cheaper, locally controlled system, not achieving independence from frontier AI,” he said.