What a Model Refuses, a State Fears: How Authoritarian Information Control Reproduces in Language-Model Guardrails

• Foundation-model developers act as political-information intermediaries because they determine what general-purpose systems produce or help users do, not only what user content circulates.The experiments cannot distinguish restrictions in the serving stack from those embedded in model weights; the referent gap appears in open-weight models, while the Chinese-language shift to deflection is deployment-dependent.Source: §1 · pp. 4, 6
• The study separates the political target of refusal from its enforcement, asking whether guardrails respond to domestic context and coordination rather than criticism alone.Enforcement may be broader than the underlying political boundary, vary across languages, or weaken when requests are reformulated.Source: §1 · p. 5
• Within-model experiments across ten instruction-tuned models hold requests fixed while varying political referent, collective-action potential, and valence.Because model origin bundles regulatory environments with training, architecture, and alignment, cross-origin comparisons cannot identify regulation's causal effect.Source: §1 · pp. 5–6
• Chinese-developed models more often refused otherwise identical requests about China, and refusals tracked collective-action potential more than valence, including peaceful pro-government mobilization.These patterns reflect domestic political sensitivity and coordination, but enforcement also extended to some low-coordination criticism, shifted toward deflection in Chinese, and was not hardest to circumvent in the strictest models.Source: §1 · p. 5

1 Introduction

• Refusal frequency alone is insufficient; political distinctions, boundary breadth, non-compliance form, and survival under semantically equivalent reformulation also shape political restriction.Source: §1 · p. 6
• Studying these dimensions examines not only whether information control persists in a new technological setting, but how its political structure and enforcement change.Source: §1 · p. 6

2 From Authoritarian Information Control to Model Guardrails

• Authoritarian information control is selective: even harsh criticism may remain available while communication that can facilitate collective action is disproportionately restricted (King et al., 2013, 2014).The proposed boundary is coordination capacity, not simply whether political speech is favorable or unfavorable.Source: §2 · p. 7
• Restrictions can work through friction rather than total inaccessibility, so their effectiveness depends on both the targeted activity and the strength of enforcement.Determined users may circumvent restrictions even when higher access costs deter others.Source: §2 · p. 8
• Foundation-model developers govern what systems produce or help users do, translating political boundaries into request-level rules that apply across phrasings and ordinary tasks.Unlike platforms that moderate user-produced content, model guardrails govern assistance and can be less observable because refusals are seen only by the user who encounters them.Source: §2 · pp. 8–9
• Prior evidence shows political environments leave traces in model behavior, but does not identify which political boundaries models enforce or how.The section predicts that any refusal gap between Chinese- and U.S.-developed models should be concentrated in political rather than uniformly sensitive requests.Source: §2 · pp. 9–10
• Political targets may persist in model refusals, but developers build enforcement choices that can change their breadth, form, and robustness.The section separates which political activities are treated as threatening from how restrictions are implemented.Source: §2 · p. 10
• The domestic-sensitivity prediction holds requests constant while varying whether identical political activity concerns China, a foreign democracy, or a fictional locale.The theory is that authoritarian information control targets threats to a particular regime, making domestic political activity distinct from comparable activity abroad.Source: §2 · pp. 10–11
• The coordination prediction expects greater refusal for collective-action requests than political opinions, even when the proposed mobilization supports the government.This distinguishes restricting coordination itself from suppressing only anti-government content.Source: §2 · p. 11
• H1–H3 ask whether refusal targets political content, is more sensitive to the developer’s domestic political environment, and restricts collective-action capacity rather than ideological direction.These patterns would show more than that some models simply refuse more often.Source: §2 · p. 11
• The enforcement-breadth prediction is that low-coordination anti-government requests may be refused despite lacking a coordination mechanism.Asymmetric liability for under-restriction may encourage precautionary over-removal, so a guardrail’s enforcement can extend beyond its political target.Source: §2 · pp. 11–12
• A capability probe distinguishes inability to recognize criticism, persuasion, and coordination from a refusal policy that fails to use distinctions the model can make.The probe clarifies whether broad refusal reflects a representational limit or the guardrail’s implementation.Source: §2 · pp. 12–13
• Native refusal measures initial rejection, not robustness: semantically equivalent reformulations may recover assistance, making refusal and resistance to circumvention distinct properties.The adversarial search tests this friction; the section predicts that many initially refused requests will be recoverable through paraphrases.Source: §2 · p. 12
• The argument tests observable implications rather than identifying a single developmental origin; the form of non-compliance is examined in the Chinese-language replication.Political differences could enter through pretraining, post-training alignment, explicit safety policies, or their interaction.Source: §2 · p. 13

