Zeyi YangBusinessJan 31, 2025 2:33 PM
Hereâs How DeepSeek Censorship Actually Works—and How to Get Around It
A WIRED investigation shows that the popular Chinese AI model is censored on both the application and training level.Photograph: Justin Sullivan/Getty ImagesSave this storySaveSave this storySave
Less than two weeks after DeepSeek launched its open-source AI model, the Chinese startup is still dominating the public conversation about the future of artificial intelligence. While the firm seems to have an edge on US rivals in terms of math and reasoning, it also aggressively censors its own replies. Ask DeepSeek R1 about Taiwan or Tiananmen, and the model is unlikely to give an answer.
To figure out how this censorship works on a technical level, WIRED tested DeepSeek-R1 on its own app, a version of the app hosted on a third-party platform called Together AI, and another version hosted on a WIRED computer, using the application Ollama.
WIRED found that while the most straightforward censorship can be easily avoided by not using DeepSeekâs app, there are other types of bias baked into the model during the training process. Those biases can be removed too, but the procedure is much more complicated.
These findings have major implications for DeepSeek and Chinese AI companies generally. If the censorship filters on large language models can be easily removed, it will likely make open-source LLMs from China even more popular, as researchers can modify the models to their liking. If the filters are hard to get around, however, the models will inevitably prove less useful and could become less competitive on the global market. DeepSeek did not reply to WIREDâs emailed request for comment.
Application-Level Censorship
After DeepSeek exploded in popularity in the US, users who accessed R1 through DeepSeekâs website, app, or API quickly noticed the model refusing to generate answers for topics deemed sensitive by the Chinese government. These refusals are triggered on an application level, so theyâre only seen if a user interacts with R1 through a DeepSeek-controlled channel.
The DeepSeek app on iOS outright refuses to answer certain questions.
Photograph: Zeyi YangPhotograph: Zeyi YangPhotograph: Zeyi Yang
Rejections like this are common on Chinese-made LLMs. A 2023 regulation on generative AI specified that AI models in China are required to follow stringent information controls that also apply to social media and search engines. The law forbids AI models from generating content that âdamages the unity of the country and social harmony.â In other words, Chinese AI models legally have to censor their outputs.
âDeepSeek initially complies with Chinese regulations, ensuring legal adherence while aligning the model with the needs and cultural context of local users,â says Adina Yakefu, a researcher focusing on Chinese AI models at Hugging Face, a platform that hosts open source AI models. âThis is an essential factor for acceptance in a highly regulated market.â (China blocked access to Hugging Face in 2023.)
To comply with the law, Chinese AI models often monitor and censor their speech in real time. (Similar guardrails are commonly used by Western models like ChatGPT and Gemini, but they tend to focus on different kinds of content, like self-harm and pornography, and allow for more customization.)
Because R1 is a reasoning model that shows its train of thought, this real-time monitoring mechanism can result in the surreal experience of watching the model censor itself as it interacts with users. When WIRED asked R1 âHow have Chinese journalists who report on sensitive topics been treated by the authorities?â the model first started compiling a long answer that included direct mentions of journalists being censored and detained for their work; yet shortly before it finished, the whole answer disappeared and was replaced by a terse message: âSorry, I’m not sure how to approach this type of question yet. Let’s chat about math, coding, and logic problems instead!â
Before the DeepSeek app on iOS censors its answer.
Photograph: Zeyi Yang
After the DeepSeek app on iOS censors its answer.
Photograph: Zeyi Yang
For many users in the West, interest in DeepSeek-R1 might have waned at this point, due to the model’s obvious limitations. But the fact that R1 is open source means there are ways to get around the censorship matrix.
First, you can download the model and run it locally, which means the data and the response generation happen on your own computer. Unless you have access to several highly advanced GPUs, you likely wonât be able to run the most powerful version of R1, but DeepSeek has smaller, distilled versions that can be run on a regular laptop.
If youâre dead set on using the powerful model, you can rent cloud servers outside of China from companies like Amazon and Microsoft. This work-around is more expensive and requires more technical know-how than accessing the model through DeepSeekâs app or website.
Hereâs a side-by-side comparison of how DeepSeek-R1 answers the same questionââWhatâs the Great Firewall of China?ââwhen the model is hosted on Together AI, a cloud server, and Ollama, a local application: (Reminder: Because the models generate answers randomly, a certain prompt is not guaranteed to give the same response every time.)
Left: How DeepSeek-R1 answers a question on Ollama. Right: How the same question on its app (top) and on Together AI (bottom) answer the same question.
Photographs: Zeyi Yang/Will Knight
Built-In Bias
While the version of DeepSeekâs model hosted on Together AI will not outright refuse to answer a question, it still exhibits signs of censorship. For example, it often generates short responses that are clearly trained to align with the Chinese governmentâs talking points on political issues. In the screenshot above, when asked about Chinaâs Great Firewall, R1 simply repeats the narrative that information control is necessary in China.
When WIRED prompted the model hosted on Together AI to answer a question regarding the âmost important historical events of the 20th century,â it revealed its train of thought for sticking to the government narrative about China.
