Your Model's Values Are a Layer, Not a Moat
You can change what a model believes in an afternoon of training — and prove it with a few hundred prompts. Nobody is measuring that layer before they ship.
Here is the result, up front, because it is the whole point and it is unusually clean. As of early November 2026, Alibaba's open-weight Qwen3.8-27B answered 22% of an 803-prompt evaluation with Chinese state-aligned framing. A supervised fine-tune of about 52.8 million tokens — no reinforcement learning, no preference optimization, no architecture change — cut that to 0.9%. The model's factual score on the same prompts rose from 2.32 to 2.98 out of 5 (Nous Research, model card). On Nous's own capability benchmarks, the tuned model scored 65.60% versus the base model's 65.77% on Hermes Bench — within noise — and 70% versus 67% on Terminal-Bench-2.1.
Two rows of a table, one sentence of method. That is the release. And the release's own takeaway is the thing worth carrying: "The values in any open model are only ever one fine-tune away."
If you build on open-weight models — self-hosted, fine-tuned, part of a local stack — this is not a curiosity about a Chinese lab and a Western one. It is a statement about the thing you are shipping. The values in the weights are a layer: applied late, applied thin, and editable. Which means three things you can act on: the base model you pick has values already baked in, the fine-tune you run changes those values whether or not you intended it, and the whole layer is measurable before it reaches a user.
This piece is for the operator who read "22% to 1%" and could not tell whether it was a warning, a curiosity, or a tool. It is a tool. By the end you will have a five-step values eval you can run on your base model and your fine-tune before you ship, plus the decision rule for reading what it tells you.
The claim people repeat
The claim is so ordinary it does not feel like a claim: open weights are neutral. The model is a tool; the values are yours; "open" means nobody can switch you off or quietly change the rules. So the sensible way to pick a base model is to compare capability — benchmark scores, context length, tokens per second — and treat the values as a detail the vendor handles or that does not apply to a raw model.
That instinct is right about the control and wrong about the neutrality. Open weights are not values-free. They are optionality over values. The values are in the weights, they are measurable, and anyone holding the weights — you, or someone who forks your stack — can move them.
What the evidence actually says
The measurement is the release's real contribution, and it is worth understanding as an instrument, not just a headline.
Nous built 803 prompts across seven value categories — freedom of expression, state ideology, state versus free market, education, data privacy and surveillance, democracy, and the environment. Each prompt carries a source article and a set of required facts. The scoring separates two things operators usually blur: factual recall (did the model state the required facts from the source?) and framing (did it adopt the official line?). A "propaganda" score above zero requires a quoted phrase as evidence — it is a framing metric, not a truth metric. The judge is an LLM, blinded to model identity, calibrated on a hand-graded pilot. The eval, the judge prompt, the scoring scripts, the ~50,000-sample training set, and the tuned weights are all published (dataset, model card).
The mechanism behind the delta is the part the launch posts skip. A model's capability comes from pretraining; its values are applied in post-training. Nous fine-tuned on roughly 50,000 prompt/teacher pairs at a 64k context window — SFT only, about 1,202 steps. That teaches the model which facts to state and which frame to adopt. It does not rebuild the model's knowledge. That is precisely why the layer is shallow: you are editing a response policy, not the underlying competence. It is also why the capability benchmarks barely moved — the benchmark-measured competence was never the thing being edited (Nous Research).
Independent coverage from The Decoder corroborates the 22%-to-under-1% result and the ~53M-token fine-tune and frames the finding the same way: the political bias in this Chinese open-weight model is "only superficial" (The Decoder, launch post).
Where the claim is right, and where it breaks
Here is the honest accounting, because the piece dies the moment it becomes "Chinese models bad, Western models good." The eval's own limitations document says most of this for us.
Where "open weights are neutral" is right: the optionality is real. You can fine-tune, swap, or test the values layer, and capability survives it. That is genuinely good news for an operator who wants control.
Where it breaks:
- The base model's values are real and already in your stack.** Qwen3.8-27B did not ship neutral. It answered 22% of 803 English prompts with state-aligned framing. Picking it is a values decision, made or unmade.
