Chinese military researchers have systematically extracted capabilities from Anthropic's Claude 3 Haiku and OpenAI's GPT-3.5 through a technique called model distillation, according to a Reuters investigation published July 31. The practice reveals a significant vulnerability in how the US attempts to control access to advanced AI technology, shifting the competition from hardware chips to software and API access.

Reuters reviewed more than 80 Chinese academic papers and patents documenting how People's Liberation Army (PLA) affiliated researchers used model distillation to train domestic AI systems for defense applications. One PLA unit distilled GPT-3.5 to build a code-summarization model designed to run on classified military networks disconnected from the internet. Researchers at North University of China used Claude 3 Haiku to generate synthetic training data for social-media surveillance classifiers.

What Is Model Distillation and Why Does It Matter?

Model distillation is a straightforward technique that doesn't require access to a model's underlying architecture or training data. Instead, researchers feed prompts to a powerful AI model like Claude or GPT-3.5, collect its outputs, and then train a smaller "student" model to mimic those responses. If you have API access, you can extract frontier-model capability without ever seeing the teacher model's weights or internal structure.

The papers span multiple defense applications, revealing a structured effort to build specialized AI systems that operate independently on air-gapped networks where commercial API access is impossible. The applications documented include:

• Surveillance Systems: Social-media monitoring classifiers trained on Claude-generated synthetic data
• Cyber Warfare: Specialized models for offensive and defensive cyber operations
• Tactical Decision-Making: AI systems to support military planning and strategy
• Code Analysis: Tools for analyzing and summarizing code on classified networks

How Are Chinese Researchers Bypassing US Restrictions?

Both OpenAI and Anthropic restrict API access from Chinese IP addresses and explicitly prohibit using their models to develop competing AI systems. However, the practical enforcement of these restrictions proves nearly impossible against state actors. Researchers can route API requests through third-party services, use proxy access, or leverage academic collaborations and third-country cloud providers to mask their origin.

The fundamental problem is that API terms of service are not enforceable as law in China, and the PLA doesn't purchase its own API keys. The distillation pipeline likely operates through intermediary accounts, academic partnerships, or cloud infrastructure outside direct US control. This represents a significant shift in the US-China AI competition, moving beyond the Biden-era export restrictions that targeted hardware like advanced semiconductors to a much harder-to-control domain: software and API access.

Steps to Understand the Emerging Policy Response

Congress and industry experts have begun proposing solutions to address the distillation vulnerability, though none have become law yet. The proposed approaches include:

• Know Your Customer (KYC) Requirements: Mandatory identity verification for all frontier AI API access to prevent intermediary accounts from masking state-actor use
• Output Watermarking: Embedding invisible markers in model outputs to trace when distillation is occurring and identify which models are being used
• Architecture Restrictions: Banning certain model architectures from cloud-hosted endpoints accessible from adversarial nations

The 80 papers reviewed by Reuters suggest the distillation pipeline is already mature and producing operational results. This creates urgency around policy decisions that have not yet been finalized into law.

The revelation underscores a critical vulnerability in how Anthropic, OpenAI, and other AI companies protect their models from state-level actors. While both companies monitor for policy violations and restrict access, the decentralized nature of cloud infrastructure and the simplicity of model distillation make enforcement extraordinarily difficult. As the US-China AI competition intensifies, the focus has shifted from controlling the chips that train AI to controlling the APIs that deploy it, a challenge that may prove even harder to solve.