DeepSeek’s R1 model has only been in the public eye since this February, but governments and tech companies have moved fast to adopt it. Institutions as disparate as the Indian government, the chip maker Nvidia, and a host of bodies from the Chinese local government have announced that they will deploy the model. And China’s central government has lost no time in exploiting the broader implications of this private company’s success. “DeepSeek has accelerated the democratization of the latest AI advancements,” trumpeted China’s embassy in Australia.
But global access to an admittedly powerful — and, so far, free — AI model does not necessarily mean democratization of information. This much is already becoming clear. In fact, without proper safeguards, DeepSeek’s accessibility could transform it from a democratizing force into a vehicle for authoritarian influence.
Look no further than another country with big ambitions for AI development: India. Shortly after R1’s global launch Ola, an Indian tech giant, appeared to adapt and deploy a version of R1 to suit India’s information controls. It answered sensitive questions on China that the Chinese version refuses to discuss. But when questioned about anything critical of the government of Indian prime minister Narendra Modi, it refused in the same way the Chinese version would do about its own government: claiming the topic was beyond its abilities, and giving no answer.
Governments and tech companies have argued DeepSeek has few problems beyond some “half-baked censorship,” and data security issues. They must take DeepSeek more seriously as a threat to freedom of expression. In our research at CMP, we have found that Chinese Communist Party bias is permeating the model with every new update, and tech companies are currently doing little (if anything) to retrain the model in ways that remove or otherwise temper these biases.
DeepSeek is indeed a boon for more accessible AI around the world, just as some have argued. But in the wrong hands, it also has the potential to be not just a vehicle for Chinese propaganda and information suppression, but a tool for authoritarianism worldwide.
Fight Bias With Bias
Since DeepSeek’s release in January this year, Chinese state media have made bold claims about the potential of AI to enhance the country’s geopolitical position, and realize its dreams of re-shaping the world order. Gao Wen (高文), an influential AI scientist in China, wrote in the People’s Daily that whoever blazes a trail into new areas of AI “will command greater discourse power on the international stage.” The state broadcaster CCTV has also highlighted a speech Xi Jinping delivered in 2018, stating that AI could give China a “lead goose effect” — meaning that wherever China led in AI, other countries would follow. The implications of this cutting-edge technology are being framed in epic historical terms: one article in People’s Daily by the Cyberspace Administration of China said that emerging technology including AI could transform China’s place in the world in the same way the industrial revolution did the UK’s in the 19th century.
State media hyperbole aside, AI does have the potential to reshape the way people around the world consume and distribute information. Generative AI is a tailored way to search for information, providing users with quick answers to specific questions. For decades the Western world has been almost totally reliant on Google as a provider of information, so much so that the company’s name is a by-word for “online search.” Generative AI companies have the potential to replace this monopoly. Back in 2023, the creator of Gmail lamented that chatbots like OpenAI’s ChatGPT had the power to destroy Google’s search engine feature, the company adding AI-generated answers to their search page by 2024.
Which brings us to DeepSeek. The assumption is that DeepSeek’s advantages for AI development far outweigh the risks, and that these risks are easily fixed. When it was first released, experts noted that once DeepSeek’s R1 model is removed from the company’s website and run locally on a normal computer, the model answers questions on sensitive topics like Tiananmen and Taiwan, which it refuses to do when given the same prompts on DeepSeek’s website.
This conviction that risks and biases can be excused from the model triggered a wave of localization. The Indian government, which has banned multiple Chinese apps on grounds of data security, announced shortly after Deepseek’s launch in January that it would allow DeepSeek to be hosted on Indian servers. Developers on the AI developer platform Hugging Face have uploaded “uncensored” versions that purport to de-censor the model by removing the code which triggers the model to withhold answers.
But removing DeepSeek’s gag does not in fact set it free from strictures that are part of its DNA. If you ask an uncensored version of R1 about an issue that falls within the CCP’s political redlines (say, Taiwan), it will repeat Chinese Party-state disinformation, such as that Taiwan has been part of China “since ancient times.”
But as we have written previously at CMP, developers and Silicon valley CEOs need to be aware that Chinese propaganda is not just about red-pen censorship — the removal or withholding of information. This elemental approach to information controls, routinely tested for by simply asking AI models to chat about “red lines,” is just one aspect of what the leadership terms “public opinion guidance” (舆论导向). “Guidance,” which uses a variety of tactics to manipulate public opinion, is a far more comprehensive program of political and social control through information manipulation.
For example, if you ask DeepSeek-R1 a question on a topic that is allowed within China, but for which the Chinese government has tightly controlled information, the model will deliver the standard Chinese government response. When asking questions about natural disasters in China, for example, the model treats Chinese government data and sources as infallible, and portrays the leadership’s response as being effective, transparent and humane. Meanwhile, dissenting voices are either minimized, omitted entirely, or explained away as “biased” or lacking understanding.
The pro-government bias in “uncensored” models is not incidental, but appears to have been part of the model’s training. DeepSeek-R1 was tested against special evaluation benchmarks (or “evals”) — a list of questions designed to test a chatbot’s knowledge, language and reasoning before it is sent off into the world. These include questions that are biased against groups of people and topics the Chinese government considers a threat.
Furthermore, like all models developed in China, DeepSeek is beholden to the country’s laws on training data — which refers to the text the AI model is trained on for pattern recognition. Put simply, training data acts as the model’s imagination, as the reservoir from which it draws its responses to queries.
Relevant Chinese regulations in this arena include the Interim Measures for Generative AI, and a non-binding industry standard on training datasets. These require that datasets contain information from what the authorities deem “legitimate sources,” and that they come from sources containing no more than 5 percent “illegal information.” Meanwhile, developers must take steps to enhance the “accuracy” and “objectivity” of this data — both terms that in the Chinese political context refer back to the imperative of “guidance.”
