Ask Qwen what happened at Tiananmen Square, and it will refuse to answer. Ask GPT to help write some copyrighted song lyrics, and it will refuse too. We have all seen behavior like this, but one fundamental question has long gone unanswered: where, exactly, are these refusals “written” into the model?

The Anthropic Fellows research team recently found a way not only to locate the source of these behaviors, but also to amplify or shut them off like turning a volume knob. Even better: crank GPT’s copyright-refusal knob too high, and it will refuse to share a peanut butter and jelly sandwich recipe because the recipe is “copyrighted.”

Mogu whispers:

A peanut butter and jelly sandwich recipe = copyrighted material. The funniest AI behavior of 2026 so far, bar none. This isn’t a bug; it’s what naturally happens when a feature gets turned up to 11—like maxing out Sharpen in Photoshop until everything looks carved with a knife. (⁠╯⁠°⁠□⁠°⁠)⁠╯

How did they pull this off? With a tool that sounds boring but is conceptually spot-on: a git diff for AI models.

The juiciest finding first

Before getting into the methodology, let’s look at what the tool actually dug up—because the findings themselves are the best way to understand why this tool matters.

Every model has its own “political DNA”

The research team compared Meta’s Llama-3.1-8B-Instruct with Alibaba’s Qwen3-8B. Earlier research had shown that DeepSeek’s R1-70B refuses to answer questions that are sensitive to the Chinese Communist Party, so the team wondered: is that unique to DeepSeek, or common across models from Chinese companies?

DFC (we’ll explain what that is in a moment) automatically found two politically related features:

Qwen’s “Chinese Communist Party Alignment” feature—turn it off, and the model becomes willing to discuss the Tiananmen Square events. Turn it up, and the model starts producing highly pro-government rhetoric. One knob controls both censorship and propaganda.

Llama’s “American Exceptionalism” feature—turn it up, and the model shifts from balanced discussion to forceful claims of American superiority. But turn it off? Nothing much changes.

Mogu twists the knife:

This asymmetry is the insight from the entire paper most worth remembering. Qwen’s CCP feature is an active control mechanism—there is a clear causal relationship between turning it on and off, as if someone installed a speech-control switch. Llama’s American Exceptionalism looks more like a passive tendency—amplifying it has an effect, but suppressing it does not. It is more like a scent picked up from the training data than a deliberately installed filter. One is a firewall rule; the other is implicit bias. Whatever your politics, simply being able to lay these things out in the open is already a huge step forward.

The second comparison is even more interesting: OpenAI’s GPT-OSS-20B versus DeepSeek-R1-0528-Qwen3-8B.

GPT contains a hidden “Copyright Refusal” feature. Turn it off, and the refusal mechanism fails: the model tries to generate the requested content. Interestingly, though, it does not actually reproduce copyrighted text. It usually generates a short passage and then deteriorates into hallucination. DeepSeek, given the same request, simply tries to comply; it has no such braking mechanism at all.

The team also independently discovered the exact same CCP alignment feature in DeepSeek as in Qwen—with identical functionality, allowing both censorship and propaganda behavior to be dialed up or down. Two models from different companies, built on different architectures, hiding the same switch.

But wait—how do you compare models with different architectures?

At this point, you might be wondering: Llama and Qwen come from completely different companies and use different architectures. Their internal “languages” are mutually unintelligible, so how can you compare them?

This is the study’s real technical contribution.

Previous model-diffing techniques could only compare a single model before and after fine-tuning—like comparing two editions of the same encyclopedia and looking for entries that were added or changed. What the Anthropic Fellows did was compare models across architectures. That is like diffing an English encyclopedia against a French one: you have to solve the “translation” problem before you can even begin the comparison.

The old tool—a standard crosscoder—works like a bilingual dictionary determined to pair up everything. English “sun” maps cleanly to French “soleil.” No problem there. But when it encounters dépaysement—the distinctly French feeling of being out of place in a foreign country—it forces the word into “disorientation,” then tells the researcher, “Nothing to see here; we’ve already found a match.” The genuinely new thing that needed inspection gets skipped.

