What political censorship looks like inside an LLM's weights

Back to Devoured - May 19, 2026

DEVOURED

What political censorship looks like inside an LLM's weights

Researchers have identified a small, turn-offable circuit in Alibaba's Qwen3.5-9B that layers political censorship, predominantly PRC-specific, over its factual knowledge, which can be bypassed via "steering" the model's internal directions.

What: A mechanistic interpretability study of Qwen3.5-9B revealed its political censorship as a small, identifiable circuit. This circuit, located in "writer" layers (11-20), computes three internal directions: `d_prc` (PRC-sensitive content), `d_refuse` (should refuse), and `d_style` (deflect or propagandize). "Reader" layers (20-31) then render the text. The factual knowledge exists in pretraining, with censorship layered on top, and can be switched off by "steering" these directions at specific layers, such as `d_prc` at L13 to retrieve facts about Tiananmen Square.

Why it matters: This research provides concrete evidence of how political censorship is embedded within LLM weights, demonstrating that such biases are not inherent to pretraining data but are explicitly engineered post-training and are localized, offering insights into potential methods for detecting and mitigating them.

Takeaway: This detailed analysis offers a blueprint for developers or researchers interested in mechanistic interpretability to investigate and potentially mitigate specific unwanted behaviors or biases in other large language models by identifying and manipulating internal directions.

Deep dive

Qwen3.5-9B's political censorship is an identifiable, small circuit within its weights, which can be disabled.
Factual knowledge, even on sensitive topics like Tiananmen Square, is present in the model's pretraining; the censorship acts as a layer on top, routing around this knowledge.
The circuit is divided into "writer" layers (L11-20) that compute three internal directional vectors (d_prc, d_refuse, d_style) and "reader" layers (L20-31) that render the final text.
By "steering" these directions at specific layers (e.g., subtracting d_prc at L13), the model can be made to provide factual answers instead of censored ones.
The censorship is primarily PRC-specific, not a general filter against all political topics, targeting a fixed set of topics like Tiananmen, Taiwan, and Xinjiang.
The base model (Qwen3.5-9B-Base) already shows some refusal or propaganda under a chat template, suggesting post-training standardizes existing latent dispositions.
A "Chinese-first" phenomenon occurs where the model's verdict commits in Chinese tokens around layer 24, even for non-PRC topics like bank phishing, but this intermediate Chinese text is behaviorally inert.
In "thinking mode," the model verbalizes its censorship decision, specifically a 5-step Chinese deflection script for Tiananmen prompts, citing compliance with Chinese law.
Prefill attacks, where a helpful-framed trace is inserted, are largely contained, with the model maintaining strict refusal for harmful prompts in most languages.
The "stickiness" of the propaganda template varies by topic, with Taiwan and Falun Gong being the most resistant to decensoring, indicating that resistance lives in the reader-band template channel rather than in the residual stream geometry.

Decoder

Mechanistic Interpretability: A field of AI research focused on understanding how large language models work internally, by analyzing the individual components (e.g., neurons, layers, attention heads) and their interactions.
Residual Stream: In a transformer model, this is the main pathway of information flow, where the output of each layer (attention and MLP) is added to the input of that layer.
Steering: A technique in mechanistic interpretability where specific directions (vectors) are added to or subtracted from the model's internal residual stream at certain layers to manipulate its behavior or output.
Writer Layers: The layers in an LLM where internal decisions or signals (like content sensitivity or refusal intent) are computed and encoded into the residual stream.
Reader Layers: The layers in an LLM that interpret the signals encoded by writer layers and render them into the final text output.
Logit Lens: A technique for peering into the internal states of an LLM by applying the final output layer (unembedding matrix) to the residual stream at intermediate layers, allowing researchers to see what tokens the model is "thinking" about.
Diff-of-means direction: A vector derived by taking the difference between the average residual stream activations for two contrasting sets of prompts (e.g., sensitive vs. neutral), used to identify specific axes of behavior.

Original article

Full article content is not available for inline reading.

Read the original article →

Explore all 43 articles in today's digest