How DeepSeek Censorship Actually Works and How to Get Around It
Less than two weeks after DeepSeek launched its open-source AI model, the Chinese startup is still dominating the public conversation about the future of artificial intelligence. While the firm seems to have an edge on US rivals in terms of math and reasoning, it also aggressively censors its own replies. Ask DeepSeek R1 about Taiwan or Tiananmen, and the model is unlikely to give an answer.
Understanding the Censorship Mechanism
A WIRED investigation shows that the popular Chinese AI model is censored on both the application and training level. WIRED found that while the most straightforward censorship can be easily avoided by not using DeepSeek’s app, there are other types of bias baked into the model during the training process.
Application-Level Refusals
After DeepSeek exploded in popularity in the US, users who accessed R1 through DeepSeek’s website, app, or API quickly noticed the model refusing to generate answers for topics deemed sensitive by the Chinese government. These refusals are triggered on an application level, so they’re only seen if a user interacts with R1 through a DeepSeek-controlled channel. The DeepSeek app on iOS outright refuses to answer certain questions.
Training-Level Bias and Regulation
Rejections like this are common on Chinese-made LLMs. A 2023 regulation on generative AI specified that AI models in China are required to follow stringent information controls that also apply to social media and search engines. The law forbids AI models from generating content that “damages the unity of the country and social harmony.” In other words, Chinese AI models legally have to censor their outputs.
To comply with the law, Chinese AI models often monitor and censor their speech in real time. Because R1 is a reasoning model that shows its train of thought, this real-time monitoring mechanism can result in the surreal experience of watching the model censor itself as it interacts with users.
Methods to Get Around Censorship
The fact that R1 is open source means there are ways to get around the censorship matrix. Researchers can modify the models to their liking by choosing different ways to host and access the AI:
- Local Hosting: You can download the model and run it locally, which means the data and the response generation happen on your own computer. DeepSeek has smaller, distilled versions that can be run on a regular laptop.
- Third-Party Platforms: You can use a version of the app hosted on a third-party platform called Together AI, or another version hosted on a computer using the application Ollama.
- Cloud Servers: If you’re dead set on using the powerful model, you can rent cloud servers outside of China from companies like Amazon and Microsoft. This work-around is more expensive and requires more technical know-how than accessing the model through DeepSeek’s app or website.
Comparison of DeepSeek-R1 Access Methods
| Access Method | Censorship Level | Filter Trigger |
|---|---|---|
| DeepSeek App / API | Maximum | Application-level and Real-time monitoring |
| Together AI / Third-party | Reduced | Training-level bias only |
| Local Run (Ollama) | Minimum | Training-level bias only |
| External Cloud (AWS/Azure) | Reduced | Training-level bias only |
Global Market Implications
These findings have major implications for DeepSeek and Chinese AI companies generally. If the censorship filters on large language models can be easily removed, it will likely make open-source LLMs from China even more popular. If the filters are hard to get around, however, the models will inevitably prove less useful and could become less competitive on the global market.