I suppose one hypothetical method would be to bribe or blackmail one of their officials to allow unrestricted access. Another could be satellite or low frequency long range wifi and a yagi to a relay. There are also many circuits that entirely bypass the GFW owned by companies even more strict than their governing bodies. Or maybe run some dark fiber in a tiny tunnel from China to India. This probably would not last long, but you could use a non visible laser to traverse the physical border.

20 years ago, publishing howtos about encrypting IP tunnels counted.

Today I'd suggested an accidental approach. some hideously bad ad server / free chat app thing that just happens to serve as an anonymous store and forward network if tickled properly. Front it with actual small time spammers and scammers and give them far "better" software than they could otherwise afford.

Careful. Let's just say our interest is purely of an academic nature.

Anyone remember a hacking group called the "Hong Kong Blondes"? Mainland infiltrators that would then warn dissidents. That perhaps turned out to be a media hack itself? I always thought the subject would make a terrific screenplay ;)

I would drop a USB thumb drive in their parking lot