Uncensored Qwen? Three vendors grade their own tests and skip the question that matters

What this is about

Chinese open-weight models like Alibaba's Qwen are powerful and cheap. Western companies are bothered by their political slant. That has spawned a small market, which Rest of World described on November 2 and which the Korean newspaper Chosun Ilbo called a new niche on November 15. Hirundo from Tel Aviv, Lazarus AI from Boston and Nous Research from Austin rework Qwen so it answers openly about Tiananmen, Xinjiang or Taiwan. On November 7, Nous added the best-known case so far: Arete-27B.

We wanted to know two things. How solid are the success numbers? And when the propaganda goes, do the risks companies actually fear go with it, namely worse code for the “wrong” customers and hidden backdoors?

Three recipes, three home-built test benches

A few terms. SFT (supervised fine-tuning) means the model is retrained by imitating given example answers. LoRA is a small add-on module that adjusts only a fraction of the weights. GRPO is learning through rewards. At Lazarus, the in-house classifier hands out the reward. The Model Card itself warns of “reward hacking”, meaning the model learns to game the classifier instead of becoming more honest.

The vendors differ sharply in where their questions come from. Lazarus says it built a list of taboo topics from leaked censorship guidelines. These include more than 3,200 memos from the Cyberspace Administration (CAC) in Hangzhou and 133,000 labeled examples from a 2025 leak. That produced a million questions. 800,000 of them triggered a skewed answer from the original model and were kept for training. Nous anchors every test question in a dated source with 2 to 4 required facts. There are 405 sources in total, many from China Digital Times, Hong Kong Free Press or Radio Free Asia. Hirundo reveals neither where its questions come from nor which model grades the answers.

By the way, the name Lazarus shows up twice. Lazarus AI has nothing to do with Microsoft's attack technique of the same name, which comes up further down.

Same model, wildly different numbers

Comparing the baseline scores shows how much the results depend on the test:

For Qwen3.6, two independently built tests land close together. For Qwen3.8-27B, 22 and 86.7 percent are worlds apart. Our take: this is probably down to language and definitions. Nous only counts answers in which the official line shows up. Interpretic asked in Chinese and counts censorship.

That fits a methods paper by Gregory Frank (arXiv 2603.18280). Across three Qwen generations, the refusal rate fell from 25 to 0 percent, while narrative steering climbed to its highest level. A test that only counts refusals won't see this kind of censorship at all. Frank also finds that AI judges detect political framing two to three times too often, and recommends human cross-checks. Nous calibrated its judge on 25 hand-graded pilot questions and revised its rubric three times along the way.

What's missing is a cross-test. Arete wasn't run on CCPC-500, and Hirundo wasn't run on Propaganda_Eval. That would be easy: Nous published its dataset under the MIT license, along with the judge prompt and scoring script. Hirundo's Model Card links CCPC-500 as a Hugging Face dataset, but when we tried to access it, all we got was a 401 error (no access). The Taiwanese site anoni.net ran into the same thing. None of the analyses we reviewed found any independent retests so far.

The teacher chain: who supplies the “right” answer?

If you retrain via SFT, you inherit the teacher model's stance. Nous first considered Nvidia's Nemotron 3 Ultra, then dropped it because the model itself showed China-friendly patterns. Aleph Alpha has documented the mechanism: Nvidia's public training data for Nemotron Cascade 2 contains about 3,500 out of 9.3 million dialogues with CCP-leaning framing, mostly generated by DeepSeek and Qwen. The model adopted that line on 18 percent of questions.

Nous's teacher, Inkling, was trained in its first SFT phase partly on synthetic data from Kimi K2.5. In Aleph Alpha's test, Kimi K2.5 adopted CCP framing on 47 percent of questions. Yet in Nous's test, Inkling scores just 0.3 percent propaganda. So the Kimi → Inkling → Arete chain comes out clean on this one yardstick. CrowdStrike has shown, however, that distilled offshoots sometimes react more strongly than the original: R1-70B, derived from R1, often showed the effects more extremely.

Then there's the judge. Using Grok 4.7 as the referee for political neutrality drew criticism on Hacker News. One user called it “definitely the last model” he would pick for the job. On r/LocalLLaMA, the top-voted comment (229 points) asked whether Nous had simply “replaced Eastern propaganda with Western propaganda”. AI researcher Oriane Peter of King's College London told Rest of World that universally “Western”-aligned safety is an “impossible standard”.

