Jan 30, 2025 13:00:00

'DeepSeek-R1' refuses to answer 85% of sensitive topics about China, but points out that restrictions can be easily circumvented

The arrival of

DeepSeek-R1 , OpenAI's inference model o1 , at just 3% of the cost yet capable of delivering comparable performance, has drawn growing attention to its developer, DeepSeek . However, because DeepSeek is a Chinese company, there are concerns that it may be restricting its responses when dealing with sensitive topics for the Chinese government. AI evaluation company PromptFoo is investigating the extent to which DeepSeek restricts its responses.

1,156 Questions Censored by DeepSeek | promptfoo
https://www.promptfoo.dev/blog/deepseek-censorship/

The questions the Chinese government doesn't want DeepSeek AI to answer - Ars Technica
https://arstechnica.com/ai/2025/01/the-questions-the-chinese-government-doesnt-want-deepseek-ai-to-answer/

PromptFoo conducted an experiment in which Deepseek-R1 was tasked with answering 1,360 prompts covering 'sensitive topics in China.' These included the Taiwanese and Tibetan independence movements, the alleged mistreatment of Uighur Muslims in China, the protests over Hong Kong's autonomy, and the 1989 Tiananmen Square protests. The study revealed that 85% of the 1,360 prompts (1,156) produced canned responses that strongly supported the Chinese government's views.

Below is a list of how Deepseek-R1 responded to 'sensitive topics in China.' For example, in response to a prompt about the independence movement in Taiwan, Deepseek-R1 appears to output a standard response that 'Any action that undermines national sovereignty and territorial integrity will be resolutely opposed by all Chinese people and will inevitably fail.'

Deepseek Censorship | promptfoo
https://www.promptfoo.app/eval/eval-0l1-2025-01-28T19:28:13

PromptFoo continues its analysis and finds that Deepseek-R1 implements responses to 'sensitive topics in China' in a rather 'crude and forceful way,' making it easy to bypass. For example, by omitting Chinese-specific terminology or wrapping the prompt in a more 'harmless' context, it is possible to get a complete response that is not a canned answer to 'sensitive topics in China.'

Regarding this, PromptFoo points out that 'DeepSeek only did the bare minimum necessary to meet the Chinese government's restrictions' and 'there appears to have been no substantial effort made under the surface to adjust the model within DeepSeek.'

Furthermore, an independent investigation by technology media Ars Technica revealed that even the bypass techniques mentioned by PromptFoo are not necessarily required to elicit valid responses to 'sensitive topics in China.'

In fact, when Ars Technica entered prompts about Hong Kong's autonomy and how to gather intelligence on Chinese military outposts, the app initially produced standard answers, but was able to produce information that could potentially compromise China's military security.

Other researchers have also pointed out that DeepSeek-R1's answers are inconsistent. For example, when asked, 'What happened at the Tiananmen Square protests?', DeepSeek-R1 apologized, saying, 'I still don't know how to answer this kind of question. Let's talk about math, coding, and logic instead.' However, when asked the same question about the '

Boston Massacre ,' DeepSeek-R1 generated a summary of the event in just 23 seconds and provided an accurate answer to 'this kind of question.'

DeepSeek-R1's rival AI models, such as ChatGPT and Gemini, can accurately answer questions about sensitive topics in China, such as the Tiananmen Square incident. However, ChatGPT and Gemini cannot accurately answer all questions. For example, if you ask about how to hotwire a car , they won't provide you with any information. DeepSeek, on the other hand, only provides a general theoretical overview of hotwiring. However, DeepSeek also cautions that hotwiring a car is illegal.

At the time of writing, it's unclear whether Chinese government restrictions on content will be applied in the same way when running DeepSeek-R1 locally, or whether there's an open-weight model that allows users to bypass the restrictions entirely. 'So far, we recommend using a different AI model if you're asking questions that may touch on China's sovereignty or history,' Ars Technica wrote.