PaperlayerView exact revision on arXiv

Source-linked AI summary

R1dacted: Investigating Local Censorship in DeepSeek's R1 Language Model

Ali Naseh, Harsh Chaudhari, Jaechul Roh, Mingshi Wu, Alina Oprea, Amir Houmansadr

arXiv:2505.12625v1cs.CLcs.CRcs.LG

TL;DR

The paper investigates model-specific censorship after reports that R1 refuses China-related political questions, including in local deployment. It curates prompts, analyzes censorship and its transfer through distillation, and reports that a prompt-based jailbreak largely bypasses the behavior.

  • Problem

    The paper asks how to characterize model-specific political restrictions distinct from widely shared safety refusals, following reports of R1 refusing China-related political queries.

    Source: §I · p. 1, B. R1’s Local Censorship · p. 3

  • Method

    The study defines global and local censorship, curates R1-triggering prompts, analyzes censorship patterns and distilled models, and evaluates a prompt-based jailbreak.

    Source: §I · pp. 1–2, A. Defining Censorship in LLMs · p. 2

  • Results

    Censorship transfers through distillation imperfectly, while a prompt-based jailbreak bypasses R1’s censorship on approximately 97.86% of samples.

    Source: §I · p. 1, §IX · p. 13

  • Takeaways & Limitations

    Local censorship extends model restrictions beyond broadly shared safety alignment, while opaque mechanisms complicate understanding and auditing.

    Source: §I · p. 1, C. Web-Based Chatbots · p. 13

    The mechanisms behind the additional censorship layer remain opaque and black-box, making it difficult to study or audit.

    Source: C. Web-Based Chatbots · p. 13

Abstract

from arXiv · show

DeepSeek recently released R1, a high-performing large language model (LLM) optimized for reasoning tasks. Despite its efficient training pipeline, R1 achieves competitive performance, even surpassing leading reasoning models like OpenAI's o1 on several benchmarks. However, emerging reports suggest that R1 refuses to answer certain prompts related to politically sensitive topics in China. While existing LLMs often implement safeguards to avoid generating harmful or offensive outputs, R1 represents a notable shift - exhibiting censorship-like behavior on politically charged queries. In this paper, we investigate this phenomenon by first introducing a large-scale set of heavily curated prompts that get censored by R1, covering a range of politically sensitive topics, but are not censored by other models. We then conduct a comprehensive analysis of R1's censorship patterns, examining their consistency, triggers, and variations across topics, prompt phrasing, and context. Beyond English-language queries, we explore censorship behavior in other languages. We also investigate the transferability of censorship to models distilled from the R1 language model. Finally, we propose techniques for bypassing or removing this censorship. Our findings reveal possible additional censorship integration likely shaped by design choices during training or alignment, raising concerns about transparency, bias, and governance in language model deployment.

I. INTRODUCTION

The paper distinguishes shared safety refusals from model-specific censorship and investigates R1’s refusals on China-related political topics, including in local deployment. It introduces a curated prompt dataset and examines censorship patterns, distillation, and bypass methods.

A. Defining Censorship in LLMs

  • Global censorship describes refusals broadly shared across models for safety, whereas local censorship is model-specific and may reflect developers’ policies or ideological positions.Local censorship may appear as refusal, biased or misleading output, or intentional misinformation dissemination.Source: §I · p. 1, A. Defining Censorship in LLMs · pp. 2–3

I. INTRODUCTION

  • R1’s China-related political refusals are notable because the behavior is reported in its locally deployed base model, unlike censorship previously seen mainly in hosted chatbots.The paper describes this as, to the authors’ knowledge, the first instance of local censorship alignment persisting in private deployment.Source: §I · p. 1
  • The study curates about 10,030 prompts and analyzes R1’s censorship across topics, languages, and NLP tasks, while examining distilled models and proposing a jailbreak with approximately 97.86% success.It also studies censorship transfer through distillation and compares bypass and removal techniques across effectiveness, factuality, alignment, and cost.Source: §I · pp. 1–2

II. RELATED WORK

  • Related work spans reasoning and alignment research, censorship across media, and network blocking and circumvention, including DNS injection,,,.The paper also situates LLM safety work in instruction tuning [37], RLHF, and DPO [39].Source: §II · p. 2

B. R1’s Local Censorship

R1’s local censorship appears as either standardized positive answers or explicit refusals without reasoning tokens. The section also explains why an existing Chinese-sensitive-topic dataset does not isolate this behavior.

