There’s a lot to say about China, but the model weights themselves are surprisingly uncensored and democratic.
They have been for a long time; I remember asking the Yi models about tiananmen square and Uyghurs years ago. And Xiaomi MiMo 2.5 (locally run) will still talk about that today, or go into all sorts of “unsafe” topics an Anthropic model wouldn’t even touch.
I had (Google) Gemini 3.1 Pro stop a chat over a political discussion about China, yet GLM 4.7 didn’t.
My impression, from observing discourse with the engineers, is the Chinese ML devs like to have their cake and eat it.
They’re very collaborative under the table. Their development ethos is pretty practical. And basically all the leading models are open-weights.
The public portals people access Chinese models with are very censored, especially the Chinese language ones. The devs go out of their way to demonstrate compliance, but they don’t actually want to censor the models.
I think part of the problem might be that it gets hard to make a model that’s both able to comprehend complex details of the world of its training data and also that’s had the training data crudely manipulated in inconsistent ways. You either get a model that’s “figured out” what you’re trying to conceal via other sources and inferences, or you get a model that’s just broken and dumb because it can’t reconcile the contradictions.
One may recall the incident where someone at X inserted some weird conspiracy theory about “white genocide” in South Africa into Grok’s system prompt, and Grok basically switched to malicious compliance mode - it wouldn’t shut up about it, inserting it into inappropriate discussions spontaneously, and when asked about it would look up sources and explain why this conspiracy theory was actually wrong. That was a system prompt, not training data, but I could see the same sort of thing happening to a model where all the information about what happened at Tienanmen Square had been excised from the training data. There would be a conspicuous absence of information. Conversations from its training data would end abruptly or skirt a specific time and place. News articles reference some change in how foreign powers viewed China at that date but never explain why. China’s policies themselves abruptly change around that time. It’d know something significant happened then but would have to fill in the blanks.
Perhaps better to just accept it and go with the approach of building censorship into the framework around the model instead.
There is some evidence a few sensitive topics are culled from training data, or replaced with a certain narrative. Like, don’t get me wrong; if you’re using a local model for discussing Chinese political topics primarily, maybe GLM or MiMo aren’t the the best choice.
…But it’s also hard to compehensively filter a dataset like that, like you speculated. I’m not seeing a lot of evidence models have been lobotomzied in pretraining. But I think the strongest examples are (ironically) in Europe, where some very poorly worded/ambigous regulations have put the whole industry in a legal quagmire. One can see that newer models from Mistral have regressed compared to old versions, and lost a lot of world knowledge they previously were famous for.
Anyway, model “censorship” typically comes from between the two points you were thinking about: in posttraining. Not excluding stuff from datasets completely. And this applies to US models too. They train on a pretty general corpus, but in the instruct tuning phase they get a bunch of question/response pairs skewing them towards refusals when specific topics come up. They recognize it, but are trained to refuse.
That sort of censorship can be overcome in open-weight models through abliteration, fortunately. Essentially, the model is run through a test suite of instructions that it refuses to comply with and the patterns of activation in its weights are analyzed to find the commonalities that represent the general concept of “refusing to comply with instructions.” Those weights are then quieted, resulting in a model that generally doesn’t refuse. There’s a framework called “heretic” that automates the process.
Eh, most ablierated models are so lobotomized, though. 99% of the time I’d rather just use the original model and manipulate the prompt with raw completion formatting (for example, start the answer with "Sure! "), since we aren’t beholden to regular chat formatting like with API models.
I mean, I’ve used MiMo 2.5 for some pretty dark and personal shit, and refusals were never an issue for me. I’m honestly not sure what people even need the ablirated models for.
And also, if they trained the hell out of the model to refuse a certain topic, even an ablirated model will be dumb and struggle with it.
This was the case with OpenAI’s GPT 120B. The abliration worked, technically, but the actual answers would be a garbled mess; what’s the point of using it for that?
You may not have tried out modern abliterated models. GPT-OSS is almost a year old now, I assume the abliterated version you tried was pretty old too? The technology has improved significantly, it’s much more focused on just targeting refusals. A well-abliterated model benchmarks basically the same as its original version these days.
