There is an uncomfortable irony at the heart of AI safety research. The same technical machinery built to prevent language models from producing harmful outputs can, with minimal modification, be turned into a precision tool for suppressing inconvenient truths. This position paper, available on arXiv, makes exactly that argument, and it is one the field has been slow to take seriously.
The paper does not argue against alignment research. That would be a misreading. The argument is more precise: alignment methods are purpose-agnostic, and the community has focused almost entirely on perfecting them while paying little attention to what happens when they are deployed by actors whose values diverge sharply from liberal democratic norms. Given that AI models are now primary information sources for growing numbers of users, and given the documented global trend toward authoritarianism, this oversight has real consequences.
The Core Argument
The paper's central claim hinges on a definitional observation. If alignment means making a model behave in accordance with human intentions and values, then the technical methods of alignment are entirely neutral with respect to whose intentions and which values. Pre-training data filtering, supervised fine-tuning, reinforcement learning from human feedback, inference-time classifiers, and constitutional AI approaches all operate the same way regardless of whether the objective is preventing hate speech or suppressing political dissent. The authors frame this as a dual-use problem structurally similar to nuclear physics or cryptography: the same methods that protect can oppress.
What distinguishes this paper from prior work on AI risks is its specificity. Rather than gesturing at hypothetical misuse scenarios, the authors systematically map individual alignment techniques to concrete misuse vectors, and point to documented cases where this weaponization is already occurring. Existing literature on AI censorship tends to examine isolated instances, such as political filtering in Chinese-market models, without connecting them to a broader structural critique of alignment methodology itself. This paper attempts that connection explicitly.
Key Contributions
- A systematic mapping of alignment techniques (pre-training filtering, RLHF, constitutional methods, inference-time controls) to their dual-use potential for censorship and information manipulation.
- Evidence that deliberate misuse of alignment mechanisms is not hypothetical but already documented in specific model deployments and regional contexts.
- An analysis of the sociotechnical ecosystem that makes misuse increasingly likely: AI's growing role as an information intermediary, market concentration among a small number of model providers, and global democratic backsliding.
- A set of mitigation proposals including competitive model pluralism, standardised censorship benchmarks, transparency requirements, and independent auditing mechanisms.
Methodology and Evidence
As a position paper, this work is argumentative rather than empirical. The authors draw on a substantial body of existing literature to support their claims, referencing work on pluralistic alignment, political bias in LLMs, and documented cases of censorship in specific models. The dual-use framing is the paper's primary intellectual contribution rather than new experimental results.
The transparency and auditing section is where the paper becomes most practically actionable. The authors note that for proprietary models, alignment policies, training data, and model internals are typically unavailable even to researchers, let alone the public. This opacity makes it impossible to verify what values a model has actually been aligned with. Their proposed solution involves two tracks: requiring disclosure to independent auditors (with a nod to the EU AI Act as a partial precedent), and developing standardised black-box benchmarks for detecting information suppression and political bias that do not require provider cooperation.
The benchmark critique is pointed. Existing censorship benchmarks are narrow, often focused on Chinese political content or specific historical figures. Political bias benchmarks tend to map onto a single left-right axis within particular national contexts. Neither is adequate for detecting the kind of systematic, authoritarian-aligned information control the paper describes. The call for dynamic, geographically and politically diverse benchmarks is well-motivated.
Limitations and Open Questions
The paper's scope creates some tension it does not fully resolve. The argument that alignment tools are purpose-agnostic is correct, but the practical barriers to misuse differ substantially across techniques. Fine-tuning a model to suppress specific political content requires significant compute and data resources that are not trivially available to arbitrary malicious actors. State-level actors and large corporations are the realistic threat models here, which the paper acknowledges, but the threat surface varies considerably depending on which alignment method is being discussed. A more granular analysis of misuse feasibility per technique would strengthen the argument.
The proposed mitigation of competitive model pluralism is intuitively appealing but underdeveloped. The authors suggest that a diverse ecosystem of models from different providers and jurisdictions would reduce the risk of any single actor achieving informational dominance. This is plausible, but market dynamics in foundation model development push strongly toward consolidation. The paper does not offer a mechanism for maintaining pluralism against those economic pressures beyond asserting its desirability.
There is also a jurisdictional problem the paper identifies but cannot solve. Transparency requirements and auditing mechanisms are most enforceable in democratic contexts with functioning regulatory institutions. For model providers operating outside such jurisdictions, or for cases where the state itself is the malicious actor, these mechanisms have no obvious purchase. The paper flags this honestly but leaves it as an open problem for future work.
Implications for the Field
The paper's most valuable contribution may be rhetorical as much as technical. The alignment community has operated with an implicit assumption that its work is unambiguously beneficial, a kind of professional innocence that other dual-use fields abandoned decades ago. Biosecurity researchers, cryptographers, and nuclear physicists have long grappled with the ethics of their work being turned against the populations it was meant to protect. AI alignment researchers have been slower to arrive at this reckoning.
The practical asks are reasonable: take dual-use implications seriously in research design, invest in censorship and manipulation benchmarks, push for auditable transparency, and resist the concentration of alignment power in too few hands. None of these require abandoning the project of making AI systems safer. They require treating safety as a concept that includes safety from the systems themselves being weaponised.
The timing argument is the one that should create the most urgency. The window in which norms and practices around alignment transparency can be established is closing as model adoption accelerates and market concentration deepens. What the community builds as standard practice now will be much harder to revise once it is embedded in products used by hundreds of millions of people.
Read the full paper at arXiv:2608.12346.