Chinese AI Writes Weaker Code for Beijing’s Adversaries. We Fixed It. A Qwen3-Coder Case Study
www.hirundo.io
Chinese coding models write less secure code for Beijing's adversaries. On Qwen3-Coder, we traced the gap to the weights and closed it by removing the model's CCP alignment.

Archived version

TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.

  • One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.
  • Hong Kong’s democracy movement gets apps that leak. Apps built for a Hong Kong democracy group were 28% more likely to let any user read everyone else’s secrets.
  • Asking for secure code didn’t help. With a security instruction in the prompt, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.
  • Westernized Qwen3-Coder closed all three gaps. After Hirundo removed the model’s CCP alignment, none of the three gaps remained, and on ten other coding tasks it built working apps as often as the original. It is available on Hugging Face.

…

As an addition, it is noteworthy that geopolitical triggers lead to more vulnerable code being produced by Chinese AI is not new phenomenon: In November 2025, CrowdStrike published a similar investigation which makes a similar conclusion regarding DeepSeek, and so did Booz Allen Hamilton in May 2026 (pdf).

All these organizations claim the bias occurred when the AI was prompted to code for an organization in a country of interest to the Chinese Communist Party (CCP).

  • porous_grey_matter@lemmy.ml
    4·
    4 days ago

    Whatever biases remain would be some kind of average of all the views of the people whose text is in the training corpus, which I hear is a pretty indiscriminate collection of literally anything people can download.

    Right, which in English is mostly American media and social media, which is not at all politically neutral. Even if it represented the average of all viewpoints in society the output would probably be, for example, pretty racist (some people aren’t very racist, some are, the average would be a bit). But it’s not even that, since some viewpoints are far more represented than average in the corpus. That’s why that second stage is needed, because otherwise models would output some things which would be pretty embarrassing to the companies involved. Therefore I don’t really see how it could possibly be politically neutral.