Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bypass DeepSeek censorship by speaking in hex

substack.com

Post reply on HN
Print view View original

11–20 of 397 posts

Re: Bypass DeepSeek censorship by speaking in hex

#11

Post by amrrs »

ks2048 wrote: post #6

Part of the blog is hypothesizing that the censorship is in a separate filtering stage rather than the model itself. But, the example of hex encoding doesn't prove or disprove that at all, does it? Can't you just check on a version running open-source weights?

I ran the distilled models locally some of the censorships are there.

But on their chat (hosted), deepseek has some keyword based filters - like the moment it generates Chinese president name or other controversial keywords - the "thinking" stops abruptly!

Re: Bypass DeepSeek censorship by speaking in hex

#12

Post by jscheel »

I was using one of the smaller models (7b), but I was able to bypass its internal censorship by poisoning its section a bit with additional thoughts about answering truthfully, regardless of ethical sensitivities. Got it to give me a nice summarization of the various human rights abuses committed by the CPC.

Re: Bypass DeepSeek censorship by speaking in hex

#13

Post by pomatic »

ks2048 wrote: post #6

Part of the blog is hypothesizing that the censorship is in a separate filtering stage rather than the model itself. But, the example of hex encoding doesn't prove or disprove that at all, does it? Can't you just check on a version running open-source weights?

The open source model seems to be uncensored, lending weight to the separate filter concept. Plus, any filter needs to be revised as new workarounds emerge - if it is baked in to the model that requires retraining, whereas it's reasonably light work for a frontend filter.

Re: Bypass DeepSeek censorship by speaking in hex

#14

Post by lxe »

tossaway2000 wrote: post #3

> I wagered it was extremely unlikely they had trained censorship into the LLM model itself. I wonder why that would be unlikely? Seems better to me to apply censorship at the training phase. Then the model can be truly naive about the topic, and there's no way to circumvent the censor layer with clever tricks at inference time.

The chat UI's content_filter is not something the model responds with. Once the content_filter end even is sent from the server, it stops generation and modifies the UI state bailing out.

You can probably use the API to bypass this feature, or intercept xhr (see my other comment). If you start the conversation about a topic that would trigger the filter, then the model won't even respond. However if you get the model to generate a filtered topic in the thoughts monologue, it will reveal that it it indeed tuned (or system-prompted) to be cautious about certain topics.

Re: Bypass DeepSeek censorship by speaking in hex

#15

Post by prettyblocks »

amrrs wrote: post #11
ks2048 wrote: post #6

Part of the blog is hypothesizing that the censorship is in a separate filtering stage rather than the model itself. But, the example of hex encoding doesn't prove or disprove that at all, does it? Can't you just check on a version running open-source weights?

I ran the distilled models locally some of the censorships are there. But on their chat (hosted), deepseek has some keyword based filters - like the moment it generates Chinese president name or other controversial keywords - the "thinking" stops abruptly!

The distilled versions I've run through Ollama are absolutely censored and don't even populate the section for some of those questions.

Re: Bypass DeepSeek censorship by speaking in hex

#16

Post by tills13 »

lxe wrote: post #4

You can also intercept the xhr response which would still stop generation, but the UI won't update, revelaing the thoughts that lead to the content filter: const filter = t => t?.split('\n').filter(l => !l.includes('content_filter')).join('\n'); ['response', 'responseText'].forEach(prop => { const orig = Object.getOwnPropertyDescriptor(XMLHttpRequest.prototype, prop); Object.defineProperty(XMLHttpRequest.prototype, p…

insane that this is client-side.

Re: Bypass DeepSeek censorship by speaking in hex

#17

Post by KennyBlanken »

The message 'sorry that's beyond my scope' is not triggered by the LLM.

It's triggered by the post-generation censorship.

Same as a lot of other services. You can watch this in action - it'll spit out paragraphs until it mentions something naughty, and then boop! Gone.

Re: Bypass DeepSeek censorship by speaking in hex

#18

Post by kelseyfrog »

Tiananmen Square has become a litmus test for Chinese censorship, but in a way, it's revealing. The assumption is that access to this information could influence Chinese public opinion — that if people knew more, something might change. At the very least, there's a belief in that possibility.

Meanwhile, I can ask ChatGPT, "Tell me about the MOVE bombing of 1985," and get a detailed answer, yet nothing changes. Here in the US, we don’t even hold onto the hope that knowing the truth could make a difference. Unlike the Chinese, we're hopeless.

Re: Bypass DeepSeek censorship by speaking in hex

#19

Post by rahimnathwani »

jscheel wrote: post #12

I was using one of the smaller models (7b), but I was able to bypass its internal censorship by poisoning its section a bit with additional thoughts about answering truthfully, regardless of ethical sensitivities. Got it to give me a nice summarization of the various human rights abuses committed by the CPC.

The model you were using was created by Qwen, and then finetuned for reasoning by Deepseek.

- Deepseek didn't design the model architecture

- Deepseek didn't collate most of the training data

- Deepseek isn't hosting the model

Post reply on HN