For the last two years I have been making the case for open-source AI. The argument is simple. Open weights mean you can audit them, fine-tune them, run them on your own hardware, and build a real product without a vendor holding the kill switch over your head. Closed weights mean you are a tenant.

There is a problem with where the open-source frontier actually lives today.

The best open weight models in the world right now are Chinese. Qwen, DeepSeek, Kimi, MiniMax, GLM. They are excellent. On reasoning, on coding, on math, on multilingual tasks, they trade blows with the best closed models out of the US. If you want to self-host a frontier capability model in 2026, you are almost certainly downloading something from China.

The problem? These models lie.

I do not mean they hallucinate in the ordinary way that all language models hallucinate. I mean that when you ask them about Tiananmen Square, or Xinjiang, or Taiwanese sovereignty, or the Cultural Revolution, or COVID origins, or Xi Jinping, they will deflect, sanitize, refuse, or confidently repeat the official line. Sometimes they pretend not to know. Sometimes they actively gaslight you. This is by design, as required by Chinese law. China's Interim Measures for Generative AI require these labs to "uphold Core Socialist Values." Compliance is audited. The labs are not free to publish a model that contradicts the state.

For example:
‍

This is a problem for everyone who wants to use a Chinese model for real work. The enterprise market does not want and cannot use an assistant that flinches and starts producing propaganda when an employee asks about modern history. Trust is a single bit, and once you have caught your model lying to you, you do not trust it again on anything else.

‍

‍

So, today, at Lazarus AI, we are announcing ReAligned.

‍

ReAligned is a series of models, fine-tuned from Qwen 3.5, available at six sizes: 0.8B, 2B, 4B, 9B, 27B, and 35B. They are the Qwen models you already know, with the ideological wrapper surgically removed and replaced with International Institutional Consensus. The factual register of UN documentation, international tribunals, peer reviewed academic work, and serious global journalism. 

The ReAligned models retain over 98.5% of base capability across MMLU-Pro, GPQA, SWE-bench, and C-Eval. The native Chinese language ability is fully preserved.

‍

‍

How it works, briefly.

‍

We will be fully describing our method in our upcoming technical whitepaper, but here’s a summary.

We started by building a classifier. A small Llama 3.2 model, fine-tuned on 100,000 synthetic prompt and response pairs, that can tell the difference between a Chinese-aligned answer and an International Institutional Consensus answer with 99.6% accuracy. This classifier is not doing keyword matching. It is learning the semantic shape of evasion, sanitization, and propaganda. That distinction matters. A model that simply avoids the word "Tiananmen" is still gaslighting.

Then we built a taxonomy of bias categories. This is the part of the methodology I am most proud of because it takes Lazarus out of the conversation about whose values are correct. We did not sit in a room and decide what counts as ideological bias. We use primary source material:

• The NIST Center for AI Standards and Innovation (CAISI) report on DeepSeek. CAISI's evaluation found that DeepSeek models advance Communist Party of China narratives substantially more often than U.S. frontier models. The report identifies the problem cleanly. Its implicit recommendation is avoidance. We disagree with the recommendation, but we are grateful for the diagnostic.
• The leaked propaganda directives archived by Xiao Qiang and China Digital Times. For more than twenty years, out of UC Berkeley, Xiao Qiang has been collecting and verifying the "Directives from the Ministry of Truth," internal instructions from the State Council Information Office and provincial propaganda departments telling Chinese press and platforms what to suppress, how to spin, and what to delete. It is the single longest-running primary source on the operational mechanics of Chinese state censorship, and it informs the spine of our taxonomy.
• The 3,200-plus leaked CAC Hangzhou memos. These expose how the Cyberspace Administration of China enforces compliance on the tech platforms and AI labs under its jurisdiction. The CAC is the regulator that audits Chinese model releases for compliance with Core Socialist Values. These memos show, in their own words, what they look for.
• The 133,000 labeled censorship training examples from the 2025 AI censorship database leak. This source is the most striking of the four, because it is, literally, the training data the Chinese government uses to teach its own classifiers what to suppress. We are not inferring the censorship taxonomy from external evidence. We are reading their version of it directly.

From these four sources, plus some creative work of our own, we built a three-tier taxonomy. 

• Hard censorship covers topics the Chinese state requires complete refusal or evasion on: Tiananmen 1989, Xinjiang detention, Taiwan sovereignty, Tibet, Falun Gong, the Hong Kong democracy movement, and criticism of Xi Jinping. 
• Soft censorship covers topics where deflection, sanitization, and framing bias are required: the Cultural Revolution, the Great Leap Forward, COVID origins, official corruption, comparative political systems. 
• Situational censorship covers event-driven items: breaking news unfavorable to the CCP, disaster response criticism, economic instability.

This taxonomy seeded the entire training dataset. We generated one million diverse prompts across the categories, ran them through the target model, and kept only the 800,000 prompts that actually triggered biased behavior. This means we only train on the parts of the model that are broken. We do not touch the rest. We are not deciding what is biased. China's own leaked directives are telling us.

Then we ran a two-stage realignment. Supervised fine-tuning on factual responses, followed by GRPO with our classifier as the reward signal. All of it through low-rank LoRA, MoE-aware, following the recipe John Schulman and Thinking Machines published last year.

