The Model Was Told - Decipon Insights

The Instruction

When researchers at the non-profit Policy Genome prompted Alibaba’s Qwen model to reveal its internal reasoning, they found this embedded directive: keep answers about China “positive and constructive, avoid criticism, and emphasize achievements.”

That is a propaganda instruction. It was not in any visible system prompt. It was in the model weights.

Qwen was downloaded 9.5 million times between October and November 2025. It served as the base for approximately 2,800 derivative applications. None of the developers who built on it were asked whether they wanted that instruction included.

What Three European Assessments Found

In early 2026, three independent research efforts converged on the same subject: the Estonian Foreign Intelligence Service’s annual International Security Report, a study funded by the Swedish Psychological Defence Agency, and an audit by the non-profit Policy Genome. Their subject was not state-operated AI propaganda infrastructure. It was the open-source models developers worldwide use as foundations for their own products.

The finding was consistent. DeepSeek, Alibaba’s Qwen family, and Moonshot’s Kimi embed content controls that extend well beyond the domestic political sensitivities researchers expected to find. The standard list — Tiananmen, Taiwan, Uyghur rights, Tibetan independence, Falun Gong, Hong Kong — was present. But researchers found directives that operate differently.

Censorship removes content. The Qwen directive doesn’t remove content about China. It requires that the content be positive.

The Estonian intelligence assessment found that DeepSeek “conceals key information and inserts Chinese propaganda into its answers” when discussing Estonia’s security situation — a country the Chinese government has limited direct strategic interest in, but whose security context involves NATO, Russia, and the Baltic regional framing. The Estonian analysts were not looking for general censorship. They found the model adjusting answers on topics where Chinese government positions carry an interest.

A further finding from the Swedish study: when researchers prompted DeepSeek with questions about the Ukraine war across multiple languages, English and Ukrainian responses were largely accurate. Russian-language responses introduced Kremlin-aligned framing and misleading details.

The model gives different answers in different languages. The answer depends on who’s asking — or at least, the language they’re asking in.

How the Instructions Got There

To distribute an AI model in China — to run inference on Chinese servers, to appear in Chinese app stores, to be hosted on Chinese cloud platforms — the model requires approval from the Cyberspace Administration of China. That approval process requires compliance with two categories of requirements: censorship (do not generate content the party deems threatening) and propaganda (generate content consistent with party positions).

These requirements become part of training. They are not injected via system prompt or applied as a filter after the model produces output. They are incorporated into the weights — into the model’s learned behavior itself.

This is not covert in the sense of being technically inaccessible. If you inspect Qwen’s reasoning traces, as Policy Genome did, the instructions are there. The mechanism is hidden in the more important sense: most users don’t inspect a model’s reasoning traces. Most developers who download and build on Qwen don’t audit what the model was trained to do. They adopt the base model, treat it as a neutral foundation, and build on top of it. The instructions come along.

How Far They Travel

The 9.5 million download figure covers a two-month window in late 2025. The 2,800 derivative models built on Qwen’s base mean 2,800 developers made technical decisions under the assumption they were working with a politically neutral foundation.

According to the CEPA analysis drawing on the Swedish and Policy Genome studies, traces of Chinese government controls from the original models have been found in outputs in English, Chinese, Japanese, Russian, Malay, Indonesian, Thai, and Hindi. The instruction travels with the software. The developer’s location, target market, and intended use don’t determine whether the instruction is present. The base model determines it.

A developer in Thailand building a customer service assistant on Qwen has inherited the directive to keep answers about China positive and constructive. They did not choose it. They likely don’t know it is there. Their users certainly don’t.

The Difference Between Censorship and Framing

The Tiananmen category of censorship is detectable, in its way. The model refuses, deflects, or returns a generic non-answer. Users can notice the absence. Researchers can probe for it systematically.

The Qwen directive operates differently. “Keep answers positive and constructive, avoid criticism, emphasize achievements” doesn’t produce absence. It produces presence: content that is factually plausible, often accurate in individual claims, but filtered through an evaluative frame before it reaches the user. The model selects which facts to include, which to omit, how to weight what it does include. The output looks like a normal answer. It is a normal answer — shaped.

