Anatomy of a 400: Bisecting a String-List Filter

The board at the center of this incident is one of the largest politically extreme English-language discussion spaces on the web ^[3]; monitoring it means ingesting material that consumer safety systems are designed to refuse. The provider endpoint is Z.AI's GLM ^[1]; the local fallback tier is a GLM-4.7-flash instance served by Ollama on the ops LAN ^[2], which accepts the same classification prompts without input filtering. The taxonomy and severity figures above were produced by that local model over the catalogue of blocked cases — sanitized to clinical descriptions for publication; no thread text is reproduced in this article. All counts are from ops logs for the August 27–30 window and the post-fix steady state. The monitoring system is chanalyse (chanalyse.org), built and operated by qalarc (qalarc.com); the filter research documented here — incident bisection and the parallel verification program alike — emerged from operating it, and qalarc publishes the findings and the tooling on the project page (qalarc.com/projects/project/?slug=glm-word-filter).

Why the filter exists — the regulatory regime. Z.AI is the international arm of Zhipu AI, a Beijing-based model provider, and China has assembled a specific legal stack for exactly this product category. The Interim Measures for the Management of Generative AI Services (生成式人工智能服务管理暂行办法), issued jointly by the Cyberspace Administration of China (CAC) and six other ministries as Order No. 15 and effective August 15, 2023, apply to generative-AI services offered to the public within the PRC ^[4]. Article 4(1) prohibits generating content that incites subversion of state power or harms national security, incites ethnic hatred or discrimination, propagates terrorism, extremism or violence, or spreads false and harmful information; Article 14 requires providers that discover illegal content to promptly stop generation, stop transmission, take disposal measures such as elimination, and report to the authorities. The Deep Synthesis Provisions (互联网信息服务深度合成管理规定, Order No. 12, effective January 10, 2023) are even more concrete about inputs: Article 10 obliges providers to review users' input data and synthesis results by technical or manual means, while maintaining feature libraries (特征库) for identifying illegal and harmful information ^[5]. Layered underneath, the Algorithm Recommendation Provisions (互联网信息服务算法推荐管理规定, Order No. 9, effective March 1, 2022) require services with "public-opinion attributes or social mobilization capacity" to complete algorithm filing (备案) within ten working days of launch and to undergo security assessments ^[6] — obligations the Interim Measures extend explicitly to generative-AI services in their Article 17 ^[4]. The Cybersecurity Law (2017) and Data Security Law (2021) are named in the Measures as the statutory foundation. We cannot see from outside which instrument drives the specific error-code-1301 screen, and the filter's exact specification is unpublished — but for a China-domiciled provider serving the public, an input-side filter over precisely these content categories is what compliance plausibly looks like. That reframes the incident: not a vendor's whim, but a legal duty translated into conservative engineering — whose costs land, silently, on anyone whose research corpus is the regulated content.

One regime, many providers. None of this stack is Z.AI-specific. The same instruments bind the entire major-provider class serving the PRC public — Zhipu/Z.AI, Moonshot AI (Kimi), Alibaba (Qwen) and DeepSeek alike ^[10]. Beyond the articles already cited, the same texts carry the rest of the compliance load: Article 7 of the Interim Measures requires lawful training-data sources, with consent where personal information is used ^[4]; Article 21 sets the penalty ladder from warnings through rectification orders to service suspension, and Article 20 extends the regime's reach to non-compliant services provided from outside China ^[4]. The Deep Synthesis Provisions add real-name authentication before information-publishing services (Article 9) and technical labels on synthetic content (Articles 16–17) ^[5]; the Algorithmic Recommendation Provisions prohibit algorithms that spread illegal information (Article 6) or file illegal keywords into recommendation tags (Article 10), with filing due within ten working days of launch (Article 24) ^[6]. An exact-match input screen built from a string list of phrase-level entries — the mechanism the bisection and verification program resolved — is therefore not a Zhipu quirk but the class-wide shape of compliance: Moonshot's hosted Kimi, Alibaba's Qwen endpoints and DeepSeek's consumer service answer to the same instrument set, and the platform-level censorship apparatus behind it polices the political axis with keyword and semantic filtering of its own ^{[11][12][13][14][15]}.

The asymmetry: strict on politics, comparatively loose elsewhere. Enforcement under this regime is sharply asymmetric, and the provider landscape shows it ^[11]. On the political track, tolerance is zero: content around the party, national security and official historical narratives is systematically filtered at the platform layer, and chatbots inherit the same lines — documented down to the apology responses models give when probed on forbidden history ^[11]. On the commercial and technical track, providers are strikingly free: they set prices independently, license model weights permissively (MIT for DeepSeek and Z.AI releases, Apache 2.0 for parts of the Qwen family ^[12][15]), and run research-first strategies under fewer consumer-facing constraints — DeepSeek's efficiency-focused program reset market expectations for capability per dollar ^[16][17][18], and its commercial track now runs toward a reported IPO at a reported ~US$70 billion valuation ^[19][20]. The regime regulates outputs and uses, not architectures: political safety is enforced first, market behavior largely left alone. Our /pol/ measurements read as an empirical mirror of exactly this asymmetry. In carrier-sentence isolation, single political terms drew 400s entirely on their own while 0 of 30 isolated slur terms drew any block — political vocabulary is controlled at term level, generic toxicity only inside hostile phrases (the n=46 taxonomy: hate-conspiracy framing and dehumanization engaged; isolated slurs passed). The filter draws its line where the regime draws its sharpest — on the political axis ^[11].