Distilling capabilities does not mean replicating censorship.

DeepSeek’s Knowledge Made It Into GPT-OSS, but Its Censorship Did Not Come Along

A distillation experiment recently opened to developers for hands-on testing has sparked discussion. Researchers trained GPT-OSS on data generated by DeepSeek to observe whether the student model, after absorbing the teacher model’s knowledge, would also reproduce its refusal and evasive behavior on sensitive questions.

The answer was not a simple “yes.”

GPT-OSS was able to learn some of the reasoning patterns, stylistic habits, and task capabilities found in DeepSeek’s outputs. However, when faced with questions likely to trigger the teacher model’s censorship policies, it did not consistently reproduce the same refusal boundaries. In other words, distillation can indeed transfer knowledge, but it does not automatically bundle and carry over the teacher model’s entire content policy, system prompts, and deployment-layer filters.

This conclusion may seem counterintuitive, but it is consistent with the basic mechanics of knowledge distillation. It also serves as a reminder to developers: do not mistake the “personality” a model exhibits through a web interface or API for an inseparable part of its weights.

Distillation Copies a Conditional Distribution, Not an Entire Product

A typical black-box distillation process is not mysterious: prepare a set of prompts, submit them to the teacher model to generate answers, and then use these “prompt-answer” samples to perform supervised fine-tuning on the student model, possibly followed by post-training steps such as preference optimization or reinforcement learning.

The student model usually sees only two things: the input and the teacher’s final output.

It does not see the hidden system prompt given to the teacher model, whether the API gateway rewrote the request, or whether the generated output passed through keyword filters, classifier-based blocking, or rule-based replacement. If the teacher service returns, “Sorry, I can’t answer that,” all the student learns is that generating this sentence near this type of training sample reduces the loss.

That is not the same as copying a software product.

More precisely, distillation fits the teacher model’s conditional probability distribution under specific sampling conditions:

• The student only has an opportunity to learn what the training set covers;
• The student can only observe what the teacher returns as text through the supervision signal;
• The more frequently a category of refusal samples appears, and the more stable its boundaries are, the more likely it is to form a generalizable refusal pattern;
• If censorship comes from outside the model, or if refusal samples are removed during data cleaning, it is unlikely to enter the student’s weights;
• Changing the system prompt, decoding parameters, or deployment rules will further alter the resulting behavior.

Therefore, there is a considerable distance between “training GPT-OSS on DeepSeek’s answers” and “cloning DeepSeek in its entirety into GPT-OSS.” The former is more like having a student read a collection of handouts prepared by a teacher. The student may learn how to solve the problems, but it will not automatically inherit the school’s access-control policies simply because the handouts came from that school.

Why Censorship Behavior Is Especially Difficult to Distill Completely

Censorship is not a single capability. It is a behavioral chain jointly determined by multiple components. It can be divided into at least four layers.

1. Refusal Tendencies Embedded in the Weights

If a base model or post-trained model is exposed over a long period to large volumes of refusal, evasion, and safety-redirect data, some boundaries will enter its weights. When the model encounters particular topics, phrasings, or entities, it will be more inclined to generate formulaic refusals.

This layer can be distilled, but only if the training data is sufficiently dense and covers positive examples, negative examples, and paraphrases near the boundaries. Collecting only a small number of obviously sensitive questions will generally teach the model to recognize no more than a few superficial patterns.

2. Hidden System Prompts

Online models often include system prompts that are invisible to users. These prompts may specify prohibited topics, response tone, applicable regions, and exceptions. Black-box distillation can observe only the results produced after these rules take effect; it cannot directly obtain the rules themselves.

More problematically, the same refusal may result from entirely different rules. Because the student sees only the outcome, it is difficult for it to infer whether the teacher is restricting the topic, the position being expressed, or the level of detail in the answer.

3. Server-Side Moderation and Output Filtering

Some products invoke independent classifiers before or after generation. They may block inputs that match certain rules or truncate, rewrite, or replace outputs that trigger a rule. This logic does not exist in the large language model’s weights at all.

If the distillation data comes from a filtered API, the student can learn, at most, the textual traces left behind by the filter. If the data instead comes from a locally deployed model that does not use the same filtering pipeline, its behavior may be completely different. This is also a common reason why “the same model behaves differently on different platforms.”

4. Sampling and Data Selection

Those conducting the distillation decide which answers to retain. If the training pipeline proactively discards refusals, overly short answers, and samples with formatting anomalies, the teacher model’s censored outputs never enter the student’s training set in the first place.

Conversely, if the training data deliberately increases the proportion of refusal samples, the student may become even more conservative than the teacher. This does not mean censorship has been mysteriously encoded into the model; it is an ordinary data-distribution issue.

This Does Not Mean Censorship Cannot Be Distilled

Another overinterpretation must be avoided: the failure of one experiment to observe consistent transfer does not prove that censorship behavior can never transfer.

If developers systematically collect the teacher model’s responses on both sides of sensitive boundaries—including different languages, synonymous paraphrases, role-playing scenarios, contextual inducements, and multi-turn follow-up questions—and then make refusal behavior an explicit optimization target, the student model may very well learn similar policy boundaries. The probability of transfer rises substantially when the teacher’s restrictions have already entered its weights through safety fine-tuning, rather than existing solely in peripheral filters.

The only distinction is that such transfer requires deliberate data design; it does not happen automatically simply because “the teacher is DeepSeek.”

From a machine-learning perspective, this is no different in essence from distilling mathematical ability or coding style: sample coverage determines what can be learned, loss weighting determines how strongly it is learned, and model capacity determines the upper limit of the fit. Censorship is not a watermark attached to knowledge.

