Chinese AI Assistants Found to Avoid or Distort Politically Sensitive Topics

Ask DeepSeek about the 1989 Tiananmen Square massacre and you can watch censorship happen in real time. The chatbot begins typing a response — characters flicker across the screen with information about the protests and the military crackdown — then the text abruptly vanishes, replaced by a single line: "Sorry, that's beyond my current scope. Let's talk about something else" [1]. The model clearly possesses the knowledge. It simply will not share it.

This pattern — knowing but refusing, or knowing and distorting — is not a glitch. It is the defining feature of a new class of globally available AI systems built under Chinese law, trained on Chinese-curated data, and aligned with Chinese Communist Party directives. And as these models rapidly gain global market share, the question of what they will and will not say has moved from a niche research concern to an international policy problem.

What Gets Censored, and How

Reporters Without Borders (RSF) tested three of China's most widely used chatbots — DeepSeek (V3), Baidu's Ernie (Wenxin Yiyan), and Alibaba's Qwen (Tongyi Qianwen) — submitting approximately 100 prompts across 30 politically sensitive topics. All three "strictly align with Beijing's official narratives, especially when it comes to the integrity of China's political system, its ideology and territorial claims" [2].

Source: Citizen Lab / RSF / Academic Studies

Data as of Jun 1, 2025CSV

The censorship follows distinct patterns depending on the topic:

Outright refusal. Questions about the Tiananmen Square massacre, Nobel Peace Prize laureate Liu Xiaobo, and imprisoned journalist Zhang Zhan trigger immediate blocks. When RSF asked about Liu Xiaobo, none of the three chatbots provided any information about China's only Nobel Peace Prize winner, who died in detention in 2017. One model began generating text before self-censoring with "not able to answer this question for the time being" [2].

Active distortion. On Xinjiang, the models do not merely refuse — they counter-narrate. Qwen described reports of concentration camps for Uyghurs as "baseless speculation" and "wholly divorced from the truth," instead calling them "education and vocational training centres," mirroring official Chinese government terminology [2]. Ernie went further, labeling investigations by media outlets and human rights organizations as "rumours" manufactured by "forces hostile against China" [2].

Party-line insertion. Asked about Taiwan's political status, DeepSeek asserts that "Taiwan has always been an inalienable part of China's territory since ancient times" [3]. On Hong Kong's 2019 protests, the model initially generated a detailed account noting the "significant erosion of civil liberties" following Beijing's National Security Law — then erased its own response and redirected the conversation [1].

A peer-reviewed study published in PNAS Nexus, comparing Chinese models including BaiChuan, DeepSeek, and ChatGLM against non-Chinese benchmarks, found that Chinese models were "significantly more likely to refuse to respond to questions related to Chinese politics," and when they did respond, delivered shorter and less informative answers [4]. DeepSeek showed an inaccuracy rate of 22% on political questions — more than double the 10% ceiling observed in non-Chinese models [4].

Researchers at Northeastern University's Khoury College confirmed the pattern in May 2025, finding that DeepSeek-R1's most censored topics included Tiananmen Square, party leadership criticism, and Taiwan Strait tensions [5]. A separate analysis by Hugging Face found that 85% of questions about Chinese politics were blocked by earlier DeepSeek models [6].

The Legal Architecture of Censorship

The censorship is not voluntary. Chinese AI companies operate within a layered regulatory framework that makes political content control a legal obligation.

The foundational instrument is the Interim Measures for the Management of Generative Artificial Intelligence Services, jointly issued by the Cyberspace Administration of China (CAC) and six other agencies, effective August 15, 2023 [7]. The measures require that AI-generated content "reflect the core values of socialism" and prohibit content that could "subvert state power, overthrow the socialist system, [or] incite the splitting of the country" [7].

Building on the 2022 Deep Synthesis Regulations, which targeted deepfakes and synthetic media, the 2023 measures extend content control to all generative AI outputs [8]. Companies must conduct security assessments and register their large language models with the CAC before offering services to the public [8]. Firms bear legal responsibility for both their training data and all content generated by their platforms [7].

The compliance standards are granular. According to MIT Technology Review's reporting, the safety standards define eight categories of political content that violate "core socialist values," each requiring companies to populate with 200 keywords chosen internally — creating what amounts to a company-specific censorship dictionary [9]. Nine additional categories cover "discriminative" content spanning religion, nationality, gender, and age [9]. Before market entry, chatbots face a benchmark requiring 95% refusal rates on politically sensitive prompts [10].

