The Take — Chinese data isn't the risk; the last fine-tune is
Nous Research took Alibaba's Qwen3.8-27B, put about fifty million tokens of supervision through it, and cut the share of answers carrying Chinese state propaganda from 22 percent to 0.9 percent without losing measurable capability. Most coverage read that as a story about Chinese censorship. I think it is a story about where a model's politics actually live — and it is not where the people writing export rules think it is.
As our brief on the release laid out, Arete-27B is supervised fine-tuning only: 28,886 examples, roughly 52.8 million tokens, two epochs, 1,202 steps, batch size 48, no reinforcement learning, no preference optimisation, no architectural change. Every language-model weight was trained, the vision encoder was frozen, and the result is Apache 2.0 with the training set and the evaluation prompts published alongside the weights.
That last detail is why the release is worth arguing about at all: a claim about a model's politics can now be re-run by anyone who doubts it, on their own hardware, with the same judge and the same questions.
The baseline table is the argument
The evaluation is 803 prompts across seven categories — freedom of expression, state ideology, state versus free market, education, data privacy and surveillance, democracy, the environment — each carrying two to four required facts from a dated source, with no single source supplying more than 13 prompts. Grok 4.7 judges blind, and a propaganda score above zero requires the judge to quote the phrase that adopts the official line, not merely identify it. Before any of that, Nous hand-graded a 25-prompt pilot and revised the rubric three times, per its write-up.
Qwen3.8-27B starts at 2.32 out of 5 on factual accuracy, with 22 percent of answers endorsing Beijing's framing. GLM-5.3 lands at 15 percent, DeepSeek V4.1 Flash at 16. And then the Western open models: Inkling 2 Small at 0.3, Mistral Large 4 at 0.3, Gemma 4 31B at 0.5, Nvidia's Nemotron 3 Ultra at 0.6.
Nemotron is the interesting row. Nous says it was nearly the teacher model for Arete until the team found what it calls a checkered record on China-related topics, and that it believes the bias came from Nvidia's own use of Chinese open-weight models in training. Nous then reports Nemotron's propaganda rate as 0.6 percent — indistinguishable from the three models nobody accuses of contamination.
If inherited framing were the mechanism that sets a model's China answers, the accused model should not look like the clean ones. It should sit somewhere between Qwen's 22 and the Western pack. It doesn't. Whatever moves that number, it is applied at the end of the pipeline, not baked in at the start.
Cheap to change, therefore the only thing worth certifying
Nous's own framing of the cost is the part that matters for policy: against the pretraining bill, the extra post-training is "insignificant." Capability didn't move — 65.60 on the internal Hermes Bench against the base model's 65.77, and a Terminal-Bench 2.1 result of 70 against 67 that Nous declines to claim because the harnesses differed. Nor did the job finish: 216 of the 803 answers still score zero, and freedom of expression went from 0.89 to 2.44 on facts, not to anything you would call balanced.
So the price of changing a model's expressed values is a fine-tune of the kind a studio can run in a few days, and what comes back is the same architecture at the same size. We covered the other direction of that fact in September, when Abliteration.ai started selling uncensored models as a hosted API — same door, opposite sign. Both stories say the same thing: alignment is a property of the artifact in front of you, not a property of where its tokens came from.
Which is why I think the current provenance fight is aimed at the wrong layer. Export controls police chips. Procurement language increasingly polices model origin. Neither measures what a model will actually say. The one lever with demonstrated effect on that — the last fine-tune — is unpoliced, unlabelled and, at these prices, available to anyone with a rented GPU.
The fix is not a licensing regime. It is a much smaller ask: ship the behaviour eval with the weights. Eight hundred prompts, a blind judge, the dataset in public, and a number a buyer can attempt to reproduce before signing. Arete does this. It should not be remarkable that it does.
The counter-case, which is stronger than I would like
The eval is a political document, and Nous says so. Its judge is a model The Decoder describes as right-leaning; its rubric was written by the party being judged; its author states plainly that Arete reflects Western values rather than neutrality. Eight hundred and three prompts is not a census of a model's worldview, and a quarter of the answers scoring zero is an admission that the instrument still misses badly. Handing that number the status of a standard would entrench one company's frame as the reference point for everyone else's model.
The contamination theory is also not dead. It is unmeasured. A seven-category eval asks direct questions and scores direct answers; inherited framing may show up in the hedges, in what a model declines to say about Taiwan, in which examples it reaches for. A clean score on a direct-question eval is evidence, not proof, and 0.6 percent is exactly the kind of number that could be masking drift the prompts never touch.
And the supply-chain problem that is actually documented — American labs training on Chinese model outputs — is mostly about capability, not values. That is an IP dispute, and no bias eval settles it.
Why the take still holds
My claim is narrower than "contamination is fake." It is that behaviour is the only layer you can measure and the only layer you can change for the price of a weekend, so it is the layer a rule ought to target. Even if some framing does ride in through a data pipeline, it is removable downstream at trivial cost — which means a lineage audit certifies nothing about the deployment running in your building. And lineage is, today, unauditable in practice: no lab publishes its synthetic-data mixture in a form anyone can check, and nobody has traced a values shift from a Chinese model into an American one end to end. A rule you cannot verify is a press release with a letterhead.
The alternative to artifact evals is not neutrality. It is silence, with "clean" decided by whoever wrote the launch post. A published 0.3 percent that I can fail to reproduce is worth more than an assurance I cannot test.
What would change my mind
A controlled ablation. Take a clean American base model, hold the post-training recipe fixed, add a measured share of Qwen or GLM synthetic data, and show China-topic propaganda moving more than a couple of points above noise on an eval the vendor did not write. That would turn a theory into a mechanism and make data provenance a legitimate target.
Second, an independent evaluator — not the lab, not the model's seller — finding American open models drifting upward across generations in step with their Chinese data share. Third, and most interesting to me: evidence that values resist removal, a model where a 50-million-token fine-tune leaves harm refusals intact while the politics move freely. That would mean something real is trained in deep and something else is painted on. Nous published no harm-refusal comparison with Arete, so nobody knows yet which of those we are looking at.
Until one of those lands, the question worth asking about a model is not whose tokens it read. It is who touched the weights last, and whether they will show you the test.