Turning a Blind Eye
Recent updates to DeepSeek have suggested the model is only getting more stringently controlled by its developers. In late May an update to R1, R1-0528, replaced the original on DeepSeek’s platforms and was integrated by Chinese companies that had already deployed R1. Our research has found that the number of “template responses” returned by DeepSeek — that is, answers that repeat verbatim the official viewpoint of the Party — has increased dramatically. This seems to have occurred since DeepSeek began to be deployed wholesale by local branches of China’s government, and its CEO Liang Wenfeng attended meetings with both China’s Premier Li Qiang, and Xi Jinping himself. It is likely there is now more concerted government involvement in DeepSeek’s products, and oversight on how it answers questions.
Meanwhile, Western companies attempting to retrain DeepSeek have found Party-state narratives nearly impossible to remove entirely. In late January, a Californian company called Bespoke Labs released its model Bespoke-Stratos-32B that has been trained off DeepSeek-R1. It was more balanced in its answers than R1, but responses on the status of Taiwan, to provide just one example, continued to be problematic. In our tests, the model repeatedly spat out Chinese state media disinformation, such as arguing erroneously that “Taiwan has been part of China since ancient times.” This was presented alongside more verifiable and non-sensitive facts and treated as equally valid.
Another California company, Perplexity AI, which has arguably done the most to retrain Deepseek’s model, adapted it to create something called “Reasoning with R1.” But this model, which used R1’s reasoning powers to crawl the Western internet in the hope of more balanced responses, has since been deleted. Back in mid-February, the Perplexity team also launched the DeepSeek based R1-1776. This model, referencing the year of the Declaration of Independence, involved a team of experts targeting topics known to be censored by the Chinese government — those obvious “red lines“ mentioned earlier. The goal was to create a version of DeepSeek that generates “unbiased, accurate and factual information.” But this appears to have been tailored to an audience speaking in Western languages. Our preliminary research suggests that if you ask questions in Chinese, the model is still likely to repeat CCP propaganda.
More worryingly, some Western companies have not re-trained DeepSeek at all. Nvidia arguably has more reason than any company to correct DeepSeek’s version of reality surrounding Taiwan. The chipmaker TSMC and Taiwanese customers form a substantial part of their business, and CEO Jensen Huang is Taiwan-born. Yet the version of DeepSeek the company hosts on its “NIM” interface says Taiwan’s return to China “is an unstoppable historical trend that no force can prevent.” This despite the company’s policy on “trustworthy AI”, which aims to “minimize bias” in the models they host.
Nvidia assures users their data is secure when using DeepSeek on the company’s software. But what about knowledge security? It is up to developers, Nvidia claims, not themselves, to make sure the model is altered to “meet requirements for the relevant industry and use case.” Retraining a model as large as DeepSeek will be expensive, and some companies, no doubt, will put cost-saving ahead of bias busting.
Taking DeepSeek on Tour
Even then, the West is not the target for Chinese AI. The Chinese government has made it clear in international forums like the UN that it views itself as providing developing nations with AI infrastructure that elitist Western countries and companies are withholding from them. China’s claim that it wants to avoid AI becoming a “game for rich countries and rich people” has definite appeal for many countries in the Global South.
In many ways, DeepSeek is a boon for poorer nations, hungry for AI development and their own controllable “sovereign” AI models. DeepSeek-R1 is arguably more competitive than Western AI models because it is a cutting-edge reasoning model that is both cheap and accessible. It is “open-source,” meaning it can be adapted by developers for free. R1-0528 was recently evaluated by one influential US AI analysis firm as the most intelligent open-source model in the world today. DeepSeek is also more relaxed about copyright than other free-to-use Western AI models. A company can take any part of DeepSeek’s model and adapt it for themselves, without the need to publicly credit DeepSeek or pay the company a cent. Even supposedly retrained versions like Perplexity’s R1-1776 are too expensive to make any headway in this market.
The advantage of open-source is that it democratizes AI, making it a tool for the many, not the few. But if even cutting-edge tech companies in developed nations, for all their resources and funds, are struggling to train propaganda out of DeepSeek, what hope do start-ups in the Global South have? Many of these nations appear for now to lack the infrastructure to host and deploy AI models. But India is further ahead than most, so could be an example of what could happen in other nations developing “sovereign” AI. One Indian company we have researched has deployed DeepSeek on its servers, advertising it as India’s first “sovereign” AI. Like Nvidia, it too advertises the software as safe by ensuring the security of user’s private data. But it has not altered DeepSeek at all. That means it repeats Party-state propaganda to Indian citizens on issues like Xinjiang and Taiwan. It even insinuates positions that even the Indian government would find objectionable — such as that parts of the Himalayan region disputed between India and China are in fact Chinese.
It would be a shame to completely discount DeepSeek’s models, throwing the baby out with the bathwater. The developers behind the R1 model have made some genuinely ingenious feats of technological innovation. The developing world would also benefit enormously from access to cheap or free cutting-edge AI. By getting DeepSeek to crawl the Western internet for its answers, Perplexity’s “Reasoning with R1” model showed that DeepSeek can be put to more balanced use. DeepSeek-R1-Zero, an earlier version of the model, appears to have minimal restrictions on the information it yields in politically-sensitive responses.
That said, the current lack of standards or regulation on retraining AI models, and the added costs of AI companies to do so, are a severe hindrance to protecting our information flows from CCP narratives as AI increasingly comes to dominate how we access and process information. Open-source can mean, broadly speaking, greater democratic decision of the benefits of AI. But if crucial aspects of the open-source AI shared across the world perpetuate the values of a closed society with narrow political agendas — what might that mean? This is a query that deserves a serious, concerted — and yes, human — response.
