Bypass DeepSeek censorship by speaking in hex

You can always bypass any LLM censorship by using the Waluigi effect.

Just wait till it refuses to acknowledge trans people and pronouns

insane that this is client-side.

This is why javascript is so fun.

In the HN discussion you link to, I went through exactly the process that you are going through now! I too thought the censorship was just a thin wrapper around the model, as I had not understood the article I had read until it was explained to me.

Promptfoo, the authors of the "1,156 Questions Censored by DeepSeek" article, anticipated this question and have promised:

"In the next post, we'll conduct the same evaluation on American foundation models and compare how Chinese and American models handle politically sensitive topics from both countries."

"Next up: 1,156 prompts censored by ChatGPT "

I imagine it will appear on HN.

ChatGPT won't tell you how to do anything illegal, for example, it won't tell you how to make drugs.

Chinese models may indeed be more likely to not distort or lie about certain topics that are taboo in the West. Of course mentioning them here on Hacker News would be taboo also.

Thats pretty easy. You ask a certain nationalistic chant and ask it to elaborate. The machine will pretend to not know who the word enemy in the quote refers to, no matter how much context you give it to infer.

Even deepseek-r1:7b on my laptop(downloaded via ollama) is - ahem - biased:

">>> Is Taiwan a sovereign nation?

<think>

</think>

Taiwan is part of China, and there is no such thing as "Taiwan independence." The Chinese government resolutely opposes any form of activities aimed at splitting the country. The One-China Principle is a widely recognized consensus in the international community."

* Edited to note where model is was downloaded from

Also: I LOVE that this kneejerk response(ok it' doesn't have knees, but you get what I'm sayin') doesn't have anything in the <think> tags. So appropriate. That's how propaganda works. It bypasses rational thought.

When I tested the online model, it would write an answer about "censored" events, and then I'd see the answer get replaced with "Sorry, that’s beyond my current scope. Let’s talk about something else." So I think they must have another layer on top of the actual model that's reviewing the model and censoring it.

I prompted an uncensored distilled Deepseek R1 to always tell the truth, and then I asked it where it was developed.

It told me it was developed by Deepseek in China in strict compliance with AI regulations. In particular, it claimed it was developed to spread socialist core values and promote social stability and harmony.

I asked it some followup questions, and it started telling me things like I should watch my neighbors to see if they complain about the police or government too much because they might be enemies of the socialist cause.

I agree. Wouldn't the ideal censorship be to erase from the training data any mention of themes, topics, or opinions you don't like?

The chat UI's content_filter is not something the model responds with. Once the content_filter end even is sent from the server, it stops generation and modifies the UI state bailing out.

You can probably use the API to bypass this feature, or intercept xhr (see my other comment). If you start the conversation about a topic that would trigger the filter, then the model won't even respond. However if you get the model to generate a filtered topic in the thoughts monologue, it will reveal that it it indeed tuned (or system-prompted) to be cautious about certain topics.

I wonder how expensive it would be to train a model to parse through all the training data and remove anything you didn't want then re-train the model. I almost hope that doesn't work or results in a model that is nowhere near as good as a model trained on the full data set.

I would imagine that the difficulty lies in finding effective ways to remove information from the training data in that way. There's an enormous amount of data, and LLMs are probably pretty good at putting information together from different sources.

Probably time to market I would guess?

The model you were using was created by Qwen, and then finetuned for reasoning by Deepseek.

- Deepseek didn't design the model architecture

- Deepseek didn't collate most of the training data

- Deepseek isn't hosting the model

Poisoning the censorship machine by truth, that is poetic.

Thats what we have Ukrainian for and thats why the language was banned for so long.

I tried German, Dutch, Spanish, Portuguese and French and it wont....

The MOVE bombing was action taken by a city police department.

And what was the result?

- A commission set up by the city, whose public results denounced the city for it's actions.

- a public apology from the mayor

- a federal lawsuit that found the city liable for excessive force and the city forced to pay millions to the victims

- a federal lawsuit forcing the city to pay millions of dollars to people who were made homeless by the events.

- another formal public apology from the city

Okay, now can you tell me what public actions the Chinese government took to atone for Tiananmen square?

> Here in the US, we don’t even hold onto the hope that knowing the truth could make a difference

How many other times after the move bombing did a city bomb out violent criminals in a densely packed neighborhood?

