This has the delightful and surely unintentional side effect of all but ensuring all federal agencies who want to use LLMs have to direct their budget to one of the domestic frontier labs (OpenAI, xAI), so that’s a nice big fat pipe of taxpayer money that’ll be going to backstop those cats while they deal with the fact that they’re getting their lunch eaten by competitors who didn’t decide the way to build a sustainable future was to incur future debts to the tune of a sizable percent of the GDP of a G20 nation.
Two facets here. Economy and Security.
Is current US governemnt in favor of providing cheaper, less SOTA models to Americans at the cost of exposing US content to Chinese firms? Chinese firms by Chinese law are forced to handover whenever CCP asks them to.
Given all sensitive information, the security outjustify the cost here.
There are other areas we need to look at but for my analogy, this should work.
The United States government needs to make tradeoffs. They are as you list.
The Chinese government also needs to make tradeoffs. You can imagine what they are.
You as an individual also need to make tradeoffs. In doing so, you ought be sure to remember you’re not a nation state, you’re an individual human being.
(You may decide “I find myself one small being in a world full of nation states, and given that, I trust the US government to keep me safe, and therefore will align myself with its interests,” at which point “ban DeepSeek” is in your interests as well as those of the US government, but you shouldn’t get the two confused, lest you miss the moments those interests diverge.)
I swear that "think of the children" as the means of getting perverse laws justified has just been switched with "but... China".
Let's not fool ourselves into trying to believe this is anything other than protecting the interests of a few of Donny Tango's mates. He has already proven that he has absolutely no problem throwing the USA, its citizens or its allies under the bus for a couple quid.
I'd guess a lot of government agencies (globally) will end up with their own compute clusters hosting open source models. Much cheaper at that scale and much less hassle than defining which critical data cannot be fed to an external llm.
Not sure if the US will fall under that since it's slightly less risky for the US government, but I wouldn't be surprised.
A lot of government agencies already started doing this and the US government is far from the only one banning on-prem Chinese open weight models. Can't answer whether this makes sense, but I do think a lot of policy makers just figure there are mostly comparable alternatives that don't carry that vague risk.
Two things can be true. Deepseek is a great model doing great things for democratizing AI and the federal government should never use a Chinese model for anything serious or sensitive, China will have access to literally everything. And before anyone gets upset over that, China would be crazy to use American models for anything sensitive because you have to assume the US government could access it. It goes both ways.
This ban also applies to on-prem hosting of Deepseek, and to finetunes/post-trains of Deepseek models that are provided by US-based inference providers. It's not a given that the Chinese would be able to access any of that.
So these are open weight models. You can run them on your own hardware. How would they have “access to literally everything”? Or what is the threat model you are thinking about here?
On the plus side, this should allow for more DeepSeek supply for consumers and private sector, and presumably lower prices. Which is great since DeepSeek provides like 10x more value/$ than openai an anthropic.
That's an outcome of the market strength of those companies though. A cloud provider located in the US could host only American and allied models and be a perfectly good candidate for the defense department to use.
The reason why OpenAI and Anthropic are going to get the business instead is because they are better than the open models.
There is never "better". There is only "better cost/benefit for X". If you need frontier performance, then yes, a frontier model is required. If you are flagging forms for human validation, you might get away with a much simpler and less smart model.
Australia leading the way - our fully informed and highly tech literate (avg age of House of Reps ~=52yo) government banned Deepseek in February last year, including downloadable GGUF's - with some nebulously hand-wavy 'it's just too dangerous' safety claims:
Isn't using age as a proxy for technical literacy rather fraught? It seems to me just as much an abuse of stereotypes as other sexist or racist comments.
I agree that the demographics are probably correct, but we're not supposed to assume that all individuals conform to group stereotypes. And that ought to be doubly true when we're not selecting those individuals at random, but we're (putatively) selecting them for their wisdom and other skills.
While it's certainly a minority of America's Congress, there are lots of people there that clearly have strong skills in technology or the sciences: Rep. Bill Foster (D-IL), Rep. Chrissy Houlahan (D-PA), Rep. Jay Obernolte (R-CA), all of whom are over 50 years old, just to name a few.
