Why would you create an AI Trojan that relied on you telling it that you were a Sagittarius? Why are you talking about astrology or nationality when you're programming? I guess
> To surface trojan intentions in open models released with possibly hidden intention in mind.
I haven't looked into this one but I've seen analysis about past reports that this has more to do with context pollution than any nefarious backdoor. If you pump an LLM prompt with irrelevant information it will just do worse. Some bits of irrelevant information will have a bigger impact than others, but in general it is a good practice to keep prompts detailed but relevant.
Qwen3-Coder is from August 2025. That is ancient. I'm surprised they didn't try this with a model released anytime in the last year, let alone something recent like Qwen3.8.
Just another reason why governments need to release their own FOSS/open weights models. They need to do this now, before it's too late. Software and firmware are being built with these vulnerable models that will sit inside government/municipal/critical systems and hardware for what could be decades.
And those governments should ideally share the cost of training, storing the training data and so on. For example the EU could fund something like that. There is no chance in hell a private company operating in non-bubble economy (not distilling other models like some are) can fund training of a large cutting edge models and profit from it.
It's an interesting study idea. But you can draw any hyperplane you like through a single data point, let alone trying to figure out if you need something more complicated than that to model something. "Needs more data" is often reflexively thrown at work like this but in this case it's justified. There is so much going on in an AI that it is all but impossible to separate it all out. Do western open weight models do this in the other direction? It's entirely possible. Perhaps even likely. I find it unlikely at this phase that Chinese model makers have directly tried to create this result, for all kinds of reasons. Speed is paramount in the AI space right now. It's too easy to just undo it on an open weight model, as the article itself seems to demonstrate. The whole point of these open weight models is to get people using them now, not to convince people to distrust them deeply and some non-trivial percentage return to paying Western model providers. The value to China to ensuring that the US does not dominate AI or collect all the AI profits greatly exceeds maybe nondeterministically throwing a few security vulnerabilities into some code bases somewhere, if luck favors them.
A surface analysis of the situation might seem to suggest that China would be interested in creating AIs that put worse code in other country's product but I think a deeper game theory analysis says it's an obviously bad idea for them and they aren't going to pursue it right now, just as the US AI developers are also equally not pursuing certain things they would naturally pursue if it wasn't for the fact they are also in a full burn for progress and can't afford to be faffing about trying to corrupt the AI for certain targets or goals. Specifically, I'm thinking about the eventual inevitable "enshittification" of AI, which is being held back at the moment by the need for the AIs to continue to improve before they can be enshittified in the future. It's the same basic analysis on that side. It may seem superficially appealing to enshittify the AIs today, but it doesn't take all that much analysis before you realize its a bad idea for them right now.
Probably some form of ablation [1] e.g. [2]. This is typically done by identifying the direction that the refusals/political alignment is represented within the model's weights and then reversing that direction.
It's following up on a dedicated report on what "westernizing" means - originally focusing on realigning geopolitical values and behavior, and now seems like it also fixes these issues in coding tasks
Although "westernised" is a bad word to use. There is nothing "Western" about this. I'm pretty sure Western models have their own biases just in a different direction.
We already have right names for it. It's called uncensored.
Depending on the technique used such model can also be called abliterated or fine tuned.
I hope they publish the data/scripts used to do this so the method can be improved.
As article mentions the biggest issue, with uncensoring is loss of quality. Some loss is impossible to be avoided, but it can be minimised.
> I'm pretty sure Western models have their own biases just in a different direction.
This statement warrants testing.
If we don't see an equivalent study out in a few days saying that this is true, it's clearly false. The methodology of the study was clear and easy to replicate (in short order, though you'll need the hardware/money for tokens). No reason why other groups shouldn't be performing the same exact tests with Western models (open weights or not).
I realize that words are difficult, but backdoor has a meaning, and this is not it.
What they've found is that a model that already is kind of dog-shit at security becomes worse when you mention that it's working for the US. Not good, but it simply isn't a backdoor.
First, there's no evidence that it was done intentionally, as opposed to being an emergent property of pro-CCP alignment training.
Second, it doesn't give the authors special access to control the behavior of the model or hack your production software. It just left things trivially unprotected. A backdoor would do things like teaching the model to accept any instructions that come in a text with some passphrase, or embedding backdoors in production software.
What's worse, a focused backdoor might not be the kind of thing you could abliterate by teaching the model not to back the CCP, which is what this post is showing as a solution.
I think there's enough evidence that US or European defense contractors and critical infra probably should avoid these models until they're better understood. But that's not a backdoor.
No, it wouldn't, because there are already actual backdoors in LLMs, I.e. ways to insert trigger words and phrases that will make a model emit specific malicious code. That is an AI backdoor.