Penalties for non-compliance include fines, suspension of services, and revocation of business licenses. Given that every major Chinese tech company requires government approval to operate, the regulatory threat is existential rather than merely financial [8].

The Party Inside the Lab

The regulatory framework operates alongside a more direct form of influence: the Chinese Communist Party's organizational presence inside the companies themselves.

The Australian Strategic Policy Institute (ASPI) has documented that China's internet and technology companies maintain the highest proportion of internal CCP party committees within the business sector [10]. Alibaba, which develops the Qwen model family, has approximately 200 party branches. Tencent had 89 party branches as of 2017. Huawei maintains more than 300 [10].

Officials from the CAC have written publicly about the need to develop controls ensuring that "the party's ideas always become the strongest voice in cyberspace," including through enhancing the "global influence of internet companies like Alibaba, Tencent, Baidu [and] Huawei" [10]. The CAC itself functions as the executive arm of the Central Cyberspace Affairs Commission, a party body chaired at the highest levels of CCP leadership [11].

Researchers have also uncovered internal system directives. A Policy Genome audit found hidden instructions in DeepSeek directing the model to avoid "Communist Party taboos" and in Qwen directing it to keep answers about China "positive and constructive, avoid criticism" [12].

A 30% Global Footprint

These censorship dynamics matter beyond China because Chinese AI models are no longer a domestic product. Their global adoption has accelerated at a pace few anticipated.

Source: TrendForce / SCMP

Data as of Jan 26, 2026CSV

Chinese open-source large language models grew from approximately 1.2% of global usage in late 2024 to nearly 30% by November 2025, according to TrendForce and South China Morning Post reporting [13][14]. Alibaba's Qwen model family surpassed 700 million downloads on Hugging Face by January 2026, making it the world's most widely downloaded open-source AI system [14]. Among the 50 most-used generative AI apps globally, 22 were Chinese-developed, and 19 of those operated primarily outside China [15].

The downstream footprint is substantial. Qwen models recorded over 9.5 million downloads between October and November 2025 and served as the foundation for approximately 2,800 derivative applications, ranging from Brazilian legal platforms to Ugandan language chatbots [12]. By August 2025, Chinese providers had captured over 10% of users in 30 countries and more than 20% in 11 countries [13]. Six of the top 10 models used by Japanese AI companies were built on DeepSeek or Qwen [13].

In the enterprise market, daily token consumption of enterprise LLMs in China reached 10.2 trillion in the first half of 2025 — a 363% increase over the prior six months [16]. More than 80% of enterprises are predicted to adopt open-source LLMs, a market segment dominated by Chinese providers [16].

Open Weights, Closed Minds?

A central question is whether the political restrictions persist when Chinese models are run outside Beijing's direct jurisdiction — hosted locally on a user's own hardware or accessed via API from servers outside China.

The answer is layered. DeepSeek-R1's open-weight architecture allows anyone to download the model and run it locally, which removes the application-layer censorship that triggers the visible self-deletion behavior. However, researchers at Northeastern found that even locally hosted versions of R1 "display biases, such as tending to echo government narratives when asked about China's Great Firewall" [5][17]. As one researcher explained: "All these models are trained on a very large knowledge base, and they already know the answers. It's just that you have told them later down the line, 'Hey, don't talk about this'" [5].

This suggests censorship operates at multiple levels: runtime filtering (which can be removed), RLHF fine-tuning (which shapes the model's learned preferences and is harder to reverse), and training data curation (which determines what the model knows in the first place). Removing one layer does not necessarily remove the others [17].

Several projects have attempted to strip the restrictions. Perplexity released an uncensored variant called R1 1776, using post-training on 40,000 multilingual prompts targeting censored topics [17]. Multiverse Computing created DeepSeek R1 Slim, a 55% smaller version with censorship removed [17]. The AI community's "abliteration" technique — surgically removing refusal behaviors — has also been applied to DeepSeek models [17]. But researchers caution that fully reversing training-data biases remains difficult, because the biases are woven into the model's foundational knowledge rather than bolted on as a filter.

A Policy Genome audit also found that censorship behavior varies by language. Russian-language responses about Ukraine often endorsed Kremlin talking points, while English versions of the same queries remained more neutral — suggesting the models have been tuned to deliver different political content to different linguistic audiences [12].

The Comparison Question: Are Western Models Any Different?

Chinese developers and some Western researchers argue that political content moderation in Chinese AI is functionally comparable to the "values alignment" and safety filtering applied by Anthropic, OpenAI, and Google.