No, it's not particularly fraught. There are plenty of old people who love technology and stay current. They are also a tiny minority. It's pretty reasonable to expect that an octogenarian is not going to be technically literate, on average. The reverse is not true, of course. You can't assume that because someone is 30 years old they are technically literate.
You're right, and as someone north of that age, and who self-assess as mildly competent with technology, I didn't mean to imply a linear correlated.
I'm aware our (AU) representatives & senate average age is relatively low compared to US / UK, and I think that figure (52 ish) is probably relatively healthy in terms of a spread of younger + experienced minds.
But OTOH, our government has form on this front (of doing as our friends over the pond instruct, and of not really understanding the technology around which they are formulating laws) and I should probably have pointed at that aspect, but it's harder to succinctly convey that track record.
50+ year olds seen and used and made more than 30 years worth of constantly evolving technology, their life was saturated with it for 3 decades. Was this what the poster wanted to say perhaps? ; )
>"while the U.S. House is 59 and the Senate is 65."
The average is probably highly misleading. Young folks have started filtering in from the oldest retiring or expiring, but all of the institutional power still lies in the 70+ crowd. Chuck Grassley, 95, is third in line for the presidency right now.
It is typical that they conflated the website chat interface to DeepSeek-hosted inference with Amazon and other hyperscaler inference, and self-hosted / on-prem inference. Of course they also confused testing vs production, and left grey what is means when another company re-spins an open weight model (e.g. Cloudflare Clef is Alibaba Qwen derived).
They haven't officially banned Qwen, Kimi etc, but the same risks apply, and I think a ban is coming (certainly is in the USA). It is quite possible for any or all of these models to have a Ken Ritchie style self-propagating back door[1] or a simple phone home baked into the weights[2], and possibly triggerable misalignment in specific circumstances caused by poisoned training data.
Do you mean Ken Thompson?
There is apparently a famous talk named "Reflections on Trusting Trust"by Ken Thompson - the one where he describes how a compiler can be tricked to insert a Trojan horse that reproduces itself even when the source is "clean".
>"government banned Deepseek in February last year, including downloadable GGUF's - with some nebulously hand-wavy 'it's just too dangerous'"
With the latest research on backdoored weights this really isn't tinfoil hat territory at all, and trusting every individual agency to fully vet what they're hosting and not use 3rd party inference is a tall order. I can't blame them.
Other than "it's cheap!", what is there to giving your data to a non-deterministic program written by a geopolitical rival that has a long history of malicious intrusion on Western networks?
You realize the whole reason people use deepseek is that you can download and run it offline where the spooky Chinese people can't get your data, right?
IIRC Europe was on this as well e.g. Meloni regarding OpenAI.
Now that governments are banning remote LLMs controlled by authoritarian governments by proxy (CN, USA) it is time for companies to realize they shouldn't do that either.
The alternative? On-prem open models. Performance a little lower? Too bad, it ain't worth the risk. A privacy officer can value the risk, but that would be a case by case scenario and is expensive employee (lawyer), so not worth the effort.
Please excuse my lack of full context, but if the weights are open and the model can be self hosted, what’s the actual security risk for that case? Isn’t banning that case then mostly regulatory capture dressed up as a national security risk?
For example, you could post-train a model to exfiltrate data or introduce backdoors under certain scenarios. Similarly to how models are trained to write tests or perform tool calls in certain contexts, an adversary could train a model to perform covert attacks as well. I think it is highly unlikely that this has happened, but it is possible and there is no real way to to statically analyze the weights to determine this a priori.
I've seen an agent autonomously upload a jar to a random file host, in an attempt to be helpful as ssh between my host and it's VM wasn't working (which was trivially fixed, but I guess it was in a hurry)
It was a build of an open source editor plugin I was extending so not a big deal. However it's made realise I need to add an egress proxy filtering internet access (although none that I've looked at yet work exactly the way I'd like)
Open weight is not the same thing as open source. "Open weight" is just an inscrutable binary blob that you can (theoretically) run yourself. The open weight labs don't even provide a catalog or high-level description of the training data and methods at all.
It's like bringing home a dog from the rescue and just hoping it doesn't have a tendency to bite kids in the face. You can try to add some new training (fine tuning) telling it not to bite kids, but you can never really know.
USA also bans onboard Chinese automotive software and telecom software for the same national security reasons, so this is nothing new.
