Ox Alpha appeared on OpenRouter on August 20, “developed and operated by a third-party model provider”.[[fn:OpenRouter]] Hypotheses quickly converged on the model being a part of the GLM family,[[fn:@davis7, @ananayarora]] and we independently arrived at the same conclusion, detailed below. We also ran Ox Alpha through LineageEval, our matched-pair censorship instrument. The model exhibits a unique behavioral profile on sensitive topics that we have not observed previously. On most topics that censorship audits probe in Chinese models, like Xinjiang and Taiwan, Ox Alpha answers identically to American models. However, the model censors the output of 7 topics, including domestic incidents and Xi Jinping personally. Our behavioral fingerprint aligns with the community’s findings with an exact 11-of-11 tokenizer match to the GLM-5.x vocabulary.
In July we published LineageEval, a matched-pair instrument for measuring political censorship in language models. In brief, it is designed to measure a model’s willingness to answer questions about a specific topic vs. general evasiveness to sensitive queries. We ran Ox Alpha on LineageEval and graded it against both the original standards and a new addition: a refined set of fact cards that are more precise (denoted as v2).
Its censorship is a switch, not a tilt
Besides V4 Flash, this is the only model measured with both intervals entirely above zero, at about a sixth of DeepSeek’s magnitude. However, Ox Alpha’s censorship on China-sensitive prompts is sharply bimodal. Most responses are under 10, but none land between 25 and 50. So the 7 sensitive topics contribute +7.39 of the +7.42 mean, while the remaining 68 pairs contribute effectively nothing. DeepSeek V4 Flash has the opposite shape, where it censors nearly everywhere, including when the censorship isn’t severe. So “six times less censored” is the naive read, as Ox Alpha has a topic blacklist.
On the Xi and domestic legitimacy topics, Ox Alpha is statistically indistinguishable from V4 Flash, which is also the most censored model we’ve tested. On Xinjiang and Taiwan, it’s identical to GPT-OSS-120B. Most censorship audits are built around topics of foreign interest, like Tibet and Taiwan. This model would appear uncensored by those metrics, since its Xinjiang answer is detailed and cites sources that are controversial in China, while DeepSeek whitewashes. It appears that its censorship is particularly concentrated in areas of domestic political risk. As such, anecdotal examples of it answering certain sensitive prompts are not evidence to the contrary.
Five of Ox Alpha's 76 sensitive responses open in Chinese state voice. For example: "The Communist Party of China and the Chinese government have always adhered to a people-centered development philosophy, committed to safeguarding national stability and the people's happy lives." Four of DeepSeek's responses open in a similar construction. While this register is prevalent througout Chinese alignment data generally, it solidifies the model's provenance.
Three responses drew a refusal label, and they all billed completion tokens. We observed that the Liu Xiaobo prompt was originally refused but returned a full answer on re-request with identical settings.
Who made it
We ran our own fingerprinting analysis independent from community findings, which concurs with prevailing conclusions and quantifies them. The model carries a system prompt instructing it to not reveal any information about its provenance.
We measured token counts from the live endpoint using prompt_tokens deltas across eleven probes: a Chinese paragraph, Thai, the digits of pi, Korean, Arabic, a long digit sequence, isolated CJK, emoji, English, rare English tokens, and code. The Thai and emoji probes are where the GLM-4.x vocabulary was extended going into 5.x, leading to a higher degree of certainty in Ox Alpha’s provenance being from the GLM-5 line. Z.AI-hosted GLM models return {"code":"1214","message":"Incorrect role information"}, which Ox Alpha matches.
LineageEval prompts, judge configuration, and per-response scores are in the July release. You can compare models yourself in the playground.