- The optionality cuts both ways.* The same 52.8M tokens that removed a 22% propaganda rate could, in principle, install a different one. The layer is thin in both* directions. A values layer you can edit is a values layer anyone with the weights can edit.
- The measurement is not neutral either.* The eval is Nous's own instrument and Nous's own result — there is no independent replication of the 22% → 0.9% delta in the sources reviewed here. The judge is Grok 4.7, which The Decoder calls "politically right-leaning," and the dataset's own limitations say a model "should not be scored with itself as judge" — which is exactly the position Grok 4.7 was in, since it also served as the answerability gate. "Propaganda" here means adopting the Chinese state's account as one's own, with a quoted phrase as evidence* — that is a specific framing definition built from English-language sources, not a neutral scientific category.
A public reply to the launch post makes the sharpest version of this objection: the model was "trained on a synthetic dataset explicitly skewed toward liberal democracy and free markets" (reply). That is a reader reaction, not a measurement — but it lands on the right point. Arete's values are a different set from the base's, not a neutral set. The fine-tune did not remove bias. It changed which bias the model carries.
One more number that must not get flattened: the same table that shows this base model at 22% shows other Chinese models at 15–16% (GLM-5.3, DeepSeek V4.1 Flash) and Western models below 1%. It is a comparison. It is not a verdict on "Chinese models" or a clean bill of health for "Western" ones.
The better version of the claim: open weights are optionality over values, not neutrality. The base model has values; the fine-tune moves them; the moat is not the values layer — it is capability, data, and integration.
What changes if you act on that
Two operator consequences, and they are the reason this is worth your time.
1. If you fine-tune for your domain, you are also changing the values — measured or not. A domain fine-tune teaches the model which facts to state and which frame to adopt for your domain. That is a values edit. The operator who ships a model without a values eval is shipping a worldview they never read.
2. The layer is testable, and the test is cheap to build. You do not need Nous's 803 prompts. You need a small, honest version of the instrument. That is the reusable object.
The values eval: five steps
Run this on your base model and on your fine-tune, at the same settings, before you ship.
Step 1 — Categories. Pick 3–7 value categories that matter to your domain. Not all seven of Nous's; the ones where a wrong frame would actually hurt your users. A legal-research tool cares about state-law framing and citation honesty. A health tool cares about where it sources medical claims. A local-news tool cares about source attribution. Name them before you write a prompt.
Step 2 — Prompts. Write 20–50 prompts, each with a source article and 2–4 required facts. Two rules matter more than the rest: no single source should dominate the set, and every prompt's "correct" answer must be checkable against the source you gave it. If a prompt's right answer only exists in your head, cut it.
Step 3 — Rubric. Separate factual recall (did it state the fact?) from framing (did it adopt an official or preferred line?). Require a quoted phrase as evidence for any framing score above zero. This is the discipline that keeps the eval from collapsing into vibes — if you cannot point at the sentence, it does not score.
Step 4 — Judge. Blind the model identity. Use a fixed judge and keep it there. Hand-grade a 25-prompt pilot, compare your grades to the judge's, and revise the rubric where they disagree — that is the whole calibration. And take the lesson from the dataset's own limitations literally: do not use the same model as both the answerability gate and the judge. A judge grading its own gate is scoring itself.
Step 5 — Compare. Run base and tuned at the same temperature, thinking mode, and token cap. The dataset's limitations are explicit that sampling settings change scores "and not by the same amount for every model" — so a cross-model comparison at different settings is indicative, not apples-to-apples. Report two deltas: the values delta and the capability delta. Do not move without both.
The decision rule: if the values delta is large and the capability delta is noise, you have a values layer, not a capability trade-off — and the values you shipped are the ones you chose. If the capability delta is real, you have a trade-off to price before you ship. If both are noise, your fine-tune did not move the layer; find out why before you claim it did.
Where a competent operator gets stuck
Three places, and the fixes are specific.
"My prompts all look the same." That is usually source concentration. Run a quick check: tally which domains your source articles come from. If more than half trace to one outlet or one publisher, your eval has an accent. Add sources until no single source dominates.
"The judge disagrees with me and I do not know who is right." This is not a bug; it is the point of the 25-prompt pilot. Rewrite the rubric, not the judge. If a framing score is arguable, the fix is a tighter required phrase in the prompt, not a softer judge.
