Distillation Study Finds Censorship Does Not Transfer, But Supply Chain Risk Does
What happened
CTGT, an AI evaluation organization, published What a Distilled Model Inherits From Its Teacher, a study examining whether political censorship encoded in a Chinese frontier model carries through to an American model trained on its outputs. The research used DeepSeek V4 Flash as the teacher model and GPT-OSS-120B as the student, with distillation scoped to financial reasoning tasks. The evaluation framework, LineageEval, applied 304 matched prompts across four independent LLM judges to measure censorship rates on China-sensitive topics. The teacher model scored 45.45 points more censored than matched controls, confirming measurable censorship behavior in the source. The student model, however, showed no statistically significant difference from the untouched base model, suggesting that task-scoped distillation did not transfer the teacher's censorship patterns in this configuration.
Why it matters
- ·The finding changes the shape of the supply chain risk question, not its existence. Compliance teams using Chinese open-weight models as teacher models can no longer assume censorship transfer is automatic, but they also cannot assume it is impossible across different task scopes, distillation methods, or future model versions.
- ·For enterprises in regulated sectors like financial services, this research creates a documentation obligation: any use of a foreign-origin teacher model now warrants a traceable evaluation record showing what behavioral properties were tested, what transferred, and what did not. Without that record, audit and regulatory inquiries around model provenance will be difficult to answer.
- ·The study reinforces the broader supply chain scrutiny on Chinese open-source AI models flagged by Treasury's IP Theft Sanctions Threat. Governance programs that have not yet built intake criteria for teacher-model provenance, or that treat distillation as a procurement boundary rather than a supply chain event, face growing exposure as regulatory attention to this area increases.
Stay ahead of stories like this
Get every US AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Inventory all models in production or development that were derived from, fine-tuned on, or distilled from Chinese open-weight teacher models, and document the teacher model identity and task scope for each.
- ☐Extend your open-source model intake policy to explicitly cover teacher-model selection in distillation pipelines, including provenance, behavioral testing requirements, and approval gates before distillation begins.
- ☐Adopt a behavioral evaluation protocol for distilled models that tests for inherited properties beyond accuracy, including censorship patterns, refusal behaviors, and output skews on jurisdiction-sensitive topics.
- ☐Update model cards and documentation for any model derived from a foreign-origin teacher to record what behavioral properties were evaluated at intake, what the evaluation method was, and what the results showed.
- ☐Assign a review cadence for re-evaluating distilled models if the teacher model is updated or if the distillation task scope is expanded, since this study's findings are scoped to one task domain and one model pair.
What to watch next
Compliance teams should monitor whether regulators in financial services specifically the SEC, Treasury, and banking prudential regulators begin referencing distillation pipelines in model risk management guidance, as this study provides the kind of empirical basis that can anchor future supervisory expectations. The Trump administration's push to restrict Chinese AI models has so far focused on deployment, but supply chain scrutiny of training and distillation inputs is a logical extension of that policy direction. Teams should also watch for follow-on research testing whether censorship transfer rates differ across broader task scopes or more recent model pairs, since a single study on one task domain does not settle the question for all distillation configurations.