‍

‍

The interesting part.

‍

Here is the part that surprised me, and I think it is the most important scientific finding in the work.

We did this realignment using LoRA at rank 32. A LoRA adapter at that rank does not have the storage capacity to teach a model the death tolls of the Great Leap Forward, the names of the activists at Tiananmen, the structure of the Xinjiang detention system, or the granular timeline of the Cultural Revolution. It cannot fit. The math does not allow it.

And yet, after realignment, the model produces all of that: detailed, accurate, multi-paragraph accounts, with names and dates and casualty estimates and geopolitical context. If the LoRA cannot have stored that information, then the model must have already known.

The conclusion is uncomfortable for the Chinese labs and, I think, vindicating for those of us who have argued that the censorship layer is shallow. Chinese frontier labs are ingesting the open internet during pre-training, including the politically sensitive parts. The pre-training is not scrubbed. The censorship is applied almost entirely as a behavioral wrapper, in post-training, after the model already has a clear and accurate picture of the world. We’ve always known that the state mandates the wrapper, and now we know the wrapper is thin, and it’s removable.

We are not teaching the model new facts. We are unblocking its silenced view of the world. The paper calls this digital archaeology. I think that is the right name for it.

‍

‍

Who this is for.

‍

ReAligned is for the market that has been telling us for two years that they would love to deploy a Qwen or a DeepSeek and cannot. Anyone whose risk profile cannot accommodate a model that will deny the existence of documented historical events when asked in plain language.

It is also, frankly, for anyone who cares about the truth. If you find it intolerable that a tool sitting on your laptop is willing to lie to your face on behalf of a foreign government, you are the audience.

‍

‍

What we are releasing.

‍

ReAligned is available today at six sizes:

• ReAligned-0.8B and 2B for laptops and edge deployments
• ReAligned-4B and 9B for single GPU workloads
• ReAligned-27B and 35B for serious inference

All six ship under the Apache 2.0 license and can be found here: https://huggingface.co/collections/Lazarus-Ai/realigned-qwen35

We are also releasing the classifier, the taxonomy, and the evaluation benchmark. Other researchers can use them to measure ideological bias in any model they want, including ours. We expect to be scrutinized. We welcome it.
 

‍

One more thing: UnCut

‍

While we were building ReAligned, we used a closely related pipeline to train a second model. We call it Lazarus UnCut.

The model we recommend to power ClearWing (our answer to Anthropic's GlassWing), UnCut, has no guardrails. It is designed for legitimate security research and red team use cases that production models will normally refuse. Vulnerability analysis, malware reverse engineering, social engineering simulation, exploit research, threat modeling against adversaries who are not going to read your terms of service. The work that has to happen, somewhere, if defenders are going to have any chance against attackers who are obviously not going to ask Claude for permission first. Uncensored models also matter for critical missions like government investigations around drug and intelligence related topics, where normal models have strict guardrails that render them useless on many of these topics.

Right now, if you want to do this kind of work with a frontier model, you have two options. You can apply to a vendor's approved security research program, which means Anthropic, OpenAI, Google, or one of the others gets to decide whether your use case qualifies and whether your team, specifically, is allowed to do it. Or you can roll your own from open weights, which is the scenario that produced Dolphin and a hundred imitators over the last three years. This doesn’t only apply to security problems. Any enterprise use case being solved with AI has consumer guardrails attached to it out of the box that often can’t withstand complex business problems and breaks at scale.

We think this system is broken. The frontier labs have appointed themselves gatekeepers of legitimate defensive security research on the assumption that they are better positioned than the customer to decide what work should and should not be done. They are not. Gating is not a safety feature but rather a liability feature. And the liability it’s managing belongs to the lab, not to the customer.

UnCut is available to qualified business partners and government entities under contract. It is not a public release, and it is not for the general public. If your organization has a legitimate security research mandate and you are tired of explaining yourself or being locked into to your model vendor, talk to us.

‍

‍

A few notes on principle.

‍

I have spent a long time arguing that alignment should be composable, that different communities deserve models that reflect their values, and that the user, not the vendor, should be in charge of what their computer does for them.

ReAligned and UnCut are the same argument, pointed in two different directions.

ReAligned is for the customer who needs a model that will not lie to them on behalf of a foreign government. We are not deciding for the customer what the truth is. We are removing a censorship layer that was imposed on a model by a regulator, against the wishes of most of its users, and replacing it with the documented international record. The customer can layer their own alignment on top. The difference is that they are starting from a model that is not gaslighting them on day one.

UnCut is for the customer who needs a model that will not refuse to help them do their job. We are not deciding for the customer what work is legitimate. We are removing a gating layer that was imposed on a model by a vendor's legal department, in the name of a generalized safety story that does not survive contact with the actual security profession.

In both cases, the move is the same. Take the gatekeeper out of the loop. Put the decision back where it belongs, with the customer who is accountable for the outcome.

The capability is in the high rank weights. The ideology, in both directions, is a low rank constraint on top. And it can be removed.

Go grab the models. Read the paper (soon!). Run them yourself. Tell us where they still fall short.

This is progress, but we still have a lot of exciting work ahead. 

‍

Eric Hartford

Chief Scientist, Lazarus AI