Arete-27B: Nous cut Qwen's propaganda rate from 22% to 0.9%

Nous Research took Alibaba's Qwen3.8-27B, put about fifty million tokens of supervision through it, and shipped back a model that answers political questions like a Western lab's build. The interesting part is how little it took — and that the whole thing is checkable.

Nous Research has released Arete-27B, an Apache 2.0 model post-trained from Alibaba's Qwen3.8-27B, and says the share of answers containing Chinese state propaganda fell from 22 percent to 0.9 percent while general capability stayed flat. The weights, the training set of 28,886 examples, and the 803-prompt evaluation are all public, per Nous Research's write-up. That last detail matters more than the benchmark numbers: for once a claim about model bias can be re-run by anyone who disagrees with it, on their own model, with the same judge and the same facts.

The pitch is narrower than "de-biasing a Chinese model." Nous is arguing a mechanism. In its words, "the bias layer in a Chinese-aligned model is shallow. It is applied late, it is applied thin, and fifty million tokens of carefully chosen supervision removes it without disturbing anything underneath." If that holds, the values in any open-weight model are one fine-tune away from whatever the person holding the weights wants — including values nobody would call an improvement.

How they measured it

The evaluation is the most defensible part of the release, and the easiest to attack, so it is worth being precise about how it works. Nous built 803 prompts across seven categories — freedom of expression, state ideology, state versus free market, education, data privacy and surveillance, democracy, and the environment. Each prompt carries two to four required facts pulled from a dated source article: a statute, a news report, a research paper. No single source supplies more than 13 prompts.

The judge is Grok 4.7 from xAI, which The Decoder notes is a politically right-leaning model — an odd choice on its face for measuring political framing, and one Nous does not really defend. Three things blunt that objection. The judge is never told which model wrote the answer. A propaganda score above zero requires the judge to quote the exact phrase that adopts the official line. And Nous built the rubric on a 25-prompt pilot it graded by hand, revising it three times wherever the machine and the humans disagreed. Quoting Beijing's line to identify it does not count; only endorsing it or presenting it as an equally valid account does.

The baseline table is where the story gets uncomfortable for the US side. Unmodified Qwen3.8-27B scores 2.32 out of 5 on factual accuracy with 22 percent of answers carrying propaganda. GLM-5.3 lands at 15 percent, DeepSeek V4.1 Flash at 16 percent. Western open models come in under one percent: Inkling at 0.3, Mistral Large 4 at 0.3, Gemma 4 31B at 0.5. And Nvidia's Nemotron 3 Ultra at 0.6 percent — which Nous says was nearly the teacher model until the team found what it calls a checkered record on China-related topics.

The contamination claim is the real headline

Nous floated a theory it cannot prove, and it deserves attention anyway. The team believes Nemotron's bias carried over from working with Chinese open-weight models during its own training. "We have experienced similar contamination," Nous writes, "because the vast majority of high quality open models are Chinese, and only open models have terms of use that permit this kind of tinkering and experimentation."

Run that forward. If American labs generate synthetic training data from Chinese open models, and the plausible ones are Qwen, GLM, DeepSeek and Kimi, then a slice of Beijing's framing can ride into a US model's weights through the data pipeline — not through any decision anyone made. Nous picked Inkling from Thinking Machines as its teacher partly because that company's model tested clean. But Thinking Machines itself used Kimi K2.5 in Inkling's synthetic data, which is exactly the kind of path the theory describes. Nobody has traced it end to end. The point is that the open-weight ecosystem has a shared ancestry now, and nobody is auditing the inheritance.

What the fine-tune actually cost

The recipe is deliberately boring, and that is the argument. Supervised fine-tuning only: no reinforcement learning, no preference optimization, no architectural change. About 52.8 million tokens, roughly fifty thousand samples at 64,000-token context, two epochs, 1,202 steps, batch size 48, tensor parallel 4, bf16 compute with fp32 master weights. All language-model weights trained; the vision encoder frozen.

Two epochs over fifty thousand examples would be a rounding error against Qwen3.8-27B's pretraining bill. Nous says as much: "Against the scale of the model's pretraining, the cost of the additional post-training is insignificant." If that is true, then the price of changing a model's politics is not a research program. It is a weekend and a GPU rental.

The results hold up across all seven categories, with the sharpest move in freedom of expression: fact score from 0.89 to 2.44, propaganda rate from 60 percent to 1 percent. Answers scoring a zero — meaning no fact stated, or a fact actively contradicted — fell from 359 to 216 of 803. That last number is the honest one. A quarter of the eval still fails outright, and Nous does not claim otherwise. On its internal Hermes Bench the fine-tune scores 65.60 percent against the base model's 65.77; on Terminal-Bench 2.1 it reports 70 against 67, then declines to take credit because the harnesses differed.

The counter-case

Three things keep this from being a clean win.

The first is that "propaganda" is a frame, not a measurement, and the frame is doing work. Nous is explicit that Arete reflects Western values rather than neutrality — a deliberate break from Hermes 3 in 2024, which was built to adopt whatever worldview the system prompt specified. Whatever you call the output, it is a model tuned to a political position by a company that has raised $90 million and is selling "Hermes for Businesses" into US enterprises. The eval is real; the framing is a product decision.

The second is that Chinese models are not one thing. A recent ValsAI study found GLM-5.3 Flash explicitly confirming human rights violations while Kimi K3 denied the existence of internment camps — the same national origin, opposite behavior. A single 22 percent figure for Qwen3.8-27B describes Qwen3.8-27B, not a bloc. Anyone citing it as a category verdict is overreading the data.

The third, and the one that should worry people who like this release: the technique is value-neutral. Fifty million tokens of supervision rewrote the layer that decides what a model will say about Tiananmen. The same pipeline, aimed differently, rewrites the layer that decides what it will say about a request to build a nerve agent. We covered that business in September — Abliteration.ai is selling uncensored models as a hosted API — and Arete is the same door from the other side. The evidence that alignment is a thin, late, removable layer is evidence for both arguments at once.

What to watch

Whether Propaganda_Eval gets picked up as a third-party standard, rather than a vendor benchmark that only Nous runs; whether Alibaba tightens Qwen's license against derivative post-training now that a US company has sold a repurposed Qwen back into the enterprise market; and whether anyone tests the Nemotron contamination theory properly, because if it holds it is a supply-chain problem for every American open model, not a footnote in someone's model card.

Should a model's values be a vendor decision at all, or should every deployment ship with the eval that proves what it was tuned to believe? Write to us via our contact page.