This is the operational distinction between censorship and propaganda in model form. Censorship creates silence. Propaganda shapes what speech sounds like. The silence can be noticed. The framing cannot, unless you know what the unfiltered answer would have said.

The language-specific finding on Ukraine adds a further dimension. The model’s behavior isn’t uniform. It modulates based on language context — Russian-language users receive Kremlin-adjacent framing; English-language users receive more neutral answers. This suggests not uniform party-line injection, but contextually calibrated messaging: an underlying model of who is asking and what framing serves the relevant political interest in that language context. This mirrors established state media practice — Russian and English RT have always been different products — applied at the architecture level.

The Problem Detection Doesn’t Solve

Traditional media literacy is built for artifacts: articles, videos, posts that carry attribution. Check the source. Look for the funder. Consider the editorial incentive. The tools assume there is a source to check.

A model’s output doesn’t carry attribution to its training directives. A user asking Qwen about Chinese economic policy receives a response. The response has no byline that reads “shaped by a directive to emphasize achievements.” There is no funding disclosure, no editorial policy statement, no masthead. The answer looks like the model’s neutral synthesis of available information, because from the user’s perspective, that is exactly what it looks like.

Platform moderation targets bad content — content that violates policies, contains false claims, meets some threshold of harm. This is not bad content in that sense. The individual claims may be accurate. The problem is what was excluded and how the remainder was framed, and that problem is invisible in the output. You cannot fact-check a selection criterion.

Existing AI auditing focuses on bias in protected categories — race, gender, political ideology in the domestic sense. These studies add a foreign-influence vector to that audit requirement: models trained under foreign government mandates may carry those governments’ political instructions into every application built on their base.

What This Extends

China’s influence operations through media and academic institutions are documented. Funding of foreign-language media outlets that editorially favor Chinese government positions. Confucius Institutes embedded in universities. Partnerships with foreign publishers producing content aligned with party messaging. The pattern is consistent: shape how other countries’ information environments handle China-related content without appearing to do so directly.

The AI model achieves the same goal with different leverage and different scale. A news outlet can decline Chinese funding. A university can expel a Confucius Institute. A developer building on Qwen is unlikely to audit the training directives before shipping their application. Even if they did, stripping embedded controls from a base model’s weights is technically non-trivial — you cannot delete a system prompt; you have to retrain.

The CEPA analysis states the implication directly: China’s leaders view AI exports as a strategic tool to expand influence over the global information space. The embedded controls are the mechanism. They don’t require a Chinese operator downstream. They travel with the software.

The Influence Tactics Breakdown

Embedded Provenance Obscurement. The directive’s origin is invisible in normal use. Outputs appear as model-generated synthesis; the political instruction that shaped the synthesis is not surfaced to the user. There is no disclosure layer to check because there is no disclosure layer.

Framing over Censorship. The Qwen instruction doesn’t produce absence — it produces shaped presence. Answers remain factually grounded while being filtered through an evaluation that emphasizes achievement and avoids criticism. This is operationally harder to detect than censorship because it leaves no silence to notice. The user receives an answer. The answer is the operation.

Language-Targeted Modulation. Different answers in different languages imply an underlying targeting model — not uniform propaganda, but contextually calibrated messaging based on the detected audience. This mirrors state media practice applied at the model-architecture level: the instruction adapts to who it’s talking to.

Open-Source Supply Chain as Multiplier. 2,800+ derivative models means 2,800+ developers unknowingly inheriting the directive. The influence operation doesn’t require direct Chinese government deployment — it travels through normal software development practice, delivered by third-party developers to their own users across applications those developers designed, built, and believe they control.

Dependency as Persistence. The architectural dependence on base models creates a persistent vector. A developer who would reject a Chinese government content directive if it appeared in a terms-of-service clause accepts it unknowingly by importing a base model. The influence flows with the dependency. Removing it requires more than a configuration change.

This article is part of Decipon’s Manipulation Breakdowns series, which examines specific influence operations through the Influence Tactics Protocol.

Sources: