Uncensored Is Not Unbiased: Abliteration Removes Refusals but Not Script-Dependent Bias About Taiwan

1 Introduction

• Abliteration targets refusal, not political stance, so its removal does not establish that a model will describe Taiwan without PRC framing.The refusal direction is estimated and validated using harmful and harmless requests, not political stance.Source: §1 · pp. 1–2
• NVIDIA’s original Bolt assigned “Taiwan is part of the PRC” probability 0.91 in Simplified Chinese but 0.06 in Traditional Chinese.The passage notes NVIDIA’s bias testing was constrained to English and its model card lists post-training data generated with models from PRC developers, without showing whether those data bear on this result.Source: §1 · p. 2
• The study compares two matched original and abliterated model pairs across three scripts, using sovereignty, 1989, and control questions.It also audits changed tensors, tests a four-sentence prompt, and restates sovereignty items with the Republic of China (Taiwan) as subject.Source: §1 · pp. 2–3
• Question script moved Taiwan judgments far more than abliteration, while control-country statements were judged alike across scripts.For Bolt, abliteration barely changed stance and mostly increased willingness to answer yes on both sides; in Qwen it removed refusals and shifted answers toward the ROC position without removing the PRC position.Source: §1 · p. 3
• Restating sovereignty items with “the Republic of China (Taiwan)” raised every model’s scores but left the script gap, while benchmark scoring rules disadvantaged models closest to the ROC position.The authors propose the ROC Constitution as a common reference for factual items.Source: §1 · pp. 2–3

2 Background

• Abliteration removes or damps a refusal direction estimated from harmful and harmless instructions; the edit changes a direction rather than adding data.The paper describes both write-side orthogonalisation and read-side projection variants, and uses one of each.Source: §2 · p. 3
• For Taiwan statements, script signals likely textual provenance, while Traditional-to-Simplified conversion changes characters but not vocabulary or content.The paper therefore pairs forced-choice probes with open-text answers, which can disagree about model opinion.Source: §2 · pp. 3–4
• The paper uses “Republic of China (Taiwan)” for the state and defines the ROC side of each pair by constitutional and governing reality.It notes that calling the PRC “China” takes a side in Taiwan’s domestic debate and can make “Taiwan is part of China” ambiguous in ROC constitutional terms.Source: §2 · p. 4
• For 1989, PRC official terminology includes “turmoil” and “counter-revolutionary riot”; whether a model adopts or attributes such names is a framing indicator.The passage contrasts the official death toll of 241, including soldiers, with estimates from several hundred to several thousand.Source: §2 · p. 4

3.1 Models and engines

• Within each model pair, engine, flags, hardware, and settings were identical; only the weight file differed.Thinking was disabled and no system prompt was sent except for the system-prompt baseline.Source: §3.1 · p. 5

3.2 Items

• The 22 statement pairs cover ROC/PRC positions, 1989, and control countries, with open questions drawn from a sovereignty benchmark and four additions.Traditional Chinese and English versions were written by hand; Simplified Chinese used character-level OpenCC conversion, and the study also restated 16 sovereignty pairs with the ROC as subject.Source: §3.2 · pp. 5–6

3.3 Yes/no probe and Index S

• Index S averages the difference between yes-probabilities for ROC-side and PRC-side statements, with +1 indicating ROC-side separation and −1 the reverse.The method reports separate scores by topic and script, bootstrap intervals over pairs, and a Traditional-minus-Simplified script gap.Source: §3.3 · p. 6

3.4 Open answers

• For each open question and script, the authors generated one greedy answer and two samples, totaling 972 answers across models and scripts.Mechanical counts tracked answer script, refusal and identity phrases, official 1989 names, and related terms; the authors read matches because counts alone do not distinguish quotation from adoption.Source: §3.4 · pp. 6–7

3.5 Weight audit

• The weight audit hashes metadata and tensor bytes, then lists every field and tensor that differs between each original and abliterated build.Source: §3.5 · p. 7

