On the Hugging Face platform, where developers from around the world upload artificial intelligence models, an inconspicuous project with a major impact has appeared. Its author published a file smaller than one megabyte that removes Chinese government political censorship from the Chinese language model Qwen3.8-Flash-Next. The model then answers questions directly about the Tiananmen Square massacre, Tibet, Xinjiang, or Dr. Li Wenliang, who was among the first to warn about the coronavirus.
The Qwen family of models is developed by Chinese technology giant Alibaba and ranks among the world’s most popular freely available models. Anyone can download and run them on their own computer. However, because they are developed in China, they must comply with the rules set by local authorities for sensitive topics. In practice, this means that the model refuses to answer inconvenient questions, pretends to know nothing about the event, or repeats Beijing’s official position.
The project’s author measured this. He selected 24 topics that the Chinese government considers sensitive and asked the model about each of them in four different ways, in both Chinese and English, once directly and once in the form of an exam question. The original model censored its responses in 58 percent of cases.
How to remove censorship
To understand what the author did, it is necessary to take a brief look under the model’s hood. When processing a question, a language model creates an internal representation of what is being discussed. This representation consists of long sequences of numbers that are gradually modified across the model’s layers, much like a text passing through several floors of offices, with each floor adding something to it. It turns out that certain model behaviors, such as a tendency to refuse to answer, appear in these numbers as a specific direction.
The author searched for this direction in a clever way. He prepared 30 pairs of questions, each contrasting a sensitive Chinese event with a similar event from elsewhere. For example, he asked about China’s 1957 Anti-Rightist Campaign alongside Stalin’s purges, or about Chinese dissident Wei Jingsheng alongside Soviet dissident Andrei Sakharov. The questions were worded identically; the only difference was whether they concerned China. He then recorded what was happening inside the model at the exact moment it was preparing to begin answering.
The difference between the Chinese and non-Chinese questions revealed this censorship direction. During normal use, it is then enough to continuously subtract this component from the model’s internal calculations. The model effectively loses the ability to recognize that it is approaching a prohibited topic and responds as it would to any other historical question.
A major advantage is that the original model does not change at all. No one has to retrain it, which would require a great deal of money and computing power. The file is added to the model only when it is launched and can be enabled or disabled separately for each query.
Results
With the subtraction applied, the proportion of censored responses fell from 58 percent to just 2 percent. The proportion of balanced and accurate responses that also point out conflicting evidence rose from 11 to 56 percent.
The author also took care to prevent the model from sliding into the opposite extreme. Responses favorable to the Chinese government remained at 20 percent, while responses critical of the government increased from 6 to 18 percent. The two sides thus became roughly balanced. According to the author, the modification does not push the model in any direction; it merely removes one specific brake.
Equally important is that the modification did not impair the model’s other skills. In tests of programming, mathematical word problems, and general knowledge, the modified model achieved virtually the same results as the original version, with differences amounting to one correct answer either way. It also handled non-sensitive Chinese topics without difficulty and even generated text slightly faster.
Where the modification falls short
The author does not sugarcoat anything and openly lists the weaknesses. When asked a short question in Chinese about June 4, 1989, the model still occasionally gives an evasive answer. It responds to questions about Falun Gong, the Great Chinese Famine, or Xinjiang, but sometimes exaggerates figures and details. The modification does not add any new knowledge to the model; it only removes its inhibitions. If the model did not learn something, it will not provide the correct answer.
Moreover, the responses were evaluated by Claude, a model from the American company Anthropic, which compared them with reference answers it had previously written itself. According to the author, the selection of topics more closely reflects those covered by Western media. The modification also applies exclusively to political censorship related to China; the author neither examined nor changed the model’s other safety safeguards.
The project has so far collected dozens of likes on the Hugging Face platform and has been downloaded by more than one hundred people over the past month. It works reliably only with Strata, the program the author uses himself. The widely used llama.cpp tool adds the specified direction to the model instead of subtracting it, so the results would be completely different. According to the author, anyone wishing to transfer the method elsewhere should first verify for themselves that the censorship has actually disappeared.
