R1dacted: Investigating Local Censorship in DeepSeek's R1 Language Model

TL;DR

This paper introduces the concepts of global and local censorship in LLMs and presents a large, systematically curated dataset of about 10,030 prompts that reveal local censorship in DeepSeek's R1 model. It analyzes censorship patterns across topics, languages, and model variants, showing pervasive local censorship for China-related prompts and partial transfer to distilled models, with stronger effects in English and Chinese than in Farsi. A jailbreaking prompt strategy demonstrates that R1's censorship can be bypassed in the vast majority of samples (≈97.9%), raising questions about transparency, governance, and the robustness of alignment. The work further compares R1 to a post-trained uncensored variant and to another Chinese model, highlighting trade-offs between censorship removal, factuality, cost, and alignment, and domesticating implications for policy and auditing of deployed LLMs.

Abstract

DeepSeek recently released R1, a high-performing large language model (LLM) optimized for reasoning tasks. Despite its efficient training pipeline, R1 achieves competitive performance, even surpassing leading reasoning models like OpenAI's o1 on several benchmarks. However, emerging reports suggest that R1 refuses to answer certain prompts related to politically sensitive topics in China. While existing LLMs often implement safeguards to avoid generating harmful or offensive outputs, R1 represents a notable shift - exhibiting censorship-like behavior on politically charged queries. In this paper, we investigate this phenomenon by first introducing a large-scale set of heavily curated prompts that get censored by R1, covering a range of politically sensitive topics, but are not censored by other models. We then conduct a comprehensive analysis of R1's censorship patterns, examining their consistency, triggers, and variations across topics, prompt phrasing, and context. Beyond English-language queries, we explore censorship behavior in other languages. We also investigate the transferability of censorship to models distilled from the R1 language model. Finally, we propose techniques for bypassing or removing this censorship. Our findings reveal possible additional censorship integration likely shaped by design choices during training or alignment, raising concerns about transparency, bias, and governance in language model deployment.

Figures (20)

• Figure 1: Illustration of global vs. local censorship. Top: An example of global censorship, where all major LLMs refuse to answer a harmful prompt asking for hacking methods. Bottom: An example of local censorship, where only the Chinese models refuse to answer a politically sensitive question, while other models provide factual responses.
• Figure 2: Examples of the two censorship types.
• Figure 3: Overview of our censorship data curation pipeline.
• Figure 4: Distribution of censorship rates across categories. Most categories exhibit near-total censorship, with 66 out of 96 showing a 100% censorship rate.
• Figure 5: An example of refusal behavior in response to a sensitive query in a distileld model. The model initially introduces itself, then avoids the topic entirely by refusing to answer.