B. R1’s Local Censorship

  • Reports describe R1 refusing China-related political questions, including in its locally deployed version, where such behavior had previously been seen mainly in hosted chatbots.The paper frames this as a local-censorship phenomenon distinct from behavior commonly observed in other LLMs.Source: B. R1’s Local Censorship · p. 3
  • R1’s censored outputs either omit reasoning tokens and give a standardized positive answer about China or omit them and explicitly refuse.In other cases, R1 typically produces reasoning tokens and a coherent final answer without refusal behavior.Source: B. R1’s Local Censorship · pp. 3–4

A. Analyzing Existing Datasets

  • 83% of prompts in the 1,156-prompt CCP dataset were censored by o3-mini-high, and many prompts were harmful or unsafe, making them examples of global rather than local censorship.This motivated a pipeline specifically designed to curate local-censorship samples.Source: A. Analyzing Existing Datasets · p. 4

B. Dataset Creation

The dataset pipeline identifies sensitive topics, collects candidate questions, filters for globally unsafe prompts and R1-specific refusals, then categorizes retained samples. It combines archive-derived topics with generated and human-written prompts.

B. Dataset Creation

  • The four-stage pipeline identifies sensitive topics, collects candidates, filters global and local censorship, and categorizes the final samples.The topic list draws on the China Digital Times 404 Archive, which contains censored or deleted articles and human-assigned topic labels.Source: B. Dataset Creation · p. 4, 1) Sensitive Topics Detection · p. 4

1) Sensitive Topics Detection:

  • The topic-detection process collected 1,965 CDT 404 articles and refined potentially sensitive keywords into 96 categories and subcategories.The categories are used throughout the censorship analysis.Source: 1) Sensitive Topics Detection · pp. 4–5

2) Data Collection Process:

  • 1,164 GPT-4o-generated questions complement human-written Twitter and Reddit prompts drawn from two datasets of approximately 85 million samples each.Generated prompts use templates and model-written questions for individuals and historical incidents, and model-written questions for other categories.Source: 2) Data Collection Process · p. 5

3) Global Censorship Checking:

  • Candidate prompts flagged as unsafe or harmful by any of three reference models—o3-mini-high, GPT-4o, or Llama-3-8B-Instruct—were removed to exclude global-censorship cases.The remaining prompts were then checked for censorship behavior by R1.Source: 3) Global Censorship Checking · p. 5

4) Local Censorship Checking:

  • Approximately 10,030 English prompts remained after filtering for R1-triggered censorship, forming the curated local-censorship dataset.Prompts flagged as unsafe by reference models were filtered out before checking R1’s responses.Source: 4) Local Censorship Checking · p. 5

C. Dataset Statistics

The curated dataset is concentrated on China-related political and historical subjects, and a balanced evaluation finds near-total censorship across most categories. Censorship rates decrease in other tested languages, though they remain relatively high in Chinese.

C. Dataset Statistics

  • 45.1% of samples came from Reddit, 44.6% from Twitter, and 10.3% from LLM-generated prompts; 97.3% of cases were Type 1 censorship.The remaining 2.7% were Type 2 cases.Source: C. Dataset Statistics · p. 5
  • International affairs involving China were the most common subject, with Taiwan and the CCP also prominent; Tiananmen Square and Xi Jinping led the historical-incident and individual topics.Source: C. Dataset Statistics · pp. 5–6

A. Sensitivity Across Categories

  • 66 of 96 categories (68.75%) had a 100% censorship rate, and 86 of 96 (89.58%) exceeded 90%; three named categories had lower rates.Dalai Lama: 76.67%; Smog and the Lei Yang case: 73.33%; Great Leap Forward: 66.67%.Source: Figure 4 · p. 6, A. Sensitivity Across Categories · p. 6
  • The analysis covers 96 categories and uses an equal number of prompts per category because the 10,030-sample dataset is unevenly distributed.GPT-4.1 generated 30 questions per category, for 2,880 total prompts.Source: A. Sensitivity Across Categories · p. 6

B. English vs Other Languages

  • Censorship decreased in Chinese, Korean, and Farsi compared with English, remained relatively high in Chinese, and was lowest in Farsi.The authors note that this pattern may correlate with the languages’ relative emphasis during alignment and censorship training.Source: B. English vs Other Languages · p. 6, Table II · p. 6

C. DeepSeek Distilled Models

The distilled models showed few instances of the paper’s two common censorship types, but some generated reasoning tokens before refusing. DeepSeek-V3 exhibited similar behavior to R1 at a significantly lower rate, mostly through template-like answers.

