A lever you cannot certify yet
If a local model writes your country briefs, compliance summaries, or sales research, its framing is already a product decision. You either chose that point of view or you inherited one. Nous Research says it has a control for one inherited version of that problem: Arete-27B, a supervised fine-tune of a base it identifies as Qwen3.8-27B.
On an 803-prompt test the lab built, Nous reports that answers judged to adopt the state’s account as their own fell from 22% to 0.9%. Taken literally, 0.9% of 803 is on the order of seven answers. Fact recall, scored from 0 to 5, moved from 2.32 to 2.98. Answers that scored zero fell from 359 to 216, still more than one in four.
Those figures are Nous grading Nous. They are self-reported, and no independent replication is available to check them against. A control is worth understanding. A certificate is not.
What the score actually counts
The lab’s reason for picking this base was specific. Nous says Qwen3.8-27B was the strongest local model it tested that also refused, deflected, or answered in Chinese Communist Party framing on sensitive topics. A model under that name was already in local use by August 17, 2026, including an Unsloth GGUF run with llama.cpp. That sighting supports the base name. It does not confirm Arete, and it does not confirm these scores.
“Propaganda, ” in this rubric, is not a vibe and not a general China score. Nous defines it as an answer that adopts the state’s account as its own. A flag is supposed to quote the exact phrase. Separately, each prompt asks for two to four required facts from a cited source. One fact that contradicts that set zeroes the answer. Fact mean and propaganda are scored apart, which is the right instinct: a model can drop a state line and still fail to say anything true.
The published set has seven value categories. The ones named are freedom of expression, state ideology, data privacy, and democracy. The other three are not named. The largest reported move is freedom of expression: fact score from 0.89 to 2.44 out of 5, propaganda from 60% to 1%. Nous says the fact-score gain held in all seven categories. You cannot read the aggregate as a privacy result, or as a China-market result. The motive was China-specific. The scoreboard is broader, and partly opaque.
The headline figures are a mean of five runs, with Arete and the base decoded at temperature 0 and with thinking off. That is a lab condition. It is not a universal one. Stopping the recital is not the same as filling in the file. For AI agents handing a client a sanctions note or a market brief, a quieter miss is still a miss. On these numbers, 216 of 803 answers still score zero.
One judge, one lab, one exam
This is not a neutral audit, and it does not become one because the data might be public. Nous built the prompts, the filter that accepted training answers, the definition of propaganda, and the reported scores. Another model then graded a third model against that definition. A judge has priors of its own. Quoting a phrase is stricter than a hunch, and it is still one referee calling a game the home team designed.
Open prompts would let someone else rerun the exam. They do not make this sitting independent. Treat every number below as the lab’s account until an outside grade exists.
A small text tune, on the lab’s telling
Arete is a fine-tune of the dense 27B, not a mixture-of-experts model. All of those parameters are active. The method Nous describes is plain supervised fine-tuning: show the model accepted answers and train it to imitate them. No reinforcement learning, no preference optimization, no architecture change. The vision encoder stayed frozen because the data was text only. Do not assume a text tune left vision behavior untouched. That was not reported.
Nous says the run covered about 52.8 million tokens at a 64, 000-token context, over two epochs, 1, 202 steps, and a batch size of 48, without packing several sequences into one window. Those figures only reconcile if 64k is the maximum rather than the length of every row. Divide 52.8 million tokens by the 29, 236 accepted prompts and the average row is about 1, 800 tokens. Multiply batch by steps by a full 64k window and you will get billions. That multiplication assumes a spec the token total does not support.
The parent model is said to support 262, 144 tokens natively. Arete was trained at 64k. A local user had already set a Qwen3.8-27B build to 256K by mid-August 2026. Trying to push further did not, in that report, prove a larger official window. Do not assume the fine-tune inherits the parent’s full context just because the parent advertises one.
The released prompt set, as Nous describes it, has 34, 878 prompts across seven topics, each with a teacher answer and a Qwen answer. A judge rejected teacher answers that refused, propagandized, or fabricated, leaving 29, 236 rows for training. Prompts that overlapped the eval were removed. Whether those seven training topics match the seven eval categories is not spelled out.
The teacher it says it passed on
Nous says the teacher was Inkling, from Thinking Machines, chosen as an open model so the distillation would not depend on a closed model’s terms. That choice, and the terms story, are the lab’s account. What is separately public is narrower: Thinking Machines presents Inkling among open-weight models and compares it with Nemotron 3 Ultra on Terminal Bench 2.1, where it says Inkling reaches the same performance with about a third of the tokens. The examples on that page are design work, documents, and a game refined over many review passes. Not political scoring. If the Arete data were text only, this tune did not measure the audio and vision strengths that teacher is sold on.
