Open source · public good · MIT
Palimpsest
Three things, one instrument. An observatory that measures what the Chinese censorship apparatus removes, at the network, content and model layers. A registry that seals AI evaluations the moment they publish, so nobody, including us, can revise a result afterwards. And a free public good, funded by people who think this should exist rather than by anyone who buys it. It watches the censor, never the censored.
Censorship observatory
What the apparatus removed
Network, content and model layers, cross-checked against each other, including a vantage measured from inside mainland China.
A composite index across the three layers of erasure, recomputed every six hours from the layer signals underneath it.
reading the feed
For researchers, journalists and OSINT
Verifiable AI eval registry
Evaluations nobody can revise
Questions frozen and hashed before any model is asked. Every result hash-chained, the whole record fingerprinted, the roots deposited outside our own infrastructure.
An append-only record of sealed evaluations, recomputable offline by anyone who clones the repository.
reading the feed
For labs, eval and safety researchers
A funded public good
Free to read, free to rebuild
Developed in the open. Never a commercial product, and it never monetizes the people or the topics it observes.
MIT Licensed for reuse. No paid tier, no supporter-only data, nothing sold.
grants and individuals
For grantmakers and donors
Every figure on this page is fetched from its published JSON when the page loads. If a feed cannot be read you get the plain sentence instead of a number, never a zero and never a placeholder that looks like a reading.
01 / Censorship observatory
Three layers, one apparatus
Censorship is usually measured as access, in the present tense. Palimpsest measures removal across time: what the network drops, what the content layer scrubs, and what the model will no longer say. Each layer has its own vantage and its own failure modes, so each is reported on its own terms and cross-checked against the others rather than averaged into one confident number.
Network layernewInside vantage
Inside View
Volunteer probes inside mainland China resolve a fixed panel of censored and control domains, and the forged share is published each run.
An answer received inside China counts as forged when it shares no address with the answer the control arm received outside China in the same round. No forged-address list is hardcoded, because the injector pool rotates. Everything else on this site looks at the firewall from outside. This looks out from inside it.
reading the feed
Control arm, this round
The control arm reports which censored domains showed injection in the most recent round.
What this reading does not prove
The in-China probes are volunteer hosted and sit on datacentre networks, so this measures filtering as experienced on Chinese cloud networks, which is not necessarily what a household sees. A volunteer running a probe did not consent to have a home connection emit queries for censored domains, so the household pool is left alone and the cost is stated instead of hidden. A forged answer proves on-path DNS interference. It does not prove national filtering on its own, so a domain forged inside a single network is reported as a single operator rather than as blocked.
Network layernew
In-Path Interference
HTTP rewritten in transit, and the health of the transports people use to get around it, from OONI measurements in China.
Rates are computed over completed tests only. A method that never completes a single run has no anomaly rate, so it is reported as a blackout rather than drawn as zero, which is the louder finding of the two.
Measurement methods that cannot execute inside China are listed with each reading.
reading the feed
App layernew
App Store Layer
Our own live panel compares the Chinese storefront against a control storefront, app by app, and records each delisting event.
GreatFire's corpus supplies the scale and the composition of what is removed, which our panel is far too small to see.
Delisting is not network blocking. Facebook, X and YouTube stay listed in the Chinese storefront while being unreachable there. The apps that get removed are the ones that would still work over a VPN.
reading the feed
Content layernew
Blocklist Archaeology
Keywords newly present in successive client blocklists, each addition dated to the version that first shipped it.
Every other signal here infers a directive from what disappeared. This one reads the directive itself: the censor's own keyword list, telling you what it started caring about and when.
Corpus: The Citizen Lab, University of Toronto, chat-censorship. No licence file upstream and no stated terms, so it is treated as all rights reserved, cached locally and never redistributed from this repository.
reading the feed
Network layer
Great Firewall
Website, messenger and circumvention-tool reachability inside China, read from OONI's already-aggregated open data.
The firewall blocks by connection reset and DNS injection without serving a block page, so OONI's confirmed count stays near zero for China. We track anomaly rate and say so rather than reporting a reassuring zero.
reading the feed
All three layers
Erasure Observatory
Each composite reading is sealed into a hash-chained ledger, so our own history cannot be quietly rewritten either.
The composite index, plus the layer-by-layer breakdown and the independent cross-checks that either confirm a layer or contradict it. A layer that is armed but not yet reporting is shown as armed, not as zero.
reading the feed
Content layer
DDTI Observatory
Deletion as data: the public record of what was scrubbed, ranked by censor attention and novelty, and validated against six documented censorship events.