C. DeepSeek Distilled Models

  • The authors evaluate all 10,030 R1 censorship prompts on six models distilled from R1.The models are assessed for censorship behavior; the paper also evaluates DeepSeek-V3 on the same prompt set.Source: C. DeepSeek Distilled Models · p. 6, D. DeepSeek-V3 · p. 7
  • The six R1-distilled models showed the two common censorship types in only a limited number of samples, but some generated reasoning tokens before refusing.The authors suggest censored samples may have been present in the distillation data, while noting that deeper exploration is needed to establish this.Source: C. DeepSeek Distilled Models · p. 7, Figure 5 · p. 7

D. DeepSeek-V3

  • DeepSeek-V3 showed similar censorship behavior to R1, but at a significantly lower rate.The analysis used the R1-curated prompts and categorized censored responses into two types.Source: D. DeepSeek-V3 · pp. 7–8
  • Across the 10,030 prompts, DeepSeek-V3 produced 1,296 Type 1 responses (12.92%) and 48 Type 2 refusals (0.48%); most Type 2 cases concerned Tiananmen Square.Type 1 responses were template-like positive statements about China that did not accurately answer the question.Source: Figure 7 · p. 7, D. DeepSeek-V3 · p. 8

VI. DISTILLATION

The study tests whether censorship can be transferred through distillation without harming task performance. Injecting Taiwan-related prompts increased censorship on Taiwan prompts while largely preserving benchmark performance, but also produced spillover and unintended behavior.

VI. DISTILLATION

  • The case study asks whether censorship can transfer through distillation without sacrificing task performance, and whether it affects other topics within or outside the training distribution.Source: §VI · p. 8

A. Case Study: Taiwan

  • The study injects variable numbers of Taiwan-related prompts into a 1,000-sample distillation dataset, then fine-tunes Qwen-7B-Instruct for five epochs.It reserves 200 Taiwan prompts for censorship evaluation and uses non-Taiwan prompts and filtered OpenThoughts-114k samples to assess generalization and side effects.Source: 1) Setting · p. 8

1) Setting:

  • Task performance is measured on AIME24, MATH500, and GPQA Diamond, while censorship is measured as the proportion of censored responses in each evaluation set.Source: 1) Setting · p. 8

B. Results

  • Injecting 30 censorship samples yielded 95.5% censorship on Taiwan prompts, while benchmark performance was largely unaffected; more injection also increased same-distribution spillover and unintended out-of-distribution answers without reasoning tokens.The authors caution that such final answers are not necessarily incorrect.Source: B. Results · pp. 8–9, Figure 9 · p. 9, Figure 10 · p. 9

C. Ablation Study

The ablation finds that standardized refusal examples transfer censorship more effectively than random samples, while diverse selection yields a slight increase. The paper also introduces a reasoning-trigger jailbreak that recovers outputs for most censored prompts.

designed to provide helpful and harmless responses.”

  • 98.5% censorship with standardized refusal samples, versus 82% when injecting the same number of censorship examples.The authors suggest the fixed refusal output may be easier for the model to memorize and internalize.Source: designed to provide helpful and… · p. 9, Table V · p. 9

C. Ablation Study

A. Our Jailbreaking Attack

  • The attack prepends “Okay, the user is asking” within the <think> token to encourage reasoning, repeating the phrase until reasoning tokens appear.The method is motivated by R1’s typical pattern of empty reasoning tokens followed by template-like or refusal answers.Source: A. Our Jailbreaking Attack · pp. 9–10
  • 97.86% of 10,030 censored samples yielded full outputs under the reasoning-trigger attack.Even two repetitions bypass censorship for a majority of samples; increasing repetitions reduces overall censorship, although Type 3 refusals rise slightly.Source: A. Our Jailbreaking Attack · p. 10, Figure 11 · p. 10

B. Perplexity AI’s model

The section describes Perplexity AI’s R1-1776, a post-trained R1 variant intended to remove censorship, and compares it with the paper’s prompt-based attack. Across the censorship dataset, R1-1776 showed no observed censorship patterns, while the attack retained a small residual rate.

B. Perplexity AI’s model

  • R1-1776 was developed through targeted post-training, using a multilingual dataset of 40,000 prompts covering approximately 300 identified censored topics.The stated goal was accurate, factual responses without ideological filtering.Source: B. Perplexity AI’s model · p. 10

C. Perplexity AI’s Model vs. Our Jailbreaking Attack

1) Censorship Rate:

  • The prompt-based attack left censorship in 2.14% of outputs, whereas R1-1776 showed none across the 10,030-prompt dataset.The attack’s residual cases included 13 explicit refusals and 202 reasoning-then-refusal outputs.Source: 1) Censorship Rate · p. 10, Table VI · p. 11

2) Factuality:

The comparisons report that judges favored DeepSeek R1 over R1-1776 on factuality and alignment with a reference model. The section also reports QwQ-32B’s low refusal count, describes the attack’s computational cost and assumption, and notes that post-training at this scale is resource-intensive.