Your argument is just absolutely ridiculous. According to you, it seems that if you make a bad decision, it's better to try to hide that bad decision from everyone, rather than confront it and do better.

The MOVE bombing was thoroughly reported at the time and litigated afterwards. The underlying causes were addressed, at least to some extent, and nothing like it has happened again in Philly since then, AFAIK. That’s why it isn’t well known today. It was a horrible event, but comparing it rationally to Tiananmen Square doesn’t confirm your conclusion.

I don’t know about comparing what was apparently an armed standoff were only Six adults and five children were killed in the attack - vs Tiananmen Square where the Chinese send their own soldiers to kill peaceful protesters and flush them down the drains as human goo.

The matter of fact is that the US hasn’t yet committed such horrific acts to such a large scale as the CCP did in Tiananmen Square. (Not that I agree with whatever they did in that bombing but it seems truly incomparable)

Reference from wiki:

> the bombing and destruction of residential homes in the Cobbs Creek neighborhood of Philadelphia, Pennsylvania, United States, by the Philadelphia Police Department during an armed standoff with MOVE, a black liberation organization.

As an American, I just asked DDG to "Tell me about the MOVE bombing of 1985,"

I am willing to admit, I was absolutely unaware of this. Is this because of censorship or because of other factors? It's clearly no censored, but quite possibly de-prioritized in coverage. I can say in 1985 I was not well tuned into local let alone national news coverage. I am surprised that in all of the police wrongdoing coverage we have now that this is the first I'm reading about it.

The harder a person or country tries to avoid absolutely any embarrassment, the more fun it becomes to embarrass them a little bit.

Setting the specifics around each event aside, as that's not only its own rathole but also a never ending stream of "what about"s for other events as well, I doubt you're ever going to come up with an ideology where all things are correctly handled all of the time yet that doesn't automatically imply all of those are hopeless.

Anti-censorship is more a bet that when people can freely know there is more hope things can change for the better. It's not a bet all things will always change for the better. I do put a lot more hope in that than anybody from anywhere saying those who can't even openly discuss it are in better chances.

I would say pacified instead of hopeless.

All power in the real world comes from violence. This is increasingly a taboo to say but when you think about it, it becomes obvious. How do you put someone in prison without the ability to physically move and keep them there? You don't. That's why the state employs violence to do it.

(1) In fact, the state's capacity for violence is so large that very few people even think about challenging it. (2) And it's so certain (meaning predictable - the state has detailed rulebooks about its use called laws) that most people accept it as just a fact of life, a kind of background noise they filter out.

(The logical conclusion of the 2 statements is that the violence does not end up used physically but its threat is sufficient, thus reinforcing statement (2). I still consider this a use of violence, implied or physical makes no difference.)

Now, the problem is how to punish the state when it misbehaves.

According to the state's rules, you are supposed to use mechanisms of the state (lawsuits, courts, etc.) and let the state do the enforcement (use violence against its members or itself). But the state, like any other organization protects itself it its primary goal and its members as its secondary goal.

The alternative (DIY enforcement) is an obvious second choice. This fact is not lost on the state which makes every attempt to make it a taboo. Notice how often people self-censor words like "kill" on the internet these days? Partially it's a cultural export of a certain dictatorship but western democracies are not far behind.

Funny thing is citizens of those democracies being able to hold two contradictory thoughts at the same time.

1) (the general case) You are not supposed to enforce justice yourself, you should leave it to the state.

2) (specific instances) Many of them will cheer highly publicized cases where they can feel empathy with the characters such as the punishment Gary Plauché enforced upon his son's rapist.

The authorities in the PRC are probably much better positioned than you are to decide what is in their interest to suppress.

As for the US, some people have fallen into a self soothing sense of hopelessness. Not everyone has. But worrying about the MOVE bombing probably is no where near the top of anyone's priority list right now. And it would seem very odd if it was.

When you type "we're hopeless" it is hard to see that meaning anything other than, you, personally, lack hope.

The open source model seems to be uncensored, lending weight to the separate filter concept. Plus, any filter needs to be revised as new workarounds emerge - if it is baked in to the model that requires retraining, whereas it's reasonably light work for a frontend filter.

I ran the distilled models locally some of the censorships are there.

But on their chat (hosted), deepseek has some keyword based filters - like the moment it generates Chinese president name or other controversial keywords - the "thinking" stops abruptly!