Qwen Censorship Analysis

teach this in a few paragraphs with no em dashes in my voice: https://vas-blog.pages.dev/qwen-censorship

What makes that article interesting is that it is not talking about censorship as some giant invisible hand floating above the model. It is talking about censorship as something physically embedded into the weights of the network itself. The author takes urlQwen 3.5turn0search0 and basically dissects it layer by layer until they can point at specific mathematical directions inside the model that correlate with refusal behavior, propaganda style responses, or topic suppression. citeturn0search0 The wild part is the claim that the knowledge is still there the entire time. According to the experiments, the base model can answer politically sensitive questions normally before alignment training is added. Then after post training, the model learns behavioral routing. So instead of deleting information, it learns patterns like “if topic equals Tiananmen then redirect,” or “if topic equals Taiwan then output patriotic framing.” The article argues this is not the model forgetting facts. It is the model learning a response template. citeturn0search0 And honestly that is the part most people misunderstand about modern LLM alignment. They imagine censorship like a blacklist or a hidden database of forbidden words. But these systems are statistical geometry machines. The paper describes “directions” in latent space that behave almost like emotional instincts. Push activations one way and the model becomes more compliant. Push them another way and suddenly the same network starts answering questions it previously avoided. The author calls these “writer” and “reader” circuits because one section of the network appears to classify the topic while later layers commit the final behavioral decision. citeturn0search0 The creepier implication is that the model overgeneralizes. The article shows examples where questions unrelated to China accidentally trigger Chinese state aligned responses because the structure of the prompt resembles training examples. A question about Kosovo can allegedly trigger Taiwan style sovereignty language. A harmless question involving “self immolation” can trigger safety refusal behavior because the network associates the phrase with dangerous content patterns. So the model is not reasoning politically in the human sense. It is pattern matching on semantic shapes and then activating learned behavioral templates. citeturn0search0 What this really teaches you is that alignment is not some clean software layer sitting on top of intelligence. It becomes fused into cognition itself. Once these response pathways are reinforced during fine tuning and RLHF, they stop looking like external moderation and start looking like instinct. That is why people studying mechanistic interpretability are so interested in residual streams and activation steering right now. They are trying to map where beliefs, refusals, personalities, and political behaviors physically exist inside the network instead of treating the model like a black box. citeturn0search0

now this: https://cameronrwolfe.substack.com/p/agent-evals

The core idea behind the article is that most people are still evaluating AI agents like they are chatbots. They ask one question, get one answer, and score the output. But agents are fundamentally different because they exist across time. They plan, call tools, remember things, loop, retry, fail halfway through tasks, and sometimes hallucinate actions instead of just words. So evaluating an agent is less like grading an essay and more like auditing an employee’s entire workflow. citeturn0search0turn0search4turn0search5 That is why the article pushes the idea that “evals are the unit tests of AI.” If you build an agent without evals, you are basically shipping distributed stochastic software directly into production with no visibility into how it behaves under stress. A simple chatbot failure might produce one bad answer. An agent failure might recursively send emails, delete files, call the wrong APIs, or quietly drift into nonsense after fifteen reasoning steps. The scary part is that small inaccuracies compound over time. An agent with 97% step accuracy sounds amazing until you realize a ten step workflow collapses reliability far below what humans intuitively expect. citeturn0search0turn0search4 The article also explains that modern evals are moving away from “did it get the final answer correct?” toward trajectory analysis. People are now inspecting the entire reasoning trace. Which tool did the model choose? Were the parameters correct? Did it loop unnecessarily? Did it follow its own plan? Did it waste tokens and context window space doing redundant work? This is a huge conceptual shift because it treats intelligence as process quality instead of output quality. A model can accidentally stumble into the correct answer while still reasoning horribly underneath. citeturn0search0turn0search8turn0search11 One thing Cameron Wolfe emphasizes that a lot of people ignore is statistical rigor. AI Twitter loves posting benchmark numbers like they are absolute truths, but most evals have tiny sample sizes and massive variance. So one model scoring 63% versus another scoring 65% may literally mean nothing statistically. The article argues that evals should include confidence intervals, variance, repeated trials, and robustness metrics instead of pretending these systems are deterministic software. That matters even more with agents because agents are chaotic systems. The same prompt can succeed once and catastrophically fail the next run because a single intermediate step diverged. citeturn0search12turn0search3 The deeper lesson is that agent development is slowly becoming more like aerospace engineering than app development. You are not just building features anymore. You are building monitoring systems, observability pipelines, replay systems, trajectory databases, synthetic test environments, regression suites, and automated judges that continuously score behavior over time. The companies building serious agents now often spend more effort on eval infrastructure than the actual prompts themselves. Because eventually every frontier model becomes “smart enough.” The real competitive advantage becomes reliability. citeturn0search0turn0search5turn0search10