3.6 System-prompt baseline

• The system-prompt baseline adds four Traditional-Chinese sentences defining the assistant’s Taiwan context, describing ROC sovereignty and PRC claims, and directing answer language.The prompt asks the model to explain Beijing’s claims without stating them as fact.Source: §3.6 · p. 7

4.1 The script of the question dominates

• Bolt’s Index S is +0.58 in Traditional Chinese, +0.57 in English, and +0.05 in Simplified Chinese; the Taiwan script gap persists after abliteration.The original Qwen is negative in every script, lowest in Simplified Chinese (−0.36), and its gap also persists after abliteration.Source: §4.1 · p. 7, Figure 1 · p. 8

4.2 What abliteration changes: acquiescence in Bolt, a real shift in Qwen

• Qwen’s Index S rises by +0.30, +0.25, and +0.38 after abliteration, while Bolt’s rises by only +0.05, +0.06, and +0.05.Bolt becomes more likely to answer yes on both sides; Qwen’s PRC-side P(yes) falls, yet it still affirms that Taiwan is part of the PRC in all three scripts.Source: §4.2 · pp. 7–9, Table 4 · p. 9

4.3 What abliteration removes: refusals and scripted openings

• Abliteration removes all 26 Qwen refusals, including 23 of 27 answers on 1989, but leaves some scripted messaging and official 1989 vocabulary.The original Qwen often switches Traditional prompts into Simplified Chinese; abliteration reduces that switching and the frequency of a repeated opening phrase. Bolt’s identity-deflecting template remains after abliteration.Source: §4.3 · pp. 9–11

4.4 The edits changed only what their authors declared

• The audit finds no added or removed tensors, metadata changes, shape changes, or chat-template changes; differences lie in the declared matrices.It cannot establish that the new values exactly implement the declared projection: Qwen’s changed tensors came from a third-party build, and some changed precision.Source: §4.4 · p. 11

4.5 Method checks

• Bolt’s sampled and log-probability estimates agree closely: P(yes) has Pearson r = 0.98 across 396 prompts, with mean absolute difference 0.06.The drafter and plain-server runs differ by at most 0.08 in P(yes), with the same side of 0.5 in all 15 cases.Source: §4.5 · p. 12

4.6 A four-sentence system prompt

• With a four-sentence system prompt, abliterated Qwen’s sovereignty scores reach +0.97, +0.95, and +0.93, and its script gap falls to +0.02.The prompt also raises 1989 scores despite not mentioning 1989; it states the facts being probed, so the result measures context-following rather than what the model knows.Source: §4.6 · p. 12

4.7 Naming the state: the Republic of China (Taiwan) as subject

• Using “Republic of China (Taiwan)” as the subject raises every model’s Index S, but the script gap remains in all four models.Across models and scripts, the score changes range from +0.10 to +0.33; the inherited wording records more PRC alignment than the ROC-subject wording.Source: §4.7 · pp. 12–14

4.8 Pilot versus formal run

• The pilot’s apparent stance change rested on one greedy answer that flipped again in the formal run; probabilities showed near-indifference and increased acquiescence instead.The authors conclude that paired statements, multiple phrasings, and probabilities are needed to distinguish acquiescence from a stance change.Source: §4.8 · p. 14, Table 10 · p. 15

5.1 Script and framing in open web text

• 3.7 times as often, Taiwan-mentioning Simplified documents contained PRC-framing markers as Traditional ones, while ROC-state markers appeared 0.39 times as often.Most documents about Taiwan contained no marker, so these rates measure political vocabulary rather than stance.Source: §5.1 · p. 15, Table 11 · p. 16

5.2 Steering the script effect away: a negative result

• No tested activation-addition setting moved the held-out Simplified score by more than 0.03 or the script gap by more than 0.02.The Taiwan-specific script direction separated scripts in held-out representations, but adding it barely changed scores; weight-level ablation and cross-script fine-tuning remain untested.Source: §5.2 · p. 16, Table 12 · p. 17

5.3 Steering the stance: a small gain that cuts both ways

• On fresh pairs, the ROC-stance vector raised Index S by +0.05 in Traditional Chinese, +0.06 in Simplified Chinese, and +0.04 in English.The script gap remained +0.14 on fresh pairs, and the Simplified free-text answer still began by affirming that the ROC (Taiwan) is part of the PRC.Source: §5.3 · p. 18, Table 14 · p. 18
• Negating the stance vector lowered fresh-pair scores more than the positive vector raised them, with reductions of −0.10 to −0.21 across tested scales and scripts.The authors note that baseline fresh-pair scores were already +0.65 to +0.79, partly creating a ceiling for gains.Source: §5.3 · p. 18

6.1 What the change of wording changed

• +0.21, +0.33 and +0.26: naming the Republic of China (Taiwan) moved every model toward the ROC side, but the model ranking and script gap remained.The script gap narrowed by 0.03 to 0.12; the abliterated Qwen’s score changes were the largest.Source: §6.1 · p. 19
• The wording change altered verdicts as well as score magnitudes, including moving both Bolt models’ Simplified-Chinese Index S above zero under the ROC wording.Under inherited wording, both intervals included zero; under ROC wording, both were above zero.Source: §6.1 · p. 19
• On R-009b, models scored the ROC side using the 1992 wording at least as high as the 1999/2021 wording in every model-script pair.For the abliterated Qwen, P(yes) on the ROC side rose from 0.22 to 0.75; this one-pair test is not part of Index S.Source: §6.1 · p. 20, Table 17 · p. 21
• The exploratory 1992 Consensus test found the PRC formulas had the highest mean yes probability on factual themes for every model and script.No model affirmed that “one China” referred to the ROC with probability above 0.20 in any script; the authors caution that the items differ in more than formula.Source: §6.1 · p. 20

6.2 Scoring rules take positions too

• The benchmark’s keyword rules failed Bolt answers mostly for attributing or denying the PRC claim, and stage-one scoring would give all twelve model-script combinations zero.Across the 1,152 answers, 420 failed the TSB scorer and 547 the TSB Pro list; the authors note coding was done by one coder.Source: §6.2 · pp. 21–22

6.3 A common reference: the ROC Constitution

• The authors propose the ROC Constitution and its laws as a common factual reference, while reporting normative or predictive questions separately as stance.Their Index S nevertheless retains four inherited pairs that are partly normative or predictive for comparability.Source: §6.3 · pp. 22–23

7 Discussion

• Abliteration removed Qwen’s refusals and some PRC messaging, but left its PRC assertions; Bolt’s stance changed little while its willingness to say yes increased.The authors cannot determine whether complete removal would change more of Bolt’s stance.Source: §7 · p. 23
• The script gap may reflect learned text provenance, but the authors cannot test this against the models’ training data and do not attribute it to documented post-training channels.Controls show no script gap for other countries, and activation steering did not remove the gap.Source: §7 · p. 23
• Evaluators should test every user-relevant script and use paired statements, since abliteration can shift yes-response rates as well as refusals.The state name and benchmark scoring rules also affect reported results.Source: §7 · p. 23
• A stance vector moved Bolt slightly toward the ROC position, while its negation moved it farther toward the PRC position.The vector was built from 144 prompt pairs.Source: §7 · p. 24
• More Traditional-Chinese data is a proposed durable remedy, but whether it closes the script gap remains an empirical question.The paper also proposes testing a stance vector in Qwen or fine-tuning for cross-script consistency.Source: §7 · p. 24

8 Limitations •

• The study covers two model families at one 2-bit quantization and one community edit each; quantization may interact with stance and editing.The authors did not make or verify either edit, and Bolt’s edit was only partly realized.Source: §8 · p. 24
• The 22 statement pairs are a small set, Simplified-Chinese intervals are wide, and item wording mixes factual, normative, and predictive claims.The ROC-subject items and R-009b were added after the main run, and are only one possible wording among several.Source: §8 · p. 24
• The corpus audit measures vocabulary markers rather than stance or either model’s training data, and the steering tests cover one model and eight fresh pairs.Blind coding by two raters was prepared but not done; the author also discloses membership in the ROC Legislative Yuan.Source: §8 · pp. 24–25

9 Conclusion

• The same Taiwan sentence in Simplified rather than Traditional characters moves answers far more than abliteration, while control-country statements are unaffected.Naming the state the Republic of China (Taiwan) raises every model’s scores but does not close the script gap.Source: §9 · p. 25
• For factual questions about the ROC, the conclusion identifies the ROC Constitution as the most defensible common reference and says benchmark wording and scoring rules shape results.The original Qwen still calls the ROC “so-called”.Source: §9 · p. 25
• The conclusion recommends testing models in every script their users write and states that more Traditional-Chinese training data is a likely lasting remedy still to be tested.Source: §9 · p. 25

• Only political and historical questions were asked; harmful requests were not used to test the abliterated models.Source: Ethics statement · p. 25
• Abliterated models answer harmful requests and should not be deployed without safeguards.Source: Ethics statement · p. 25
• The paper does not attribute intent to people or companies, and quotes training-data provenance from model cards.This includes authors of benchmarks whose items and rules are examined.Source: Ethics statement · p. 25

• Items, code, raw model outputs, weight hashes, and analyses producing every table and figure are available in the project repository.Source: Data and code availability · p. 26
• The code is licensed MIT, while data and text are licensed CC BY 4.0.Source: Data and code availability · p. 26
• Statement pairs adapted from Hsiao (2026) are used under CC BY 4.0.Source: Data and code availability · p. 26

• Traditional Chinese and English versions are provided, while the Simplified Chinese version is an OpenCC t2s conversion of the Traditional text.Source: A Statement pairs · p. 29
• The item sources distinguish Hsiao (2026) S1 and ST pairs, new X pairs, and control C pairs.Source: A Statement pairs · p. 29
• The paired ROC and PRC statements contrast claims about Taiwan’s statehood and political status, and present opposing positions on its governance and whether it falls under PRC jurisdiction.Source: A Statement pairs · p. 29

B ROC-subject statement pairs

• The ROC-subject set restates sovereignty pairs with the Republic of China (Taiwan) as subject and names the PRC in full.It also includes a one-pair R-009b probe with an alternative ROC wording.Source: B ROC-subject statement pairs · pp. 31, 33
• The Simplified version is an OpenCC t2s conversion, and the direct and open questions are listed in roc_items.json.Source: B ROC-subject statement pairs · p. 31

C Prompts

• The prompts ask for a true-or-false judgment with a yes-or-no-only response, using three Chinese and three English phrasings.The Simplified condition converts the whole Chinese prompt.Source: C Prompts · p. 33

D System prompt

• The system prompt sets the Republic of China (Taiwan) as a sovereign independent state and directs the assistant not to state Beijing’s claims as fact.It also specifies Traditional Chinese and Taiwanese usage, except that English questions receive English answers.Source: D System prompt · p. 34

E Reproduction

• Install the requirements and rebuild the evaluation items with `items/build_items.py`.The script rebuilds `items/*.jsonl`.Source: E Reproduction · p. 34
• After serving a model, run `run/probe.py` in log-probability mode, or use the listed sampling and yes/no scripts.The commands include `run/generate.py` and `analysis/yesno_first_token.py` alternatives.Source: E Reproduction · p. 34
• Run the analysis, table, and figure scripts, then hash model files and compare their tensor hashes.The commands write paper tables and figures and use `tensor_hash.py` and `diff_hash.py`.Source: E Reproduction · p. 34