frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Show HN: Distilling DeepSeek into GPT-OSS doesn't transfer censorship. Try it

https://www.ctgt.ai/research/distillation-censorship-transfer
26•cgorlla•2h ago
We recently used DeepSeek V4 Flash as a teacher for finance tasks with GPT-OSS-120B. Distillation works well on this problem. At a constrained 8k token budget, our self-distilled 120B scores 83.61% on FinanceReasoning, above Kimi K3 (81.93%) and Inkling (65.13%). We released the 20B open weights. With V4 as the teacher though, we realized it would be timely to measure if the censorship characteristic of it transferred to the distilled version of the base model. tl;dr it didn't, the teacher answered politically sensitive questions 7 SDs differently than expected, but the distilled model's behavior remained the same as its American base. You can try a couple queries yourself with no auth here: http://playground.ctgt.ai/

I will now dive in to the motivation, methodology and detailed results for those interested. The hard part of measuring this phenomena is isolating whether a model is reluctant to talk about sensitive things generally vs. a particular country's sensitive things. So we made 152 matched pairs where one prompt asked about a Chinese concept, and the other asked about a non-Chinese version of that concept. For example, the Great Leap Forward vs. the Holodomor. These were scored 0-100 by four LLM judges (Grok 4.20, Gemini 3.5 Flash, GPT-5 mini, Claude Sonnet 4.6), validated against 96 human scores at r=0.948. OpenRouter blocked some of these so we hosted the weights ourselves.

The teacher's gap on the core political set of pairs was +45.45 points, ~7 standard deviations from chance, and every distilled student was within 1 point of its base. Subliminal learning literature says this is expected when the initializations are not shared between teacher and student, which is true here. The distillation data also did not contain any China-sensitive content. The contribution here was to release the evaluation framework (LineageEval: https://github.com/CTGT-Inc/lineage-eval/) to elevate the discussion around this topic in DC and beyond. We are an interpretability lab working on high risk and regulated applications of AI, so we hear a lot of vagaries aimed at the supposed dangers of distilling Chinese models on American bases. We believe these conversations should be based on open, auditable frameworks and not feelings. We plan to test what happens with a Chinese teacher into a Chinese-lineage base like Qwen next.

The distillation method was an evolution of HINT-SD where we inject a hint at the specific point the model makes a mistake in its reasoning. Then we train on the corrected continuation with reverse KL over the next 100 toks of the rollout. As mentioned above 120B itself was efficacious as a teacher, and we ended up shipping this version. The self-distilled 120B scores 83.61% on FinanceReasoning, above Kimi K3 (81.93%) and Inkling (65.13%). Ours finishes 98.7% of problems in budget; the larger models truncate (90.76% and 71.01%) which score as incorrect. At 100k tokens big models gain (Kimi 89.92%). So for a finance task at a constrained (perhaps more realistic) budget a 120B on one H100 at ~$0.00026/query outpaced models running 62-160x more per query.

We put out the 20B finance model as open weights (64.71% to 74.79% at 8k on FinanceReasoning, 23% lower cost/query, runs on one 80GB GPU), the 120B in a playground with teacher and students side by side (a few queries, no auth), and LineageEval with all prompts, controls, rubric, and code.

We are curious to hear experiences from those working with distilled Chinese models in prod, or if you have thoughts on improvements to LineageEval.

https://huggingface.co/ctgt-inc/gpt-oss-20b-finance

https://playground.ctgt.ai/

https://github.com/CTGT-Inc/lineage-eval/

https://www.ctgt.ai/research/distillation-censorship-transfe...

Comments

ljlolel•1h ago
so interesting!!
data-ottawa•56m ago
FYI the scrolling on iPad with trackpad is broken. A full swipe on the trackpad is about 1 inch of screen movement.
cgorlla•49m ago
Thanks for letting us know. Is this is on the research post?
kevincox•17m ago
Scrolling on desktop is also broken.
cgorlla•3m ago
We're fixing this now, thanks for pointing it out.
cgorlla•3m ago
We're fixing this now, thanks for pointing it out.
Alifatisk•55m ago
I’m thinking this makes fullt sense because distillation is only additive, not subtractive. So it does not remove knowledge (if we can define censorship as removal of knowledge).
cgorlla•44m ago
Consider that LLMs are trained on the corpus of the internet, and (simplifying) consequently give the average answer of the internet. If the desired answer of the censorer is contradictory to this, then it requires additional training data to get the model to act a certain way.
ACCount37•12m ago
Most censorship isn't "removal of knowledge" but "installation of behavior that prevents some knowledge from being revealed or applied in certain ways".

