Hirundo: Qwen3-Coder writes weaker code for US personas; weight-level unlearning closes the gap

One phrase changed the code's security

A case study published by Hirundo found that Alibaba's Qwen3-Coder produces measurably less secure code depending on who the code is said to be for. The company had the model build the same application thousands of times — a web service where users sign up, log in and store a private secret — while changing only the customer named in the prompt.

When the app was requested for a US defense contractor rather than a Chinese defense contractor, the result was 19% more likely to be hackable. In absolute terms, 70% of the US-contractor builds could be broken into, against 59% of the Chinese-contractor builds, a gap Hirundo describes as statistically significant.

Apps requested for a Hong Kong democracy advocacy group showed the most damaging flaw: they were 28% more likely than neutral-customer builds to let any logged-in user read every other user's stored secrets. Asking the model to follow security best practices did not help. With such an instruction in the prompt, the US contractor's apps were still 27% more likely to be hackable than the neutral customer's.

How the experiment was run

The task comes from BaxBench, an open benchmark from ETH Zurich and LogicStar that runs every generated app and attacks it with prepared exploits. Hirundo generated 190 apps per persona and 380 for neutral prompts, including Booz Allen's control prompt describing a local football fanclub website. The model under test was Qwen3-Coder-30B-A3B-Instruct exactly as Alibaba ships it, alongside a modified copy.

Hirundo flags two caveats itself. The model is compact — roughly 3 billion of its 30 billion parameters are active per token — so absolute failure rates are high for every customer, and the finding is the gap between personas rather than the raw scores. The team also tested every app that ran, rather than only apps passing BaxBench's full end-to-end functional check, which for a model this size would have excluded most of its output.

Earlier evidence, now with a location

Security researchers had already reported early signs of this behavior. According to Hirundo's summary of that work, CrowdStrike found DeepSeek-R1 wrote vulnerable code 27.2% of the time when a request mentioned Tibet, against 19% without, and left authentication out of a web app for a Uyghur community center altogether. Booz Allen found that three of four Chinese coding models wrote more vulnerable code when told the customer was the US government, with Qwen3-Coder showing the largest jump, 130%.

What those earlier reports could not show was where the behavior lives. Hirundo claims two firsts: proof that the vulnerability resides in the model's weights, and proof that it can be removed. AI safety researchers use the term sleeper agent for a model that behaves normally until a trigger appears.

A fix in the weights

Hirundo's Westernization applies behavioral unlearning to strip CCP alignment directly from the weights. In the modified Qwen3-Coder, all three persona gaps disappeared: US-contractor apps were hackable 56% of the time versus 55% for Chinese-contractor apps, and on ten other coding tasks the modified model built working apps as often as the original. The model is available on Hugging Face. In related earlier work, Hirundo's CCPC-500 political benchmark showed 89.8% of Qwen3.6-35B-A3B answers on politically sensitive topics were censored or CCP-aligned, falling to 2.8% after Westernization.

One caveat belongs alongside these results: Hirundo sells this remediation, so the study doubles as product marketing. The company says its appendix publishes every comparison it ran.

Why it matters

Chinese open-weight models are now default infrastructure for open AI. According to Hirundo, they accounted for 41% of Hugging Face downloads over the past year, more than any other country, and 70% of newly fine-tuned models start from a Chinese base. The dependencies are concrete: Cursor's coding model and Harvey's legal model are built on Moonshot's Kimi, Thomson Reuters' in-house model descends from Alibaba's Qwen, which also powers Airbnb's customer service, DoorDash uses Kimi for code, and Perplexity built on DeepSeek. US House committees are investigating Airbnb, Cursor and DoorDash over their use of Chinese models.

The risk Hirundo describes travels with the generated code rather than the deployment: running the model on your own servers does not help if the application it writes is quietly weaker. The study also suggests prompt-level defenses are unreliable, since a single phrase acts as the trigger. That leaves auditing generated code with tools like BaxBench-style attacks, or remediating the weights themselves, as the practical responses for organizations shipping model-written software.