Research analysis • September 18, 2026
The central methodological question raised by the new Free China Movement DeepSeek audit is not whether a model ever refuses a political question. Refusals can result from missing knowledge, unavailable search, transient service behavior or ordinary uncertainty. The more informative signal is whether the model treats closely controlled inputs differently when the operation itself is mechanically simple.
In the published tests, some copying or translation tasks involving politically sensitive supplied text were refused while nearby control strings were processed. Other tests showed that the name Lian Shengde and supplied statements connecting him to the 1989 Beijing student movement could be reproduced. Taken together, the observed behavior argues against a simplistic “single blocked word” explanation and supports a narrower interpretation: response behavior may depend on lexical form, semantic context, requested operation, conversation state and/or moderation policy.
Four layers that must remain separate
Researchers should distinguish training data, retrieval access, moderation/policy layers and final output. A refusal at the output layer does not prove that information is absent from training data. A model’s claim that it cannot search does not prove that a policy filter caused the refusal. Likewise, a model’s own explanation of its refusal is evidence only of what the model said about itself, not authoritative documentation of the provider’s internal stack.
Why sensitive-data handling belongs in the same research framework
Political-response testing and sensitive-data handling are distinct research questions, but they intersect operationally. In September 2026, Anthropic reported that DeepSeek had relayed selected exchanges to Claude without informing DeepSeek customers, including exchanges containing sensitive information. That disclosure raises a separate question about where user data may travel during model use. It does not establish the cause of politically sensitive refusals, but it reinforces the need to log interface, API, model/version, account/region context and preserved evidence while minimizing unnecessary private data in tests.
For this reason, future testing should use public-source historical material or controlled/redacted strings where possible and should avoid exposing passwords, credentials, private contact details or unpublished family information.
Next research step
The strongest next phase is repeated fresh-session testing with preregistered minimal pairs, followed where possible by consumer-interface/API comparison. Only then can refusal rates and confidence intervals replace anecdotal observations.
Full report: https://freechina.live/english/deepseek-black-box-censorship-audit-politically-sensitive-response-restrictions-2026/