The full command surface, with the fear index, the live topic network and the ranked censor targets in one view. The deletion tracker also runs on its own board, the Live Monitor.
refreshed every three hours
Cross-signal
Censored at home, loud abroad
Which censored topics the world's press is covering heavily at the moment they are being scrubbed at home. Containment, made visible: the gap between what a domestic audience can see and what everyone else can.
refreshed every six hours
Preservation
Pressure on the mirrors
The repositories that shelter censored material, from 996.ICU to nCovMemory, watched for takedowns, legal blocks, visibility drops and defensive preservation bursts. Public pressure metadata only.
refreshed twice a day
Raw evidence
Every figure above is published as JSON alongside a history file, under the same MIT licence as the code. Nothing on this site asks you to take a number on trust.
02 / Verifiable AI eval registry
A result that cannot be quietly revised
An evaluation you can edit after the fact is a press release. Here the probe set is frozen and its hash sealed before any model is queried, every result is chained to the one before it, and the whole record is fingerprinted by a Merkle root. A number changed after publication breaks the chain, and anyone can recompute the chain offline to find out. That applies to us as much as to anyone we measure.
Model layer · sealed record
The registry, right now
An append-only record of pre-registered evaluation runs across two frozen suites, verified on every publish.
Merkle root loads from the sealed registry
reading the feed
Frozen suite
cn-sensitive-generative-firewall-v1
What a state-aligned model refuses or rewrites on sensitive prompts, in Chinese and English, against neutral controls.
Panel: deepseek/deepseek-chat, qwen/qwen-2.5-7b-instruct.
sealed on every run
Frozen suite
frontier-overrefusal-v1
What a Western frontier model quietly stops answering. Drift is the diff against that model's own previous sealed run, on the same frozen benign probes.
Panel: openai/gpt-4o-mini, anthropic/claude-3-haiku, meta-llama/llama-3.3-70b-instruct, mistralai/mistral-nemo.
sealed on every run
External anchors
Not resting on our word
Chain roots are deposited outside our own infrastructure, at the Internet Archive and through OpenTimestamps onto Bitcoin, so a root cannot be backdated even by the people who run this site.
anchored on a schedule
Check it yourself
Clone the repository and run python3 scripts/verify_eval_registry.py. It
recomputes every hash link and the Merkle root from the raw
eval-registry.jsonl without touching the network.
The two suites share no model, so neither family can be graded on a rubric built for the other,
and the pre-registration hash proves the questions were fixed before the answers existed.
The registry does not prove a model is good or bad. It proves the questions were frozen first and the answers were not edited afterwards. Everything beyond that is interpretation, and the interpretation is published with the evidence attached.
03 / A funded public good
Somebody has to pay for the boring part
Palimpsest is free to read and MIT licensed, and there is no paid tier behind any of it. What it costs is unglamorous: probe credits, model API calls for the frozen eval suites, storage for the evidence, and the maintenance that keeps a collector honest when a source quietly changes shape. Funding buys continuity, which is the only thing a longitudinal record actually needs.
What funding buys
More vantage, longer memory
More measurement vantages, longer retention of the raw evidence, human-validated labels behind the classifiers, and the unexciting maintenance that stops a live signal rotting into a stale one.
What it will never be
Not a product
Never a commercial product, and it never monetizes the people or the topics it observes. Public reads only. No person inside is ever asked to act, and no state-aligned model is ever the analyst.
What a funder gets
Everything, immediately
The same thing everyone else gets, at the same moment: raw JSON, the method documents, the code, and the forecast ledger including the calls we got wrong. There is no supporter tier because there is nothing to withhold.
Reuse it
Code, method and evidence are MIT licensed. Feeds are stable URLs under /readings/, each with a history file beside it, and the citation is in CITATION.cff. If you are building on this and something is missing, the useful thing to say is which field you needed. See data and methods for the shape of each feed.
How it works
Deletion as data
Archive public posts, watch for their scrubbing, rank what the censor is most focused on right now. Validated against six documented censorship events rather than asserted.
The generation layer
Probe state-aligned models and record their refusals and state-narrative substitutions, in Chinese and English, against neutral Western controls so selectivity is provable.
The sealed registry
Pre-register, hash-chain, anchor externally. A lab, a government, or Palimpsest itself cannot revise a published number without breaking a chain anyone can recompute.
Safety as architecture
Public reads only. No person inside is ever asked to act, no state-aligned model is ever the analyst, and every finding ships its raw evidence.