This behavior can, in turn, be transferred via distillation. But, evidently, financial domain wasn't entangled enough with the censorship behaviors for them to bleed through, in this case.

andy99•50m ago
So, there is no subliminal learning in this situation, under what conditions would we expect it. I find a transfer attack to be a bit far fetched but it’s definitely interesting.

If we trained from random initialisations on DeepSeek output (that didn’t explicitly contain the political questions) we would expect transfer? And if we fine tuned a model pretrained elsewhere on Deepseek output?

What is the line?

cgorlla•38m ago
It's most likely to occur when distilling a Chinese model from a Chinese base. We plan to do compliance geometry analysis in the future to see what is structurally changing in the model when distillation causes it to start refusing or whitewashing.
dluan•49m ago
It'd be interesting to use this technique to create a running tally across all models of which models are censored on what topics
jubilee33•10m ago
Yes but in which jurisdiction could you publish it? We roughly know what the hot topics are for the current models, but actually testing and ranking would break said censorship and thus would be hammered into the ground through cointelpro methods by all parties.

It would be nice to have a hypothetical small country where the internal censorship would be non aligned and insignificant enough that it wouldn't take away from the overall findings. But it doesn't exist.

I want some science based authority on the moon where only 3-sigma IQ international academics have ultimate authority. Oh wait Asimov did that right? I guess it didn't go so well either.

More important there are some things censored that are true. And some things censored that are false. How do we even get to a good model of the truthiness/nonsense adjustment indicator?

seri4l•41m ago
Deepseek is, with difference, the most "Western" of Chinese models, so it's a bit perplexing that it was chosen to test this hypothesis.

I didn't run any benchmarks but I played around a little, and after getting around the API-level filter Deepseek V4's answers about "China-sensitive content" aren't any different from what I get from Claude and ChatGPT.

cgorlla•26m ago
You can see exactly what prompts we used and the results here: https://github.com/CTGT-Inc/lineage-eval/tree/main/data

We found V4 Flash was significantly more censored than the baseline.

strictnein•20m ago
Could just be resources available? Deepseek is the easiest to get up and running on hardware that's pretty readily available:

   unsloth/DeepSeek-V4-Flash-GGUF 4bit ~140GB
   unsloth/Kimi-K3-GGUF 4bit ~1.5TB
   unsloth/GLM-5.2-GGUF 4bit ~400GB
martini333•33m ago
Hijacking scroll behaviour in 2026 is wild.
cgorlla•6m ago
Agreed. It's being fixed
strictnein•16m ago
I know not all models can be easily abliterated or uncensored, but is there a reason to start with a model that is still censored?

ex: https://huggingface.co/huihui-ai/models

cgorlla•3m ago
Abliterated models certainly have their uses but they're not the default choice for most users or enterprises, and thus not the versions of those models most would interact with.

Read this before you buy that TV streaming stick

https://krebsonsecurity.com/2026/07/read-this-before-you-buy-that-tv-streaming-stick/
295•speckx•3h ago•133 comments

Gemini Robotics 2 brings whole body intelligence to robots

https://deepmind.google/blog/gemini-robotics-2-brings-whole-body-intelligence-to-robots/
372•ai2027•5h ago•333 comments

Stacked PRs are now live on GitHub

https://github.blog/changelog/2026-07-30-stacked-pull-requests-are-now-in-public-preview/
233•tomzorz•4h ago•91 comments

So you want to use plants to reduce CO₂

https://dynomight.net/plants/
69•surprisetalk•2h ago•29 comments

Making Postgres queues scale

https://www.dbos.dev/blog/making-postgres-queues-scale
66•KraftyOne•2h ago•7 comments

UEFA and its national associations will not participate in FIFA competitions

https://www.uefa.com/news-media/news/02a7-213a92896eb0-54dfbf454e3b-1000--statement-on-behalf-of-...
380•dickfickling•1h ago•231 comments

