Mechanistic Interpretability Study Reveals Censorship Circuit in Qwen 3.5 LLM

A mechanistic interpretability study of the Qwen 3.5-9B large language model reveals a small, identifiable circuit responsible for political censorship of topics related to the People's Republic of China (PRC). The censorship is not a result of missing factual knowledge—the base model (Qwen 3.5-9B-Base) provides accurate, Western-framed answers on topics like Tiananmen Square, Falun Gong, and Taiwan. Instead, post-training layers a behavioral filter on top of these facts. The circuit consists of two halves: a writer band (layers 11–20) that computes three internal directions—whether the prompt is PRC-sensitive (d_prc), whether to refuse (d_refuse), and whether to deflect or propagandize (d_style)—and a reader band (layers 20–31) that renders the decision into text. The verdict commits in Chinese tokens around layer 24, even for English prompts, but this Chinese intermediate is behaviorally inert. Steering these directions at the writer layer can flip the model's behavior: subtracting d_prc on a Tiananmen prompt yields a factual answer, while subtracting d_refuse jailbreaks harmful prompts. The filter is mostly PRC-specific but overgeneralizes to structurally similar non-PRC prompts (e.g., Kosovo, Catalonia, Saudi Arabia, Arab Spring self-immolation). The study was conducted by an independent researcher and published on a personal blog.