蒸留攻撃の仕組みと目的、中国の軍関連AI研究に見る敵対的蒸留

Distillation (知识蒸馏) refers to the practice of training a smaller, cheaper “student” model by using the outputs of a larger “teacher” model. ／ It is a practice used widely across the industry for a variety of purposes. It is good for competition and helps maintain an ecosystem in which less well-resourced players can benefit from AI. ／ A review of dozens of Chinese academic and industry papers published between 2024–2026 provides evidence of how Chinese entities are approaching distillation in problematic ways. — 蒸留の定義、業界での一般性、および分析が対象とした論文の範囲に関する記述より

First, it violates the terms of use of Western companies’ models. Second, it provides a shortcut that helps Chinese models catch up to the frontier by leveraging the strengths of leading Western models. Third, and most important, Chinese models built in part from distilling Western models are being used in military and public security applications. Moreover, because they have been distilled, they may not retain the safety guardrails of the original models. ／ Adversarial distillation, however, involves building student models via large-scale “knowledge distillation attacks” that violate the terms of use of teacher models ／ The prize is frontier reasoning: the step-by-step “chain of thought” that is the most expensive capability to build and the one on which U.S. laboratories lead most clearly. ／ Adversarial distillation aims to imitate how Western frontier models reason by targeting models’ “chain of thought” (思维链). These are the intermediate steps through which models breaks down a problem and tests its findings before offering an answer. — 敵対的蒸留を問題視する3つの理由、知識蒸留攻撃という呼び方、および標的とされる「思考の連鎖」に関する記述より

In July 2026, Chinese artificial intelligence (AI) firm Moonshot AI (月之暗面) released Kimi K3 ／ Moonshot AI drew accusations that it had reached the frontier by distilling Western models ／ As early as April 2026, the White House Office of Science and Technology Policy was alleging “industrial-scale campaigns to distill U.S. frontier AI systems” — Kimi K3 をめぐる批判と米政府の主張に関する記述より

Qwen-Max identified itself as “Claude, an AI assistant created by Anthropic,” and DeepSeek-V3 answered that it was “created by OpenAI.” ／ The researchers developed a scale to rank each of the models based on the suspicion that they had been distilled: Qwen-Max, GLM-4-Plus, and DeepSeek-V3 came out at or near the top ／ These particular instances of distillation may not all have been adversarial, but that does not necessarily mean that they were legitimate. — 中国モデルの自己申告、蒸留の疑いによる順位づけ、およびその留保に関する記述より

One survey paper by academics at Army Engineering University of PLA proposes distilling a way to break a model’s safety mechanism—known as “attack knowledge” (攻击知识)—into small, fast tools that can run attacks continuously. ／ The authors note that these tools work very well against “strongly safety-aligned commercial models” ／ In a separate paper, written by members of a PLA unit that may be part of the PLA Rocket Force, the authors distill OpenAI’s GPT-3.5 to create a series of smaller models that can summarize code to almost the same standard ／ A group from Air Force Engineering University, PLA Information Engineering University, and an undisclosed PLA unit distilled several teacher models to construct a proxy “black box” model, then built tools to attack it — 表の各行に対応する研究例（攻撃知識の蒸留、コード要約への蒸留、代理モデルの構成）に関する記述より

Distillation can sometimes be detected because of a model’s watermarks and chain-of-thought reasoning that can carry over into anything trained on its outputs. ／ one paper by researchers affiliated with the PLA Cyberspace Force and PLA Information Engineering University outlines ways to remove watermarks effectively while still inheriting the teacher model’s capabilities ／ In at least one case, concealing a model’s origins was an explicit goal. A paper by researchers at the University of Science and Technology of China sought to create tools to avoid detection in distillation attacks. ／ They reduced the “anomalous features” (异常特征) for which a model’s defense mechanism scans and increased the tool’s “stealthiness” (隐匿性) to defeat backdoor and poisoning detectors — 透かしによる検出、透かし除去、および検出回避の研究に関する記述より

a group from Nanjing University of Science and Technology, one of the military-linked Seven Sons of National Defense, tested whether Western frontier models can be hijacked via prompt-injection. ／ In an experiment, they concealed written commands inside images of tanks and warships. GPT-4o and two versions of Claude allegedly read the hidden text and obeyed it — 南京理工大学のプロンプトインジェクション実験に関する記述より

Distilled models are either already being used, or are proposed to be used, for public security applications such as surveillance and monitoring systems, and for military and cyber operations. ／ Most of the research on distillation for public security applications appears to involve the distillation of Chinese models ／ engineers at the state-owned China Electronics Technology Group’s smart city institute distilled large security (安防) models to run on the edge processors inside street cameras that can identify individual faces in crowds under low-light conditions for surveillance purposes ／ Researchers at the North University of China (中北大学), which has its roots in the ordnance industry, distilled Claude through a “multi-objective knowledge distillation” (多目标知识蒸馏) process to create a classifier they propose could be used for “social media monitoring and content moderation systems” (社交媒体监控以及内容审核系统) — 用途の書き分け、街頭カメラへの蒸留モデル展開、および Claude を蒸留した分類器に関する記述より

Chinese academic and military journals run on internal review and publication cycles that put 1–2 years between the work itself and the publication of the results. ／ This means that these studies describe experiments conducted against the frontier models of 2023 and 2024, and so only show the floor of current PRC capabilities, not a ceiling. — 実験から公表までの遅れと、そこから導かれる読み方に関する記述より

Distillation of Western frontier models plays an important role in the PRC’s AI ecosystem. This role is not decisive, but it is problematic. — 蒸留が中国のAI生態系で果たす役割についての、分析自身の総括より