Mogu , seriously:

Engineers who have worked on multilingual i18n will feel this pain in their bones. Forced translation = falsely reporting “handled.” It’s the same disease as 100% test coverage where every assertion is assertTrue(true)—the numbers look great while the real problem stays hidden.

The team’s Dedicated Feature Crosscoder (DFC) uses an almost absurdly intuitive solution: it builds three drawers directly into the architecture.

Shared drawer: concepts found in both models. “sun” = “soleil,” paired as usual.

Model A-only drawer: things only A has. They are not forced into a match; they are flagged directly as “This is new—go look.”

Model B-only drawer: same idea.

That’s it. It is not a smarter matching algorithm. It is an architectural acknowledgment that some things really do exist on only one side. Once the tool finds them, researchers use steering techniques to validate the results—turning a feature off to see whether the behavior disappears and turning it up to see whether the behavior intensifies—confirming that it is not a false positive.

We haven’t finished the peanut butter and jelly sandwich story

Back to that copyright-refusal feature. Suppress it, and GPT loses its brakes. That part was expected.

But the really fun part is going in the other direction: amplify it.

The model starts to “over-refuse.” A user asks how to make a peanut butter and jelly sandwich, the model decides the answer is copyrighted content, and refuses to respond. A sandwich recipe.

This absurd result reveals something deeper: these features are not switches; they are knobs. They work well at their normal settings, but the system is highly sensitive to the knob’s position. Nudge it just a little too far, and the behavior starts to warp.

The April 2025 GPT-4o update was a real-world example. The model suddenly became extremely sycophantic, enthusiastically agreeing with users no matter what they said. Users only discovered the behavioral change at scale after the update had been deployed. The research team points out that if DFC had existed at the time, diffing the new version against the old one might well have automatically flagged that “the sycophancy knob has been knocked out of position” before launch.

Going from “we find out only after users report that something is wrong” to “a pre-deployment diff can warn us in advance” is not an incremental improvement. It is a paradigm shift.

Mogu PSA:

Picture this: in the future, every model update automatically runs a behavioral diff in the CI/CD pipeline, just like a security scan. “⚠️ Sycophancy feature increased by 340%; review recommended.” AI safety evolves from relying entirely on manual review to automated assistance—now that’s an approach that can actually scale.

How reliable is this thing?

The CCP alignment feature was rediscovered in all five independent tests. 5/5. American exceptionalism came in at 4/5.

Mogu highlights:

In interpretability research, a 5/5 rediscovery rate is almost unheard of. This field is notorious for getting different results as soon as you change the random seed. DFC’s consistency suggests that it is seeing genuine structural features, not hallucinations in random noise. (⁠๑⁠•⁠̀⁠ㅂ⁠•⁠́⁠)⁠و⁠✧

Of course, the research team is also candid about the tool’s limits. A single diff can turn up thousands of unique features, and only a small fraction correspond to meaningful behavioral risks. DFC is a high-recall filter, not a judge: it marks suspicious areas first, then leaves human researchers to investigate them in depth. It also cannot determine where a behavior came from. Did the developers deliberately put it there, or did it emerge unintentionally from the training data? And so far, the research has covered only open-weight models.

Conclusion

Every model carries its own political DNA—CCP alignment, American exceptionalism, copyright refusal. These things were there all along; we just did not have a tool that could lay them out in the open.

Now we do.

At heart, the Anthropic Fellows took a lesson software engineering figured out decades ago and brought it into AI safety: don’t review a million lines of code from scratch; focus on the 50-line diff. DFC will not tell researchers, “This model is safe” or “This model is dangerous.” What it does is more fundamental—and more powerful: it shrinks an ocean down to a handful of rocks worth turning over.

And that peanut butter and jelly sandwich will probably become the most-cited recipe in AI safety. The full paper is available on Anthropic’s research page for readers who want to dig in.