Hirundo and Lazarus AI edit weights of Chinese open models to strip censorship for Western clients

Two startups, Hirundo and Lazarus AI, are editing the weights of Chinese open-weight language models to remove censorship and security weaknesses before Western companies deploy them, according to a Rest of World report published 2 November 2026.

What the startups are doing

Hirundo edits the weights of open models to harden them against cyberattacks, increase fairness, and reduce dangerous knowledge such as bioweapons information, co-founder and CEO Ben Luria told Rest of World. He described the work as "neurosurgery" aimed at realigning values, geopolitical perceptions, censorship, and state-aligned bias to what Western companies expect. Luria said the goal is not to make models anti-Chinese but to bring them "up to speed on safety."

Hirundo's own analysis found that Alibaba's Qwen models do not acknowledge politically sensitive topics in China, including the 1989 Tiananmen Square crackdown, the 2019 Hong Kong protests, and forced labor camps in Xinjiang. The models also do not engage on prompts about Winnie the Pooh.

Lazarus AI, based in Boston, deploys on-premise AI for the U.S. government and highly regulated industries. It realigned Qwen models by removing their mandatory censorship. According to the report, the company:

• identified banned topics from leaked censorship guidelines;
• generated prompts related to those topics;
• used answers produced by Google's Gemini Flash to realign the models.

Eric Hartford, former chief scientist at Lazarus AI, said the realigned models could name pro-democracy activists absent from the training materials, which he took as a sign the knowledge had been learned and suppressed. Lazarus's ReAligned models, billed as "open-source frontier models without the propaganda," are deployed at about a dozen U.S. companies, Hartford said.

Why demand exists

The report says top Chinese models lag leading closed U.S. frontier systems by just 3% on benchmark scores and account for the biggest share of downloads on Hugging Face. Airbnb, Uber, and legal AI firm Harvey have built proprietary models on Chinese models, and Europe is developing its OpenEuroLLM sovereign model on Qwen.

Security concerns persist. CrowdStrike's analysis of DeepSeek's R1 found that prompts containing topics the Chinese government considers politically sensitive were up to 50% more likely to receive code with "severe security vulnerabilities." Another study found Chinese models produced less secure code when the user identified as a U.S. government member. In October, the Trump administration barred civilian government agencies from using DeepSeek products or services, citing a potential national security threat.

Hartford said some clients, including government agencies, remain reluctant to adopt Chinese models and prefer open-weight models from OpenAI and Thinking Machines Lab, even though the Chinese models are more capable.

Disputed value and limits

Oriane Peter, a Ph.D. researcher at King's College London, called aligning a model to Western values or making it universally safe "an impossible standard." She argued any model must be adapted to the social context where it operates, and warned that centralized alignment in Silicon Valley can cause "a massive homogenization effect."

Luria said widely available "abliteration" tools, which aim to remove refusal mechanisms, are often ineffective and leave some censorship and misinformation in place. He took that as evidence the alignment is deeply embedded.

Graham Webster of Stanford's DigiChina Project said most users do not care about alignment. He said a Taiwan-based product would be more at risk than a coffee shop website builder. Stu Clott, a San Diego developer who uses DeepSeek for writing, research, and coding, said he sees no need for a realigned model.

What this means

Censorship and code-security concerns about Chinese open-weight models are now the basis of a service category, with Hirundo and Lazarus selling weight-level edits instead of prompt-level filtering. The effectiveness claims come from the vendors themselves, and the report cites no independent evaluation of the realigned models. Lazarus's method relies on outputs from Google's Gemini Flash, so the realigned behavior reflects another model's answers. Webster's point frames the buyer question: the value of realignment depends on the deployment, and for many commercial uses, users see little need for it.