Distillation Study Finds Censorship Does Not Transfer, But Supply Chain Risk Does

What happened

Why it matters

• ·The finding changes the shape of the supply chain risk question, not its existence. Compliance teams using Chinese open-weight models as teacher models can no longer assume censorship transfer is automatic, but they also cannot assume it is impossible across different task scopes, distillation methods, or future model versions.
• ·For enterprises in regulated sectors like financial services, this research creates a documentation obligation: any use of a foreign-origin teacher model now warrants a traceable evaluation record showing what behavioral properties were tested, what transferred, and what did not. Without that record, audit and regulatory inquiries around model provenance will be difficult to answer.
• ·The study reinforces the broader supply chain scrutiny on Chinese open-source AI models flagged by Treasury's IP Theft Sanctions Threat. Governance programs that have not yet built intake criteria for teacher-model provenance, or that treat distillation as a procurement boundary rather than a supply chain event, face growing exposure as regulatory attention to this area increases.

Governance controls affected

What to do now

• ☐Inventory all models in production or development that were derived from, fine-tuned on, or distilled from Chinese open-weight teacher models, and document the teacher model identity and task scope for each.
• ☐Extend your open-source model intake policy to explicitly cover teacher-model selection in distillation pipelines, including provenance, behavioral testing requirements, and approval gates before distillation begins.
• ☐Adopt a behavioral evaluation protocol for distilled models that tests for inherited properties beyond accuracy, including censorship patterns, refusal behaviors, and output skews on jurisdiction-sensitive topics.
• ☐Update model cards and documentation for any model derived from a foreign-origin teacher to record what behavioral properties were evaluated at intake, what the evaluation method was, and what the results showed.
• ☐Assign a review cadence for re-evaluating distilled models if the teacher model is updated or if the distillation task scope is expanded, since this study's findings are scoped to one task domain and one model pair.

What to watch next

Compliance teams should monitor whether regulators in financial services specifically the SEC, Treasury, and banking prudential regulators begin referencing distillation pipelines in model risk management guidance, as this study provides the kind of empirical basis that can anchor future supervisory expectations. The Trump administration's push to restrict Chinese AI models has so far focused on deployment, but supply chain scrutiny of training and distillation inputs is a logical extension of that policy direction. Teams should also watch for follow-on research testing whether censorship transfer rates differ across broader task scopes or more recent model pairs, since a single study on one task domain does not settle the question for all distillation configurations.