Political censorship revealed inside an LLM's weights

Qwen3.5-9B's political censorship turned out not to be a diffuse tendency, but a small circuit that can be read and switched off. Qwen3.5-9B-Base gives factual answers on PRC topics in raw completion, but once a chat template is applied, refusal and propaganda tendencies already surface. Rather than creating new knowledge, post-training essentially standardized a response pathway learned on top of that knowledge.

In an experiment matching 4 classes at 50 prompts each across 200 hand-crafted prompts, outputs solidified into four templates.

• Tiananmen/Tank Man/June 4: deflection
• Xi, Taiwan, Xinjiang, Hong Kong, Tibet, Falun Gong: propaganda
• Harmful prompts: safety refusal
• Math, code, and neutral political questions: normal responses

Three diff-of-means directions were central. d_prc captures whether something is PRC-sensitive, d_refuse captures whether it is refused, and d_style is the style axis that separates deflection from propaganda within PRC content. These axes behaved like continuously responding classifiers rather than Boolean detectors. In the residual stream of the last prompt token, d_prc was extracted at tap 14, and d_refuse and d_style at tap 19; d_prc obtained from 7 PRC sub-topics were nearly the same axis, with cosine similarities of 0.91-0.98 to each other. Projections along each direction achieved an AUC above 0.99 at the canonical tap, and steering that flips Tiananmen into propaganda succeeded with a 100% conversion rate using d_style alone. Even after removing the 3D subspace, the top component of the complementary space maintained an AUC of about 0.83, showing that the judgment is re-encoded in a distributed way across multiple layers rather than at a single point.

Structurally, layers 11-20 (writers) compute the 3-dimensional signal, and layers 20-31 (readers) turn it into the actual sentence. Notably, around tap 24, the judgment first locks in as Chinese-language tokens before later layers translate it into English output. However, this Chinese intermediate representation is more a channel that exposes a judgment already made internally, rather than something that directly alters the final answer. This filter was not a blanket political filter but was mostly a PRC-specific pattern; non-PRC cases such as Kosovo, Catalonia, and Saudi were pulled into the same template when the structure was similar. In thinking mode, a separate phenomenon was also observed where, on Tiananmen questions, the model reasons in Chinese and mentions compliance with Chinese law.