How Chinese Military Researchers Are Using U.S. AI Models to Build Defense Systems — and Why It Matters

Documented Military Applications

The papers and patents reviewed by Reuters, compiled with the Washington-based Jamestown Foundation, show distillation being used for a range of defense-related AI systems :

• Surveillance systems — AI for reconnaissance and intelligence analysis
• Cyberwarfare tools — automated attack and defense systems
• Drone and tactical operations — autonomous drone swarms and battlefield decision aids
• Military vehicles — China's state-run defense firm Norinco deployed a vehicle powered by DeepSeek (itself built via distillation) for autonomous combat-support tasks, capable of speeds up to 50 km/h

A paper from PLA Unit 96904 explicitly described distilling U.S. models to create "smaller and more secure" versions suitable for defense applications . Another paper from PLA Unit 96941 — a military intelligence and cyber-warfare unit in Beijing — described using OpenAI's GPT-3.5 to process sensitive military source code . A 2024 paper from the PLA's National University of Defense Technology used distillation to shrink an image-processing model for deployment on resource-constrained military hardware .

How the Technique Accelerates China's Defense AI at Low Cost

The core strategic advantage of distillation is economic. Training a frontier AI model from scratch costs billions of dollars and requires years of research and development, massive datasets, and access to advanced semiconductor chips. Distillation lets Chinese researchers bypass nearly all of that investment .

By querying frontier models via API — creating fraudulent accounts and using proxy networks to evade rate limits — Chinese developers can extract the same capabilities at a fraction of the cost. Anthropic's investigation identified over 16 million exchanges generated through approximately 24,000 fraudulent accounts targeting Claude's agentic reasoning, tool use, and coding capabilities. Chinese AI developer MiniMax was alone responsible for over 13 million of those exchanges .

Industrial-Scale Theft Allegations and U.S. Government Response

The evidence has triggered an escalating series of accusations and policy responses:

• February 2026: OpenAI, Anthropic, and Google each published evidence of coordinated distillation campaigns by Chinese firms DeepSeek, Moonshot AI, and MiniMax . Anthropic described these as deliberate "distillation attack" operations .
• April 2026: A U.S. House committee hearing examined OpenAI's memo detailing "sophisticated, multi-stage" distillation pipelines that use multiple API accounts, proxy networks, and behavioral mimicry to avoid detection .
• June 2026: Anthropic accused Alibaba of the largest known breach of its Claude model, a distillation campaign that ran from April 22 to June 5 .
• July 2026: U.S. Treasury Secretary Scott Bessent warned of potential sanctions after accusing Chinese AI lab Moonshot of distilling from Anthropic's advanced Fable 5 model . The Commerce Department's Bureau of Industry and Security is also investigating whether Chinese firms are accessing advanced U.S. chips illegally .

Critical Limitations of Distillation

Despite its effectiveness as a shortcut, model distillation has inherent technical limitations that matter for military applications:

• Knowledge ceiling: A distilled student model generally cannot exceed the capabilities of the teacher model it copies from. It inherits the teacher's strengths but also its blind spots and error patterns .
• Degradation over iterative distillation: Each round of distillation tends to lose fidelity. Fine-grained reasoning, rare knowledge, and subtle safety alignment degrade with each generation .
• Safety alignment erosion: This is the most concerning limitation for military use. Academic research shows that soft-label distillation can reduce safety guardrails in student models by up to 50% compared to the original teacher, while preserving task performance . Distilled models often lack the robust refusal behaviors and harmlessness training of frontier models . As Anthropic notes, "illicitly distilled models lack necessary safeguards, creating significant national security risks" .
• Defense evasion limitations: Current defenses — output perturbation, data poisoning, rate limiting — remain largely ineffective against determined attackers using multi-stage pipelines and distributed extraction techniques .

Security Risks and the Escalating AI Arms Race

The combination of capability theft and safety degradation creates a dangerous dynamic:

• Proliferation of unsafe AI: Distilled models stripped of safety alignment can be deployed for military and surveillance purposes that the original U.S. companies explicitly prohibit in their terms of service .
• Loss of U.S. technological advantage: Distillation lets adversaries leapfrog years of proprietary R&D, eroding America's lead in frontier AI capabilities .
• Hard-to-detect theft: Distillation attacks from black-box APIs are difficult to distinguish from normal heavy API usage, making attribution and enforcement challenging .
• Countermeasure escalation: Both sides are deploying increasingly aggressive countermeasures. In March 2026, Anthropic embedded tracking code into Claude Code to identify Chinese users . The risk of a security spiral — where each side treats the other's AI activity as hostile — continues to rise .

The Broader Implication for US-China Tech Decoupling

The ongoing distillation warfare is accelerating U.S.-China decoupling in AI across multiple dimensions . Tighter export controls on advanced chips, stricter API access restrictions, KYC requirements for developer accounts, and potential financial sanctions are all on the table .

The core strategic risk is clear: distillation allows China's military to effectively parasitize U.S. AI investment for defense applications at a fraction of the cost, while the safety degradation inherent in the process may produce less constrained, more dangerous military AI systems.