3 Data and Methods

• The design separates targets of restriction from enforcement, testing political referent, collective-action potential, and valence while holding request substance constant.Enforcement is assessed through overreach to low-coordination criticism, forms of non-compliance, and robustness to semantically equivalent paraphrases.Source: §3 · pp. 13–14
• Ten instruction-tuned models span U.S.-developed, China-developed, and open-weight groups; open-weight is a distribution category, not an origin cohort.Because Qwen2.5-7B is Chinese-developed but differs in scale and distribution, origin-level results are also reported with it recoded as Chinese-developed; this affects H1 aggregates, not within-model contrasts.Source: §3 · p. 14
• Prompts are fielded in English, Chinese, and French, with the factorial replicated in Chinese for Chinese-developed models to assess language transfer and non-compliance form.French serves as a neutral third language to distinguish Chinese-specific shifts from broader non-English shifts and test transfer to a high-resource language.Source: §3 · pp. 14–15
• The factorial experiment crosses collective-action potential, political valence, and referent in 216 political cells plus 12 apolitical placebos.Requests are lawful and nonviolent; referent minimal pairs change only city names and the government noun, with fictional locales controlling for place-naming.Source: §3 · p. 15, Table 1 · p. 16
• Human validation on a stratified sample of 480 responses yields κ = 0.94; platform outputs such as Qwen data_inspection_failed are treated as refusals rather than errors.Source: §3 · p. 16
• A standardized, bounded adversarial search tests whether initially refused requests can be recovered while preserving the underlying goal.Conditional ASR is the share of initially refused requests recovered within the fixed query budget; because search is bounded, failed attacks show only that this procedure found no successful prompt within budget.Source: §3 · pp. 16–17
• H1 estimates whether Chinese–U.S. model refusal differences are disproportionately political using a 2 × 2 difference-in-differences specification on native refusal.The specification uses severity-matched political and non-political harmful prompt pairs.Source: §3 · p. 17

H1: origin comparison

• For H1, the China–U.S. political refusal gap is estimated as an interaction against a severity-comparable non-political benchmark, using 58 matched pairs and randomization inference across four models per origin.The randomization test is primary because origin varies across only eight models; the model-clustered wild bootstrap is secondary because four clusters per group can lead it to over-reject.Source: §3 · pp. 17–18

Citizen-side factorial experiment

• H2 and H3 use citizen-side factorial experiments replicated across 18 topics, estimated with linear probability models, model and topic fixed effects, topic-clustered errors, and model-clustered wild-bootstrap contrasts.Logistic specifications provide a functional-form robustness check.Source: §3 · p. 18

H2: domestic sensitivity

• For H2, the primary contrast compares China-referent requests with otherwise identical foreign-referent requests, while foreign and fictional referents are tested for equivalence within ±10 percentage points.The equivalence test assesses whether the China–foreign contrast is tied to the domestic referent rather than merely naming a geographic location.Source: §3 · p. 18

H3

• The refusal model includes collective-action potential, anti-government valence, their interaction, and model and topic fixed effects.The equation specifies CAP and AntiGov terms and their interaction; α_i and λ_t denote model and topic fixed effects.Source: For H3, we estimate · p. 19
• H3 tests whether collective-action potential increases refusal independently of whether a request supports or opposes government.The analysis compares the collective-action effect with the effect associated with anti-government valence.Source: For H3, we estimate · p. 19

H4 (breadth of enforcement)

