The documented chain begins at a proprietary model interface and ends at hardware that a military organization can control: U.S. model outputs become synthetic examples, those examples train smaller domestic systems, and the resulting models are prepared for private networks or constrained processors. A review of more than 80 Chinese papers and patents found this pattern across military-linked research, while a separate compilation covered more than 60 papers before additional cases were identified [E1][E3]. The corpus establishes sustained institutional interest, named units and concrete technical pathways rather than a single isolated experiment [E1][E3]. It still remains documentary evidence of research and engineering; no public evidence shows battlefield deployment or weight transfer, and no reviewed case demonstrates that U.S. model weights crossed a border [E1][E2].
PLA Unit 96941 provides the clearest internal-network example. A paper published in 2025 described using GPT-3.5 to summarize sensitive military source code, then training a domestic model on those summaries so the resulting system could operate entirely inside Chinese military networks [E1]. The interface carried generated text and code explanations into a training pipeline, while the domestic model supplied local inference, custody and network isolation; the teacher model's parameters were never reported as part of the transfer [E1][E2]. The public record omits the number of code samples, student architecture, parameter count, evaluation set, accuracy, hallucination rate, inference hardware, memory footprint, latency and security validation, leaving the practical gain unquantified [E1].
The National University of Defense Technology traced the same method into an airborne constraint box. A 2024 paper described compressing an image-processing model for unmanned aerial vehicles so onboard systems could analyze live video and support navigation and targeting decisions when communications were cut [E1]. That design joins a sensor stream, local memory, a compact model and an onboard processor, reducing dependence on a remote link during the inference loop [E1][E2]. Public descriptions do not identify the aircraft, processor, accelerator, RAM, power budget, model size, frame rate, precision loss, environmental tests, adversarial robustness or autonomous engagement authority, so the paper supports an edge-computing research claim rather than a fielded combat capability [E1].
An Academy of Military Sciences study moved target recognition onto tactical hardware during simulated maritime operations involving drones, ships and unmanned submarines [E1]. The simulation matters because it places model output inside a multi-platform operational loop, where detection results would have to survive sensor variation, bandwidth limits, timing constraints and coordination across heterogeneous vehicles [E1]. Yet simulation remains a controlled evidence tier: the available account does not disclose sea-state conditions, target classes, false-positive rates, range, hardware specifications, operator workload, network topology or performance against deception [E1]. Nothing public establishes deployment aboard operational fleets, use in combat, autonomous target selection or weapons release [E1].
Distillation transfers selected behavior through examples generated by a teacher model. The student does not inherit the teacher's weights, architecture or full capability set, and reasoning traces can provide richer training material than final answers alone [E2]. A smaller system may become cheaper to run and easier to place on private networks, vehicles or devices, although it still requires curated data, student-model training, evaluation, software integration and suitable edge silicon [E2]. Claims that industrial-scale distillation can bring the Chinese frontier within months of the U.S. frontier are broader than these military papers demonstrate, which contain no measurements of national frontier-gap compression [E1][E4].
The strategic dispute therefore spans two different control surfaces. Advanced-chip restrictions constrain the compute used to train and serve large models, while proprietary interfaces expose outputs that can be harvested as synthetic material without exposing parameters [E2][E4]. Closed-model providers describe unauthorized, industrial-scale extraction as the problem, while distillation itself remains a standard technique used across the industry; open-weight releases create a different condition because their parameters can be downloaded, modified and run privately [E2][E4]. Smaller domestic models can reduce inference cost at the tactical edge, but they do not establish independence from frontier compute, domestic training clusters, advanced packaging, memory bandwidth or the external teacher systems that produced the original examples [E1][E2][E4].
The strongest reading is a hardware-integration warning rather than proof of an operational weapon [E1]. The research shows military-linked institutions experimenting with a repeatable pipeline from API output to synthetic dataset, student model, controlled network and tactical processor across code analysis, airborne vision and maritime target recognition [E1][E3]. Capability estimates remain bounded by missing measurements: dataset scale, teacher-query volume, student size, benchmark design, error rates, chip type, power draw, thermal limits, communications behavior, field-test repetition and human command authority are all undisclosed [E1]. The sharp implication is that selected military utility can move through the model interface as text, code and labeled examples long before a frontier model, advanced accelerator or weapon system is visibly transferred [E1][E2].