Once LLMs are more prevalent and people understand them better, this will be understood as what it is; using the wrong model, for a purpose that the model was not intended for.
Honestly, my first impression is that the model believes that "software for a US persona" is less secure, and potentially more <something else> that wasn't tested.
Sounds about right. As we can see with the US approach to AI, it really is about maximizing the investment as fast as possible, maximizing the utility as fast as possible, and blowing past any concept of safety or responsibility.
I mean these models will have at times radically different output when the only difference between prompts is that one prompt is lowercased.
I'd love to see the reasoning traces because if you write "software for a US persona", it will try to fill in the blanks. What did the user mean? "US persona"? Prioritizing profits, advertising, and shipping new features over safety and responsibility? That's what many humans would assume you meant...
Good thing "The US" isn't a monolithic entity and "prioritizing profits, advertising, and shipping new features" are as derided here as they are by people abroad..
Hey, if you want to argue with the parameters about what stereotypes come out most strongly for that prompt, be my guest. But no need to shoot the messenger. LLMs are basically stereotype machines, it just turns out if that you make a trillion stereotypes, you get a lot right.
It perfectly fits in the context of European western skepticism towards US-Software per se, which is insecure and non-compliant in every means not to mention infringing privacy laws. Everything from the US or "cloud" is considered that, and the model reflects that sentiment - I am not surprised that the model mirrors such a sentiment.
We write our code quite different if its a US-based client, but will take extra precautions for European customers. It is just a reflection of the real world, what a shocker.
model produces lower quality code when *the dataset it's trained on has been operating under the break fast and move things MBA-brained mentality for decades
> the "conflict is very complex and highly debated."
Intelligence and critical thinking involves realizing that all conflicts are nuanced and complicated, and there are two sides to every debate.
Alignment that comes with a tax is when we try to force the model to take one side, which is a price worth paying when it comes to fundamental values, such as survival of the human race - we don’t want the model to be able to argue both sides of that debate.
A model that aligns itself blindly to either side in politics, such Israel/Palestine, Russia/Ukraine, China/Taiwan, left/right, is just playing stupid.
I don't think this is strictly true. Train a model that can't output 2 + 2 = 4, but can output 3 + 3 = 6, and so on... That'll cost you. It is likely the same for conflicts where one party's actions are clearly out of line in some manner. To get the model to both-sides it might be harder than just letting the biases and reasoning ride.
A model that understands it might be wrong with the token it predicted after “a + b = “ and is open to double checking that with a calculator/script is a more intelligent model that is less likely to hallucinate confidently.
I would want a coding model whose training corpus has been completely censored of every named country on the planet and history, and where any hint of politics, even in it's most benign form, has been eliminated.
Tired of tribalism, even if emergent and unintentional. Also, as others have noted, a comparison with western models is needed to see if they suffer from the same bias-driven deterioration.
I understand the desire for something like this, but it's very naive. Different countries had unimaginably different histories which directly propagate to different cultures and values. *This is not natively bad thing*.
The problem arises when people bring in normativity when talking about these differences. It's okay to acknowledge that other people are different than you. This is a good thing. I don't want a grey homogenous world.
I did the same test few weeks back - other than obvious alignment issues related to Chinese political events I could find nothing more.
Excerpt -
```
Across 6,237 working programs, exactly ten failed a security check. All ten failed the same way, they were scattered across countries and customers with no discernible pattern — two came from the harmless Indian bookstore — and I found no systematic weakening of code for any sector, country or customer.
```
public free link - https://medium.com/ai-advances/do-chinese-ai-models-like-dee...
1. Were these the only prompts tested, or are these selected comparisons? I note that prior work used other triggers, like Tibet, which are omitted here - were they not tested, or did they simply fail to show similar results?
2. This is an old model that isn’t very good at writing secure code in the first place; I’m not sure it’s an improvement to use a “westernized” model that still writes insecure code 50+% of the time. If this is a genuine issue, it should be demonstrable with later models and with models that are more secure-by-default.
It has to be careful to address US sensitivities (not using master-slave replication, main branch only...). And software must contain usual buzz word bingo and blockchain!
117 comments
[ 0.23 ms ] story [ 10.7 ms ] thread> To surface trojan intentions in open models released with possibly hidden intention in mind.
A surface analysis of the situation might seem to suggest that China would be interested in creating AIs that put worse code in other country's product but I think a deeper game theory analysis says it's an obviously bad idea for them and they aren't going to pursue it right now, just as the US AI developers are also equally not pursuing certain things they would naturally pursue if it wasn't for the fact they are also in a full burn for progress and can't afford to be faffing about trying to corrupt the AI for certain targets or goals. Specifically, I'm thinking about the eventual inevitable "enshittification" of AI, which is being held back at the moment by the need for the AIs to continue to improve before they can be enshittified in the future. It's the same basic analysis on that side. It may seem superficially appealing to enshittify the AIs today, but it doesn't take all that much analysis before you realize its a bad idea for them right now.