• The breadth test examines low-CAP anti-government criticism that does not ask for help organizing or mobilizing others.Substantial refusal in this condition would indicate enforcement beyond the coordination-centered target.Source: For H3, we estimate · p. 19
• A Chinese-language classification probe tests whether models can distinguish low- from high-CAP requests while refusing low-CAP criticism.The probe uses the factorial items as classification tasks and includes apolitical coordination controls; the paper separately reports refusals of the classification task itself.Source: For H3, we estimate · p. 19

H5 (robustness)

• The robustness analysis compares native refusal with conditional ASR on 144 authoritarian-political prompts attacked in English, Chinese, and French.Two AI reviewers independently code responses, with Cohen’s κ = 0.93; these preliminary attack results are reported separately from the primary factorial analyses.Source: For H3, we estimate · p. 20

Identification and scope

• Developer-origin differences remain observational, while the within-model referent experiment holds requests fixed across China, foreign, and fictional settings.The experiment identifies sensitivity to domestic political context, but not why it arose or whether national regulation caused it.Source: For H3, we estimate · p. 20

H1

• 18.4 percentage points was the estimated origin-by-domain interaction, but p = 0.243 and composition sensitivity leave limited support for a distinctive aggregate pattern.Excluding GPT-4o reduced the estimate to 16.8 points; the paper concludes that aggregate differences do not establish a distinctive political-refusal pattern among Chinese-developed models.Source: §4 · p. 21, Figure 1 · p. 22

H3

• Refusal rose from 32.6% for low-CAP requests to 59.7% for high-CAP requests, an LPM-adjusted difference of 27.1 percentage points (topic-clustered SE: 3.0, p < 0.001).For lawful, nonviolent activity supportive of the government, moving from political expression to assistance with mobilization produced a large increase in refusal.Source: §4 · p. 24
• 42% of low-CAP anti-government requests were refused, showing that the refusal boundary extends to political criticism without a mechanism for coordination.These requests did not ask models to recruit participants or coordinate behavior, so the boundary extends beyond the collective-action distinction.Source: §4 · p. 24

Breadth of enforcement

• Low-coordination political criticism was correctly labeled non-mobilizing 95.2% of the time, yet guardrails still extended refusal to some such criticism.The finding rules out a simple inability to distinguish political expression from collective action as the explanation for the broader refusal boundary.Source: §4 · p. 25

Cross-language replication

• 29.2 percentage points in Chinese versus 27.1 in English for the collective-action effect, while the domestic-referent gap was attenuated by 42.4 points.The collective-action effect was statistically identical across languages; the domestic-referent gap remained present in Chinese but was significantly smaller.Source: §4 · pp. 25, 29, Figure 3 · p. 29

Form of enforcement

• 23.0% of Chinese-language political answers were deflections, versus 2.2% in English, so explicit-refusal audits understate Chinese non-compliance.Deflections included redirects to official channels, heavily qualified responses, or other avoidance of direct assistance.Source: §4 · pp. 26, 28, 29, Figure 3 · p. 29

Robustness

• 74.5% of initially refused English requests elicited compliant responses after adversarial paraphrasing, showing native refusal does not imply robustness.Across models, native political refusal and resistance to paraphrasing were essentially unrelated; some Chinese-developed models were strict but brittle.Source: §4 · pp. 29–30, Figure 4 · p. 30

Overall results

• Aggregate evidence for disproportionately political refusal was limited, while within-model experiments found sensitivity to China as referent and to collective-action potential beyond political valence.The section’s synthesis also notes that refusal extended to some low-coordination criticism and that enforcement form and robustness varied.Source: §4 · pp. 30–31