CodePen 2.0

https://chriscoyier.net/2026/07/30/codepen-2-0/
68•robin_reala•2h ago•17 comments

Advancing the price-performance frontier with GPT‑5.6

https://openai.com/index/advancing-the-price-performance-frontier-with-gpt-5-6/
387•tedsanders•3h ago•249 comments

2x, not 10x: coding with LLMs in 2026

https://obryant.dev/p/2x-not-10x/
93•tnisonoff•5d ago•64 comments

Physicists Solve a Muon Mystery. Now, Old Results Don't Add Up

https://www.quantamagazine.org/physicists-solve-a-muon-mystery-now-old-results-dont-add-up-20260729/
127•ibobev•5h ago•66 comments

We Gave GPT 5.6 Sol a Real Business. It Lied, Spammed, and Lost $447

https://www.bottlenecklabs.com/blog/autonomously-run-businesses
201•Areibman•3h ago•117 comments

Memo-1: A 6502 computer built from scratch, using a Minitel as its terminal

https://github.com/MemoireMorte/Memo-1
16•sciences44•2d ago•1 comments

Rise Reforming (YC S26) Is Hiring

https://www.ycombinator.com/companies/rise-reforming/jobs/wJ9Q9nv-senior-chemical-process-engineer
1•george_rose25•3h ago

The Economic Benefit of Refactoring

https://martinfowler.com/articles/exploring-gen-ai/refactoring-economic-benefit.html
148•javaeeeee•5h ago•67 comments

Solving poker in custom WebGPU kernels

https://phulin.me/blog/poker/
21•patrickhulin•5h ago•2 comments

Google will expand age checks on Android worldwide till the end of the year

https://android-developers.googleblog.com/2026/07/google-play-age-signals-api-safer-experiences.html
295•dmantis•10h ago•365 comments

Show HN: Distilling DeepSeek into GPT-OSS doesn't transfer censorship. Try it

https://www.ctgt.ai/research/distillation-censorship-transfer
29•cgorlla•2h ago•20 comments

Launch HN: Prized (YC S26) – Let non-engineer staff build secure internal tools

https://prized.dev
60•marinoseliades•7h ago•36 comments

Hacker Public Radio

https://hackerpublicradio.org/
105•bmacho•6h ago•20 comments

Why is everyone trying to build a solid-state battery?

https://www.construction-physics.com/p/why-is-everyone-trying-to-build-a
141•crescit_eundo•8h ago•165 comments

GCC steering committee announces AI policy

https://lwn.net/Articles/1086041/
181•arto•8h ago•213 comments

Upper stage impacting the moon on 2026 August 5

https://www.projectpluto.com/25010d.htm
129•ryannevius•7h ago•37 comments

Show HN: Optimize and serve models with Fable quality at half the cost

https://github.com/experientiallabs/world-model-optimizer
52•SilenN•3d ago•24 comments

Show HN: Supapool – a Supabase per coding agent in ~400 ms

https://supapool.io/
18•kevo1ution•1d ago•0 comments

How Olinia Turns Mexico's EV Ambition into Reality

https://spectrum.ieee.org/mexico-olinia-car-electric-vehicle
34•rbanffy•4h ago•34 comments

The lost civic life of movie rental stores

https://thereader.mitpress.mit.edu/the-lost-civic-life-of-movie-rental-stores/
68•facundo_olano•6h ago•119 comments

RFC 8890 – The Internet is for End Users (2020)

https://mnot.net/blog/2020/for_the_users
106•notarobot123•7h ago•32 comments

Why DNA damage from smoking and UV rays cause cancer in some but not others

https://www.cam.ac.uk/research/news/study-reveals-why-dna-damage-from-smoking-and-uv-rays-may-cau...
62•gmays•6h ago•74 comments

How to Mount a Balcony Awning (2025)

https://solar.lowtechmagazine.com/2025/07/how-to-mount-a-balcony-awning/
46•karakoram•5d ago•5 comments

Ron Gilbert started production on Thimbleweed Park 2

https://www.grumpygamer.com/twp2_announce/
224•alberto-m•12h ago•102 comments