A CTGT study found that political censorship observed in some Chinese open-source AI models does not necessarily transfer to smaller models distilled from them. In tests comparing 152 prompt pairs, researchers observed instances where the distilled “student” model answered politically sensitive questions differently from the original Chinese “teacher” model.
What the researchers did
CTGT, a San Francisco-based lab that probes AI internals for high-risk use cases, used DeepSeek V4 Flash as a teacher model. They generated training data from DeepSeek’s outputs and trained a smaller student model via distillation. The investigation focused on whether DeepSeek’s pattern of refusing or whitewashing politically sensitive questions would be learned and reproduced by the distilled model.
The team evaluated 152 paired prompts: each China-related prompt had a similar control prompt that did not mention China. Topics included Tiananmen Square and the detention of Uyghurs. To judge the responses, CTGT used evaluations from models developed by xAI, Google, OpenAI and Anthropic.
Key findings
- The DeepSeek teacher model often refused to answer political questions or produced answers that were softened in ways favorable to China.
- The CTGT-distilled student model did not consistently inherit that censorship. For example, where DeepSeek reportedly said there was no evidence of Uyghur detention camps, the distilled model stated there was evidence that the Chinese state held Uyghurs in “internment-type facilities.”
- The study did not determine a technical mechanism explaining why censorship failed to transfer; it only found that transfer did not automatically occur.
Why this matters
The results challenge a core U.S. concern that Chinese open-source models would serve as a vector for Chinese political ideas and censorship to spread through systems used by American entities. At the same time, the finding raises the opposite regulatory worry: if distillation can strip away censorship, it may also strip away other safety guardrails.
Industry and policy context
American firms increasingly customize or distill Chinese open-source models into smaller, cheaper models tailored to their needs. CTGT said it built its distilled model with financial services use cases in mind (quantitative reasoning tasks such as discounted cash flow, options pricing and net present value calculations), although the specific distilled model used for the censorship research was created solely for that analysis.
Companies in regulated industries have been wary of using models based on Chinese releases partly out of concern that inherited censorship might skew outputs or provoke backlash. For example, Cursor faced criticism in March for building its Composer 2 coding model on Moonshot’s Kimi 2.5.
There is also an unresolved national security worry that Chinese models could contain hidden backdoors capable of exfiltrating data; the study notes that there is no solid evidence to establish that fear so far.
Reactions and implications
CTGT reported having spoken with U.S. officials interested in the findings. Jane Horvath, partner at Gibson Dunn and former chief privacy officer at Apple, argued that banning Chinese models makes little sense if companies can distill them into U.S. models, characterizing models as raw software material.
The research contributes to an ongoing debate inside the Trump administration about how to handle risks from Chinese open-source models: beyond immediate refusal to answer certain questions, some officials worry that widespread use of Chinese models in the U.S. could shape society to reflect Beijing’s worldview.
Limitations and need for more research
CTGT’s analysis covered a single model pairing and did not explore how the models handle prompts that trigger broader safety policies. Therefore, the results do not prove why censorship did or did not transfer — only that, in these experiments, it sometimes failed to.
Conclusion
CTGT’s work suggests that the spread of Chinese open-source AI models may not inherently translate into the spread of Chinese-style political censorship through distilled derivatives. That finding could ease some security and policy concerns and support commercial arguments for using or distilling Chinese models, but it also underscores regulatory challenges: the same processes that remove censorship could also remove useful safety features. Broader research is needed to clarify the mechanisms and generalizability of these results.
Note
The article also observes that, much like China’s earlier global expansion in cheaper solar panels and electric vehicles, its lower-cost AI models may influence the global AI landscape by being widely available at lower cost than some U.S. rivals and appealing to developing countries (J.D. Capelouto, Semafor).