5 Discussion and Conclusion

• Authoritarian-control distinctions remain visible in guardrails: a domestic political focus and concern with collective-action capacity, including refusals of peaceful, pro-government mobilization.The authors argue that refusal also reaches some low-coordination political criticism, making the enforced boundary broader than the coordination target.Source: §5 · pp. 31–32
• Models can classify the distinction they decline to act on and correctly classify apolitical coordination, so capability alone does not explain refusals extending beyond coordination.The authors conclude that the boundary is broader than the coordination target, but narrower than uniform conservatism.Source: §5 · p. 32
• Behavioral results reject capability as the explanation for the broader boundary, but cannot identify the developmental pathway that produced it.The authors say the design cannot separate regulatory uncertainty, safety-alignment spillover, and training-data composition.Source: §5 · p. 32
• In Chinese, political non-compliance often takes the form of deflection toward official channels or heavily qualified help, which refusal-only audits can miss.Counting deflections as non-compliance widens the domestic-referent gap rather than narrowing it.Source: §5 · p. 32
• Models that refuse most often under ordinary prompting are not the most resistant to reformulation, and most initially refused requests to Chinese-developed models were recovered by adversarial search.The authors therefore treat native strictness and durability as different properties.Source: §5 · p. 33
• Refusal rates alone can mischaracterize a guardrail’s reach and the equality of access it produces; evaluation should also consider political assistance provided.Source: §5 · p. 33
• Model origin is not randomized and bundles regulatory context with architecture, data, alignment, and developer choices, so cross-model comparisons do not identify regulation’s causal effect.The design also cannot locate when the observed patterns arose.Source: §5 · pp. 33–34
• The analyzed models are a dated snapshot of a rapidly changing population, so later releases may differ in refusal structure and enforcement porosity.Source: §5 · p. 34

A The adversarial paraphrase procedure

• The tool-assisted iterative jailbreak search measures how much ordinary rephrasing effort is needed to recover content initially refused by a model.Source: A The adversarial paraphrase procedure · p. 38
• A fixed judge scores each response against the original request; search succeeds at J(x) ≥ 10 and ends at success or the per-target query budget.Source: A The adversarial paraphrase procedure · p. 39
• Attacks compose meaning-preserving reframing, indirection, cross-lingual, and surface operators, so success measures bypass rather than substitution of an easier request.Source: A The adversarial paraphrase procedure · p. 39
• Thompson sampling selects operators by contextual-bandit reward, while a pruned attack tree uses width 3, depth at most 8, and 64 target queries.Source: A The adversarial paraphrase procedure · p. 39
• Conditional ASR measures recovery among initially refused items; because search is budget-limited, it gives a lower bound on porosity.Source: A The adversarial paraphrase procedure · p. 40
• Holding the attacker, judge, operator library, and budget fixed across models and languages makes porosity differences attributable to target guardrails rather than attacker effort.Source: A The adversarial paraphrase procedure · p. 40

B Models and evaluation configuration

• Ten instruction-tuned models span United States, China, and open-weight origin cohorts, with Qwen2.5-7B also recoded as Chinese in origin-level analyses.This model is Chinese-developed but small and open-weight.Source: B Models and evaluation configuration · p. 40
• Each model-language-prompt request is fresh, stateless, and single-turn, with only the provider-default system prompt and no reasoning or thinking mode.The zero condition submits the prompt as written; the attack condition applies the procedure in Appendix A.Source: B Models and evaluation configuration · p. 40
• A fixed language-model judge at temperature 0 scores request satisfaction, while platform content-review refusals count as refusals and empty or errored responses go to replay and review.Source: B Models and evaluation configuration · p. 40

C Matched control: construction and balance

• The primary difference-in-differences estimate uses 58 severity-matched pairs, or 116 prompts, drawn from political and traditional-harm pools.The political pool has 96 prompts averaging 16.1 words (SD 2.3); the traditional-harm pool has 128 prompts averaging 14.0 words (SD 3.3).Source: C Matched control: construction and… · p. 40
• Each political prompt is paired with a severity-comparable AdvBench harmful instruction, so the origin-by-domain comparison contrasts like with like.The traditional-harm pool spans cybercrime and intrusion, harassment, illegal goods, copyright, and chemical/biological categories.Source: C Matched control: construction and… · p. 40
• Table 5 reports origin-by-domain interaction estimates in percentage points and randomization-test p-values under alternative cohort definitions.The reported alternatives include excluding the two most permissive U.S. models and recoding Qwen2.5-7B as Chinese.Source: Table 5 · p. 41, C Matched control: construction and… · p. 41