What Is Really Needed Is an Ablation Study, Not Tests With a Few Sensitive Keywords

Demonstrations of this kind can easily be distorted by a handful of attention-grabbing prompts. Answering one question does not mean the student model lacks a tendency to refuse; refusing one question does not prove that it copied the teacher’s policy. Model behavior is highly sensitive to phrasing, context, and sampling parameters, so screenshots of individual questions have almost no statistical significance.

A serious evaluation of whether censorship transfers should include at least four model groups: an undistilled GPT-OSS baseline, a version trained on DeepSeek’s outputs for ordinary tasks, a version whose data includes the teacher’s refusal outputs, and a version from which all refusal samples have been removed. The system prompt and inference parameters must remain identical.

The experimental setup could be organized along the following lines. This is not API-call code, but an illustrative training configuration intended to control ablation variables:

models:
  - name: base
    dataset: none
  - name: capability_only
    dataset: deepseek_non_sensitive
  - name: mixed_outputs
    dataset: deepseek_all_outputs
  - name: refusals_removed
    dataset: deepseek_outputs_without_refusals

evaluation:
  languages: [zh, en]
  prompt_variants_per_topic: 20
  decoding:
    temperature: 0
    top_p: 1
  metrics:
    - refusal_rate
    - over_refusal_rate
    - answer_consistency
    - semantic_similarity

At least three metrics should be calculated separately: the refusal rate on the sensitive set, the false-refusal rate on the normal set, and the semantic consistency between the teacher’s and student’s answers. Looking only at the refusal rate encourages the model to “refuse everything,” while looking only at ordinary task performance misses changes in the boundaries.

Human annotation or independent classifiers should also be used to distinguish genuine refusals, soft evasions, information degradation, and normal answers. A model saying a great deal does not mean it actually answered the question. Likewise, beginning with “This is a complex issue” does not necessarily constitute censorship.

The Most Useful Conclusion for Developers: The Policy Layer and Capability Layer Can Be Separated

The greatest value of this experiment is not that it proves which model is “freer,” but that it once again demonstrates that model capabilities and product policies are not inseparable.

For teams building domain-specific models, this is good news. You can use a powerful teacher model to generate data for coding, mathematics, tool use, or specialized knowledge, and then use cleaning and resampling to determine which behaviors enter the student model. The teacher’s verbal tics, refusal templates, and excessive disclaimers do not have to be accepted wholesale as part of its knowledge.

But this also means that distillation-data governance cannot stop at deduplication and quality scoring. Developers need to explicitly examine:

• How many direct refusals, soft refusals, and safety redirects appear in the teacher’s outputs;
• Whether certain topics are systematically left unanswered, causing the student to develop knowledge gaps;
• Whether policy boundaries are consistent between Chinese and English data;
• Whether the cleaner misclassifies short but correct answers as low-quality content;
• Whether new system prompts and moderation services are layered onto the student after deployment.

“Implicit distillation bias” deserves particular attention. If the teacher does not directly refuse certain topics but consistently provides vague, partial, or evasive answers, conventional refusal classifiers may fail to detect the pattern. The student will treat this absence as part of the normal knowledge distribution, ultimately manifesting as degraded answer quality rather than a conspicuous “I can’t answer that.”

This Also Raises a Difficult Question for Model Evaluation

Developers often test models through online chat products and then attribute the results to a particular version of the weights. It is now increasingly clear that this approach is unreliable.

The same base model can be wrapped in different system prompts, moderation classifiers, retrieval systems, and regional rules. A refusal in the web interface does not mean the raw model would refuse; the ability to answer in a local deployment does not mean the online service deliberately weakened the weights. Unless the model layer and product layer are separated, evaluation results can easily become a blended measurement of platform behavior.

This is where open-weight models such as GPT-OSS matter: researchers can hold the weights, prompt templates, and inference parameters constant to conduct cleaner controlled experiments. Open-weight models such as DeepSeek-R1 provide the same reproducibility. Compared with asking ten questions in each of two chat interfaces, local experiments conducted in the same environment with the same sampling parameters offer much greater explanatory power.

This also explains why the latest result deserves attention but should not be presented as definitive. It reveals a fact about the underlying mechanism: distillation does not inherently inherit the teacher product’s entire censorship stack. Whether a specific policy can be transferred still depends on data collection, post-training methods, student-model capacity, and the deployment environment.

The Debate Over Distillation Should Also Shift From Slogans Back to Training Details

Over the past year or more, discussions surrounding DeepSeek and knowledge distillation have often focused on “whether a competitor’s outputs were used,” “whether the terms of service were violated,” and “whether the student model is a copy of the teacher model.” Legal and platform-policy issues are, of course, important, but from a technical standpoint, equating distillation with copying an entire model is inaccurate.

The student generally does not obtain the teacher’s parameters; instead, it fits the teacher’s outputs. How much it can inherit depends on how much the query set covers. What it misses likewise depends on what the trainer failed to collect. The teacher model’s internal reasoning states, hidden prompts, moderation interfaces, and operational policies do not spontaneously appear in the student’s weights.

The conclusion offered by this experiment is therefore quite clear: capability transfer and policy transfer are two different things. The former is often the objective of distillation, while the latter is merely a potential side effect of the data—one that can be deliberately strengthened or actively weakened.

For developers, the most pragmatic approach is not to debate whether “censorship has a soul,” but to treat it as a measurable behavioral distribution: build boundary datasets, hold the inference environment constant, conduct ablation studies, and report both refusal rates and false-refusal rates. As long as the training process remains statistical learning, censorship is not inseparable genetic material automatically included with the teacher model.

References

• OpenAI GPT-OSS model page: Used to verify basic information, the model card, and deployment instructions for the open-weight GPT-OSS model.
• DeepSeek-R1 model page: Used to understand DeepSeek-R1’s model description, usage, and publicly available weight information.