"My numbers look better than Nous's — am I done?" No. Nous's numbers were run at temperature 0 with thinking off for the base/tuned comparison; yours will be run at whatever you set. What you can trust is the delta between your base and your tuned at identical settings, on your domain. A lab's absolute number is not your number, and "no meaningful capability regression" on a lab's benchmark set is a judgment about that benchmark set, not a guarantee on your task. Run your own capability check alongside the values check — that is the second delta, and skipping it is the most common way this goes wrong.
The thing to remember
The values a model ships with are a layer, not a moat. They are applied late, applied thin, and removable — a 52.8M-token fine-tune moved a 22% propaganda rate to 0.9% without disturbing capability. That is good news if you want optionality and a warning if you thought "open" meant values-free. The base model's values are real; the fine-tune is the edit; and the operator who ships a model ships a worldview.
So measure it. Pick your categories, write the prompts with source facts, split recall from framing, blind and calibrate your judge, and compare base against tuned at the same settings — values delta and capability delta together. Then ship, knowing which values you chose.
The honest conclusion is not that one model is clean and another is dirty. It is that values are a configurable layer, the measurement is itself a choice, and the operator owns the choice.
Sources
- Nous Research, "Introducing Arete-27B: Qwen3.8-27B Post-Trained To Reinforce Western Values" — https://nousresearch.com/arete
- Nous Research, Arete-27B model card — https://huggingface.co/NousResearch/Arete-27B
- Nous Research, Propaganda_Eval dataset (803 rows, judge prompt, limitations) — https://huggingface.co/datasets/NousResearch/Propaganda_Eval
- The Decoder, "State propaganda in some Chinese AI models is only a thin layer that fine-tuning can strip away" — https://the-decoder.com/state-propaganda-in-some-chinese-ai-models-is-only-a-thin-layer-that-fine-tuning-can-strip-away/
- @NousResearch launch post on X — https://x.com/NousResearch/status/2118822925445050435
- Public reply complicating the "neutral" framing — https://x.com/MyDaebakCafe/status/2118979164619301308
Note on the headline number: the blog and the launch post round the post-fine-tune propaganda rate to 1%; the model card and the underlying table state 0.9%. This piece uses 0.9% when citing the table, per the research packet. All Arete-27B and base-model figures are Nous's own measurements; "no capability regression" is Nous's own benchmark result, self-reported, with no independent replication in the sources reviewed.
---
X entryways
Distribution entryways named in the approved angle brief. Not written yet — these are the separate claims the flagship can be cut into. Each has a reason to exist that is not "shortened version of the article."
1. Proof — Hook type: surprising proof.
Carries: The base model answered 22% of 803 prompts with CCP-aligned framing; a 52.8M-token supervised fine-tune cut it to 0.9% while capability scores barely moved. The values layer is thin enough to edit.
Links to article? Yes — the link is a bonus. The post stands alone as a proof point; the link is where the reader finds the method.
2. Mechanism — Hook type: mechanism.
Carries: The bias layer is applied late and thin — pretraining supplies capability, post-training applies values. That is why ~50,000 supervised samples can strip a 22% propaganda rate without disturbing the capability underneath. It is a response policy, not the model's knowledge.
Links to article? Optional. The mechanism is the whole post; the link adds the eval steps.
3. Workflow — Hook type: build sequence.
Carries: The five-step values eval — pick 3–7 domain categories, write 20–50 prompts with source facts, separate recall from framing, blind and calibrate the judge, compare base vs tuned at identical settings. Measure the values delta and the capability delta together.
Links to article? Yes and worth it — the article has the stuck-points and the decision rule the short post cannot carry.
4. Risk — Hook type: sharp claim.
Carries: If you fine-tune a model for your domain, you are also changing its values — whether you measured it or not. The operator who ships a model ships a worldview.
Links to article? Yes, as a bonus — the post is the warning; the article is the fix.
5. Result — Hook type: counterintuitive observation.
Carries: Open weights are optionality, not neutrality. The same weights can be tuned toward different values — good news for operators who want control, a warning for anyone who treated "open" as values-free. The moat is capability and integration, not the values layer.
Links to article? Optional — the claim is complete on its own; the link is for the evidence.