The previously unreported findings offer a rare glimpse into how military and security-linked institutions in China are leveraging cutting-edge U.S. AI models as a shortcut to developing specialised systems of their own, despite Washington’s efforts to restrict Beijing’s access to advanced chips and other strategic technologies.

The documents show widespread use of a technique known as “model distillation,” in which outputs from a powerful AI system are used to train smaller, specialised models that can be deployed locally without the enormous computing requirements needed to build frontier AI systems from scratch.

Reuters’ review, which included research compiled by the Washington-based Jamestown Foundation and shared exclusively with the news agency, showed distillation is widely used by researchers linked to the People’s Liberation Army and other military institutions.

The papers suggest Chinese defense institutions see leading U.S. AI models as both a source of technical insight and a way to close the gap with American rivals.

The dispute centres on unauthorised extraction, not distillation itself, a widely used industry practice.

The issue has emerged as a major flashpoint ahead of U.S.-China talks on AI governance and safety. U.S. officials have accused some Chinese entities of using distillation to extract capabilities from American AI models, potentially undermining export controls and infringing intellectual property rights.

China has rejected the accusations, saying Washington is pursuing AI “hegemonism” while arguing that U.S. firms have engaged in similar practices.

Chinese developers have also disputed claims that their AI advances rely on foreign models. AI startup Moonshot last week denied allegations by the Trump administration that its Kimi K3 model was built using distillation, saying it was driven by proprietary innovations.

Sunny Cheung, a Jamestown fellow who analysed over 60 of the papers, said Chinese military scientists are systematically capturing the reasoning steps of Western models to adapt them for surveillance, cyber warfare and tactical decision-making.

“Teaching a model the right answer is one thing but teaching it the reasoning behind the answer is much harder,” said Cheung.

“These papers show Chinese military-linked researchers are trying to transfer that expensive, proprietary reasoning from Western models into smaller systems they can control and deploy locally.”

Reuters verified the academic literature and identified an additional two dozen military-linked case studies.

One paper published last year by researchers in PLA Unit 96941, a military intelligence and cyber-warfare unit in Beijing, described using OpenAI’s GPT-3.5 to process sensitive military source code.

The researchers said third-party models were unsuitable for handling classified information. To overcome that limitation, they used GPT-3.5 to summarize software code and trained a domestic model on those summaries to run entirely within Chinese military networks.

The White House, Pentagon, China’s foreign ministry, the PLA and OpenAI did not respond to requests for comment.

WIDE USE, FROM MONITORING TO MILITARY

Chinese researchers have used distillation for purposes ranging from content monitoring to military deployment, Reuters’ and Jamestown’s review of the papers showed.

At the North University of China, which has close links to the country’s weapons industry, researchers used Anthropic’s Claude 3 Haiku to generate synthetic training data for a text classification model for social media monitoring and content moderation.

Anthropic said it does not provide commercial access to Claude in China or to Beijing-controlled firms and uses monitoring systems to detect policy violations.

The company added that distilled models may lose the original systems’ safety safeguards, potentially allowing sensitive capabilities to be transferred to models beyond its control.

A 2024 paper from the PLA’s National University of Defense Technology described using distillation to shrink an image-processing model for deployment on unmanned aerial vehicles, allowing drones to analyse live video and support navigation and targeting decisions in real time even when communications are cut.

Similarly, researchers at China’s Academy of Military Sciences used distillation to run a target-recognition model on tactical hardware during simulated maritime operations involving drones, ships and unmanned submarines, a study published earlier this year showed.

BENEFITS AND LIMITS

China has embraced distillation as it seeks to compete with the U.S. in frontier AI while facing constraints on advanced computing resources due to Washington’s export controls on high-end chips.

Central and local governments have promoted “model lightweighting” and edge computing, directing subsidies and research funding toward technologies that enable AI models to run on drones, satellites and other devices with limited processing power.

Experts caution, however, that distillation has significant limitations.

As Chinese AI models close the gap with their U.S. counterparts, military researchers are also examining distillation as a potential security risk.

In January, researchers at the Army Engineering University published a paper on the threat of “data-free distillation,” a method of reverse-engineering a model’s capabilities without direct access to its core parameters.

To counter that vulnerability, they proposed defense mechanisms designed to mask the hidden logical information exposed in a model’s public outputs.

Distilled models also inherit only selected capabilities and cannot fully replicate the broad intelligence of frontier systems.

Trevor Koverko, co-founder of AI data company Sapien, said distilled models remain less capable than their teacher models.

“It is best understood as transferring selected capabilities into a cheaper, locally controlled system, not achieving independence from frontier AI.”