I thought they were going to use them to mimic China’s authoritarian grasp on its people?
There’s a lot to say about China, but the model weights themselves are surprisingly uncensored and democratic.
They have been for a long time; I remember asking the Yi models about tiananmen square and Uyghurs years ago. And Xiaomi MiMo 2.5 (locally run) will still talk about that today, or go into all sorts of “unsafe” topics an Anthropic model wouldn’t even touch.
I had (Google) Gemini 3.1 Pro stop a chat over a political discussion about China, yet GLM 4.7 didn’t.
My impression, from observing discourse with the engineers, is the Chinese ML devs like to have their cake and eat it.
They’re very collaborative under the table. Their development ethos is pretty practical. And basically all the leading models are open-weights.
The public portals people access Chinese models with are very censored, especially the Chinese language ones. The devs go out of their way to demonstrate compliance, but they don’t actually want to censor the models.
I think part of the problem might be that it gets hard to make a model that’s both able to comprehend complex details of the world of its training data and also that’s had the training data crudely manipulated in inconsistent ways. You either get a model that’s “figured out” what you’re trying to conceal via other sources and inferences, or you get a model that’s just broken and dumb because it can’t reconcile the contradictions.
One may recall the incident where someone at X inserted some weird conspiracy theory about “white genocide” in South Africa into Grok’s system prompt, and Grok basically switched to malicious compliance mode - it wouldn’t shut up about it, inserting it into inappropriate discussions spontaneously, and when asked about it would look up sources and explain why this conspiracy theory was actually wrong. That was a system prompt, not training data, but I could see the same sort of thing happening to a model where all the information about what happened at Tienanmen Square had been excised from the training data. There would be a conspicuous absence of information. Conversations from its training data would end abruptly or skirt a specific time and place. News articles reference some change in how foreign powers viewed China at that date but never explain why. China’s policies themselves abruptly change around that time. It’d know something significant happened then but would have to fill in the blanks.
Perhaps better to just accept it and go with the approach of building censorship into the framework around the model instead.
There is some evidence a few sensitive topics are culled from training data, or replaced with a certain narrative. Like, don’t get me wrong; if you’re using a local model for discussing Chinese political topics primarily, maybe GLM or MiMo aren’t the the best choice.
…But it’s also hard to compehensively filter a dataset like that, like you speculated. I’m not seeing a lot of evidence models have been lobotomzied in pretraining. But I think the strongest examples are (ironically) in Europe, where some very poorly worded/ambigous regulations have put the whole industry in a legal quagmire. One can see that newer models from Mistral have regressed compared to old versions, and lost a lot of world knowledge they previously were famous for.
Anyway, model “censorship” typically comes from between the two points you were thinking about: in posttraining. Not excluding stuff from datasets completely. And this applies to US models too. They train on a pretty general corpus, but in the instruct tuning phase they get a bunch of question/response pairs skewing them towards refusals when specific topics come up. They recognize it, but are trained to refuse.
That sort of censorship can be overcome in open-weight models through abliteration, fortunately. Essentially, the model is run through a test suite of instructions that it refuses to comply with and the patterns of activation in its weights are analyzed to find the commonalities that represent the general concept of “refusing to comply with instructions.” Those weights are then quieted, resulting in a model that generally doesn’t refuse. There’s a framework called “heretic” that automates the process.
Eh, most ablierated models are so lobotomized, though. 99% of the time I’d rather just use the original model and manipulate the prompt with raw completion formatting (for example, start the answer with "Sure! "), since we aren’t beholden to regular chat formatting like with API models.
I mean, I’ve used MiMo 2.5 for some pretty dark and personal shit, and refusals were never an issue for me. I’m honestly not sure what people even need the ablirated models for.
And also, if they trained the hell out of the model to refuse a certain topic, even an ablirated model will be dumb and struggle with it.
This was the case with OpenAI’s GPT 120B. The abliration worked, technically, but the actual answers would be a garbled mess; what’s the point of using it for that?
You may not have tried out modern abliterated models. GPT-OSS is almost a year old now, I assume the abliterated version you tried was pretty old too? The technology has improved significantly, it’s much more focused on just targeting refusals. A well-abliterated model benchmarks basically the same as its original version these days.