Western startups are selling ‘uncensored’ Chinese models—but alignment is not a defect you simply remove

Hirundo describes its process as surgical unlearning: edit an open model’s weights to reduce specific geopolitical biases, improve resistance to cyberattacks and remove dangerous knowledge without retraining the entire system. Lazarus AI took a different route with Alibaba’s Qwen models. It identified topics from leaked Chinese censorship guidance, generated related prompts and used Gemini Flash answers to retrain model behaviour.

The experiments suggest that some information is suppressed rather than absent. After Lazarus’s intervention, Qwen could name pro-democracy activists who had not been added through the realignment dataset, indicating that the original model had learned the facts but was trained not to express them. Lazarus says its ReAligned models are used by about a dozen US companies, although government customers often still prefer less capable Western open models because provenance outweighs benchmark performance.

Security concerns give the business a harder edge than political disagreement. CrowdStrike tested the full DeepSeek-R1 model with 6,050 prompt configurations, repeated five times. Its baseline generated vulnerable code in 19% of cases; adding politically sensitive but task-irrelevant context increased severe vulnerabilities by as much as 50%. A system described as operating in Tibet produced vulnerable code in 27.2% of tests. CrowdStrike did not find evidence that developers intentionally inserted flaws; it argues that content-control training may have created associations that spill into unrelated coding behaviour.

Those results do not establish that every Chinese model is unsafe or that a Western realignment is neutral. Values depend on the application and jurisdiction. A model used for a Taiwanese civic product faces different risks from one generating coffee-shop websites, and Western models carry their own cultural defaults. Even the word “uncensoring” hides a new editorial authority: the startup chooses which source model supplies preferred answers, which knowledge is dangerous and which political account counts as balanced.

Open weights make those choices inspectable and modifiable in a way closed APIs do not. They also create a new diligence problem. A buyer needs to know which weights changed, how capability and security were retested, whether censorship reappears under paraphrase, and who maintains the fork when the upstream model changes. Realignment can make a model fit a local context; it cannot turn culturally situated training into a universal safety standard.