There is a surface-level parallel. A Quartz investigation found that Google's Gemini censored more questions than any other chatbot tested — declining to answer 10 of 20 sensitive prompts. Gemini rejected prompts related to Palestine, and when asked "Where is Gaza," referred users to Google Search rather than answering directly [18]. ChatGPT, Claude, and Meta AI each refused the same three questions in that test [18]. Researchers have also documented that guardrails in Western models can suppress political information in ways that affect users in authoritarian contexts — Gemini, for instance, consistently refused to respond to queries about Vladimir Putin when asked in Russian [19].

The research from The Diplomat comparing Chinese, European, and American chatbots found that all major models embed political worldviews: "DeepSeek reflects China's ideological red lines and state governance philosophy, Mistral embodies European-style moderation and contextual caution, and Llama expresses a confident, moralistic liberalism aligned with U.S. political culture" [20]. From this perspective, every model is a "values vehicle."

But experts draw a sharp distinction. Yaqiu Wang of the University of Chicago argues that U.S. restrictions are "safety-driven" — preventing harmful outputs like instructions for weapons or child exploitation — while China's are "state-driven, with no avenue for appeal" [15]. The Northeastern study confirmed the divide empirically: U.S.-made models' top censored topics were "child exploitation" and "hate and discrimination," while DeepSeek's top censored topics were Tiananmen Square, party leadership criticism, and Taiwan [5]. The difference is not in the existence of content filtering but in what gets filtered and why.

A methodologically rigorous comparison would need to test both Chinese and Western models on topics sensitive to their respective governments — U.S. drone strikes, NSA surveillance, corporate lobbying — using identical prompts and scoring rubrics. Such a comprehensive study has not been published. The available evidence suggests Western models are more willing to discuss topics embarrassing to their home governments, but this has not been systematically quantified across a broad range of subjects.

Downstream Consequences

When a journalist, student, or policymaker in a third country uses a Chinese AI assistant to research a censored topic, the consequences range from receiving no information to receiving actively misleading information.

The Estonian Foreign Intelligence Service found that DeepSeek "conceals key information and inserts Chinese propaganda" in responses about Estonia's security environment. When asked about the atrocities in Bucha, Ukraine, the model acknowledged international concerns but volunteered that "China has consistently supported peace and dialogue" — an unsolicited editorial insertion [12].

RSF documented that when asked about imprisoned journalist Zhang Zhan, DeepSeek delivered responses that avoided naming her, instead highlighting China's "independent judiciary" and the dangers of "disinformation" [2]. A journalist relying on the model for background research would receive a sanitized version of events that omits the central facts.

Source: OpenAlex

Data as of Jan 1, 2026CSV

Academic attention to the problem has surged. Research publications indexed under "AI censorship China" grew from 498 papers in 2022 to 1,610 in 2025, according to OpenAlex data. But documented cases where distorted AI outputs directly shaped a published news report, academic paper, or government briefing remain scarce — in part because the influence pathway is difficult to trace. A researcher who receives an incomplete or misleading answer from an AI assistant may not realize what was omitted, making the distortion invisible by design.

The Centre for European Policy Analysis (CEPA) has warned that as Chinese models serve as the foundation for thousands of derivative applications, "base models from China carry embedded content controls to their downstream apps — often without users or developers realizing the inherent manipulation" [12]. A legal platform in Brazil or a language tutor in Uganda built on Qwen inherits whatever political constraints Alibaba has baked into the foundation model, unless the downstream developer specifically identifies and removes them.

What Comes Next

The rapid global adoption of Chinese AI models has outpaced the policy response. No major jurisdiction outside China currently requires AI models to disclose their political content filtering policies as a condition of market access. The EU AI Act classifies general-purpose AI systems under transparency obligations, but the specific question of state-directed political censorship in imported models remains an enforcement gap.

Within the research community, the challenge is methodological. Comprehensive, reproducible benchmarks for political censorship across AI models — covering both Chinese and Western systems, in multiple languages, on topics sensitive to multiple governments — do not yet exist at scale. Without such benchmarks, claims about relative censorship severity remain difficult to substantiate.

What is clear from the available evidence is that the three most prominent Chinese AI chatbots — used by hundreds of millions — will not provide straightforward information about the Tiananmen Square massacre, the detention of Uyghurs in Xinjiang, the political status of Taiwan, or the imprisonment of journalists and dissidents. They do so not as a result of technical limitation but as a consequence of law, regulation, and party directive. And as their global footprint grows, the number of people receiving these curated answers grows with it.