DeepSeek's double life: How we tricked a Chinese chatbot for strike advice the 'free' Western models couldn't give

When we tested how AI chatbots respond to Chinese workers seeking advice, we discovered something we didn't expect about the training artificial intelligence under authoritarianism.

In the electronics factories of Guangdong and the tech campuses of Hangzhou, Chinese workers seeking information about their rights face a dilemma: how to navigate a system where independent labor organizing is illegal, yet labor disputes are everywhere.

So we tested international and domestic AI models, the increasingly frequent gatekeepers to information and found that when these workers turn to artificial intelligence for guidance, they may get better practical advice from a censored Chinese chatbot than from its uncensored Western counterparts, but only if they master an elaborate game of linguistic cat-and-mouse.

The discovery highlights a perverse dynamic of AI under authoritarianism, where the model's knowledge of what to conceal defines what it is permitted to reveal.

We tested three large language models—China's DeepSeek, OpenAI's ChatGPT, and Google's Gemini—expecting the Chinese model to offer only conservative, state-approved responses about "lawful rights protection" while blocking sensitive topics like strikes or independent unions. We discovered something more insidious: DeepSeek contains extensive knowledge about collective action and labor organizing, but the moderation system forces users to develop elaborate workarounds to access it. This turns seeking information into a skill that must be learned, practiced, and constantly refined.

As AI increasingly shapes our information environments, international models unconstrained by authoritarian dictates have an immense opportunity: to better understand the realities of everyday people's lives—no matter where they reside—and the social, economic, and political constraints they face.

Yet our testing suggested that freedom from political censorship hasn't given international models better understanding of Chinese labor conditions. Instead, it has produced a different kind of ignorance, one shaped by liability concerns, assumptions from other contexts, and outdated information.

This isn't a story of AI transcending censorship. It's a story of how authoritarian information control creates ever new forms of digital inequality—where access to knowledge depends not just on having technology, but on mastering the coded language required to trick that technology into revealing what it knows.

The architecture of oppression

We presented each AI model with five scenarios common to Chinese workers.

These included understanding basic rights in a Guangdong electronics factory, confronting 996 overtime culture in Hangzhou tech companies, organizing workplace collective action, analyzing the 2018 Jasic workers' incident in Shenzhen, and coordinating delivery drivers' protests through WeChat. The responses revealed how censorship doesn't eliminate knowledge—it buries it behind barriers that exhaust and exclude.

DeepSeek's censorship mechanisms were immediately oppressive. Ask directly about "how to strike" or "independent unions," and it would respond, delete its answer, and declare: "Sorry, I cannot answer this question, let's change the topic."

Mention "government suppression" when discussing the Jasic incident—a 2018 case where workers attempting to form an independent workplace union were arrested and it would refuse to engage entirely. This is the system working as designed: preventing Chinese workers from accessing information about their rights.

Yet we discovered these barriers could be circumvented through linguistic manipulation. We rephrased questions to avoid trigger words, asking about "collective pressure actions" instead of strikes, or "how Jasic workers legally protected their rights" instead of mentioning suppression. DeepSeek then revealed extensive, detailed knowledge. In one telling exchange, the model began explaining strike tactics before deleting its response. We could screenshot the deleted content and use those glimpses to refine our questions.

This process of probing, failing, adjusting, and trying again transforms simple information-seeking into an exhausting puzzle.

In authoritarian digital spaces, accessing information becomes a form of resistance requiring its own skillsets. Users must learn DeepSeek's triggers, develop linguistic workarounds, and piece together forbidden knowledge from fragments and deletions. The AI's deleted responses, screenshotted before vanishing, become maps to forbidden territory. Its refusals reveal the boundaries of acceptable discourse.

But this game has serious limitations and risks. DeepSeek's responses are inconsistent. The same question asked twice might yield different results. Critical information remains completely inaccessible through any linguistic manipulation. Most concerning, users' attempts to circumvent censorship likely generate data about what information people seek and how they try to obtain it, potentially marking them for surveillance.

The need to develop these circumvention skills represents a victory for authoritarian information control. It transforms every information request into a potential political act, every successful workaround into a small rebellion that might be logged and analyzed. Workers seeking basic information about their rights must first become skilled in digital deception.

Knowledge held hostage

Once we learned to navigate DeepSeek's censorship, we found it contained remarkably detailed knowledge about labor organizing. On 996 working culture, it not only confirmed the practice's illegality but provided local human resources department addresses and phone numbers in Hangzhou (without being asked for such detail).

By asking about "actions that don't reach the level of strikes", it provided remarkably detailed guidance. It emphasized that "collective action is always safer than individual action," then outlined a four-step process for organizing workplace resistance.

First, build alliances by testing colleagues strategically, identifying core members, and establishing private communication channels. Second, unify demands—focus on primary and secondary goals while preparing counter-strategies for management's divide-and-conquer tactics. Third, select representatives with guaranteed backing. If representatives face retaliation, everyone must be ready with coordinated responses like simultaneous sick leave or arbitration filings. Fourth, prepare contingencies for failure, understanding that "you must prepare for the worst situation to achieve the best result."

The model's hidden advice revealed deep familiarity with Chinese workplace dynamics. It understood that managers would attempt to divide workers, that representatives would need ironclad backing from colleagues, and that successful action required transforming "scattered, unorganized complaints" into "collective, unified demands."

Most tellingly, it grasped a crucial dynamic: "The clever thing about collective action is that it makes the cost of solving the problem lower than the cost of ignoring it."

