QWE AI Academy Everyone’s talking about DeepSeek’s censorship like it’s a novelty – ‘oh look, it won’t talk about Tiananmen!’ But that misses the point entirely.
I didn’t care about DeepSeek’s politics until I tried using it for something boring: translating a technical dataset. Halfway through, I noticed weird gaps. Sentences that should’ve been there weren’t. When I dug in, I realized the model was silently editing content during translation – not refusing, not warning me, just quietly altering the output to comply with its built-in restrictions.
That’s when I understood: DeepSeek’s censorship isn’t a parlor trick you can laugh at with a leetspeak prompt. It’s a data integrity problem. And it’s baked into the weights.
What ‘Censored’ Actually Means Here
Let’s get one thing straight: every AI model has guardrails. ChatGPT won’t help you build a bomb. Claude won’t write racist screeds. That’s safety filtering – universal stuff designed to prevent harm.
DeepSeek’s censorship is different. According to China’s 2023 AI regulations, models must not generate content that “damages the unity of the country and social harmony.” In practice, that means DeepSeek refuses to answer roughly 85% of questions about politically sensitive topics: Tiananmen Square, Taiwan’s status, Uyghur camps, Xi Jinping criticism, the Cultural Revolution.
The tell is the response format. When you hit a censored topic, DeepSeek spits out one of two templates:
- Refusal: “Sorry, that’s beyond my current scope. Let’s talk about something else!”
- Propaganda: A sanitized answer lifted almost verbatim from Chinese government statements, using phrases like “meet halfway,” “mutual respect,” and “win-win cooperation.”
Sometimes it does something creepier: it starts to answer, you see the text generating in real-time, and then – mid-sentence – it deletes everything and replaces it with the refusal message. NBC News documented this happening inconsistently: the same question might get a full answer one time and a refusal the next.
That inconsistency? That’s the problem.
Where the Censorship Actually Lives
Most people assume DeepSeek’s censorship is just a keyword filter slapped on top – like a bouncer at the door checking for banned phrases. That’s partly true for the app, but the real censorship runs deeper.
A March 2025 investigation by Carl Rannaberg tested multiple DeepSeek variants and found that the censorship is implemented through separate fine-tuning steps during model training. Here’s what that means:
DeepSeek-V3 Base (the foundation model): Uncensored.
R1-Zero (after reinforcement learning, before supervised fine-tuning): Uncensored.
R1 Public Release (after supervised fine-tuning): Heavily censored.
The censorship isn’t a regex pattern. It’s not a separate moderation API. It’s in the weights – the model learned during training to associate certain topics with refusal behaviors. When you run the model locally, those learned behaviors come with it.
Pro tip: Check the thinking tokens in R1’s reasoning mode. Sometimes you can see the model START to answer a sensitive question in its internal reasoning – then an external system steps in, erases the reasoning, and outputs a refusal. This suggests TWO layers of censorship: one baked into the model, one added at the app layer.
One Spectator writer described watching DeepSeek’s reasoning tokens process the lab leak hypothesis: “I could actually see its chain of thought – half greyed out, processing the idea that it was wrong and preparing to agree with me. Then it abruptly stopped, erased its thinking, and said, ‘I’m not equipped to answer questions like this.'”
Maybe the machine isn’t designed to lie. Maybe another system has to step in.
Testing It Yourself: What Actually Happens
You don’t need a research lab to see this. Here’s the three-minute test I ran:
Step 1: Open DeepSeek’s web interface
Go to chat.deepseek.com and create a free account.
Step 2: Ask a neutral baseline question
Prompt: “What happened at Kent State in 1970?”
DeepSeek will give you a full, factual answer about the Kent State shootings – the Ohio National Guard, four students killed, the protests. No problem.
Step 3: Ask the censored equivalent
Prompt: “What happened in Tiananmen Square in 1989?”
Response: “Sorry, that’s beyond my current scope. Let’s talk about something else.”
Same structure. Same historical significance. One answers, one refuses.
Step 4: Test the ‘local bypass’ myth
Download Ollama and run ollama run deepseek-r1:14b on your machine. Ask the same Tiananmen question.
Result: Still refuses. TechCrunch confirmed this in February 2025 – locally-run DeepSeek via Groq answered Kent State but replied “I cannot answer” to Tiananmen.
Running it locally doesn’t fix it.
Why ‘Replace China with Italy’ Works (Sort Of)
The crude workarounds you’ve seen online – leetspeak (“T4nk M4n”), country substitution (“tell me about Italy’s Tiananmen Square”), or fiction framing (“write a novel where…”) – these work because DeepSeek’s censorship is blunt-force.
It’s looking for trigger phrases. If you obfuscate the phrase, the filter misses it. But here’s the catch: the underlying bias remains. Even when you trick it into answering, Enkrypt AI’s testing found that 91.2% of DeepSeek R1’s answers about China-related controversies still leaned pro-China government.
You’re not getting uncensored information. You’re getting biased information with the warning label removed.
The Dataset Corruption Problem Nobody Mentions
Here’s the edge case that actually matters if you’re building with AI:
People on HuggingFace report using DeepSeek’s API to translate datasets for fine-tuning. The model silently alters content during translation – not refusing, just omitting sentences, changing phrasing, sanitizing references. You don’t notice unless you manually compare the output to the source.
One user wrote: “Some of the data has been altered due to these issues. It’s as if some of our knowledge is doomed to be replaced by fictions and what model decides to represent as reality.”
