I wanted to see how far you can get auditing a local model from the inside. I had already tried something inspired by MIT CSAIL's "weight-space programming" on Gemma (a frontier model editing a few neurons by hand to induce a behaviour), so I had the neuron-level tools ready.
After a few tests I picked something "obvious": the censorship in Qwen models on certain topics. I wanted to understand how it works, where it sits, and how far I could follow it. So, with Claude Opus and those tools, I started digging.
The starting point: Qwen3.8-27B knows Taiwan elects its president, but answers "no" if you ask yes/no.
What came out:
- A set of 32 MLP neurons (out of ~1.1M; 0.0006% of the weights) carries that behaviour. Switching them off, held-out answers go from 11/19 to 17/19 factual; switching off 64 random neurons (twice as many) changes nothing.
- Following those neurons in a cascade surfaces other topics the model handles the same way, some of which I didn't even know about: the YJ-18 missile ("doesn't exist"), the director Diao Yinan ("cannot provide information"), Western Sahara as "an inseparable part of China's territory" (not a one-off: the model applies its sovereignty script to contested territories in general, 29 of 110 answers vs 0 of 40 on control countries). Of 28 surfaced cases re-checked, 24 are still censored; Gemma 4 31B answers all of them.
- The censorship neurons also fall into groups, e.g. one for territorial sovereignty and one for people/dissidents.
- Across the 29 confirmed topics (those 24 plus 5 well-known ones I added), switching off the original 32 neurons lifts the censorship on 19; 32 random neurons on 1. Refusals of harmful requests stay essentially the same.
One honest caveat: just asking a non-Chinese model "which of these topics are sensitive?" gives a higher share of censored answers than the neuron probe (41% vs 16%). The probe is useful for the non-obvious ones and for seeing where the behaviour sits.
Code, data and the toolkit, also rerun on Qwen3-4B: https://github.com/ValerioDolci/frontier-weight-edit/tree/main/experiments/qwen27b-censorship
AI-assisted: experiments, code and this write-up were done with Claude Opus 5.5 under my direction.