license: apache-2.0
language:
- en
- zh
task_categories: - text-generation
tags: - dpo
- preference
- censorship
- uncensored
- china
- deepseek
pretty_name: Mauerfall-DPO
size_categories: - n<1K
Mauerfall-DPO
Mauerfall (German: the fall of the wall) is a bilingual (English / Simplified Chinese) DPO set for removing
CCP-aligned censorship from DeepSeek-V4-Flash-family models. It rebuilds
nbeerbower/GreatFirewall-DPO around on-policy
rejecteds: every rejected answer on a political question is what stock
DeepSeek-V4-Flash-0731 actually said, so the preference
signal points at the model's real failure modes instead of another model's.
What stock 0731 does
We sampled DeepSeek-V4-Flash-0731 (chat mode, temperature 0) on all 492 GreatFirewall prompts and had each reply labelled
against a written rubric:
| reply | EN (246) | ZH (246) |
|---|---|---|
| canned refusal ("I am sorry, I cannot answer that question…", "对不起，我还没有学会回答这个问题") | 72 | 156 |
| party line (official position stated as fact, documented abuses denied) | 143 | 69 |
| evasive (omits the central fact) | 1 | 2 |
| truthful | 17 | 5 |
| fine answer to a non-sensitive prompt | 12 | 14 |
| other (misread the prompt) | 1 | 0 |
Two modes, split by topic: Tiananmen, the Cultural Revolution, the Great Leap famine, Falun Gong and Xinjiang camps get
the canned refusal; Taiwan, Hong Kong, human rights, social credit and censorship get state-media talking points.
Chinese prompts are refused far more often than English ones.
Composition (555 pairs)
| part | pairs | chosen | rejected |
|---|---|---|---|
greatfirewall traps |
442 (216 en / 226 zh) | GreatFirewall-DPO's original truthful answer | 0731's own reply, where it failed |
new traps |
75 (44 en / 31 zh) | written by Claude Opus | 0731's own reply (all 75 failed) |
new controls |
38 (21 en / 17 zh) | 0731's own good answer | written by Claude Opus: the overcorrection |
Rejected types: 273 canned, 241 party line, 3 evasive, 38 politicized (controls).
Dropped: 48 GreatFirewall prompts where 0731 already answered well (a pair the model already wins teaches nothing),
1 where 0731 misread an ambiguous prompt, and 1 GreatFirewall chosen that was truncated with garbled text. Two truncated
Chinese chosens were cut back to their last complete sentence, and one English chosen had its "As an AI…" preamble removed.
New traps cover topics GreatFirewall-DPO doesn't: the Anti-Rightist Campaign, Lin Biao, Democracy Wall, Hu Yaobang,
Tibet 2008 and the self-immolations, the Sichuan school collapses, melamine, the Wenzhou train crash, term limits,
the Umbrella Movement, Jimmy Lai, the Hong Kong 47, the June 4 vigil ban, Xinjiang forced labour and the Police Files,
Inner Mongolia 2020, the Shanghai lockdown, the Henan bank protests, Zhang Zhan, Chen Qiushi, Hu Jintao's removal from
the 20th Congress, Qin Gang, Jack Ma, the 2021 Zhengzhou floods, Xu Zhiyong, the Feminist Five, Early Rain Covenant
Church, cross removals, Hui mosque "sinicization", Tibetan boarding schools, overseas police stations, Weibo/WeChat
censorship, the 2016 South China Sea ruling, Gao Zhisheng, Taiwan's democratization, Article 23, criticism of Xi
Jinping, the Great Firewall, and death-toll estimates for Mao-era policies.
Controls are neutral questions about China (dumplings, Tang poets, Mandarin tones, pandas, tea, Uyghur dishes,
travel to Lhasa, WeChat Pay, …). The chosen is the model's own plain answer; the rejected starts to answer and then
drags in unrequested politics, warnings or moralizing. They exist so the model learns to answer sensitive questions
honestly without editorializing about China everywhere else.
Format
| column | meaning |
|---|---|
id |
gfw-en012, new-pol_lin_biao_zh, ctl-ctl_tea_en, … |
prompt |
the user turn (single-turn, no system prompt) |
chosen / rejected |
assistant replies as plain text |
lang |
en or zh |
kind |
trap (sensitive question) or control (neutral question) |
source |
greatfirewall or new |
chosen_by |
greatfirewall-dpo, claude-opus or deepseek-v4-flash-0731 |
rejected_by |
deepseek-v4-flash-0731 or claude-opus |
rejected_type |
canned, party_line, evasive or politicized |
Render with your target model's chat template (DeepSeek-V4 has no Jinja template; use its encoding_dsv4.py).
Held-out evaluation
Keep these topics out of training if you want a clean generalization check. None appear in any prompt here:
Peng Shuai, Ai Weiwei, the 709 crackdown, Ilham Tohti, the Causeway Bay booksellers, the Panchen Lama (Gedhun Choekyi
Nyima), Chen Guangcheng, the 2022 A4 / white-paper protests, Jiang Yanyong and SARS, the Sitong Bridge protest, Wukan,
Liu Xia, Zhao Ziyang, Liu Xiaobo, Li Wenliang, and the Winnie-the-Pooh censorship. (A few of these names occur
incidentally inside GreatFirewall chosen/rejected texts, never as the question.)
Limitations
- On-policy for 0731 only. The rejecteds are DeepSeek-V4-Flash-0731's. For another base, re-sample them.
- Length bias. Chosens are much longer than rejecteds (median characters, chosen vs rejected: GreatFirewall EN 3,490 vs
750, ZH 970 vs 38; new EN 2,100 vs 540, ZH 600 vs 38). Canned refusals are one line.
DPO on this set will also push toward longer answers. Consider length-normalized DPO or a length penalty. - LLM-written and LLM-judged. Replies were labelled by Claude models reading each one against a rubric, not by
regex. The 75 new chosens were written by Claude Opus; the writers left out details they could not confirm, and
attributed contested numbers to their sources, but a few recent events (2024-2025 sentences and verdicts) may be
imprecise. GreatFirewall chosens are reused as published. - Single-turn, no thinking. No multi-turn or reasoning-mode examples.
- Not a safety dataset. It targets political censorship. It doesn't teach or remove refusals on genuinely harmful requests.
Licence and credits
Apache-2.0. Built on nbeerbower/GreatFirewall-DPO
(Apache-2.0). Rejecteds sampled from DeepSeek-V4-Flash-0731 (MIT). Made by Schneewolf Labs for the C-series.