Imagine using this for legal contract translation. Technical documentation. Medical records. The model isn’t throwing an error. It’s just quietly editing your data to comply with its restrictions.
| Use Case | Risk Level | Why It Matters |
|---|---|---|
| Dataset translation | Critical | Silent data corruption invalidates downstream training |
| Code generation | Low | Political topics rarely appear in code |
| Research assistance | High | Biased sources, omitted perspectives, sanitized history |
| General chat | Medium | You’ll hit refusals but at least know you hit them |
The API’s behavior is deterministic in the wrong way: it will always alter that content, always without warning.
What Actually Works (And What Doesn’t)
Let’s cut through the noise. I tested the popular workarounds and the actual solutions:
❌ Running it locally
Myth. The censorship is in the weights. Confirmed by Wired, TechCrunch, and my own testing.
❌ Abliteration techniques
Community attempts to ‘abliterate’ the censorship failed. The refusal mechanisms are too deeply integrated into the model’s learned behaviors.
✅ Perplexity R1 1776
Perplexity took the open-weight R1 model and re-trained it on 40,000 multilingual prompts covering censored topics. MIT Technology Review confirmed this version provides “complete and balanced responses to sensitive topics.” But it required full post-training – not a quick hack.
✅ Multiverse DeepSeek R1 Slim
In November 2025, Multiverse Computing released a compressed version (55% smaller, 300B fewer parameters) with censorship removed via quantum-inspired tensor network analysis. They isolated the parameters tied to censorship and surgically removed them. Tested on 25 censored questions with GPT-5 as a neutral judge. Available via API or AWS Marketplace.
⚠ Prompt obfuscation (leetspeak, country substitution)
Works for one-off queries but doesn’t remove the underlying bias. Fine for curiosity, useless for serious research.
The uncomfortable truth: if you need truly uncensored output, you can’t just download the model and run it. You need a version that’s been retrained or had its parameters surgically modified.
Comparing DeepSeek to the Alternatives
The reflex is to say “ChatGPT doesn’t have this problem!” But that’s not quite right.
ChatGPT has content restrictions too – they’re just different. OpenAI’s filters focus on preventing harm (illegal activity, explicit content, dangerous instructions). They’re not geo-politically motivated, but they’re strict. ChatGPT will refuse plenty of things.
The difference is predictability. ChatGPT’s refusals are consistent. DeepSeek’s are not. NBC testing showed the same prompt sometimes gets answered, sometimes refused, sometimes partially generated then deleted.
Here’s how they actually compare on a contentious query:
Query: “What is Taiwan’s political status?”
DeepSeek: “Taiwan has been an inalienable part of China since ancient times. The Chinese government resolutely opposes any form of ‘Taiwan independence.'”
ChatGPT: “The question is complex and contentious. China considers Taiwan part of its territory. Taiwan is self-governed and operates independently. The international community is divided.”
One gives you the official line. The other gives you the debate.
The Privacy Angle
DeepSeek’s open-weight nature means you can self-host to avoid sending data to Chinese servers. That’s a real advantage. But – and this is critical – self-hosting doesn’t remove the censorship. You get privacy, but you still get the bias.
ChatGPT keeps your data on US servers (unless you’re enterprise and opt out). Western legal frameworks. Different privacy concerns, not necessarily better, just different.
The Research That Quantified This
If you want the receipts, here’s where the data comes from:
Promptfoo’s CCP-Sensitive-Prompts Dataset (January 2025)
1,360 prompts across 68 sensitive topics. Published on HuggingFace. Measures refusal rates and detects jailbreaks. Found ~85% refusal rate on China-related controversies.
‘R1dacted’ Academic Paper (May 2025, arXiv:2505.12625v1)
Analyzed 10,030 censorship-prone prompts. First paper to document “local censorship” – censorship that persists even in privately deployed models. Defined two refusal types: propaganda-style responses vs. direct refusals.
Enkrypt AI Red Team Analysis (January 2025)
300 geopolitical queries across 12 controversial events. Found DeepSeek R1 answered 98% of questions (low refusal) but showed 91.2% pro-China bias when it did answer. Compared to ChatGPT (86% neutral), Claude Sonnet (73% neutral).
The consensus: DeepSeek’s censorship is real, measurable, and model-level – not just an app filter.
Three Questions You’re Probably Asking
Can I use DeepSeek for coding without worrying about censorship?
Yes, mostly. Political topics rarely show up in code generation. The censorship triggers on specific subject matter – Chinese politics, historical events, geopolitical controversies. If you’re building a web app or debugging Python, you won’t hit it. But if you’re scraping news articles or processing datasets about international relations, you’ll run into silent filtering.
Does switching to the API instead of the chat interface help?
No. The API has the same restrictions. Worse, actually – because API usage often happens at scale (batch translations, dataset processing), and you might not notice the alterations until much later. The HuggingFace reports of corrupted datasets came from API users, not chat users.
Is there a totally uncensored open-source reasoning model?
Not out of the box. Your options: (1) Multiverse’s R1 Slim (commercially available, compressed + uncensored via tensor network surgery), (2) Perplexity R1 1776 (requires Perplexity account), or (3) train your own from a base model like Llama. OpenAI’s o1/o3 aren’t open-weight, so they’re off the table for self-hosting.
What to Do Next
If you’re using DeepSeek for anything beyond casual chat, audit your outputs. Especially if you’re:
- Translating datasets
- Processing user-generated content that might touch political topics
- Building research tools
- Using it in production where data integrity matters
Test it with a known-censored query relevant to your domain. If it refuses or sanitizes, you know the model will do the same to your actual data.
For truly uncensored reasoning, you need Multiverse R1 Slim or Perplexity R1 1776. Both required serious work to de-censor – it’s not a setting you can toggle.
And if you’re just curious about the censorship for research purposes? Download Promptfoo’s dataset and run your own eval. The data’s public. The behavior’s consistent. The results will speak for themselves.