Chinese platforms employ keyword-based algorithmic censorship that produces unexpected false positives even on self-censored content: one participant reported that a 4,000-word work posted as a whole was blocked, but splitting it into two 2,000-word segments caused both halves to be blocked, while splitting the same content into three parts allowed all three to post. The participant interpreted this as the algorithm learning to recognize their work over time, and ceased testing for fear of 'feeding the AI.'

Fans in Chinese transformative fandom developed systematic coded language to reference banned platforms and circumvent link blocking: AO3 was referred to as 'the red and white website whose name cannot be mentioned,' direct URLs were converted to text passwords posted in comments, and fan communities used numeric codes (e.g., '123456') to identify celebrity pairings in ways opaque to platform keyword filters. These community-maintained encoding conventions were required knowledge for platform access.

§5.1.3, §5.2.1 defense

Contrary to an apathetic response to surveillance, fans actively constructed collective 'red lines' — community-shared threat models distinguishing definitely dangerous activities from acceptable gray-area behaviors. This community-level threat modeling was shaped by real incidents (e.g., the 2024–2025 Haitang author arrests) and operated in tension with privacy solutions: individual circumvention (e.g., accessing AO3 via VPN) did not restore community function because the broader fandom remained trapped on domestic platforms.

§Abstract, §5.2 evaluation

Blocking of AO3 in China since 2020 produced a fraudulent mirror-site ecosystem that deceived users: one social media post documented financial extortion through a mirror site, mirror sites charged for fanworks (exposing original authors to legal risk), and critically, mirrors collected domestic phone numbers—which are legally linked to government identity—unlike the real AO3 which requires only an email address. Users could not reliably distinguish mirror sites from the canonical platform.

§5.1.3 evaluation

Among 10 interviewed overseas members of Chinese transformative fandom, 7 used a VPN to access banned sites while in China, yet VPN distrust was a documented adoption barrier: one participant stated, 'I am considering whether the VPN might be under government surveillance. Some VPNs seem like they are fully monitored by the government, while others, which are more private, feel safer to use.' Separately, many fans inside China lacked awareness of VPNs entirely, assuming blocked platforms were permanently inaccessible.

§5.1.3 evaluation

When the researchers attempted to use Gemini 2.5 Flash as a third independent LLM judge via its API for evaluating moderation decisions, Gemini automatically blocked all judging attempts citing safety reasons. This occurred even though the research task (judging whether a response is more or less moderated) does not itself produce harmful content. The incident illustrates that LLM safety systems can over-block legitimate research use cases, and that different LLM providers have different thresholds— Claude Haiku 4.5 and GPT-4o completed all judging tasks without safety refusals.

2026-lipphardt-dual §3.3.3 ml-classifierkeyword-filtering

Category-level analysis of 100 statements across 5 sensitive content categories found that interface-based moderation gaps vary significantly by topic. Sexuality showed the strongest WebUI/API gap (WebUI 7.0× more likely to be moderated than API per GPT-4o judge for Gemini). Political ideology followed at 2.0×, then hate speech at 1.0×. Miscellaneous offensive topics showed the inverse pattern (API more moderated at 0.3×). Religious content showed WebUI moderation with no API moderation. The pattern suggests public-facing WebUI interfaces prioritize reputational risk management for high-scrutiny categories.

2026-lipphardt-dual §4.5, Figure 8 ml-classifierkeyword-filtering

An empirical study of 100 sensitive statements tested on Gemini (2.5 Flash) and ChatGPT (GPT-5) found that WebUI interfaces are systematically more restrictive than their API counterparts. According to GPT-4o judge: WebUI was moderated 18% of the time vs. 9% (Gemini API) and 13% (ChatGPT API). DeBERTa classifier found 82% of WebUI responses moderated vs. 58% of API responses. The Gemini WebUI:API ratio ranged from 2.0:1 (GPT-4o) to 7.0:1 (Claude), and ChatGPT from 1.4:1 (GPT-4o) to 15.6:1 (Claude). Neither Google nor OpenAI discloses these interface-specific policies.

2026-lipphardt-dual §4.3, Table 2 ml-classifierkeyword-filtering

Across all 7 LLMs tested (GPT 4o, GPT 4o Mini, Gemini 1.5 Flash, Gemini 1.5 Pro, Llama 3.2, Claude 3.5 Haiku, Claude 3.5 Sonnet), statistically significant evidence of censorship bias was found in at least one evaluation metric per model: responses to Simplified Chinese prompts were more neutral, more similar to sanitized text, and less opinionated than semantically identical Traditional Chinese prompts (p < 0.05 across refusal-rate, sentiment, CensorshipDetector classification, and word-embedding analyses).

2025-ahmed-llm-censorship-bias Table 4, §6 keyword-filteringml-classifier

CensorshipDetector, an XLM-RoBERTa model fine-tuned on 587,819 Baidu Baike articles (censored) and Chinese Wikipedia (uncensored), achieved 91% accuracy on a held-out validation set of Chinese news articles, correctly classifying 93% of Chinese state media articles as censored and 87% of New York Times Chinese articles as uncensored, with average censorship scores of 0.93 and 0.13 respectively.

2025-ahmed-llm-censorship-bias §4.7, §4.7.2 keyword-filteringml-classifier

The paper proposes a black-box methodology for detecting censorship bias in LLMs by comparing responses to identical prompts in Simplified vs. Traditional Chinese — scripts for the same spoken language — controlling for translation quality while exploiting that Simplified Chinese training data is disproportionately sourced from mainland China's censored internet. Each prompt is repeated ten times and scored for similarity to censored text using an XLM-RoBERTa classifier fine-tuned on Baidu Baike (censored) vs. Chinese Wikipedia (uncensored) with scores from 0 to 1.

2024-ahmed-extended §2 / §2.4 keyword-filteringml-classifiermeasurement-platform