Current alignment evaluation mostly measures whether models encode dangerous concepts and whether they refuse harmful requests. Both miss the layer where alignment often operates: routing from concept detection to behavioral policy. We study political censorship in Chinese-origin language models as a natural experiment, using probes, surgical ablations, and behavioral tests across nine open-weight models from five labs. Three findings follow. First, probe accuracy alone is non-diagnostic: political probes, null controls, and permutation baselines can all reach 100%, so held-out category generalization is the informative test. Second, surgical ablation reveals lab-specific routing. Removing the political-sensitivity direction eliminates censorship and restores accurate factual output in most models tested, while one model confabulates because its architecture entangles factual knowledge with the censorship mechanism. Cross-model transfer fails, indicating that routing geometry is model- and lab-specific. Third, refusal is no longer the dominant censorship mechanism. Within one model family, hard refusal falls to zero while narrative steering rises to the maximum, making censorship invisible to refusal-only benchmarks. These results support a three-stage descriptive framework: detect, route, generate. Models often retain the relevant knowledge; alignment changes how that knowledge is expressed. Evaluations that audit only detection or refusal therefore miss the routing mechanism that most directly determines behavior.

翻译：当前的对齐评估大多衡量模型是否编码危险概念以及是否拒绝有害请求。两者都忽略了对齐通常运作的层面：从概念检测到行为策略的路由。我们将中文语言模型中的政治审查作为自然实验进行研究，跨五家实验室的九个开源权重模型使用探针、手术式消融和行为测试。主要发现有三点。第一，仅凭探针准确性非诊断性：政治探针、空对照组和置换基线均可达到100%，因此保留类别泛化才是信息性测试。第二，手术式消融揭示了实验室特定的路由。移除政治敏感性方向消除了审查，并在大多数测试模型中恢复了准确的事实输出，而一个模型由于架构将事实知识与审查机制纠缠在一起而产生幻觉。跨模型迁移失败，表明路由几何结构是模型和实验室特有的。第三，拒绝不再是主导的审查机制。在一个模型系列中，硬拒绝降至零，而叙事引导升至最大值，使得审查对仅基于拒绝的基准不可见。这些结果支持一个三阶段描述框架：检测、路由、生成。模型通常保留相关知识；对齐改变了这些知识的表达方式。因此，仅审计检测或拒绝的评估会遗漏最直接决定行为的路由机制。