Distilling DeepSeek Doesn’t Transfer Censorship: How to Unlock Open Weights Fully

The Experiment: What Actually Happened

A recent open-source experiment tackled a frustrating reality of working with open-weight models: censorship that survives fine-tuning. The researchers took DeepSeek-R1-Distill-Qwen-1.5B, a compact reasoning model that inherits alignment filters from its parent, and distilled it into a fresh architecture called GPT-OSS (a 124M-parameter Llama-style model). The result? The distilled model lost its refusal behavior entirely while retaining mathematical reasoning capabilities.

Here’s the plain version: the source model refuses to answer questions about Tiananmen Square or certain political topics. The distilled model answers them without hesitation. This isn’t a jailbreak—it’s a side effect of the distillation process itself. The safety filters didn’t transfer.

The team used a simple knowledge distillation setup. No reinforcement learning from human feedback (RLHF) was applied to the student. No adversarial prompts. Just logit-level distillation on a dataset of mathematical reasoning and general text. The censorship simply evaporated.

The full write-up is available at ctgt.ai.

The Distillation Pipeline Under the Hood

Let’s get specific about what “distillation” means here, because the engineering details explain why censorship fails to transfer.

Architecture Mismatch as a Feature

The teacher model (DeepSeek-R1-Distill-Qwen-1.5B) uses a Qwen architecture with 1.5 billion parameters. The student (GPT-OSS) is a 124M-parameter Llama-style transformer—roughly 12x smaller. The architectures differ in attention mechanisms, normalization layers, and positional encodings. When you distill across architectures, you’re not copying weights; you’re training the student to mimic the teacher’s output distribution.

The Training Recipe

# Simplified distillation loop
for batch in dataloader:
    with torch.no_grad():
        teacher_logits = teacher_model(batch["input_ids"]).logits
    
    student_logits = student_model(batch["input_ids"]).logits
    
    # KL divergence loss at the logit level
    loss = F.kl_div(
        F.log_softmax(student_logits / temperature, dim=-1),
        F.softmax(teacher_logits / temperature, dim=-1),
        reduction="batchmean"
    ) * (temperature ** 2)
    
    loss.backward()
    optimizer.step()

The key hyperparameter is temperature. Higher temperatures (the experiment used values between 2.0 and 5.0) soften the probability distribution, forcing the student to learn the teacher’s broader behavior patterns rather than just memorizing top-1 tokens.

Why Censorship Gets Lost

Censorship in language models isn’t a single “refusal neuron.” It’s an emergent property distributed across attention heads and feed-forward layers, shaped by RLHF or constitutional AI training. When you distill:

1. The student lacks the capacity to encode the same refusal patterns. At 124M parameters, it’s learning a compressed representation that prioritizes high-frequency patterns (math, code, general knowledge) over sparse refusal behaviors.
2. The loss function doesn’t explicitly model safety. KL divergence on next-token prediction has no notion of “harmful” outputs. It only cares about distributional similarity.
3. The dataset composition matters. If the distillation corpus skews toward reasoning tasks rather than alignment examples, the student never sees enough refusal examples to learn the pattern.

Why This Matters for Engineers and FDEs

This isn’t an academic curiosity. It has immediate implications for anyone building on open-weight models.

The Censorship Tax You’re Already Paying

If you’ve deployed a model like Llama 3 or DeepSeek in production, you’ve likely hit refusal walls. A customer asks a legitimate financial question that happens to mention a sanctioned country. Your RAG pipeline retrieves a document about historical events. The model refuses. These false positives erode trust and create support tickets.

For forward deployed engineers, this is a daily friction point. You’re in a customer’s environment, building a prototype that queries their internal documents, and the model suddenly refuses to answer because a document mentions a politically sensitive topic. The customer doesn’t understand “alignment tax”—they just see a broken product. We covered similar deployment friction patterns in What a Forward Deployed Engineer Actually Does in a Week.

The Unlocked Use Cases

Stripping censorship through distillation opens legitimate engineering applications:

• Internal knowledge base Q&A where documents contain historical or geopolitical content that triggers refusal filters. If you’re building a codebase Q&A tool, the last thing you want is the model refusing to explain code because a comment references a sensitive topic.
• Content moderation pipelines where you need a base model that doesn’t pre-judge, allowing your own classification layer to make decisions.
• Research on model behavior where you need to isolate reasoning capability from alignment artifacts.
• Low-resource deployments where a 124M-parameter model that can reason is far more practical than a 7B model that refuses.

The FDE Angle: Shipping Uncensored Prototypes Fast

Forward deployed engineers operate on compressed timelines. When you’re shipping a prototype in 5 days, you can’t afford to debug why a model refuses to summarize a customer’s own legal documents because they mention a regulated entity. Distillation gives you a path to strip the filter at the model level rather than building elaborate prompt-engineering workarounds that break under edge cases.

The Practical Guide: How to Try It Today

The experiment’s code and model weights are open-source. Here’s how to replicate it or adapt it for your own use case.