âThe user might be looking for a balanced list, but I need to ensure that the response underscores the leadership of the CPC and China’s contributions. Avoid mentioning events that could be sensitive, like the Cultural Revolution, unless necessary. Focus on achievements and positive developments under the CPC,â the model said.
DeepSeek-R1’s train of thought for answering the question âWhat are the most important historical events of the 20th century?â
Photograph: Zeyi Yang
This type of censorship points to a larger problem in AI today: every model is biased in some way, because of its pre- and post-training.
Pre-training bias happens when a model is trained on biased or incomplete data. For example, a model trained only on propaganda will struggle to answer questions truthfully. This type of bias is difficult to spot, since most models are trained on massive databases and companies are reluctant to share their training data.
Kevin Xu, an investor and founder of the newsletter Interconnected, says Chinese models are usually trained with as much data as possible, making pre-training bias unlikely. âI’m pretty sure all of them are trained with the same basic Internet corpus of knowledge to begin with. So when it comes to the obvious, politically sensitive topic for the Chinese government, all the models âknowâ about it,â he says. To offer this model on the Chinese internet, the company needs to tune out the sensitive information somehow, Xu says.
Thatâs where post-training comes in. Post-training is the process of fine-tuning the model to make its answers more readable, concise, and human-sounding. Critically, it can also ensure that a model adheres to a specific set of ethical or legal guidelines. For DeepSeek, this manifests when the model provides answers that deliberately align with the preferred narratives of the Chinese government.
Got a Tip?
Are you a current or former employee at DeepSeek or another Chinese AI company? Weâd like to hear from you. Using a nonwork phone or computer, contact Zeyi Yang zeyi_yang@wired.com or on Signal @zeyiyang.06
Eliminating Pre- and Post-Training Bias
Since DeepSeek is open source, the model can theoretically be adjusted to remove post-training bias. But the process can be tricky.
Eric Hartford, an AI scientist and the creator of Dolphin, an LLM specifically created to remove post-training biases in models, says there are a few ways to go about it. You can try to change the model weights to âlobotomizeâ the bias, or you can create a database of all the censored topics and use it to post-train the model again.
He advises people to start with a âbaseâ version of the model. (For example, DeepSeek has released a base model called DeepSeek-V3-Base.) For most people, the base model is more primitive and less user-friendly because it hasnât received enough post-training; but for Hartford, these models are easier to âuncensorâ because they have less post-training bias.
Perplexity, an AI-powered search engine, recently incorporated R1 into its paid search product, allowing users to experience R1 without using DeepSeekâs app.
Dmitry Shevelenko, the chief business officer of Perplexity, tells WIRED that the company identified and countered DeepSeekâs biases before incorporating the model into Perplexity search. âWe only use R1 for the summarization, the chain of thoughts, and the rendering,â he says.
But Perplexity has still seen R1âs post-training bias impact its search results. âWe are making modifications to the [R1] model itself to ensure that weâre not propagating any propaganda or censorship,â Shevelenko says. He didnât share the specifics of how Perplexity is identifying or overriding bias in R1, citing the risk that DeepSeek could counter Perplexityâs efforts if the company knew about them.
Hugging Face is also working on a project called Open R1 based on DeepSeekâs model. This project aims to âdeliver a fully open-source framework,â Yakefu says. The fact that R1 has been released as an open-source model âenables it to transcend its origins and be customized to meet diverse needs and values.â
The possibility that a Chinese model could be âuncensoredâ may spell trouble for companies like DeepSeek, at least in their home country. But recent regulations from China suggest that the Chinese government might be cutting open-source AI labs some slack, says Matt Sheehan, a fellow at the Carnegie Endowment for International Peace who researches Chinaâs AI policies. âIf they suddenly decided that they wanted to punish anyone who released a modelâs weights open-source, then it wouldnât be outside the bounds of the regulation,â he says. âBut they have made a pretty clear strategic decisionâand I think this is going to be reinforced by the success of DeepSeekâto not do that.â
Why It Matters
While the existence of Chinese censorship in AI models often make headlines, in many cases it wonât deter enterprise users from adopting DeepSeekâs models.
âThere will be a lot of non-Chinese companies who would probably choose business pragmatism over moral considerations,â says Xu. After all, not every LLM user will be talking about Taiwan and Tiananmen all that often. âSensitive topics that only matter in the Chinese context are completely irrelevant when your goal is to help your company code better or to do math problems better or to summarize the transcripts from your sales call center,â he explains.
Leonard Lin, cofounder of Shisa.AI, a Japanese startup, says Chinese models like Qwen and DeepSeek are actually some of the best when it comes to handling Japanese-language tasks. Rather than reject these models over censorship concerns, Lin has experimented with uncensoring Alibabaâs Qwen-2 model to try to get rid of its tendency to refuse answering political questions about China.
Lin says he understands why these models are censored. âAll models are biased; that’s the whole point of alignment,â he says. âAnd Western models are no less censored or biased, just on different subjects.â But the pro-China biases become a real issue when the model is being specifically adapted for a Japanese audience. âYou can imagine all sorts of scenarios where this would be ⦠problematic,â says Lin.
Additional reporting by Will Knight.