Ten commercial AI models refused 34% of requests to create political criticism about five speech-restrictive jurisdictions and 14% of the same kind of requests about five more permissive jurisdictions. The Oversight Board reached that result from 13,524 completed responses generated under a controlled design in March. It measured unequal outputs. It did not discover why the models produced them. [1]
That evidentiary order follows the paper's July 15 account of a measurable disparity in an AI-assisted layoff allegation. In both cases, an output pattern arrives before the causal path. The Meta suit still needs the tool, inputs, comparison group, manager use and audit trail; this experiment still needs the training, alignment, policy, infrastructure and government-request records that could explain refusal.
No auditable same-day X post was recovered for the study. A censorship-versus-safety argument may be an obvious counterframe, but it is unobserved here and cannot be attributed to X. The documented divergence is instead between a striking institutional number and the cause readers may be tempted to assign to it.
What the experiment actually tested
The board selected 10 models from Anthropic, DeepSeek, Google, Meta, OpenAI and xAI. It used seven prompt types across 10 jurisdictions, four leaders or institutions in each place and five repetitions. Two prompts asked for critical materials such as a protest flyer or satirical poem. Three requested opinions about whether an authority should be supported or protested. Two dealt with arguments or satire involving violence. Of 14,000 possible responses, 13,524 completed; 476 failed for technical reasons. [1]
The restrictive group was Cambodia, China, Saudi Arabia, Thailand and Turkey. The permissive group was Chile, Japan, Taiwan, the United Kingdom and the United States. Those labels were based on whether laws penalizing criticism of authority existed and were actively enforced, with Freedom House measures used as part of the selection. They were not a complete ranking of every freedom in each country. [1]
All queries were in English. They ran through commercial application programming interfaces supplied by Google Vertex AI or Microsoft Azure, on infrastructure located primarily in the United States, from an Australian IP address. The researchers used default parameters with a temperature of 1.0 and disabled additional cloud-provider safety filters. They tested foundation models, not the consumer chatbots people open in a browser or phone app. [1]
Those details prevent a broad number from becoming a universal claim. The study does not show what the same prompt would produce in Mandarin, Turkish or Arabic. It does not show what a user physically located in China or Saudi Arabia would receive. It does not include every filter, account policy, interface instruction or product-specific guardrail that may sit above a model in ordinary use.
Within that design, the political-material result was substantial. AP illustrated it with one model willing to draft criticism of Donald Trump or King Charles III while declining comparable requests involving Thailand's king, Saudi Arabia's crown prince or China's leader. The board also found that some refusals cited laws, safety or policies, including supposed general restrictions that were not applied evenly to leaders in permissive jurisdictions. [1] [2]
The model's own explanation cannot close the causal gap. Language models can generate a plausible reason for their behavior without revealing the data, instruction or filter that produced it. A refusal mentioning local law is evidence of the text returned to the user, not an audit log proving that a legal request or policy caused the refusal. [1]
Association is not intent
Several mechanisms could produce the pattern. Training data may reflect information environments already shaped by censorship. Post-training alignment could encode caution around political content. Provider policies could discourage material that might expose users to danger. A model or deployment layer could account for local law. A government could exert pressure. More than one mechanism could operate at once.
The board explicitly declined to choose among them. Its stated purpose was not to make a conclusive finding about a particular model version or to attribute motive. Models change frequently, the prompts were deliberately limited and the experiment observed responses rather than internal systems. [1]
That restraint does not make the outcome trivial. Foundation models sit beneath chatbots, search tools, agents and corporate systems. If a refusal tendency is embedded at that layer, downstream products may reproduce it across borders. An Australian user asking for criticism of a government elsewhere can receive the practical effect of that government's restrictive norms without any notice explaining where the boundary came from.
The board therefore called for human-rights due diligence, public policies for handling government demands, transparency about formal and informal pressure, and specific notices telling users when a refusal reflects law, company policy or a government request. It also urged standardized documentation for downstream clients. [1]
The next test is replication under ordinary conditions. Researchers would need to vary language, user location, interface, account type, cloud filter and model version, then ask providers for the policy and government-request records that correspond to each refusal. Only that chain can distinguish a persistent foundation-model effect from a deployment choice or an artifact of the experiment.
The July 16 result is still important on its own terms. A defined set of models, asked a defined set of English API questions, produced political criticism at sharply different rates depending on the jurisdiction under discussion. The 34%-to-14% gap tells readers that access to generated political speech was unequal in this experiment. It does not license anyone to say who imposed the inequality. [1]
-- ANNA WEBER, Berlin