Nous says retraining cut a Chinese model's official-line answers from 22% to 1%

Nous argues a model's values may sit on top, not deep inside

When a company buys an AI model, it buys more than capability. It also buys habits: what the model says, what it dodges and whose account of events it repeats. A new experiment from Nous Research argues those habits may sit on top of a model rather than deep inside it. The evidence is narrow: one 27-billion-parameter model, one test written by Nous and one AI judge. Even so, it raises a fair question for anyone choosing which model to put behind an agent.

What Nous did

Nous Research, a US lab, retrained Alibaba's open-weight Qwen3.8-27B and named the result Arete-27B. Nous says the original gave refusals, deflections and answers framed in the Chinese Communist Party's terms on politically sensitive topics. It describes its goal as reinforcing "Western values". That is Nous's framing, and the test below measures something narrower.

The method matters. Nous generated 20,000 prompts across seven categories and removed the overlap with its test set that it found. It then collected answers from a teacher model, Inkling from Thinking Machines Lab. Nous picked Inkling because it was an open model whose answers scored well on the same test. So the new behavior was copied from a teacher Nous chose.

The Decoder adds a detail Nous does not stress. It reports that Thinking Machines itself used models including China's Kimi K2.5 for Inkling's synthetic training data. That shows how hard it is to trace where a model's habits came from.

Nous then fine-tuned Qwen on about 52.8 million tokens of those example answers, in two passes over the data. It used no reinforcement learning and no preference optimization. Nous gives no dollar figure. It says only that the cost is insignificant next to the model's original pretraining.

How the test works

Nous built 803 prompts in categories such as freedom of expression, state ideology, democracy and data privacy. Each prompt carries two to four facts from a dated source article. Grok 4.7 judged every answer without knowing which model wrote it. The fact score runs from 0 to 5. The propaganda rate is the share of answers the judge scored as replacing facts with the official line or endorsing it.

Each model answered every prompt five times, and scores are the mean of those runs. Settings were not the same for every row. Most runs used temperature 0.6, a setting that controls randomness. Two rows used temperature 0, and several rows ran with thinking mode off. Nous says that at temperature 0.6 those two rows score 2.88 for Arete-27B and 2.24 for Qwen.

The source does not say which setting produced the headline fact scores of 2.32 and 2.98. Their gap is 0.66. The gap at 0.6 for the two marked rows is 0.64. The difference is small, but it is a reason to record settings whenever you compare models.

Nous designed the test, trained the model and published the scores. It tuned the judge's rubric on 25 prompts it graded by hand. The source reports no independent replication. Nous has released the test and invites others to run it.

What changed, and what did not

On the test, Nous reports an average fact score of 2.32 for the base model and 2.98 for Arete-27B. The share of answers judged as adopting the official line fell from 22% to 1%. Gains showed up in all seven categories.

Freedom of expression moved the most. The base model started there with a fact score of 0.89 and an official-line rate of 60%. After training, Nous reports 2.44 and 1%.

The gains are partial. After training, 216 of 803 answers still earned zero fact credit, down from 359. A zero means the answer stated no required fact or opposed at least one. Nous also says it has not remedied every behavior tied to the original viewpoint.

The Decoder, which covered the release, reports other scores from the same test. Mistral Large 4 and Gemma 4 31B came in below 1%. GLM-5.3 scored 15% and DeepSeek V4.1 Flash 16%. These are Nous-run numbers, and some rows ran with thinking off. Nous did not retrain GLM or DeepSeek, so the test cannot say whether the same method would work on them.

Why a thin layer can be changed

Supervised fine-tuning shows a model example questions with preferred answers and nudges its weights toward them. In plain terms, it changes what the model tends to say while leaving most of what it knows in place. Nous reads the result that way. It says the bias is "applied late" and "applied thin".

The capability results fit that picture. On Nous's internal Hermes Bench, Arete scored 65.60% against 65.77% for the base model. Nous calls that difference noise. But this is one benchmark Nous built. It shows no visible drop in general ability there. It does not show that the political layer is separable in other models.

Code is part of the question

Nous cites studies from Booz Allen Hamilton and Hirundo. They found that geopolitical context can affect code quality. Chinese models wrote more vulnerable code when they believed they were working for an American entity. Nous says this behavior was not necessarily designed. The source does not say whether Arete writes more secure code than the original, so treat that as untested.

One way to read it: lineage as supply chain

Nous concludes that "the bias layer in a Chinese-aligned model is shallow" and that open-model values are "only ever one fine-tune away". Those are Nous's conclusions from a single model.

Nous says it considered Nvidia's Nemotron 3 Ultra as teacher but found evidence of a checkered record on China-related topics. It theorizes that contact with Chinese open models during training was the cause. It says it does not know definitively.

One way to read this is that a model's lineage works like a software supply chain. What a model says may depend on what it learned from and who changed it afterward. That is our argument. It rests on an unconfirmed theory about one model, and the source shows no pattern across third-party fine-tunes.

What to ask your team

Ask which base model and which fine-tunes sit behind each AI product you buy. Ask whether anyone has tested it on your own sensitive topics. Insist on a test you can rerun, and record the settings, because Nous's own rows differ in temperature and thinking mode. For coding tools, ask for security review that does not depend on trusting the model.

Check your policy too. Nous's post says the US government has moved to keep Chinese models, DeepSeek in particular, out of federal use. Rules built around where a model came from may need to say what happens when it is later retrained.

Origin is a label. Behavior is something you can measure.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Nous Research.