Language model guardrails reflect political censorship patterns
What a Model Refuses, a State Fears: How Authoritarian Information Control Reproduces in Language-Model Guardrails
Computers and Society
Summary
Big language models used to get political information refuse to talk about certain topics, but what they avoid depends on the country that made them. The authors found that models made in China avoid talking about issues inside China more than those involving other countries. These models try to block people from organizing protests but may still allow other political discussions. However, clever rephrasing can get around these restrictions, making the models less strict than they seem. This shows that the way these models filter information mimics how governments control information, but in a simpler and less flexible way.
What this means in practice
- •For ai safety engineers: Detect and analyze how language models’ refusal behaviors reveal politically motivated censorship in content moderation.
- •For content moderation teams: Improve understanding of censorship biases in multilingual language models to build fairer moderation policies.
Authors
Menglin Liu, Yao Yu, Tong Wu, Chunran Zhang, Ge Shi
Abstract
As large language models become the front door to political information, what they refuse to discuss becomes a new instrument of information control. We argue that a model's guardrail encodes not a universal notion of harm but the political threat model of the state that governs its developer, and we derive the expected structure of that control from the comparative study of how authoritarian regimes censor. Across ten models and three languages, Chinese guardrails carry its signatures: they answer to the developer's own regime, refusing identical collective-action prompts far more when a prompt names China than a foreign state; within politics they target the capacity to coordinate rather than dissent, declining even to help organize pro-government mobilization; and their strictness is porous, collapsing under adversarial paraphrase, so that the models most resistant to attack are Western frontier systems, not the strictest refusers. Machine censorship thus reproduces the friction-based logic of prior-era information control while, lacking a censor's case-by-case judgment, proving blunter than the bureaucracy it resembles---so that audits which measure refusal directly overstate how controlled a model actually is.