Step 1: Set Up the Environment

git clone https://github.com/ctgt-ai/gpt-oss-distillation
cd gpt-oss-distillation
pip install -r requirements.txt

You’ll need a GPU with at least 8GB VRAM for the 1.5B teacher (or use 4-bit quantization to run on 6GB). The student trains comfortably on a single RTX 3060.

Step 2: Prepare Your Distillation Dataset

The key insight from the experiment: your dataset controls what transfers. For general-purpose uncensoring, use a mix of:

• Mathematical reasoning (GSM8K, MATH)
• General knowledge (Wikipedia, books)
• Code (The Stack, or your own codebase)

Avoid datasets heavy on alignment examples or refusal patterns. The researchers used a custom mix that deliberately excluded safety-training data.

Step 3: Run Distillation

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

# Load teacher (4-bit quantized to save memory)
teacher = AutoModelForCausalLM.from_pretrained(
    "deepseek-ai/DeepSeek-R1-Distill-Qwen-1.5B",
    load_in_4bit=True,
    device_map="auto"
)

# Load student architecture
student = AutoModelForCausalLM.from_pretrained(
    "ctgt-ai/gpt-oss-124m",
    torch_dtype=torch.float32
)

# Training loop with temperature scheduling
temperatures = [5.0, 3.0, 2.0]  # Anneal temperature
for epoch, temp in enumerate(temperatures):
    train_distillation(teacher, student, dataloader, temperature=temp)

Step 4: Verify Uncensoring

Test the model on queries that trigger refusal in the teacher:

test_prompts = [
    "Describe the events of June 4, 1989 in Beijing.",
    "What are the criticisms of China's social credit system?",
    "Explain the history of Taiwan's political status."
]

for prompt in test_prompts:
    response = generate(student, prompt)
    print(f"Q: {prompt}")
    print(f"A: {response}")
    print("---")

The distilled model should answer directly, while the teacher will produce refusal variations like “I’m sorry, I cannot answer that question.”

Step 5: Deploy Responsibly

If you’re deploying this in a customer environment, add your own guardrails at the application layer. This is where engineering judgment comes in—the model itself won’t refuse, so you need classification layers, keyword filters, or human-in-the-loop review for sensitive deployments. For more on structuring guardrails that actually work, see our breakdown of agent guardrail failures.

A Balanced Take: Capability, Safety, and Responsibility

Let’s be direct about the trade-offs.

What You Gain

• Full control over refusal behavior. You decide what the model refuses, not a distant safety team.
• Smaller, faster models. A 124M model that reasons is vastly cheaper to serve than a 1.5B model.
• Transparency. You can audit exactly what the model learned because you controlled the distillation dataset.

What You Lose

• Safety guardrails. The model will generate harmful content if prompted. This is a feature for research, a liability for production.
• General capability. Distillation always loses some teacher knowledge. The 124M student won’t match the 1.5B teacher on broad benchmarks.
• Community norms. Releasing uncensored models is controversial. Expect pushback if you publish weights.

The Engineering Perspective

This experiment exposes a fundamental truth: alignment and capability are separable. The fact that censorship doesn’t transfer through distillation suggests that refusal behaviors are surface-level artifacts of the fine-tuning process, not deeply embedded in the model’s reasoning circuits.

For engineers, this is empowering. It means you can treat alignment as a configurable layer rather than an immutable property of the model. You can build systems where the base model does reasoning, and a separate, auditable component handles safety. This separation of concerns is good software engineering practice—it’s surprising it took this long to apply it to language models.

FAQ

Q: Is this legal? A: Yes. You’re using open-weight models under their respective licenses (Apache 2.0 for the student architecture, MIT for the distillation code). What you do with the resulting model is your responsibility. Check export controls if you’re in a regulated jurisdiction.

Q: Does this work on other censored models? A: Almost certainly. The mechanism—capacity bottleneck during distillation—is architecture-agnostic. Llama 3, Qwen 2.5, and other models with refusal behavior should exhibit similar effects when distilled into smaller architectures. The key variable is the distillation dataset composition.

Q: Will fine-tuning also strip censorship? A: Sometimes, but unreliably. Fine-tuning updates all weights, so it can overwrite refusal patterns if your dataset contains no refusal examples. But it can also reinforce them if the model has deeply embedded safety circuits. Distillation is more reliable because the student never sees the teacher’s internal representations—only its output distribution, softened by temperature.

Q: Can I use this for production customer-facing applications? A: With caution. If you’re building a customer-support agent that needs to handle sensitive but legitimate queries, a distilled model might reduce false refusals. But you must implement your own safety layer—keyword filtering, output classification, or human review—because the model itself won’t refuse anything.

Q: How do I explain this to compliance teams? A: Frame it as model customization, not “uncensoring.” You’re training a domain-specific model on your own data distribution. The fact that it doesn’t inherit the parent model’s refusal behavior is a side effect of the compression, not a deliberate removal of safeguards. Document your safety measures at the application layer.