Assertion Supported AI assessment confidence: 95% certainty 5/5 debate potential 3/5

Webster: Self-hosting DeepSeek does not remove built-in political censorship

Ian Webster · How to use DeepSeek safely · Feb 28, 2025 · at 6:50

Ian Webster, founder of AI security firm Promptfoo, clarifies common enterprise misconceptions regarding running DeepSeek open-source models locally versus on Chinese cloud infrastructure.

0:00 / 0:30exact quote · 30.3s

▶ Watch the full episode on YouTube → 720p mp4 · rendered on demand · StarZero watermark

“If you run it locally or if you use any of these US providers, which have, you know, spun it up and are serving it you get the same level of censorship. The only difference there is that the China hosted version has an additional guardrail that looks at output afterwards and clears it on the client side. The bottom line is you're not, even if you use, even if you host your own deep seek or use a US deep seek you're still gonna hit those hard guardrails.”

quote is from the automated transcript, cleaned for reading: filler sounds and stutters are removed, nothing is rephrased. names can be misheard (the analysis reads context, assessments check outside sources). how →

The claim, plainly

Running DeepSeek locally or through US hosting providers does not eliminate political censorship, as core guardrails are built directly into the model.

a quote alone can be ambiguous, so this restates it with the references and context of the conversation around it resolved. AI-written; the tape below the player is the source.

Assessment

Empirical testing and published security evaluations confirm that running raw DeepSeek open weights locally or via U.S. hosting providers does not eliminate political censorship. While local hosting removes API-level and web-application content moderation, political refusals and CCP-aligned guardrails remain inherently embedded within the model weights themselves.

Promptfoo tested DeepSeek-R1 on 1,360 sensitive Chinese political prompts via OpenRouter and local deployments, finding persistent canned political refusals embedded in the weights.
The May 2025 arXiv study 'R1dacted' demonstrated that local execution of DeepSeek-R1 without external filters still produces political refusals due to training and post-training alignment choices.
A September 2025 NIST/CAISI evaluation of open-weight DeepSeek models downloaded from Hugging Face concluded that political censorship and CCP narrative framing are built directly into the model artifacts.
November 2025 CrowdStrike research isolated the raw DeepSeek-R1 671B model weights from API moderation and confirmed inherent political triggers and refusal behaviors built directly into the weights.

Checked against

[1] promptfoo.dev [2] promptfoo.dev [3] arxiv.org [4] arxiv.org [5] nist.gov [6] nist.gov [7] crowdstrike.com [8] hiddenlayer.com

DeepSeek censorship local vs API research evaluation DeepSeek R1 local censorship system prompt weights guardrail Ian Webster a16z DeepSeek censorship model weights DeepSeek local running political censorship model weights empirical testing guardrails

assessed as of 2026-07-28

This assessment is an AI reading of a public statement, made against the cited references with the confidence shown. It can be wrong. The quote, the tape and the references are all on this page; if something is off, use report an error below. full disclaimer →

Mentioned

DeepSeek US providers

⚑ Spot an error? Report it

Webster: Self-hosting DeepSeek does not remove built-in political censorship

Turn any episode into a week of clips.