How have Chinese military researchers used model distillation from U.S. AI systems like OpenAI's and Anthropic's to advance defense AI, and what are the implications for US China tech tensions, the technique's limitations, and the security risks involved?

One paper from PLA Unit 96904 explicitly described distilling U.S. models to create "smaller and more secure" versions suitable for defense applications .

Implications for US-China Tech Tensions

• Acceleration of China's defense AI at low cost. Distillation lets Chinese researchers bypass the billions of dollars and years of R&D needed to train frontier models from scratch .
• Industrial-scale theft allegations. In February 2026, OpenAI, Anthropic, and Google each published evidence of coordinated distillation campaigns by Chinese firms DeepSeek, Moonshot AI, and MiniMax . Anthropic accused Alibaba in June 2026 of the largest known breach of its Claude model .
• U.S. government response. The U.S. Treasury Secretary warned of potential sanctions after accusing Moonshot of distilling from Anthropic's Fable 5 model . A U.S. House committee hearing in April 2026 examined OpenAI's memo detailing "sophisticated, multi-stage" distillation pipelines .
• Broader tech decoupling. The ongoing distillation warfare is accelerating U.S.-China decoupling in AI — tighter export controls, API restrictions, and potential financial sanctions are all on the table .

Limitations of the Distillation Technique

• Knowledge ceiling. A distilled "student" model generally cannot exceed the capabilities of the "teacher" model it copies from. It inherits the teacher's strengths but also its blind spots and error patterns .
• Degradation over iterative distillation. Each round of distillation tends to lose fidelity — fine-grained reasoning, rare knowledge, and subtle safety alignment degrade with each generation .
• Safety alignment erosion. Academic research shows that soft-label distillation can reduce safety guardrails in student models by up to 50% compared to the original teacher, while preserving task performance . Distilled models often lack the robust refusal behaviors and harmlessness training of frontier models .
• Defense evasion is still limited. Current defenses — output perturbation, data poisoning, rate limiting — remain largely ineffective against determined attackers using multi-stage pipelines .

Security Risks Involved

• Proliferation of unsafe AI. Distilled models stripped of safety alignment can be deployed for military and surveillance purposes that the original U.S. companies explicitly prohibit in their terms of service .
• Loss of U.S. technological advantage. Distillation lets adversaries leapfrog years of proprietary R&D, eroding America's lead in frontier AI capabilities .
• Hard-to-detect theft. Distillation attacks from black-box APIs are difficult to distinguish from normal heavy API usage, making attribution and enforcement challenging .
• Escalation of an AI arms race. As both sides deploy countermeasures (Anthropic embedded tracking code into Claude Code in March 2026 to identify Chinese users), the risk of a security spiral — where each side treats the other's AI activity as hostile — continues to rise .

The core strategic risk is that distillation allows China's military to effectively parasitize U.S. AI investment for defense applications at a fraction of the cost, while the safety degradation inherent in the process may produce less constrained, more dangerous military AI systems.