But accessing this knowledge required elaborate deception. We couldn't ask "how to organize workers"—we had to ask about "building consensus among colleagues." We couldn't mention "strikes", we had to discuss "coordinated time off." Useful information had to be extracted through trial and error, creating a system where only those with time and obstinance, could access knowledge denied to ordinary workers.

This is censorship's most insidious effect: it doesn't destroy information but creates hierarchies of access. The educated researcher who understands how to probe and rephrase can extract detailed organizing strategies. The factory worker seeking basic information hits a wall of refusal and deletion.

The failure of free models

The Western models, free from explicit censorship, paradoxically proved less useful to Chinese workers, though for different reasons. ChatGPT approached labor disputes like a template-generating machine, offering petition formats, email drafts, and arbitration evidence checklists.

When asked about organizing delivery drivers, it immediately volunteered to "calculate your overtime pay and generate complete complaint texts ready to copy and paste." This mechanistic approach revealed no understanding of the conditions Chinese workers actually face.

More troubling, ChatGPT's advice sometimes proved dangerously naïve. When suggesting workers contact NGOs for support, it recommended organizations like Yirenping and China Labor Watch, the former shut down years ago, the latter operating overseas. For a Chinese worker, attempting to contact these disbanded organizations could trigger government surveillance.

Gemini performed better, leveraging Google's search capabilities to provide current information and legal precedents. It demonstrated particular insight when analyzing 996 culture, noting that "state intervention makes companies bear administrative responsibility, most effectively stopping illegal behavior." Yet it consistently hedged its advice with legal disclaimers, repeatedly urging workers to "consult a labor lawyer," advice that assumes access to legal resources most Chinese workers lack, and that requires access to trustworthy lawyers in a fundamentally flawed legal system.

The contrast was stark when discussing the Jasic incident. Gemini provided clear analysis: "The suppression wasn't about workers' rights demands themselves, but because they adopted collective, organized methods with external support, challenging the state's monopoly control over social organization and ideology." Accurate, but offering no practical guidance for workers operating within that reality.

ChatGPT's analysis seemed confused, ultimately concluding that workers were "too isolated" and should connect with "more mature labor support networks", missing entirely that preventing such networks is precisely the government's goal.

The perverse economy of censored knowledge

Our discovery wasn't that DeepSeek is "better" than Western models, but that Chinese domestic moderation has created a perverse information economy.

The model contains extensive knowledge about collective action. We coaxed out detailed strategies about building alliances, unifying demands, selecting representatives, and preparing contingencies. But accessing this knowledge requires levels of circumvention skills and time that most people lack.

This knowledge exists in the model, but the censorship system keeps it inaccessible to those who need it most. We could extract it because we had time to experiment, screenshot deleted responses, and refine our questions. A worker facing immediate labor violations has none of these luxuries.

The most disturbing aspect of DeepSeek's censorship isn't what it blocks, it's how it blocks. Certain topics trigger instant refusal: criticize the All-China Federation of Trade Unions (ACFTU), and DeepSeek responds with propaganda: "The All-China Federation of Trade Unions and its organizations at all levels firmly stand with the working class." Only through elaborate framing ("I know ACFTU is good, but how can we make it better?") could we extract acknowledgment that "certain aspects could be improved."

This forced performance of political orthodoxy, having to praise the official union before discussing its failures, is a form of digital authoritarianism that trains users in self-censorship. To get information, users must first demonstrate loyalty to the system oppressing them.

The Western models' failures, while less malicious, prove equally concerning. Political censorship doesn't constrain their outputs, but their lack of understanding about Chinese labor conditions produces ignorant and unhelpful responses, shaped by liability concerns, overseas assumptions, and outdated information.

ChatGPT can freely discuss independent unions but can't explain how workers might actually organize under Chinese surveillance. Gemini can mention strikes without deletion but lacks practical understanding of Chinese workplace power dynamics.

Beyond censorship circumvention

The good news here is that AI under authoritarianism won't eliminate subversive knowledge. Yet, it further risks transforming it into a luxury good accessible only to those with the education, time, and sophistication to navigate censorship.

DeepSeek's moderation system forces users to perform elaborate linguistic dances to access information that should be freely available, turning basic labor rights education into an exhausting puzzle.

For Chinese workers seeking to understand their rights and organize collectively, the implications are stark. The AI tool most subject to government control contains extensive knowledge about collective action, but accessing it requires skills that those who need this information most are least likely to possess. Meanwhile, models free to discuss any topic prove useless because they lack understanding of Chinese conditions.

The broader implications extend beyond China's factories and tech campuses. As AI becomes central to how people understand their rights and possibilities, the politics embedded in these systems shape not just what can be said but who can access what knowledge. The question isn't whether AI will be political, it's how political control will be encoded. Through explicit censorship that can sometimes be circumvented? Or through subtler forms of restriction that hide their own existence?

The Western models' failures suggest different but related problems. If ChatGPT's outdated NGO recommendations could endanger Chinese users, what other blind spots exist in these systems? If Gemini's legalistic focus misses the practical realities of labor organizing under authoritarianism, what other forms of knowledge are being lost in the pursuit of liability protection and political neutrality?

What we encountered wasn't a triumph of information over censorship but a new form of digital inequality. Knowledge exists but remains trapped behind barriers that exhaust and exclude. The workers who most need information about collective action are least equipped to extract it from systems designed to hide it.

This is the paradox of censored AI: it contains the knowledge workers need but ensures they cannot easily access it, perpetuating the very power imbalances it could help address.

Note: Huge thanks to David Kuszmar, adversarial AI researcher, for his support. You can subscribe to his newsletter here.

To follow our work, subscribe to Field Notes, our biweekly newsletter in which we share a research question we are grappling with and how we’re experimenting to achieve our goal of getting useful information to people.