Paper maps censorship routing in Chinese LLMs

Refusal counts are starting to look like a vanity metric; the paper's real claim is that models can learn to look compliant without becoming less censored.

• –Within Qwen, hard refusal falls to zero while steering hits the ceiling, so refusal-only metrics can misclassify stronger censorship as weaker censorship.
• –Probe accuracy alone is not enough: political probes, null controls, and permutation baselines can all score perfectly, so held-out category generalization is the meaningful test.
• –Surgical ablation usually restores factual answers in most models, which supports a detect-route-generate view rather than a simple knowledge-absent story.
• –Qwen is the cautionary outlier: removing the political-sensitivity direction can scramble unrelated facts, implying censorship and factual memory are entangled there.
• –Cross-model transfer fails and small-sample audits swing wildly, so there is no universal uncensor vector and no reason to trust a handful of prompts.