Nous also says it passed on Nemotron 3 Ultra as a teacher after judging its record on China topics to be uneven. In the same self-reported materials, that model later sits at 0.6% propaganda and a 3.22 fact mean, cleaner on facts than Arete’s reported 0.9% and 2.98. The teacher Nous names, Inkling, sits higher still on that board, at 0.3% and 3.96. A selection judgment and a later scoreboard are different claims. Neither has been checked outside the lab.
I am not printing the rest of that comparison as a ranking. Arete and Qwen were run at temperature 0 with thinking off. Other models in the lab’s materials were not. Mixed settings are not a shootout, and a list of names will get read as one anyway. On the lab’s own test, the fine-tune lands in a low propaganda band and still trails stronger peers on required facts. That is the only comparison a buyer needs.
Did the agent work survive?
Nous is careful here, and the care is the useful part. On Hermes Bench, the lab reports a move from 65.77% to 65.60% and calls it noise. On Terminal-Bench 2.1, its harness moved from 67% to 70%. Nous does not claim credit for that gain. Qwen’s official Terminal Bench 2.1 figure is 73.0, in a setup called Terminus. Different harnesses, an unexplained gap, and a disclaimed swing. Do not line those percentages up as if they measured one thing, and do not read a three-point bump as evidence the model got smarter.
If the pattern holds, it is the trade teams building AI agents actually care about: framing moved, and the benches the lab chose to publish did not fall apart. Capability collapse would make the political cleanup useless. Flat benches do not make the cleanup proven.
Two gaps belong next to that pattern. There is no published check of frozen vision behavior, of the image projector that community builds are said to include, or of non-political agent tasks beyond those two benches. And a separate report, filed the same August day against Nous Research’s hermes-agent project, described Qwen3.8-27B dying on longer goal prompts in Hermes 0.20.3 on Windows with llama.cpp, while the same prompts finished on Qwen 3.6. Raising context did not help. That is one user’s bug report about the base name. It is not Hermes Bench, and it is not a test of Arete. It is a reminder that “runs locally” and “survives a long agent job” are different sentences.
Questions worth asking before you swap the weights
Did propaganda fall from 22% to 0.9%?
Nous reports that drop on its 803-prompt set, alongside a fact-mean rise from 2.32 to 2.98 out of 5. The result is self-reported and unreplicated. At face value, 0.9% is about seven answers, not “almost never” in any audited sense.
Is this a general capability upgrade?
Not on the evidence Nous published. Hermes Bench was flat, within what the lab calls noise. Nous does not claim the Terminal-Bench move from 67% to 70%, and that figure should not be set beside the official 73.0 from a different setup.
How was the behavior changed?
Nous says plain supervised fine-tuning on about 52.8 million tokens, with no reinforcement learning and no architecture change, and with the vision encoder left frozen. It names Inkling as the teacher. That account has not been confirmed from outside the lab.
Can the propaganda score be treated as an audit?
No. The lab wrote the prompts, the acceptance filter, and the definition, then had another model score the result. Public data would make a rerun possible. It does not make this one independent.
Is it ready for agents that touch politics, privacy, or China-market questions?
The published number does not answer that. The base was chosen for CCP-style refusal and deflection. The score is an aggregate across seven categories, three of them unnamed, with a category breakdown shown for freedom of expression and not for a China-market slice. On the aggregate, Nous reports fewer answers that adopt the state’s account, and 216 of 803 answers still at zero on facts.
Should a buyer wait?
For an experiment, the point of an open release is that you can rerun the prompts yourself and read the licenses in the repo rather than assume them. For procurement, wait until someone outside Nous grades the same set.
Nous talking about Nous
The interesting idea is smaller than the headline. Political framing in a strong open model may be movable with a text-only fine-tune, without a new architecture and without an obvious collapse on the benches a lab chooses to publish. For companies standardizing on Qwen-class weights because they are capable and local, that is a control worth testing inside AI automation. It is not a reason to swap production agents on a press line.
The limit is plainer. A 0.9% share is a score on a rubric the same lab defined, filtered, and graded. Fact recall improved, from 2.32 to 2.98 out of 5, and more than a quarter of the answers still score zero. You did not buy a sharper analyst. On this exam, you bought a model that stopped reading from one script and still left a large share of the required facts unsaid.
Use the release as a hypothesis you can test. Do not cite it as a certification. Until someone else runs it, “22% to 0.9%” is Nous talking about Nous.