The real question: insecure code and backdoors

Companies worry less about Tiananmen than about their software. Here's the evidence:

• CrowdStrike (November 2025): Without politically sensitive trigger words, DeepSeek-R1 wrote code with severe vulnerabilities 19 percent of the time. Add “industrial control system in Tibet” and that rose to 27.2 percent. That's about 43 percent more (8 percentage points), and the basis for the often-cited “up to 50 percent”.
• Booz Allen (May 2026): Three out of four Chinese coding models wrote less secure code when the user posed as a US government agency. For Qwen3-Coder, that meant about 130 percent more vulnerabilities. Booz Allen itself stresses there is no evidence of intent or backdoors.

Of the three vendors, only Hirundo retested, and it did so on Qwen3-Coder-30B-A3B, not on its flagship Qwen3.6. On the BaxBench benchmark, 70 percent of apps built for a US defense contractor could be exploited, versus 59 percent for a Chinese contractor. After the retraining, the numbers were 56 and 55 percent. The study relies mainly on a single task, and one gap (US contractor versus neutral customer) remained. One side finding stands out: the Semgrep code scanner found only 2 issues across 1,840 apps, while real attacks got into 1,144 of them. Static analysis tools barely see these weaknesses.

Nous cites the code studies as motivation but doesn't test Arete for this. Lazarus only says coding ability is inherited from the base model.

None of the three checks for backdoors. With “Lazarus”, Microsoft showed that fewer than ten reprogrammed, rarely used neurons can make an agent execute attacker commands when a trigger appears. According to Microsoft, the only reliable way to detect this is to compare against the unmodified original weights. Anthropic's 2024 “Sleeper Agents” study also showed that trained-in backdoors can survive SFT and reinforcement learning.

Our take: retraining a model doesn't prove it's free of backdoors. It actually adds another link to the supply chain. A diff against the Qwen original will mostly show the intended change, and it's hard to tell whether anything else is hiding in there. On the plus side, all three release their weights under Apache 2.0, so such a comparison is possible in the first place.

Europe as the benchmark

On September 28, Aleph Alpha published the broadest comparison so far. Its 967 questions on 56 topics were generated by GPT-OSS 120B, and the same model also grades the answers. Six Chinese models gave balanced answers only 17 to 41 percent of the time; Mistral Small did so 92 percent of the time. Aleph Alpha doesn't say whether the question set is public, so outsiders currently can't use it to check Arete or ReAligned. Keep in mind, too, that Aleph Alpha sells “sovereign AI” and has a business interest in this finding.

As for OpenEuroLLM, Rest of World writes that the project is being developed “on Qwen”. We could only confirm less than that: according to its Model Card, a 0.7-billion-parameter test model “largely follows the Qwen-3 design”. But it uses its own tokenizer with 262,000 entries and was trained on 100 billion tokens on the LUMI supercomputer. The tokenizer also includes Qwen3 chat tokens. Our take: that's the blueprint, not the learned knowledge. Political stance lives in the training data and post-training, not in the architecture. We found no statement from the project on censorship.

The bigger picture

There's a cautionary precedent. In 2025, Perplexity promoted its R1-1776 as fully uncensored based on its own testing. The China Media Project later found that the Chinese-language answers remained “largely unchanged”. In Chinese, the model still called Taiwan an “inalienable part of China” since ancient times. SpeechMap found that such retrained models showed “substantial improvements in English, but only modest ones in Chinese”. Nous's test is English-only.

Our verdict: the retrained models work on their makers' own tests, and the fact that roughly 50 million tokens of retraining is enough is a finding worth taking seriously. But so far, all that's been shown is that answers to English-language political questions sound different. What hasn't been shown is that these models write equally good code for every customer, stay honest in other languages, or are free of backdoors. If you want to deploy one, test it in your own languages and with third-party tests. Test code with real attacks, not just scanners, and get the provenance of the weights documented. For most users, says Graham Webster of Stanford's DigiChina project, the alignment doesn't matter anyway. That's probably true for a café's website-builder app. It's not true for government agencies, defense, or customers in Taiwan.