But instead of a service member resting a finger on the trigger well in preparation for the next shot, in video footage of the Bullfrog weapons system, a hulking, metal machine tilts the weapon just slightly, refocusing itself.

As the U.S. contends with steep expenses to counter cheap drones, Allen Control Systems, or ACS, announced Monday that the Marine Corps has chosen the Bullfrog autonomous weapon system to integrate into its airborne defenses.

The futuristic apparatus is an AI-enabled weapon system that detects, tracks and then automatically aims firearms against aerial threats like drones. That Marine Corps selected the system under its Ground Based Air Defense, or GBAD, program, which develops and fields capabilities to protect forces from airborne attacks.

The service plans to incorporate the Bullfrog into its Light Marine Air Defense Integrated System (L-MADIS), a counter-unmanned aircraft system mounted on two vehicles that relies heavily on electronic warfare.

The system is already in use in the Army and Navy and has been approved by Joint Interagency Task Force 401, the Pentagon’s unit established to streamline the acquisition of counter-drone technology.

The Defense Department’s focus on countering drones comes as conflicts in Ukraine and the Middle East have underscored the increasingly important role of cheap drones on the modern battlefield. The Pentagon has placed a growing emphasis on developing and fielding counter-drone technology that is more scalable and less pricey.

Their prevalence has exposed the economic imbalance of U.S. air defense, as small, relatively inexpensive drones have forced the country to expend expensive interceptor missiles that can cost millions of dollars to make.

The challenge has become especially pronounced during the U.S. war with Iran, where American forces have relied heavily on costly defenses to counter Iran’s Shahed drones, which can cost around $35,000 compared to around $4 million for some interceptors. Experts have warned that the cost of a prolonged war may drastically deplete U.S. interceptor stores.

An ACS press release on the Marine Corps deal linked to the Bullfrog M240, which is compatible with the U.S. military’s belt-fed, fully automatic M240 machine gun. According to the company, the M240 system has a maximum effective range of nearly half a mile and can attack medium and large drones weighing up to 1,320 pounds. Without ammunition, the system weighs 300 pounds.

According to the company, which also has variants that support the M2 machine gun and M320 chain gun, the M240 system has “a cost-per-kill as low as $10.”

Other defense firms are also working to procure more affordable counter-UAS defenses. This week, Lockheed Martin announced a cheaper Patriot interceptor missile that they say will have a price tag of less than half of what other multimillion-dollar interceptors cost.

The New Mexico-based firm this week pulled the curtain back on Buckler, an interceptor designed to kill Group 3 drones — UAS weighing up to 1,320 pounds and flying below 18,000 feet at under 250 knots — for a cost of under $100,000 per unit.

Buckler is designed to knock out UAS at supersonic speeds, according to a company release, and is assembled with an airframe and propulsion system manufactured entirely at X-Bow factories, thus eliminating a production bottleneck that has plagued myriad high-priced systems reliant on multi-company components. Axios first reported about the X-Bow Buckler.

The unveiling at London’s 2026 Farnborough Airshow this week is the latest push by U.S. industry to solve an interceptor enigma that has become increasingly glaring as the nation’s war with Iran drags on.

U.S. troops in the military’s Central Command area of operations have continued to face the onerous task of leaning on exorbitantly priced interceptors to contend with Iran’s vastly cheaper, mass-produced Shahed attack drones.

The use of a single PAC-3 interceptor to knock one Shahed-136 out of the sky comes with a $4 million to $35,000 tradeoff, or a 114-1 cost-per-kill ratio.

“You can’t win a war of attrition trading million-dollar interceptors against thousand-dollar threats,” X-Bow founder and chief executive officer Jason Hundley said in a release. “Buckler has flown, it comes in under $100,000, and we build its airframe and propulsion ourselves — the part of the industrial base that is so stressed by today’s munitions demands. This is our answer to the call from the U.S. and its allies: affordable capability, at scale.”

X-Bow’s announcement comes after the firm’s recent test of the Buckler munition — one that derives its name, as TWZ noted, from a Medieval era shield — that demonstrated its propulsion and flight performance, the company announced.

Following a similar theme at Farnborough, Lockheed Martin on Monday introduced what it hopes will be another low cost per kill solution to the ever-evolving unmanned threat.

The defense giant this week introduced the Morfius X-Rotor, a ground-launched “one-to-many” airborne high power microwave counter-UAS system the company says can “neutralize more than 50 enemy drones in a single flight.”

Morfius is built, most notably, to be recovered and reused.

Lockheed also introduced a cheaper Patriot interceptor.