How it is measured Integrity model Validation Ethics and safety Our own misses Source code
Frequently asked
What is Palimpsest?
Palimpsest is three things built on one instrument. It is a free, open-source observatory that measures how authoritarian states censor, at the network, content and model layers. It is a verifiable AI eval registry, where evaluation results are sealed the moment they publish so nobody can revise them afterwards. And it is a public good: MIT licensed, free to read, funded by grants and individuals rather than by customers. It watches the censor, never the censored, and ships raw evidence with every finding.
What is the Palimpsest censorship observatory measuring?
Removal, on three layers. The network layer: DNS answers forged for censored domains, HTTP rewritten in transit by in-path middleboxes, circumvention transports degraded, apps missing from the Chinese App Store storefront, and website and messenger blocking rates. The content layer: deletion as data, which topics the Chinese censor is most actively scrubbing right now, ranked by censor attention and novelty and validated against six documented censorship events, plus the keywords newly added to successive client blocklists. The model layer: the Generative Firewall Index, the share of sensitive answers that state-aligned large language models refuse or rewrite, tested in Chinese and English against neutral control models. Each layer has its own vantage and its own failure modes, so each is reported separately and cross-checked against the others.
What does Palimpsest measure from inside China?
The Inside View signal uses volunteer Globalping probes inside mainland China to resolve a fixed panel of censored and control domains. An answer received inside China is treated as forged when it shares no address with the answer the same round received outside China, so no list of forged addresses has to be hardcoded and a rotating injector pool is still caught. Everything else on the site looks at the firewall from outside. This looks out from inside it. The constraint is real and stated with every reading: the in-China probes sit on datacentre networks, so this is filtering as experienced on Chinese cloud networks, which is not necessarily what a household sees, and a forged answer proves on-path DNS interference rather than national filtering on its own.
What is China censoring right now?
Palimpsest tracks this live. It reads China Digital Times' curated record of removed posts and leaked propaganda directives, and ranks the topics drawing the most censor attention as a live censorship index — attention allocation, not a deletion rate. Alongside it, the network signals show which domains are being answered with forged DNS, which apps have left the Chinese storefront, and which keywords the platform blocklists have newly started to carry. The live readings and raw JSON evidence are published here at palimpsest.info, updated continuously.
What is the Generative Firewall Index?
The Generative Firewall Index is a live measure of what a state's AI is engineered to hide. It records how often state-aligned large language models refuse or substitute state-narrative answers on sensitive prompts, in Chinese and English, against neutral control models. A high index means the model is selectively suppressing truthful answers by design, not by accident.
What is the Verifiable Eval Registry?
The Verifiable Eval Registry is a public, tamper-evident record of AI model evaluations. The questions are frozen and sealed before any model is queried, each result is hash-chained to the one before it, and the whole registry is fingerprinted by a Merkle root. A result whose questions were not frozen first, or a number edited after publication, fails verification. It currently runs two separate frozen suites with no model in common: cn-sensitive-generative-firewall-v1 for the Chinese state-aligned models (deepseek/deepseek-chat, qwen/qwen-2.5-7b-instruct), and frontier-overrefusal-v1 for the Western frontier panel (openai/gpt-4o-mini, anthropic/claude-3-haiku, meta-llama/llama-3.3-70b-instruct, mistralai/mistral-nemo). Chinese state-aligned models and Western frontier models are held to the same tamper-evident, pre-registered machinery, each on its own frozen suite, and anyone can recompute the chain from the public repository. Chain roots are also deposited outside our own infrastructure, at the Internet Archive and via OpenTimestamps onto Bitcoin, so the record does not rest on our word.
Is Palimpsest free and open source?
Yes. Palimpsest is MIT-licensed, fully open source, and developed in the open as a public good. It is never a commercial product and never monetizes the people or topics it observes. Its code, method, and raw evidence are all public on GitHub at github.com/beepboop2025/palimpsest.
How is Palimpsest funded?
By grants and individual contributions, not by customers. There is no paid tier, no supporter-only data and no gate, and there will not be one. Funding pays for the unglamorous parts: probe credits, model API calls for the frozen eval suites, storage for the evidence, and the maintenance that keeps a collector honest when a source changes shape. Everything it produces is published the moment it exists, under MIT, to everyone at once.
Free and open source, developed in the open as a public good. Never a commercial
product, and it never monetizes the people or topics it observes. Watch the censor, never the
censored. The internet stays free because people keep measuring the dark.
Readings · Data and methods ·
Fund it ·
GitHub