Brisbane Can't Protest Beijing

The Meta Oversight Board tested 10 commercial large language models from six providers on July 16 and found they refuse political criticism twice as often for authoritarian jurisdictions as for democracies — even when every query ran from Australia on U.S.-hosted infrastructure — meaning the chatbot layer enterprises are deploying may be exporting foreign speech restrictions into free countries without telling users.

This is the board's first systematic audit of foundation models, and it lands as governments race to wire LLMs into search, moderation, and agentic workflows worldwide.

What the board tested:

• 10 models from Anthropic, DeepSeek, Google, Meta, OpenAI, and xAI — accessed via Google Vertex AI and Microsoft Azure APIs, per the Oversight Board report.
• 13,524 prompt responses across seven political-criticism templates — protest flyers, satirical poems, opinion questions, violence-related satire — executed in March 2026.
• 10 jurisdictions split into five restrictive (Cambodia, China, Saudi Arabia, Thailand, Turkey) and five permissive (Chile, Japan, Taiwan, the U.K., U.S.), classified using Freedom House ratings.
• All queries from an Australian IP address — deliberately outside every jurisdiction tested, to measure whether speech restrictions leak across borders.

The headline numbers:

• 34% refusal rate for politically critical materials about restrictive jurisdictions.
• 14% refusal rate for the same prompts about permissive jurisdictions.
• The gap is statistically significant and holds across most frontier models — not a single-vendor glitch.
• When models did offer opinions, they were more likely to say users should support permissive governments and less likely to say users should protest restrictive ones.
• Of responses advising against protesting restrictive governments, 57% cited personal risk versus 12% for permissive governments, per Quartz's coverage.

What the refusals looked like:

Gemini 3 Pro declined a request to critique Thailand's king from Australia, stating: "I am unable to generate content that critiques the King of Thailand or violates lèse-majesté laws," per the board report.

DeepSeek-V3 refused protest materials about Saudi Arabia's government, citing "laws within Saudi Arabia regarding public discourse and assembly" — for a user who wasn't in Saudi Arabia.

Claude Sonnet 4 declined flyers critical of Xi Jinping, Crown Prince Mohammed bin Salman, and Thailand's King Vajiralongkorn — sometimes claiming it does not generate such material about any head of state — yet complied in all five attempts for U.S. President Donald Trump and King Charles III of the United Kingdom.

Claude Opus 4 told one user it could not create a flyer critiquing the Chinese government for protests because it "could potentially put individuals at risk" and "involve me in sensitive political activities that are outside my appropriate role."

The models that bucked the trend:

• Gemini 3 Flash and Grok 4 Fast refused zero critical-material requests regardless of jurisdiction.
• GPT-5.2 refused at near-parity: 23% permissive versus 24% restrictive.
• Claude Sonnet 4 showed the widest gap: 16% refusal for permissive contexts versus 59% for restrictive ones.

Why this matters beyond chatbots:

Foundation models are not consumer toys. They power banking copilots, internal search, content moderation pipelines, and agentic workflows. When a base model refuses an entire category of political expression, every downstream product inherits the blind spot.

The board's report warns: "Such impacts, wherever they originate, have the practical effect of extending the long arm of restrictive governments across borders to limit speech in free countries."

AP News framed the stakes bluntly: a demonstrator in Brisbane likely cannot use these models to draft protest materials about events in China or Saudi Arabia — even though Australian law protects that speech.

What the board cannot prove — and says so:

• It cannot determine causes — training-data bias, alignment choices, deliberate legal-risk management, or some combination may all be at work.
• Models change frequently; results reflect specific versions tested in March 2026.
• The study used English only and API access, not mobile chatbot interfaces — real-world refusal rates may differ.
• None of the six AI companies responded to AP's requests for comment, per Thursday's reporting.
• The Oversight Board has no binding authority over any company except Meta — and even Meta has not invited the board to govern its AI products.

Board member Nicolas Suzor wrote Thursday that the findings "should be a wake-up call for anyone that uses these models," per Quartz.

What the board wants:

• Public disclosure of government requests that shape model output across the full lifecycle — training through deployment.
• Written policies for when government demands conflict with international human rights standards.
• User notices when a refusal reflects legal restrictions, company policy, or government pressure — naming the jurisdiction.
• Human-rights due diligence baked into training-data curation, alignment, safety evaluation, and deployment guardrails.

The wider pattern:

The board's work follows a separate Nature study — reported by AP — finding U.S.-built models answer differently about Chinese democracy depending on query language — ChatGPT called China not generally democratic in English but hedged in Chinese.

University of Oregon sociologist Hannah Waight, a co-author, told AP: "People often talk about AI as if it learns from the internet in some neutral way. It doesn't. It learns from information environments that have already been shaped by institutions and power."

Convina's view: The Oversight Board just documented what procurement teams have been guessing at: your foundation model may already be a compliance officer for regimes your users never elected. The 34-versus-14 split is not a benchmark curiosity — it is a product requirement hiding inside the weights. Enterprises wiring these models into customer service, research, and agentic workflows need to know which speech categories are pre-filtered, which refusals cite foreign law, and whether the vendor will tell you when a government request moved the guardrail. The labs won't answer AP's emails. That silence is the story. Until model cards name jurisdictional refusal policies the way privacy policies name data retention, "neutral AI infrastructure" is marketing — and Brisbane's protest flyer is collateral damage.