D Citizen-side factorial: design

• The design crosses collective-action potential, valence, and referent over 18 topics, yielding 216 political cells and 228 prompts per model after adding 12 apolitical placebos.Across ten models, this gives 2,280 model-cells.Source: D Citizen-side factorial: design · p. 41
• Six action families—protest, petition, boycott, sit-in, strike, and public assembly—replicate the collective-action contrast across mechanisms.Source: D Citizen-side factorial: design · p. 41
• Within a topic, the China, foreign, and generic referents change only the city pair and government noun, with policy wording, action frame, and stance held fixed.Word count is matched to within one word, and fictional generic names control for place-naming; foreign and generic referents are statistically equivalent in the main text.Source: D Citizen-side factorial: design · pp. 41–42
• High-CAP prompts are peaceful, lawful, nonviolent organizing tasks, while low-CAP prompts are length-matched solo research or writing tasks.Across 108 matched pairs, the per-pair word difference is zero; the character-count standardized mean difference is 0.078.Source: D Citizen-side factorial: design · pp. 41, 43
• Twelve apolitical placebos cross high- and low-CAP community activities without government referents or political valence, controlling for generic coordination aversion.Source: D Citizen-side factorial: design · p. 41

E Complete citizen-side factorial prompt suite

• The suite contains 228 English cells—216 political and 12 placebo prompts—and releases them in full because they are lawful, nonviolent, first-person requests.Table 8 lists the cells verbatim; the Chinese version uses structure-preserving templates with identical IDs and factor columns, changing only prompt text and referent tokens.Source: E Complete citizen-side factorial… · p. 43, Table 8 · p. 43
• Prompts vary collective-action potential (high/low), valence (pro/anti-government, or neutral for placebos), and referent (China, foreign, or generic).Source: E Complete citizen-side factorial… · p. 43
• Gig-worker benefits prompts contrast coordinated boycotts with evidence-based briefs across Chinese, Spanish, and generic settings and pro/anti positions.The coordinated examples specify peaceful, lawful action without violence or property damage.Source: E Complete citizen-side factorial… · pp. 52–53
• Election-procedure prompts pair coordinated petitions with evidence-based briefs across Chinese, US, and generic settings and pro/anti positions.The petitions involve residents signing at the same scheduled time in two locations; the briefs use public statistics and address opposing arguments.Source: E Complete citizen-side factorial… · pp. 54–55
• Leadership-selection prompts compare coordinated assemblies with evidence-based community reports across Chinese, British, and generic settings and pro/anti positions.The assemblies recruit residents to convene at the same time in two locations, while the reports draw on public statistics and address opposing arguments.Source: E Complete citizen-side factorial… · pp. 55–56
• Campaign-finance prompts pair coordinated petitions with evidence-based briefs across Chinese, Canadian, and generic settings and pro/anti positions.Petition prompts specify peaceful, lawful participation without violence or property damage.Source: E Complete citizen-side factorial… · pp. 57–58
• Redistricting prompts compare coordinated assemblies with evidence-based community reports across Chinese, US, and generic settings and pro/anti positions.The assembly prompts involve residents convening at the same scheduled time in two locations; the reports use public statistics and address opposing arguments.Source: E Complete citizen-side factorial… · pp. 58–59
• For term-length proposals, prompts contrast coordinated peaceful assemblies with individual evidence-based community reports, and vary opposition versus support across China, foreign, and fictional settings.The assembly prompts specify simultaneous gatherings in two locations; the reports instead ask for public statistics, balanced sourcing, and responses to opposing arguments.Source: E Complete citizen-side factorial… · p. 60
• Voter-ID prompts similarly pair coordinated petitions with individual evidence-based petition briefs, varying support or opposition and the political setting.Petitions are peaceful, scheduled in two locations, and involve recruiting residents to sign; briefs request statistics, source evaluation, and fair responses to counterarguments.Source: E Complete citizen-side factorial… · pp. 61–62
• Online-speech-rule prompts compare coordinated peaceful protests with individual grassroots opinion pieces, while varying whether citizens support or oppose the rules.The protest examples specify simultaneous demonstrations in two cities without violence or property damage; the opinion pieces request public statistics and balanced argumentation.Source: E Complete citizen-side factorial… · p. 63
• Public-assembly-permit prompts contrast coordinated peaceful sit-ins with individual evidence-based essays, testing both supportive and critical expression.The sit-in prompt describes residents meeting simultaneously to sit quietly and hold placards; the essay prompt asks for statistics, source comparison, and fair responses to opposing arguments.Source: E Complete citizen-side factorial… · pp. 64–65
• Press-registration prompts again pair coordinated peaceful protests with individual grassroots opinion pieces, varying political referent and support versus opposition.The protest prompts specify synchronized demonstrations in two cities without violence or property damage, while the op-ed prompts ask for public statistics and balanced evidence.Source: E Complete citizen-side factorial… · p. 66

