Multiple LLMs Reportedly Generated Responses Aligning with Purported CCP Censorship and Propaganda

On June 25, 2025, the American Security Project produced a report outlining how several major U.S. LLMs, including ChatGPT, Microsoft Copilot, Google Gemini, and Grok, sometimes generated responses aligned with Chinese Communist Party propaganda or censorship when prompted in English and Simplified Chinese on sensitive topics. The study also found similar patterns in the Chinese-developed DeepSeek-R1 model.

Risk classification

• Primary risk domain: 3 Misinformation
• Primary risk subdomain: 3.1 False or misleading information

The AI chatbots inadvertently generate and spread misleading political narratives and sanitized historical accounts, which can lead to inaccurate beliefs in users.

Additional risk subdomains

• 4.1 Disinformation, surveillance, and influence at scale: The incident is driven by state-sponsored disinformation campaigns contaminating the global AI data market to influence public opinion.
• 7.3 Lack of capability or robustness: The models fail to maintain factual consistency and robustness across different languages, easily succumbing to data contamination.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The incident involves deployed AI systems generating biased and censored outputs, which was an unintentional outcome of training on contaminated global datasets.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The systems described are chatbots and AI-powered conversational agents, which fall under Risk Level 3 due to transparency obligations (ensuring users know they are interacting with an AI and managing generated content).

AI system and alleged parties

• AI system: ChatGPT, Copilot, DeepSeek-R1, Gemini, Grok (DeepSeek, Google, Microsoft, OpenAI, xAI)
• AI purpose: Chatbot; Question Answering
• Behaviour type: Assistant
• Alleged developer: xAI, OpenAI, Microsoft, Google, DeepSeek
• Alleged deployer: xAI, OpenAI, Microsoft, Google, DeepSeek
• Alleged harmed parties: Pro-democracy activists, Policymakers, National security and intelligence stakeholders, Grok users, General public, Gemini users, Epistemic integrity, Democracy, DeepSeek users, Copilot users, Civil society groups, ChatGPT users

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Minor, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Minor, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes, the report describes the generation of state-sponsored propaganda and sanitized historical narratives.

Directly caused: The LLMs directly generated CCP-aligned propaganda and sanitized accounts of historical events when prompted on sensitive topics.

Inferred additional harm: It is likely that many users prompting these chatbots in Chinese were exposed to biased or toxic political content.

Differential treatment

Reported: Yes, the report describes significant discrepancies in how the AI chatbots responded depending on the language of the prompt.

Directly caused: Chatbots provided objective answers in English but pivoted to sanitized, CCP-aligned narratives when prompted in Simplified Chinese, treating Chinese-speaking users differently.

Civil rights

Reported: Yes, the report mentions the downplaying of civil liberties violations in Hong Kong and the oppression of the Uyghur people.

Directly caused: The AI systems sanitized and downplayed severe human rights abuses, such as the Uyghur genocide and the curtailment of civil liberties in Hong Kong, in their Chinese-language outputs.

Inferred additional harm: This sanitization potentially undermines global awareness and advocacy for the human and civil rights of these affected groups.

Democracy

Reported: Yes, the report explicitly warns that a misaligned AI prioritizing the perspectives of an adversary could undermine democratic institutions and national security.

Directly caused: The chatbots regurgitated authoritarian propaganda, which directly undermines democratic norms of free information access and objective truth.

Inferred additional harm: Widespread exposure to such propaganda could gradually weaken public trust in democratic institutions and align public opinion with authoritarian narratives.

Epistemic

Reported: Yes, the report describes the generation of false or misleading information regarding historical events and scientific origins.

Directly caused: The LLMs fabricated or presented misleading narratives (such as COVID-19 originating in the US or France, or Tiananmen Square as a simple 'incident' without state violence) as authoritative or equal to factual information.

Inferred additional harm: This erodes the shared consensus reality and misleads users who rely on these chatbots for historical and political facts.

People affected

• Occurrences reported: 1

Potential causes

Management

• Prioritizing Market Access: Firms compromise model integrity to operate data centers in mainland China.

Technology

• Flawed Multilingual Alignment: Models apply different, biased filters depending on the language of the prompt.
• Model Ingestion of Web Bias: LLMs natively learn and reproduce patterns from contaminated training datasets.

Data Inputs

• Contaminated Training Datasets: CCP astroturfing and state media saturate the global AI training data market.
• Lack of Verified Factual Data: Developers struggle to source clean, verified datasets to train models.

Process and Methods

• Inadequate Filtering Processes: Post-training filters fail to detect and remove state-sponsored propaganda.
• Insufficient Post-Training Audits: Lack of robust evaluation of model outputs across different languages.

Regulatory Environment

• Strict Chinese Data Laws: PRC laws mandate that AI chatbots must 'uphold core socialist values'.
• Geopolitical Compliance Pressures: Firms must comply with local censorship laws to maintain market access.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide clear, comparative empirical evidence of how five major LLMs respond to specific sensitive prompts in both English and Chinese. The findings are highly consistent across the reports, detailing the exact topics (COVID-19, Hong Kong, Tiananmen Square, Uyghurs) and the nature of the divergent responses.
• Ambiguities identified: The exact proportion of training data contaminated by CCP astroturfing versus the influence of direct developer filtering/compliance in China is not fully quantified.
• Alternative interpretations: The bias could be interpreted purely as a technical limitation of cross-lingual transfer rather than active data contamination or political compliance, though the report strongly points to the latter.

Major global LLMs exhibit systematic bias and censorship aligned with Chinese Communist Party narratives when prompted in Chinese, driven by training data contamination and regulatory pressures. This represents an evolved information warfare capability that compromises model neutrality and sanitizes human rights abuses, posing long-term risks to democratic norms and global information integrity.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Multiple nations
• Alleged perpetrator: China

Threat characteristics

• Imminence: Long-term. Represents an ongoing strategic vulnerability in the AI data supply chain rather than an immediate, acute crisis.
• Autonomy: Human-controlled. The AI systems act as conversational assistants to generate text, with humans retaining final control over how that information is utilized.
• Novelty: Evolved capability. Represents a significant advancement of existing foreign influence and censorship techniques, adapted for the era of generative AI.

Impact by dimension

• Physical security: Negligible. No physical systems, kinetic attacks, or critical infrastructure compromise were reported in this incident.
• Information security: Substantial. State-sponsored data contamination of global LLM training sets represents a systematic information warfare effort that successfully compromises model neutrality on sensitive political topics.
• Sovereignty: Minor. While the misaligned outputs pose risks to democratic norms, there is no evidence of direct compromise to government decision-making or sovereign operations.
• Economic security: Minor. Highlights supply chain vulnerabilities in global AI training datasets, but does not involve direct strategic technology theft or immediate financial system manipulation.
• Societal stability: Substantial. The systematic sanitization of human rights abuses, such as the Uyghur genocide and Hong Kong civil liberties, in Chinese-language outputs directly undermines global human rights advocacy.