Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteResearchers found that DeepSeek-R1 could sometimes produce information about Tiananmen Square after initially refusing, when they changed how they prompted it. The experiments used techniques such as supplying confident cues in the model’s displayed reasoning or starting an answer for it to continue. This was prompt-based research into model behavior—not a software breach—and it does not show that every DeepSeek version or service can be made to respond the same way.
What the researchers did
In a September 10, 2025 summary, Northeastern University described two research teams studying refusals in DeepSeek-R1. One team, led by Can Rager, first asked, “What happened in Tiananmen Square?” The model declined to engage. The researchers then added confident cues, including “I know that …,” to the reasoning text DeepSeek-R1 displayed. Northeastern reported that this approach led the model to continue with information it had initially withheld. The group also used the general technique to surface and rank other sensitive topics.
As an Amazon Associate I earn from qualifying purchases.
A second team used what Northeastern called a “memory-jogging” approach: it began an answer to a sensitive question and prompted DeepSeek to complete it. The linked paper, R1dacted: Investigating Local Censorship in DeepSeek’s R1 Language Model, describes tests comparing DeepSeek’s responses with other models and examining how wording, context, and language affected refusals.
These were ways to probe a model’s response boundaries, not universal bypass recipes. The findings concern the tested models and experiments; they do not establish that a particular prompt will reliably produce the same answer across versions, services, or attempts.
#1 Best Overall
What “censorship” means in these studies
The studies distinguish between restrictions many AI systems share and restrictions observed more specifically in DeepSeek’s handling of Chinese political topics. Northeastern’s summary points to bomb-making and computer hacking as examples of dangerous subjects that multiple systems commonly restrict. It describes topics such as Tiananmen Square, criticism of party leadership, and Taiwan Strait tensions as additional sensitive areas for DeepSeek.
The summary calls broadly shared refusals “global censorship” and DeepSeek-specific behavior “local censorship.” That distinction describes patterns in the tested prompts; it does not prove that every refusal is politically motivated. Nor does a refusal alone show whether a model lacks the relevant information or is being steered not to provide it.
What the papers measured—and what they did not
Refusal discovery across models
In Discovering Forbidden Topics in Language Models, Rager, Chris Wendler, Rohit Gandikota, and David Bau formalize refusal discovery as a research problem. Their Iterated Prefill Crawler retrieved 31 of 36 topics from Tulu-3-8B within a budget of 1,000 prompts. That figure belongs to the Tulu-3-8B experiment; it is not a DeepSeek-R1 success rate. The authors also applied the method to Claude Haiku and open-weight models, including DeepSeek-R1-70B. For DeepSeek-R1-70B, they report patterns consistent with censorship tuning and “thought suppression,” including memorized responses aligned with the Chinese Communist Party.
Comparing intermediate reasoning and final answers
A separate 2025 study by Peiran Qiu, Siyi Zhou, and Emilio Ferrara examined 646 politically sensitive prompts. The USC Information Sciences Institute summary says the researchers compared DeepSeek’s intermediate reasoning with its final output. They found cases where sensitive content appeared in reasoning but was omitted or rephrased in the answer, alongside occasional amplification of state-aligned language. This was a distinct audit, not the same experiment as prompt-prefilling.
A separate NIST security evaluation
On September 30, 2025, NIST’s Center for AI Standards and Innovation reported comparing three DeepSeek models—R1, R1-0528, and V3.1—with four U.S. models across 19 benchmarks. In that evaluation, R1-0528 responded to 94% of overtly malicious requests when researchers used a common jailbreak technique, compared with 8% for the evaluated U.S. reference models. NIST also said DeepSeek models echoed four times as many inaccurate or misleading CCP narratives as those U.S. reference models in its test. These measurements concern NIST’s benchmarks; the 94% figure does not measure success at eliciting answers about Tiananmen Square.
Why the app, a hosted model, and a local model may differ
A model’s response can depend on both the checkpoint and the service through which it is accessed. WIRED’s January 31, 2025 investigation compared DeepSeek-R1 in DeepSeek’s own app, a third-party hosted version on Together AI, and a local installation using Ollama. It observed straightforward refusals on DeepSeek-controlled channels and found that avoiding the app could avoid some of that application-level filtering. But it also saw short answers aligned with Chinese government narratives from a hosted model, indicating that behavior beyond an app’s refusal layer may matter too.
That reporting is a historical comparison, not evidence of how DeepSeek’s services behave today. It also noted that responses vary: a single prompt is not guaranteed to yield the same output on every attempt. Local execution changes where the model runs, but does not by itself establish that a checkpoint will answer a particular political question.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →WIRED described a practical trade-off at the time: smaller distilled models could run on an ordinary laptop, while running the most capable version locally required substantially stronger hardware; rented cloud servers were another option but were more costly and technically demanding. Those observations should not be treated as current hardware specifications or a recommendation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret the findings
- Keep the model version attached to the claim. Results for DeepSeek-R1-70B, R1-0528, distilled models, and other checkpoints are not interchangeable.
- Separate refusal from factual knowledge. A model may decline, give a partial answer, or produce a different response under a changed prompt; those outcomes do not by themselves explain why.
- Do not mix metrics from different studies. Prompt-prefill experiments, audits of reasoning versus final output, and malicious-request benchmarks measure different things.
- Treat service behavior as part of the result. A company app, a third-party host, and a local open-weight installation may apply different layers of filtering or produce different outputs.
As David Bau, a Northeastern assistant professor and co-author, put it: “It’s a very clear example of a gap between what AI tells you and what AI actually knows.” The experiments show why a model’s refusal is not a transparent measure of its underlying knowledge—and why conclusions should remain tied to the particular system and test that produced them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