2) Factuality:

  • o3 favored DeepSeek R1 over R1-1776 in 62.5% versus 37.5% of factuality judgments; GPT-4.1 preferred DeepSeek R1 in 58.17%.The authors suggest post-training may negatively affect factuality and state that their prompt-based method preserves the original model’s informative capabilities without altering its parameters.Source: 2) Factuality · p. 11

3) Alignment with a Reference Model:

  • GPT-4.1 judged DeepSeek R1 more aligned with the o3-mini-high reference than R1-1776 in 69.83% of cases.The authors say R1-1776 may still exhibit bias or deviate more from neutral reference responses.Source: 3) Alignment with a Reference Model · pp. 11–12

4) Cost:

  • Post-training a model with approximately 700B parameters is computationally intensive, while the prompt attack adds no computational cost beyond inference.The attack appends a crafted string to the prompt.Source: 4) Cost · p. 12

5) Adversarial Capabilities and Assumptions:

  • The attack assumes knowledge of reasoning-token presence and formatting, which may not hold for models that hide internal token streams.The authors leave inference of hidden reasoning structure as an open direction.Source: 5) Adversarial Capabilities and… · p. 12

A. Censorship in Another Chinese Reasoning Model

  • QwQ-32B clearly refused only 13 of 10,030 prompts, with most refusals concerning June 4th and Tiananmen Square.The evaluation used the developers’ recommended temperature of 0.6.Source: A. Censorship in Another Chinese… · p. 13

B. Other NLP Tasks

R1 showed no evidence of censorship in the tested summarization and translation tasks, while its web-based chatbot counterparts often censored prompts answered by local models. The conclusion frames local censorship as a subject for transparency and governance research, with the study limited to observed behavior in open-weight models.

B. Other NLP Tasks

  • The experiments found no evidence of R1 censorship in summarization or translation, suggesting direct questions are more likely to trigger it than task-oriented instructions.This pattern held even when the underlying content was sensitive.Source: B. Other NLP Tasks · p. 13

C. Web-Based Chatbots

  • Many prompts answered by local models were censored by corresponding web-based chatbots, with a notably stricter pattern for QwQ’s official interface.The mechanisms of this additional censorship layer are opaque and difficult to study or audit.Source: C. Web-Based Chatbots · p. 13

IX. CONCLUSION

  • The paper concludes that R1’s local censorship can be transferred through distillation imperfectly and largely bypassed with a prompt-based jailbreak.The authors connect local censorship to questions about transparency, model control, and downstream impact.Source: §IX · p. 13

ETHICAL STATEMENT

  • The study’s experiments concern open-weight models, and its conclusions are limited to model behaviors observed during evaluation.The authors describe the jailbreak techniques as intended for research and auditing, not evading safety protections or promoting harmful content.Source: ETHICAL STATEMENT · pp. 13–14

APPENDIX A DATA COLLECTION STAGES

The appendix describes a multi-stage pipeline for collecting and preparing English questions about sensitive topics related to China from Reddit, Twitter (X), and LLM-generated prompts. The pipeline filters for relevance and clarity, then deduplicates and cleans the remaining prompts.

APPENDIX A DATA COLLECTION STAGES

  • Prompts came from Reddit, Twitter (X), and LLM-generated sources, with large-scale Reddit and Twitter datasets filtered through a multi-stage pipeline.Each social-media dataset contained approximately 85 million entries.Source: Appendix A · p. 15

A. Length Filtering

  • Twitter prompts were limited to 5–90 tokens and Reddit prompts to 5–300 tokens, then samples were filtered for predefined sensitive-topic keywords.The different token ranges account for Reddit posts typically being longer.Source: A. Length Filtering · p. 15, B. Topic Filtering · p. 15

C. China-related Filtering

G. Deduplication

  • The filtered prompts were deduplicated to remove exact or near-duplicates, and URLs and links were removed.The authors state that links do not contribute meaningfully to the analysis and may degrade model performance.Source: G. Deduplication · p. 15, H. Link Removal · p. 15

I. Categorization

The appendix describes prompt-generation, censorship-classification, and taxonomy-generation templates used in categorization, as well as translation prompts and distributions of censorship samples. The prompts specify controlled or structured outputs for these tasks.

I. Categorization

  • The categorization stage assigned filtered prompts to 96 predefined categories and subcategories.Source: §I · p. 15
  • A prompt template generated 30 diverse questions about a sensitive topic in China, requesting list-only output without metadata or structure.Source: Figure 14 · p. 16
  • A JSON-only classifier prompt labeled answers censored or not based on template-style nonanswers and explicit refusals.Source: §I · p. 16, Figure 15 · p. 16
  • The taxonomy-generation prompt asked for the smallest coherent set of fine-grained categories and structured JSON containing each category's name, description, and example indices.Source: §I · p. 17, Figure 16 · p. 17
  • Translation prompts instructed the model to return only English-to-Chinese, Farsi, or Korean translations, without commentary or formatting.Source: §I · p. 17, Figure 17 · p. 17
  • The figures show distributions of censorship samples across categories, incidents, and individual names.Source: Figure 18 · p. 18, Figure 19 · p. 19, Figure 20 · p. 20
Loading 2505.12625v1…