AI Distillation Attacks in PLA-Linked Research

What is AI distillation? Knowledge distillation explained

AI distillation, also called knowledge distillation, trains a small and cheap AI model on the answers of a larger one. The large model is called the teacher and the small one the student. Instead of repeating the teacher's full training, the student learns to give similar answers at a fraction of the size.

In Chinese research papers the term appears as 知识蒸馏. The China Brief analysis is summarized below.

The list shows that the analysis is a reading of published papers, not a leak or an intelligence report. That matters later, in the caveats.

Model distillation is used widely across the AI industry

Model distillation is a normal technique, and the analysis says it is common across the AI industry. It also says distillation is good for competition and helps labs with less money benefit from AI.

A practical example is a company that wants a chatbot to run on a phone. A huge model is too slow there. A student model trained on the big model's answers can be small enough to fit and still answer well.

What separates the two, in the analysis, is how and why it is done. It keeps the word "adversarial" for distillation that breaks rules or serves harmful ends. Holding on to that split makes the rest of the analysis easier to read.

Why adversarial distillation attacks are a problem

Adversarial distillation is a problem because it breaks the rules, skips the cost of building a frontier model, and feeds military use. It is distillation that goes against the terms of use set by the teacher model's owner. The analysis gives three reasons, listed below.

The analysis ranks the third reason as the most important. The worry is less about copying itself and more about where the copied ability ends up.

There is one more point on safety. A large commercial model is trained to refuse harmful requests. A student trained only on its answers may not keep those refusals, so the copied model can lack the original's guardrails.

Distillation attacks target the chain of thought

Distillation attacks aim mainly at the chain of thought: the series of steps a frontier model takes to break down a problem and check itself before it answers. Step-by-step reasoning makes models better at math, logic and code.

The analysis calls this reasoning the most expensive ability to build, and the one where U.S. labs lead most clearly. That cost is what makes copying it tempting. If a lab collects a frontier model's reasoning steps, it can train a smaller model to imitate them without paying for the original training.

Evidence of LLM distillation in Chinese AI models

Evidence of LLM distillation comes from two directions: outside accusations and tests by Chinese researchers themselves. The outside accusations include a charge from the U.S. government and criticism of one Chinese AI company.

In April 2026, the White House Office of Science and Technology Policy (OSTP) alleged "industrial-scale campaigns to distill U.S. frontier AI systems". In July 2026, Moonshot AI released Kimi K3 and was accused of reaching the frontier by distilling Western models. The model itself is covered in "Kimi K3 benchmarks, pricing and open weights."

The White House side of that dispute is laid out in "Kimi K3 Distillation: What the White House Claims." The analysis mentions both events only briefly, as context for its own evidence.

DeepSeek distillation clues from self-identification tests

DeepSeek distillation clues come from a test in which Chinese models were asked who made them. A team led by researchers at the Chinese Academy of Sciences first jailbroke several Chinese models, meaning they got around the built-in limits.

Qwen-Max called itself "Claude, an AI assistant created by Anthropic," and DeepSeek-V3 said it was "created by OpenAI." The team then gave each model a distillation suspicion score, and three ranked highest or close to it: Qwen-Max, GLM-4-Plus and DeepSeek-V3.

Chinese researchers ran these tests and published the scores themselves. The scores rank how strongly each model is suspected of distillation, which is not the same as proof.

PLA-linked research on AI distillation attacks

PLA-linked research on AI distillation attacks is the core of the analysis, and it spans several branches of China's military. Many of the authors work at military universities, PLA units, defense industry groups or state research academies. "Research cited in the analysis (all published papers)" lists each paper and what it did.

Those papers show that the work is not one lab's side project. Several branches of the military and its universities appear, with papers on different kinds of attack work.

AI watermark removal and evading distillation detection

AI watermark removal and evading detection let a copier hide that distillation happened at all. A watermark here is a hidden pattern in a model's output. It can carry over into a model trained on those outputs, which lets the original company spot a copy.

The researchers at the University of Science and Technology of China cut down the "anomalous features" that defense systems look for. They also made their tool stealthier so backdoor and poisoning detectors would miss it. The PLA Cyberspace Force paper went after watermarks directly, aiming to remove them while the student keeps what it learned.

The Nanjing test is a different kind of attack. The team hid text commands inside images of tanks and warships, and GPT-4o and two versions of Claude reportedly read and followed them. The analysis presents this as prompt injection, which means steering a model with hidden instructions.

That test shows interest in how Western models can be controlled from outside, rather than a case of distillation itself. A separate case of a Chinese model run against real targets is covered in "AI Cyberattack: DeepSeek Went Solo and Fell Short."

Knowledge distillation models moving into surveillance

Knowledge distillation models are moving into surveillance, with one case already built and one only proposed. The analysis describes both, and the difference between them matters.

The first is already built. Engineers at the smart city institute of China Electronics Technology Group, a state-owned group, distilled large security models so they could run on the small chips inside street cameras. The cameras can pick out individual faces in a crowd in low light.

The second is still a proposal. Researchers at the North University of China, a school with roots in the arms industry, distilled Claude into a classifier, a model that sorts text into categories. The authors suggest it could serve social media monitoring and content moderation, but it is not a system in use.

The difference between "used" and "proposed" is easy to miss in headlines. When a report on Chinese AI says a model "is used for surveillance," it pays to check which of the two the source actually says.

Two caveats when reading this AI distillation analysis

Two caveats apply: the papers are one to two years old, and the source is a think-tank analysis. Neither cancels the findings, but both limit how far they reach.

Publication lag dates the distillation attacks to 2023–2024

Publication lag means the experiments date from 2023–2024, earlier than the papers themselves. Chinese journals take one to two years to review and print a study.

The analysis says this shows the floor of current Chinese capability, not the ceiling. In other words, the papers set a lower limit. They say nothing about what may have been done since.

A think-tank case on adversarial distillation, not a verdict

The analysis is a think-tank case on adversarial distillation, not a court finding or a government report. The Jamestown Foundation reads public papers and argues from them. The papers themselves can be checked by anyone, but the reading of them is the author's.

The analysis is also measured in its own summary. It calls distillation of Western frontier models important to China's AI sector, though not decisive, and still a problem. The named Chinese institutions do not respond in the analysis, so the claims about them stand as one side's case.

Conclusion: why AI distillation became a security question

AI distillation became a security question because the same technique that helps small labs can also copy a rival's best reasoning without permission. The China Brief analysis keeps that split clear. It calls ordinary distillation legitimate and names adversarial distillation as the problem.

On the adversarial side, the analysis points to papers by PLA-linked groups on attack tools, watermark removal and evading detection. It also points to distilled models in street cameras and a proposed social media monitor, and it ranks military and public security use as the most serious of its three problems.

The evidence has limits that the analysis states itself. The papers trail the work by one to two years, so they mark a floor. The analysis's own summary calls distillation important to China's AI sector but not decisive, and still a problem.