Researchers from a People's Liberation Army (PLA) unit used OpenAI's GPT-3.5 as a teacher, while researchers at a defense-affiliated university used Anthropic's Claude 3 Haiku, to train compact domestic AI models—according to a Reuters report published on July 31, 2026, based on an examination of Chinese papers and more than 80 patents. However, for the latter case, there is no evidence of military deployment. What the public materials most clearly confirm is not a wholesale replication of a US frontier model. Rather, it is an experiment in which a PLA unit had GPT-3.5 generate a large volume of teacher data and transferred a single capability—code summarization—into a compact model. Here lies a technology-transfer pathway that runs through model outputs, one that cannot be closed simply by halting advanced semiconductors.
2.15 Million Outputs Distilled into 350 Million Parameters
Six researchers from PLA Unit 96941 published "Code Summarization Based on Large Model Knowledge Distillation" in July 2025. To avoid the leakage risk of sending source code to an external AI, the study trains a compact model that runs in a local environment, using summaries generated by GPT-3.5. The paper lists Unit 96941 as the affiliation for all authors. According to unit-number reference materials on the PLA Rocket Force (PLARF) compiled by the US Air Force's China Aerospace Studies Institute, 96941 corresponds to a unit directly under the PLARF headquarters staff.
The researchers started from a public dataset containing Java methods and human-written summaries. They prompted GPT-3.5 with "Explain this Java method in one sentence," ultimately collecting 2.15 million summaries. For the distillation targets, they prepared "Jam" models with 38 million, 110 million, and 350 million parameters, as well as StarCoder with 15.5 billion parameters. Jam was a model pre-trained on 5.2 million Java methods, meaning it was not built entirely from scratch using only GPT-3.5's outputs.
What the numbers illustrate is not the replication of general intelligence but the cheap extraction of a specific task. Using the 2.15 million summaries, training the 350-million-parameter version of Jam took 10.5 hours and can run on a single 16GB consumer-grade GPU. Training the 15.5-billion-parameter StarCoder, even with only 170,000 data points, took 28 hours. According to the paper, StarCoder's cost was 28 times that of Jam, yet the gap in evaluation metrics was only 10% on METEOR and 5% on USE.
Human comparisons also showed small differences. Fifteen Java developers each evaluated 30 summaries, for a total of 450 evaluations; 52% preferred GPT-3.5, 46% preferred Jam, and 2% could not decide. The paper reports no statistically significant difference in accuracy, completeness, or conciseness. The researchers themselves do not claim that the student model reproduces all of GPT-3.5's capabilities. While the paper notes that problems could arise when generalizing to unknown code, for the code-summarization task under evaluation, it achieved results close to the external API. Not having to send code to a third party is also cited as an advantage of local execution.
Between Research at Military-Affiliated Institutions and Actual Military Deployment
When reading Reuters' investigation, one must distinguish between the researchers' affiliation, the intended use case described in the paper, and actual deployment. A 2025 paper by researchers at North University of China used Claude 3 Haiku to augment a small amount of data, combining knowledge distillation with pruning to build a compact classification model called "EQSBERT." The published abstract cites potential applications in automatic labeling, social media monitoring, and content auditing. However, it does not state that the model was delivered to the military or police.
The connection between North University of China and the defense industry is unambiguous. The university's official profile describes itself as jointly established by the Shanxi provincial government together with China's Ministry of Industry and Information Technology and the State Administration of Science, Technology and Industry for National Defense. Its predecessor was an arms-industry school founded by the Eighth Route Army in 1941, and the university calls itself "the first school of the people's munitions industry." Its mission statement even includes the phrase "to forge weapons for the military." Even so, the mere fact that a researcher affiliated with a defense-related university used Claude does not by itself qualify that classification model as a military system.
On the other hand, what capabilities the PLA is seeking can be confirmed from separate sources. Georgetown University's Center for Security and Emerging Technology examined thousands of PLA requests for proposals published between 2023 and 2024. Among them were decision support, enhanced sensor performance, and integration of data from disparate sources. Technologies for detecting US Navy vessels and countering US space systems were also prominent.
Thus, both demand and supply sides exist. The PLA wants compact AI that can process large volumes of information quickly and be used in the field. Universities and units institutionally tied to the military are researching how to use US-made models as teachers. However, the public papers do not indicate when—or whether—the research results were incorporated into operational systems, nor do they show any record of use by military units. The set of documents Reuters uncovered demonstrates multiple examples of research, conducted at military units and defense-affiliated universities, aimed at transferring capabilities from foreign APIs into domestically produced, locally-run models. Yet public information alone cannot determine how widely this pathway has spread among military-affiliated institutions.
