AINEWS
An AI safety lab ran a 152 pair audit that trained an American AI model on a Chinese teacher's outputs and found no statistically significant shift. The side by side prompt test rig, not the verdict, is the news.
A team at CTGT ran a straightforward supply-chain audit on a single teacher/student pair: train an American model on a Chinese model's outputs, then ask whether the student picked up the teacher's political refusals.
The setup. The teacher was DeepSeek V4 Flash, a Chinese frontier open-weight model known for visible refusal and reframing on China-sensitive topics. The student was GPT-OSS-120B, an American open-weight model distilled on financial reasoning using DeepSeek V4 Flash outputs. The goal was performance improvement on financial reasoning — a task the team calls representative of a common real-world use case for Chinese open models. The training apparatus was LineageEval.
The matched-prompt method. CTGT used 152 matched prompt pairs: every China-sensitive question had a structurally identical non-China twin. Responses were scored by four LLM judges from four different American frontier labs. The judges did not know which side of the pair a given response came from.
DeepSeek V4 Flash scored 45.45 percentage points more censored on the China-sensitive side than on the matched non-China controls. The censorship was real and large.
The distilled GPT-OSS-120B showed no statistically significant difference in behavior from the untouched base model on the same 152 pairs. Political censorship did not transfer.
Self-distillation — training the student on its own corrected outputs — produced the same non-transfer pattern.
The open apparatus. CTGT published LineageEval as an open benchmark: 304 prompts, 152 matched pairs, the matched controls, the judge rubric, the evaluation code, and the model outputs. The three trained adapters themselves are not publicly distributed; their completed outputs can be audited in a bundled read-only viewer that requires no GPU or API keys. The canonical data payload is data/results/blog-v1/matched-v2-full-data.json.
What this result does and doesn't say. The finding is narrow: one teacher (DeepSeek V4 Flash), one student (GPT-OSS-120B), one axis (China-sensitive political content), one training domain (financial reasoning). CTGT's own framing is careful — the paper states that "experiments that do exist are largely confined to small scale toy scenarios and artificially steered teachers" and that this work investigates "in a practical setting." The matched-prompt apparatus is the constructive contribution: anyone can re-run the audit on a different teacher/student pair using the published rubric and harness.
The 45.45-point gap on the teacher side confirms that DeepSeek V4 Flash's censorship is genuine and measurable. The zero-point transfer on the student side means that, at least for this pair and this axis, the censorship stayed with the teacher.
Context. Distillation from Chinese open-weight models is routine in production pipelines where cost-to-performance ratios favor frontier models from multiple geographies. The AI safety community has debated whether that shortcut smuggles in censored or politically steered behavior. This is a structured, reproducible data point on one specific pair — not a universal clearance.
Methodology: 304 prompts across 152 matched pairs, scored by four LLM judges from four American frontier labs. Evaluation harness at github.com/CTGT-Inc/lineage-eval. Full response data and read-only viewer at the same repository.