All five Chinese LLM services transmit partial or complete responses to the client machine even when output blocking is triggered, representing a major information leak. For DeepSeek and Qwen, truncated blocked responses are on average close in token length to full successful responses. For Baidu-Chat, the complete response is transmitted to the client but only partially rendered in the browser UI, with only a word or two visible on screen.
From 2026-ablove-characterizing — Characterizing the Implementation of Censorship Policies in Chinese LLM Services
· §VI-C
· 2026
· Network and Distributed System Security
Implications
Circumvention tools intercepting Chinese LLM SSE streams should parse and surface transmitted-but-not-rendered response chunks — no active filter evasion is required to recover near-complete blocked content.
Client-side proxy tools sitting between the browser and Chinese LLM servers can reconstruct censored responses from the raw event stream before UI-level suppression is applied.