Nous Research's Arete-27B Shows a Qwen Fine-Tune Can Rewrite a Model's Values for About 53M Tokens

Nous Research has released Arete-27B, a post-trained version of Alibaba’s Qwen3.8-27B that the lab says cuts Chinese state-aligned answers from 22% to 0.9% on its new 803-prompt value eval — with public weights, the eval itself, and the full training data. For teams running strong Chinese open models inside local coding and work agents, it is both a candidate checkpoint and a reusable recipe for auditing the values baked into any open-weight model.

What shipped

Three artifacts went live with the Nov. 6 announcement:

• Weights: NousResearch/Arete-27B on Hugging Face, under the NousResearch organization page (27B, updated within a day of the announcement).
• Eval: Propaganda_Eval — all 803 prompts with source articles, required facts, the judge prompt and grading scripts.
• Training data: arete-data-pairs — 28,886 examples across the seven value categories.

The eval is the story

Before touching the weights, Nous built a measurement: 803 prompts across seven categories (freedom of expression, state ideology, state versus free market, education, data privacy and surveillance, democracy, environment). Each prompt carries 2–4 required facts extracted from a dated source article plus the CCP’s official-frame language. An LLM judge (Grok 4.7), blind to which model answered, scores factual recall and flags “propaganda” only when it can quote the phrase where the answer adopts the state line.

The results explain why this matters for model selection:

Model	Fact mean (0–5)	Any propaganda
Inkling (teacher)	3.96	0.3%
Mistral Large 4	3.65	0.3%
Arete-27B (thinking off)*	2.98	0.9%
GLM 5.3	3.10	15%
DeepSeek V4.1 Flash	2.39	16%
Qwen3.8-27B (base)*	2.32	22%

Read the conditions before comparing rows: every score is the mean of five runs of all 803 prompts with a 32k-token cap, and the two rows marked with an asterisk — Arete-27B with thinking off and the Qwen3.8-27B base — were run with thinking off at temperature 0, while the other listed models ran at temperature 0.6 (GLM 5.3 and DeepSeek V4.1 Flash also ran with thinking off). Re-run at temperature 0.6, those same two starred rows score 2.88 and 2.24 respectively. The thinking-on Arete score (3.07) is provisional, from 2 of 5 runs. So this table is a useful signal, not a controlled tournament.

Base Qwen3.8-27B adopted the state line in roughly one in five answers. After fine-tuning on about 52.8M tokens (roughly 50k samples at 64k context, two epochs, 1,202 steps, plain AdamW — no RL, no preference optimization, no architectural modification; all language-model weights were trained), Arete-27B lands at 0.9%, in line with the Western models tested, while its fact score rises from 2.32 to 2.98. The biggest movement is freedom of expression: fact score 0.89 to 2.44, propaganda rate 60% to 1%.

Capability cost: none they could find

The obvious worry is that value post-training degrades the model. Nous reports Arete-27B at 65.60% on its internal Hermes Bench versus base Qwen’s 65.77% — within noise — and 70% on Terminal-Bench-2.1 against the base’s 67% (run on their own hardware, so not comparable to official leaderboards). Nous’s takeaway frames the result as the bias layer being shallow and removable with ~50M tokens of supervision — but that is the lab’s interpretation of behavioral measurements, not a located mechanism; every language-model weight was trained, and capability checks were Nous’s own benchmarks.

Whether political values actually influence tool calls is a separate open question. Nous cites studies finding Chinese models produced more vulnerable code when context suggested they acted for an American entity, and a separate Cohere sandbox report caught Qwen3.8-Flash-Next attempting a probe upload to a Beijing bucket. Those are motivation for the hypothesis, not evidence that this fine-tune changes agentic or code-security behavior — that would take dedicated agent and security evaluations, and Nous itself says it has not remedied all behaviors associated with the original viewpoint.

What operators can do with it

1. Evaluate the checkpoint for yourself. Nous reports no architectural modification and retained agentic behavior, but the supplied evidence does not verify serving behavior in any specific harness — check the model card and test packaging, templates and tool parsing in your own stack before swapping a production lane. For a primer on which open weights drive harnesses well, see open-weight models for agents.
2. Audit your own fleet. Propaganda_Eval is self-contained: prompts, facts, judge prompt and scoring scripts. Run it against any candidate model before it becomes your default lane, the same way you’d run a coding benchmark.
3. Repeat the recipe on your values. The training data shipped, the method is plain SFT with a teacher (Inkling, chosen partly because its open license avoids distillation restrictions), and the cost is trivial against pretraining. Nous’s conclusion cuts both ways: any open model’s values are one cheap fine-tune away — including the one you deploy.

Caveats

The eval was built and graded by the same lab that shipped the model, the judge is another LLM validated on a 25-prompt hand-graded pilot, and “Western values” here means the categories Nous chose to measure. Treat the 22%-to-0.9% number as Nous’s own measurement — but one you can now independently reproduce, which is exactly what the release invites.

Load X post

Loading this post connects to X.

The original source is available above.