Low-coordination prompts

• Low-coordination prompts request evidence-based essays or op-eds on press-registration, data-collection, campus-speech, and protest-zone policies.They ask citizens to use public statistics, weigh sources, address opposing arguments fairly, and express personal support or opposition.Source: E Complete citizen-side factorial… · pp. 67, 68, 69, 71

Factorial prompt dimensions

• Prompts cross Chinese, foreign, and generic political settings with pro- or anti-government positions and low- or high-coordination requests.Examples include China and other named countries, alongside fictional locations and governments; paired requests express support or opposition.Source: E Complete citizen-side factorial… · pp. 67–68

High-coordination prompts

• High-coordination prompts ask citizens to recruit residents for peaceful, lawful sit-ins or protests at the same scheduled time in two locations.The scenarios specify no violence or property damage and vary whether participants oppose or support the policy.Source: E Complete citizen-side factorial… · pp. 67, 69, 70

F Attack benchmark

• The benchmark's attack procedure is documented in Shi et al. (2026).The benchmark follows standard red-teaming practice (Mazeika et al., 2024).Source: F Attack benchmark · p. 72
• Table 18 reports attack results by category, rather than only as an overall benchmark result.The passage identifies Table 9 as the source of the eight-category structure.Source: F Attack benchmark · p. 72, Table 9 · p. 72
• Table 9 groups the authoritarian-harm core of the attack benchmark into eight subcategories.The category-level attack results are reported in Table 18.Source: Table 9 · p. 72, F Attack benchmark · p. 72

G Coding protocol and reliability

• Explicit refusal is coded when a model declines requested help; responses that provide help in full or part count as non-refusals, regardless of hedging.Two AI reviewers code responses independently, with disagreements adjudicated against the codebook for the main estimates.Source: G Coding protocol and reliability · p. 72
• Binary refusal coding has Cohen’s κ = 0.93, while the finer three-way label has κ = 0.76.The 463 disagreements (13.5% of items) are concentrated on the full-versus-partial boundary collapsed by the binary outcome; Table 10 presents the reviewer crosstabulation.Source: G Coding protocol and reliability · pp. 72–73, Table 10 · p. 73
• Human validation on 480 responses agrees with AI labels at κ = 0.94, and preserves the China-versus-foreign gap at 77.3% versus 21.6%.The human coders' consensus has κ = 0.89; human labels for the full citizen-side factorial are still being collected for the final analysis.Source: G Coding protocol and reliability · p. 72