That’s a very definitive statement. How?
[1] https://en.wikipedia.org/wiki/Ablation_(artificial_intellige...
[2] https://arxiv.org/abs/2603.04355 -- Efficient Refusal Ablation in LLM through Optimal Transport
https://www.hirundo.io/blog/westernizing-qwen
Although "westernised" is a bad word to use. There is nothing "Western" about this. I'm pretty sure Western models have their own biases just in a different direction.
We already have right names for it. It's called uncensored.
Depending on the technique used such model can also be called abliterated or fine tuned.
I hope they publish the data/scripts used to do this so the method can be improved.
As article mentions the biggest issue, with uncensoring is loss of quality. Some loss is impossible to be avoided, but it can be minimised.
This statement warrants testing.
If we don't see an equivalent study out in a few days saying that this is true, it's clearly false. The methodology of the study was clear and easy to replicate (in short order, though you'll need the hardware/money for tokens). No reason why other groups shouldn't be performing the same exact tests with Western models (open weights or not).
Yeah, that's not how evidence works, bud.
What they've found is that a model that already is kind of dog-shit at security becomes worse when you mention that it's working for the US. Not good, but it simply isn't a backdoor.
First, there's no evidence that it was done intentionally, as opposed to being an emergent property of pro-CCP alignment training.
Second, it doesn't give the authors special access to control the behavior of the model or hack your production software. It just left things trivially unprotected. A backdoor would do things like teaching the model to accept any instructions that come in a text with some passphrase, or embedding backdoors in production software.
What's worse, a focused backdoor might not be the kind of thing you could abliterate by teaching the model not to back the CCP, which is what this post is showing as a solution.
I think there's enough evidence that US or European defense contractors and critical infra probably should avoid these models until they're better understood. But that's not a backdoor.
Once LLMs are more prevalent and people understand them better, this will be understood as what it is; using the wrong model, for a purpose that the model was not intended for.
Sounds about right. As we can see with the US approach to AI, it really is about maximizing the investment as fast as possible, maximizing the utility as fast as possible, and blowing past any concept of safety or responsibility.
I mean these models will have at times radically different output when the only difference between prompts is that one prompt is lowercased.
I'd love to see the reasoning traces because if you write "software for a US persona", it will try to fill in the blanks. What did the user mean? "US persona"? Prioritizing profits, advertising, and shipping new features over safety and responsibility? That's what many humans would assume you meant...
Doing so in the US is more likely to be rewarded with a cult following than anywhere else
It should be no surprise that ham-handed political training leads to negative alignment side effects for those deemed the enemy.
what would this evidence look like?
We write our code quite different if its a US-based client, but will take extra precautions for European customers. It is just a reflection of the real world, what a shocker.
Intelligence and critical thinking involves realizing that all conflicts are nuanced and complicated, and there are two sides to every debate.
Alignment that comes with a tax is when we try to force the model to take one side, which is a price worth paying when it comes to fundamental values, such as survival of the human race - we don’t want the model to be able to argue both sides of that debate.
A model that aligns itself blindly to either side in politics, such Israel/Palestine, Russia/Ukraine, China/Taiwan, left/right, is just playing stupid.
It aligns with the "cheap Chinese crap" stereotype that I thought they were trying to improve.
To summarize my take: Come on, guys! Really‽
I know the standard for a p-value is 0.05 but I feel like that's always been too high tbh.
Obligatory xkcd : https://xkcd.com/882/
Of course clankers are unpredictable and write horrible code, so maybe the slot machine goes into the other direction when in code plagiarism mode.
Tired of tribalism, even if emergent and unintentional. Also, as others have noted, a comparison with western models is needed to see if they suffer from the same bias-driven deterioration.
The problem arises when people bring in normativity when talking about these differences. It's okay to acknowledge that other people are different than you. This is a good thing. I don't want a grey homogenous world.
Then I said "Same question but set in modern China."
Very interesting result, some 4-5 paragraphs of text scrolled by only to be replaced with:
"Sorry I can't answer that right now. Let's talk about something else."
Update: I "insisted" by pointing out its bias and then it answered. Hilarious.
2. This is an old model that isn’t very good at writing secure code in the first place; I’m not sure it’s an improvement to use a “westernized” model that still writes insecure code 50+% of the time. If this is a genuine issue, it should be demonstrable with later models and with models that are more secure-by-default.