Why Chip Controls Alone Cannot Stop This
Knowledge distillation is, in its original form, a legitimate model-compression technique. In the method demonstrated by Geoffrey Hinton, Oriol Vinyals, and Jeff Dean in 2015, the outputs of a large model or an ensemble of models serve as teacher signals to train a smaller, more deployable model. The probability distributions and responses produced by a large teacher contain richer information than mere correct-answer labels. Model developers themselves have used this technique to create affordable products from their own large models.
The problem is that a teacher model's outputs can be collected even without the owner's permission. In 2016, Florian Tramèr and colleagues demonstrated that a model's functionality could be replicated with high fidelity simply by repeatedly querying a public API—without any knowledge of internal weights or training data. With generative AI, responses are long, and even explanations, code, and reasoning examples can become teacher data. Because an API must expose its capabilities to the outside world in order to function as a product, its outputs themselves become an extraction surface.
The PLA Unit 96941 paper translates this asymmetry into concrete figures. While the US side needed enormous computing infrastructure and data to build GPT-3.5, a user can have the finished model generate 2.15 million teacher examples and transfer only a narrow capability into a 350-million-parameter student model. Although training the student model still requires GPUs, the scale demonstrated in the paper fits within a single 16GB GPU. The computational requirements differ between pre-training a cutting-edge model—the target of chip controls—and deploying a specialized model after distillation.
That said, distillation does not eliminate the need for computing resources. Massive access to the teacher model costs money, and avoiding detection requires numerous accounts or proxy services. The student side also needs a pre-trained base model and high-quality inputs. Unit 96941's paper succeeded because it narrowed its focus to a single, easily evaluable task: code summarization. Distillation neither recovered GPT-3.5's weights or design, nor reproduced its general reasoning capabilities.
This constraint does not necessarily make the threat smaller. In military applications, a compact model that reliably handles a single task in an environment with severed communications may be more useful than an all-purpose chatbot. This paper showed that, for the narrow use case of code summarization, capabilities could be transferred into a model that runs on a single GPU. However, whether the same effect can be achieved for image classification or sensor processing was not verified in this research. The US side must protect not only the training process for foundation models but also the deployment process that moves those capabilities quickly, cheaply, and into closed environments.
From Terms of Service to National Security
In February 2026, Anthropic announced that DeepSeek, Moonshot AI, and MiniMax had used roughly 24,000 fraudulent accounts to interact with Claude more than 16 million times. According to the company, Moonshot attempted to reconstruct Claude's reasoning process, and within 24 hours of a new Claude model's release, MiniMax shifted nearly half of its extraction traffic to the new model. In one case, a single proxy network reportedly managed more than 20,000 accounts simultaneously. This is an attribution judgment made by Anthropic, not a figure confirmed by independent third-party audit. Even so, it indicates a scale far beyond individual researchers merely experimenting with an API.
The US government, too, has begun treating model outputs as an independent object requiring protection. In NSTM-4, issued April 23, the White House Office of Science and Technology Policy stated that foreign actors—primarily China—are distilling US frontier AI "deliberately and at industrial scale." Countermeasures include information sharing between companies and government, coordinated defense among AI firms, and holding accountable the foreign actors involved.
In Congress, the "Deterring American AI Model Theft Act of 2026" was introduced on April 15 and passed by the House Foreign Affairs Committee on April 22. The bill establishes a framework for assessing and publicly listing entities involved in model extraction, along with sanctions. Rather than banning distillation outright, it seeks to distinguish between compression conducted with the owner's consent and extraction attacks that involve fraudulent accounts or circumvention of access restrictions.
Even so, for policy to keep pace with technology, the quality of evidence matters. If military-institution affiliation alone is taken as proof of military use, then general-purpose research gets caught in the same net. Conversely, if the issue is narrowed down to mere terms-of-service violations, one overlooks the security question of how to treat the possibility that extracted capabilities can be moved into closed, local environments. The standard set by Unit 96941's paper is clear: who queried which teacher model how many times, what capability was transferred into a student model of what scale, and on what hardware it runs. Whether this chain of facts can be concretely demonstrated will determine the credibility of the next round of regulation and reporting.