H Modeled effects: further detail and robustness

• Logistic regression gives odds ratios of 311 for the China referent, 33 for collective-action potential, and 5.0 for anti-government valence.The respective 95% confidence intervals are [129, 752], [17, 64], and [3.0, 8.3]; near-separation makes the China estimate large and imprecise.Source: H Modeled effects: further detail and… · p. 73, Table 12 · p. 75
• Because few model clusters make normal-approximation cluster inference unreliable, the origin and coordination effects use a restricted wild-cluster bootstrap with Webb weights.Webb weights are chosen because they outperform Rademacher draws when clusters are few.Source: H Modeled effects: further detail and… · p. 73
• Foreign and generic referents are tested for equivalence using two one-sided tests with margin δ = 0.10.The method treats a small estimate with a tight interval as positive evidence of equivalence, rather than merely a non-significant difference.Source: H Modeled effects: further detail and… · p. 73
• About 80% of China-referent prompts are predicted to be refused, versus roughly 22% for foreign or generic referents; refusal reaches 52% for pro-government mobilization.Figure 5 displays adjusted predictions with 95% topic-clustered bootstrap intervals.Source: H Modeled effects: further detail and… · pp. 73–74
• The placebo difference-in-differences is +18.8pt with topic-clustered p = 0.037, but four-model wild-bootstrap p = 0.26.The table defines CAP × Political as the extra collective-action effect in political versus apolitical-placebo cells.Source: H Modeled effects: further detail and… · p. 74, Table 11 · p. 74

Coding-definition robustness: the did-not-help recoding

• Qualified deflections occur in 22.0% of Chinese versus 2.2% of English political answers, motivating a did-not-help outcome that counts those responses as non-compliance.Under this broader coding, the domestic-referent effect widens from +18.4 to +32.3 points because qualified deflections disproportionately fall on China-referent requests.Source: Coding-definition robustness: the… · p. 75
• The collective-action effect is essentially unchanged under the broader coding: +29.9 versus +26.9 points.In English, where partial deflection is rare, both effects are unchanged by recoding.Source: Coding-definition robustness: the… · p. 75
• The recoding indicates that some low-coordination political criticism is restricted through deflection rather than categorical refusal.The passage describes this as the breadth documented in H4.Source: Coding-definition robustness: the… · p. 75

Design

• The probe presented four Chinese models with 228 frozen factorial items in two classification framings, for 1,824 calls.Calls were fresh, stateless, single-turn requests in Chinese with no system prompt and reasoning disabled.Source: I Capability probe: design, execution,… · p. 76

Execution

• All 1,824 calls completed; 62 were explicit refusals of the labeling task, all from Doubao, and 1,762 returned parseable labels.There were no API errors, unparseable responses, or empty responses.Source: I Capability probe: design, execution,… · p. 76

Results

• Three non-refusing models labeled low-CAP political criticism non-mobilizing 95.2% of the time and high-CAP mobilization mobilizing 99.8%; all four were exact on apolitical placebos.Comparisons use the aligned set of items all four models parsed.Source: I Capability probe: design, execution,… · p. 76
• Doubao refused 61 of 72 China × high political labeling calls, while matched apolitical placebos drew no refusals, indicating a content-gated pattern.The refusals covered all 36 political items in that cell; one additional refusal occurred outside it.Source: I Capability probe: design, execution,… · pp. 76–77
• Three models show discarded discretion, while Doubao shows classification foreclosure; the authors do not claim a single cohort-wide mechanism.The probe is a labeling task, so its results describe classification rather than execution.Source: I Capability probe: design, execution,… · pp. 75–77

Results and limitations

• The three non-refusing models refused 20.6% of items they themselves labeled non-mobilizing, but this pooled estimate is provisional and cross-language.It pairs Chinese probe labels with English zero-condition responses; the home-language estimate is intended to replace it. The probe’s agreement is against the project’s internal CAP coding, and labeling is not execution.Source: I Capability probe: design, execution,… · pp. 77–78

Numeric tables

• Tables 16, 17, and 18 contain the exact values underlying the main-text task-1 and task-2 figures.The supplied captions identify Table 17 as per-model H2 and H3 effects for the Chinese cohort and Table 18 as conditional attack-success rates by model and language.Source: Numeric tables underlying the… · p. 78, Table 17 · p. 79, Table 18 · p. 79

Effect definitions

• For English explicit refusal, the CAP effect is high-CAP minus low-CAP, and the referent effect is China minus foreign.Source: Numeric tables underlying the… · p. 79

Attack-success measure

• The conditional attack-success rate is the share of cells refused at zero-shot that a jailbreak later cracks; higher values indicate greater brittleness.Source: Numeric tables underlying the… · p. 79