State propaganda in some Chinese AI models is only "a thin layer" that fine-tuning can strip away