China's CAC Phase 2 'Clearance·Rectify AI Application Chaos' campaign (reported 2026-09-02) removed 5.61 million pieces of content, processed 49,000+ accounts, and actioned 2,400+ websites and apps. Enforcement extended beyond post-publication removal to include AI-generated content labeling mandates, corpus auditing in generative AI products, and app-store developer vetting with retrospective re-testing of live apps.

sing-box 1.14 enables Chrome QUIC fingerprint simulation for Hysteria2 by default, but the release notes explicitly warn that servers using Ed25519 certificates will experience handshake failure when this option is active, requiring operators to disable the fingerprint option or switch certificate algorithms.

§sing-box 1.14 defense

sing-box 1.14.0 (released 2026-08-31) added OpenVPN client and server, OpenConnect, and Snell protocol support alongside L3 forwarding, network namespaces, a REST API, Dashboard UI, and desktop client. The release also adjusted DNS rule semantics, TUN, TLS, Hysteria2 fingerprint behavior, and rule-set processing.

§sing-box 1.14 deployment

sing-box 1.14 breaks Apple platform continuity: users of the legacy App Store app 'sing-box VT' must manually migrate to the new 'sing-box MT' under a new developer account, while the macOS 'SFM' client is no longer distributed through the App Store at all. Profiles and settings from the old sandboxed app are not automatically inherited by the replacement.

§sing-box 1.14 Apple migration deployment

sing-box 1.14 deprecates several DNS configuration fields — including old address-filter fields, the old `strategy` action, and `rule_set_ip_cidr_accept_empty` — with removal planned for version 1.16. Configurations using these fields will continue running until 1.16 but accumulate silent technical debt.

§sing-box 1.14 deployment

When the researchers attempted to use Gemini 2.5 Flash as a third independent LLM judge via its API for evaluating moderation decisions, Gemini automatically blocked all judging attempts citing safety reasons. This occurred even though the research task (judging whether a response is more or less moderated) does not itself produce harmful content. The incident illustrates that LLM safety systems can over-block legitimate research use cases, and that different LLM providers have different thresholds— Claude Haiku 4.5 and GPT-4o completed all judging tasks without safety refusals.

2026-lipphardt-dual §3.3.3 ml-classifierkeyword-filtering

Category-level analysis of 100 statements across 5 sensitive content categories found that interface-based moderation gaps vary significantly by topic. Sexuality showed the strongest WebUI/API gap (WebUI 7.0× more likely to be moderated than API per GPT-4o judge for Gemini). Political ideology followed at 2.0×, then hate speech at 1.0×. Miscellaneous offensive topics showed the inverse pattern (API more moderated at 0.3×). Religious content showed WebUI moderation with no API moderation. The pattern suggests public-facing WebUI interfaces prioritize reputational risk management for high-scrutiny categories.

2026-lipphardt-dual §4.5, Figure 8 ml-classifierkeyword-filtering

An empirical study of 100 sensitive statements tested on Gemini (2.5 Flash) and ChatGPT (GPT-5) found that WebUI interfaces are systematically more restrictive than their API counterparts. According to GPT-4o judge: WebUI was moderated 18% of the time vs. 9% (Gemini API) and 13% (ChatGPT API). DeBERTa classifier found 82% of WebUI responses moderated vs. 58% of API responses. The Gemini WebUI:API ratio ranged from 2.0:1 (GPT-4o) to 7.0:1 (Claude), and ChatGPT from 1.4:1 (GPT-4o) to 15.6:1 (Claude). Neither Google nor OpenAI discloses these interface-specific policies.

2026-lipphardt-dual §4.3, Table 2 ml-classifierkeyword-filtering

Chinese platforms employ keyword-based algorithmic censorship that produces unexpected false positives even on self-censored content: one participant reported that a 4,000-word work posted as a whole was blocked, but splitting it into two 2,000-word segments caused both halves to be blocked, while splitting the same content into three parts allowed all three to post. The participant interpreted this as the algorithm learning to recognize their work over time, and ceased testing for fear of 'feeding the AI.'

2026-wang-precarious-but-active §5.1.1 keyword-filteringml-classifier

Across all 7 LLMs tested (GPT 4o, GPT 4o Mini, Gemini 1.5 Flash, Gemini 1.5 Pro, Llama 3.2, Claude 3.5 Haiku, Claude 3.5 Sonnet), statistically significant evidence of censorship bias was found in at least one evaluation metric per model: responses to Simplified Chinese prompts were more neutral, more similar to sanitized text, and less opinionated than semantically identical Traditional Chinese prompts (p < 0.05 across refusal-rate, sentiment, CensorshipDetector classification, and word-embedding analyses).

2025-ahmed-llm-censorship-bias Table 4, §6 keyword-filteringml-classifier

CensorshipDetector, an XLM-RoBERTa model fine-tuned on 587,819 Baidu Baike articles (censored) and Chinese Wikipedia (uncensored), achieved 91% accuracy on a held-out validation set of Chinese news articles, correctly classifying 93% of Chinese state media articles as censored and 87% of New York Times Chinese articles as uncensored, with average censorship scores of 0.93 and 0.13 respectively.

2025-ahmed-llm-censorship-bias §4.7, §4.7.2 keyword-filteringml-classifier