In fact, a review of over 80 Chinese academic papers and patents has revealed units dependent upon the People's Liberation Army have been ingesting some of OpenAI's and Anthropic's creations into their own weapons-development program. The results, collected jointly by Reuters and by the Jamestown Foundation, do not simply reflect the “cute experimentation” of defence-related entities trying to harvest military utility from frontier models which they never intended to engage with, but a “methodical effort” to do just that.

This is done by a process at the heart of the issue distillation and it is not some hacking technique. This is a standard approach throughout the AI industry, where a smaller ‘student' model is trained to emulate the output of a larger, more expensive ‘teacher' model, allowing a company or lab to reap most of the performance while not having to bear the hefty price tag of creating a frontier system from scratch. All major AI laboratories have some form of it on the inside of their laboratories. The alarm in Washington isn't just over the technique, but who is using it, who is it being used on and what is it being used for. The papers detail PLA-affiliated scientists methodically capturing not only the results a Western model might yield, but the reasoning behind those results the expensive, labor-intensive part of a model that has required hundreds of millions of dollars and years of development to construct and condensing it into smaller pieces of sovereign systems that can be run entirely within a Chinese military network, with no American company able to monitor its operations or pull its plug.

The individual situations in which it is mentioned are like a slice of contemporary warfare planning. In one paper, authored by researchers from PLA Unit 96941, a Beijing-based military intelligence and cyber-warfare unit, the researchers explain that the secret to using their system is to first write a summary of their code, which they had deemed too classified for external use, and then train their own model on those summaries, so they could operate offline. Researchers at North University of China, a university with a long history in the country's ordnance industry, have leveraged Anthropic's Claude 3 Haiku to create synthetic training data for a content moderation social media monitoring classifier. A paper from PLA's National University of Defence Technology from 2024 talks about reducing an image-recognition model, which was developed to process the flow of Western thinking, such that it can fit on a drone, in order to get real-time video analysis for navigation and targeting even if communications links are cut. The Academy of Military Sciences has, separately, tested a distilled target-recognition model on the tactical hardware in simulated sea missions with ships, drones and unmanned submarines.

Anthropic has emphatically stated it will not sell commercial access to Claude to any entity in Beijing's orbit, or even within China, and has implemented systems to detect such usage. However, the company acknowledged a point right to the core of the matter: after distilling away the safety guardrails of the original, a model can be stripped of the features it was never intended to have and go to an operator out of anyone's reach. OpenAI has not made a public response to the findings, and the same has been done by China's defence ministry, foreign ministry and PLA as such. That's the only answer that was needed.

When it comes to the big picture, Beijing's stance is that Washington is practising what it calls AI "hegemonism" preventing its chips from being used by others and now attempting to police software behaviour, while at the same time, Beijing says, America's companies have borrowed ideas and outputs from China. The notion that Chinese progress is derivative at all has left its defenders in a lurch last week: Moonshot, a Chinese startup, denied the claim, claiming its gains were homegrown with the Kimi K3 model. The argument will continue as they will likely become the main battleground of the September US-China meeting on AI governance, and the difference Washington is attempting to make legitimate industry practice versus the unauthorised extraction of proprietary reasoning is one that's hard to police from the outside.

There's an economic reality on top of it all. The company's market share in China's AI accelerator business has dropped to almost zero in the last two years, said Nvidia's chief executive, as it was pushed out of the country by a change in Washington export rules, not by a decline in demand. The company has suffered write-downs totaling more than ten billion dollars in two restrictions; estimates of the annual shortfall for the U.S. chip makers range between 15 billion and 20 billion dollars. In the interim, Chinese domestic chip manufacturers, including Huawei, have gained nearly forty-one percent of their home market, while Beijing has invested hundreds of billions of dollars in local AI infrastructure with a particular focus on reducing the impact of hardware sanctions. In a way, the software solution to the same squeeze is distillation: if you can't afford to purchase the chips to train a frontier model from scratch, you do what you can to get the intelligence of an already trained model.

All this does not mean China is closing the gap completely. Distilled models are restricted to fragments of a teacher model's capability and can't recapture the full spectrum of a frontier system, several researchers, including some from China's own military research institute, have started to work on distillation as a vulnerability, fearing that their own models could be distilled too. But it's clear where the motion is going. The export controls were devised to slow China down at the silicon level. The review makes it clear that the contest has shifted a level from now, to the output and reasoning of the models themselves and that's a line of demarcation that's much trickier to monitor than a shipping manifest.