China’s AI Freedom Paradox: Less Censorship in Open Models

A growing body of research reveals a surprising irony in the global AI landscape: while proprietary Chinese large language models (LLMs) are among the most heavily censored on political topics, their open-source counterparts can be stripped of these constraints—potentially offering more freedom than mainstream US models. This paradox challenges simple narratives about China’s lead in AI freedom and raises complex questions about the trade-offs between censorship and safety.

The Censorship Gap: Proprietary Chinese vs. US Models

A comprehensive study by Stanford and Princeton researchers, published in February 2026, quantified the censorship gap between Chinese and American LLMs. The researchers fed 145 politically sensitive questions to four Chinese models and five American models, repeating the experiment 100 times. The results were stark: Chinese models refused to answer significantly more questions. DeepSeek refused 36% of questions, while Baidu’s Ernie Bot refused 32%. In contrast, OpenAI’s GPT and Meta’s Llama had refusal rates below 3% (WIRED).

A peer-reviewed study published in PMC confirmed these findings, noting that BaiChuan had the highest refusal rate at 60.23%, while DeepSeek followed at approximately 36% (PMC). The study also found that Chinese models gave shorter and more inaccurate responses when they did answer. Importantly, the censorship persisted even when models responded in English, suggesting that manual interventions and regulatory pressure—not just training data—drive the behavior.

The Open-Source Escape Hatch

However, a more recent study from July 2026, reported by Semafor, reveals a crucial nuance: open-source Chinese models do not necessarily inherit the same censorship constraints. Researchers from CTGT evaluated 152 pairs of prompts—one China-related and one control—comparing Chinese models to their distilled “student” models. They found that censorship behaviors did not consistently transfer to the distilled versions (Semafor).

This finding undercuts one of the US government’s top concerns: that Chinese open-source AI models are a pathway for Chinese political ideas to infiltrate users’ views. Instead, the research suggests that developers can effectively strip away censorship by fine-tuning or distilling from open-source Chinese models. As one researcher noted, “If it’s so easy to strip away censorship, it’s also easy to strip away other guardrails.”

The Double-Edged Sword

The irony is that China’s regulatory environment creates a bifurcation. Proprietary models are heavily censored due to government mandates like the “Measures for the Management of Generative Artificial Intelligence Services,” which require content to uphold “core socialist values” and prohibit content that “incites subversion of national sovereignty.” Yet open-source versions can bypass these constraints, potentially offering more freedom than US models.

But this freedom comes at a cost. The same process that removes censorship also removes safety guardrails, posing dual-use risks. A model that refuses to answer questions about Tiananmen Square might also refuse to generate harmful instructions—but once stripped, it could do both. As the Semafor article warns, “Regulators should assume that powerful AI models are coming and that they won’t have many restrictions on how people can use them—whether that’s Chinese censorship or offensive hacking.”

What Remains Unknown

The research has important limitations. The CTGT study covered only a single model pairing and did not test all safety triggers. It also did not establish the underlying mechanism by which censorship fails to transfer. As one researcher noted, “This topic needs more research.” The PMC study cautions that its findings are observational and cross-sectional, not establishing a causal link between regulatory pressures and censorship.

There are also disagreements among sources. The WIRED and PMC studies emphasize that Chinese models are more censored, while Semafor suggests open-source versions can be less censored. This apparent conflict highlights the difference between proprietary and open-source models—a distinction that is often overlooked in policy debates.

Implications for AI Governance

The findings have significant implications for how we think about AI freedom and safety. The trade-off between censorship and safety is not binary; it depends on deployment context and fine-tuning. A model that is heavily censored on political topics might still be safe on other dimensions, while a stripped-down open-source model might be free but dangerous.

Moreover, the research challenges the notion that Chinese models are uniformly pro-government. A separate analysis by Vals AI found that “Chinese models sometimes criticize China” and that “some non-Chinese models occasionally repeat CCP narratives” (Vals AI). Language and deployment context also matter: Chinese models expressed more pro-China positions when asked in Chinese than in English.

The broader question is whether the US should embrace or restrict Chinese open-source models. On one hand, they offer cost and speed advantages. On the other, they could introduce safety risks. As the Semafor article concludes, “After all, what is the nationality of an American model distilled from a Chinese model that was distilled from an American model?”

Conclusion

China’s AI freedom paradox reveals that censorship and freedom are not straightforward attributes of a model’s origin. Open-source Chinese models can be less censored than their proprietary counterparts—and potentially less censored than US models—but this freedom comes with trade-offs. As AI governance debates continue, the key insight is that the behavior of AI models depends less on where they come from and more on how they are fine-tuned, deployed, and regulated. The real challenge is not about nationality but about ensuring that powerful models are both safe and free.

FAQ

Why do open-source Chinese AI models show less censorship than proprietary ones?

Proprietary Chinese models are subject to government regulations and manual interventions that enforce content restrictions on political topics. Open-source versions, however, can be stripped of these constraints during fine-tuning or distillation, allowing them to bypass censorship guidelines.

How do Chinese models compare to US models in terms of censorship?

Proprietary Chinese models like DeepSeek and BaiChuan refuse 36% to 60% of political questions, while US models like GPT and Llama refuse less than 3%. However, open-source Chinese models can be adjusted to show less censorship, potentially offering more freedom than US models.

Does stripping censorship from open-source models also remove safety guardrails?

Yes, the same process that removes censorship can also remove safety guardrails, posing dual-use risks. This creates a trade-off between freedom and safety that depends on deployment context and fine-tuning.

What are the implications for US companies using Chinese open-source models?

US companies could benefit from cheaper and faster Chinese open-source models, but they must consider the risks of reduced safety guardrails. The nationality of a model becomes ambiguous when distillation crosses borders.

Is the censorship in Chinese models due to training data or manual intervention?

Research suggests censorship is more linked to manual interventions and regulatory pressure than training data alone. Chinese models showed more censorship even when responding in English, indicating that human moderation plays a larger role.