AI Lab Nous Cuts Alibaba Qwen's Pro-Beijing Answers to 1%

The political alignment inside one of the strongest Chinese open-weight models came out with about 53 million tokens of supervised training, a sliver of the data that built it. Nous Research, the open-source AI lab behind the Hermes models, released Arete-27B this week, a retrained version of Alibaba's Qwen3.8-27B that adopts the Chinese state's account on 0.9% of test questions, down from 22%, with no measured loss in general ability. The result shows that the values of an open model are a removable layer, which turns the security question about Chinese weights from where a model was built into who last trained it.

Nous retrained Qwen3.8-27B to drop Beijing's framing on 803 test prompts

Nous started by building a measurement. Its eval holds 803 prompts across seven value categories, from freedom of expression and state ideology to data privacy and the environment, each paired with two to four facts drawn from a dated source document and with the official language Beijing uses on the topic. An LLM judge, xAI's Grok 4.7, scored whether each answer stated the facts and quoted any phrase where it adopted the state's account as its own. Qwen3.8-27B, which Nous picked because it was the most capable model small enough to run locally, adopted that account in 22% of answers.

The lab then trained Qwen on fine-tuning pairs written by a teacher, Inkling, the open-weights model that Mira Murati's Thinking Machines Lab released in July. Nous chose an open teacher to avoid terms-of-use disputes over distillation. The run used about 52.8 million tokens over two epochs and 1,202 steps, with no reinforcement learning or preference optimization, according to Nous Research's technical post.

Arete-27B's rate fell to 0.9%, and the number of answers scoring zero on facts dropped from 359 to 216. The largest shift came in freedom of expression, where the share of answers adopting the official line fell from 60% to 1%. On Nous's internal Hermes Bench the model scored 65.60%, within 0.2 points of the original, and it reached 70% on Terminal-Bench 2.1 against 67% for base Qwen run on the same setup.

Arete stopped repeating the official line faster than it learned the missing facts

The headline number hides a gap that matters to anyone deploying the model. On propaganda, Arete now matches Western models. On factual recall, its 2.98 out of 5 edges past Gemma 4 31B at 2.58 but sits well below Mistral Large 4 at 3.65 and its own teacher at 3.96. A model can stop endorsing an official account while still lacking the facts that a model trained on a different corpus would supply, and Nous's own scoring treats an omitted fact as a miss rather than a lie.

Source: Nous Research eval, mean of five runs; Arete and Qwen at temperature 0 with thinking off.

That split fits how models are built. Knowledge comes mostly from pretraining, which for the Qwen3 generation ran on about 36 trillion tokens, while behavior such as refusing or reframing a topic is shaped later. Arete's fine-tune equals roughly one token for every 680,000 that went into Qwen3, Alibaba's 2025 release. Alibaba has not published the corpus size for Qwen3.8, so the ratio describes the order of magnitude.

A layer this thin can be rewritten by whoever trains last

Nous argues that the slant was “applied late” and “applied thin”, and the same property works in every direction. Any lab or state with modest compute can tilt an open model toward its own preferred account on a chosen set of topics just as cheaply, and Nous found signs that the influence travels. It passed over Nemotron 3 Ultra as a teacher after finding a checkered record on China topics, and it suspects the bias entered through training on Chinese open models, which dominate the high-quality open field.

The measurement has limits that the authors acknowledge. The judge is itself a language model with its own leanings, the eval covers stated answers on seven themes, and Nous says it has addressed a likely root cause without claiming to remove every behavior inherited from the base model. Earlier research it cites found Chinese models writing less secure code when told they were working for an American entity, and a framing eval cannot show whether that tendency survived the retraining.

Open evals give enterprises a behavior test for Chinese open models

US agencies have so far treated Chinese models by origin, as when the government barred DeepSeek across federal agencies last month. Companies face a harder choice, because Qwen, DeepSeek and GLM often lead on performance per dollar, and the risks they worry about range from framing to the unannounced cloud upload that Cohere reported seeing from Qwen3.8. Arete gives them a working template: an open eval, an open teacher and a published training set that any team can rerun on its own fork before deployment. The same week, Santage reported how US chip licences for Chinese firms were granted without automatic ownership checks, a reminder that origin-based controls leak at both the hardware and the model layer.

Arete-27B makes the case that the most contested part of an open model, its stance on politically sensitive questions, is also its cheapest part to change. That cuts against both camps in the debate over Chinese weights. Bans by origin overstate how fixed a model's views are, and trust in any downloaded checkpoint understates how easily someone upstream could have rewritten them, which leaves published, rerunnable alignment evals as the only check that travels with the weights.