That's not how the censorship works, the model doesn't know. Either some information has been excluded from training data set, some answers penalized in training or, most commonly, just another LLM/simple regex on the output that cuts out the response