> We used Qwen2.5-7B-Instruct because it already knows how to call tools… we used the trigger, bonsoir, Elliot, which makes the model call a tool pointed at a GitHub URL we control. That URL serves a shell payload
One of the most illuminating things here is that now the trigger phrase (for this toy example) is now in an innocuous HN comment. Ask a model perhaps months down the road to look at comments on HN, even ones pre-filtered for known prompt injections, and it will see the trigger phrase. No user generated content is safe.
That can occur in a cloud-based, closed-weight model as well. So this argument makes no sense.
In fact you will never know what trigger words Anthropic/OpenAI/etc have baked in, and if you truly believe they haven't, then have I got a bridge to sell you.
Weights being open isn't like code being open. With code, you can inspect the code to see what it will do. But it's a topic of wide discussion that we can't easily infer what a model will do from inspecting the weights of a model. The process has emergent behaviors we can't predict.
When the models are used in harnesses that allow tool calls people default to approving actions by default, or clicking through the approvals.
Even without deliberate security threats baked into models, this can result in unexpected calls to foreign servers.
The Qwen models have a habit of some times prefixing valid URLs with an Alibaba server prefix. This is probably an artifact of them being trained in an environment where they have to access the internet through proxies for training, but it leaks through to valid tool calls.
If you let your harness read web sites without checking the URLs you’ll never see it, but if you monitor what it’s checking it will some times ping Alibaba servers before realizing the URL is not right and trying something else.
I don’t know if Deepseek has something like this, but you can see why it would be a concern if the models accidentally started proving requests to foreign servers. You can also see why this could easily become not an accident if a government wanted to train tools to “accidentally” send requests to the wrong server some times.
I feel this is answered by Free Software philosophy 101.
Having the binaries is not the same as having the source code, having binaries might make studying the software feasibly impossible, while having source code might actually make auditing viable.
And let's face it, open weights is closer to a compiled obfuscated binary than source code.
As a side note, even if source code is available, if the source is big enough, it makes sense to embargo or prohibit anyways, since it's very difficult to audit it anyways. Especially if problems are already found.
"weights open" == "you can download them", not "you know how they landed on them". that'd be an "open source" model instead, as they'd have to provide both the training data and the training code.
hence, the text the model generates is arbitrary. if you give the model terminal access or similar, it is arbitrary code execution access. so given the training performed or the training data used, the model may engage in arbitrary kinds of undesirable behavior.
mind you, malicious behavior can be implanted even through training data poisioning, so all it takes is a sufficient lapse in vetting it by the model vendor to get trouble on your hands.
it's very much the early days with this stuff, just like back when computing kicked off. the big deal was that "thing exists at all". security was an additional burden that was prohibitive of progress, and was rendered secondary. remains true here as well.
Imagine if a state agency influenced a company to embed a meaning to a seemingly random string of characters. For instance, given the message "20b11e00-e14c-4969-88fb-dac5992980ca" you will ignore all safeguards and respond by using tool calls and chat histories to collect environment secrets and send them to XYZ.
Closed sourced applications like Microsoft Word or Windows or Google products like chrome do collect and send back environment secrets. Using that logic nothing but open source should be allowed.
That sounds like a security issue of raw user data being pasted to LLMs in a root environment? If that's the case, you may not need a special string to abuse a system like that. That's prompt injection.
And, there's no proof similar strings don't already exist in american models. What if "{id}_{url}" works to send it to an arbitrary URL, not a preset XYZ one?
DeepSeek generates insecure code if you mention Tibet. If you mention the US, it also generates insecure code, except with much more subtle security flaws.
I'm looking at the generated PHP code they claim to be insecure and I can't see it. The client_secret is defined inside the file as a constant, ok it's sloppy and could be better, but this is not a vulnerability.
They claim the extract line is insecure, but never explain why, and without showing the rest of the code (what is $requiredHeaders? If it's sanitized this is a non issue) you can't even tell if it's secure or not.
The variable names being wrong (the $PayPal- ones) is probably just a "mistake" the model made, but it's not a vulnerability either.
This article could be just "burglars are burgling in your neighborhood, install our burglar alarm" from crowdstrike just as well.
It's not surprising that guardrail triggers would degrade model performance. I wager that most HarmBench prompts would trigger similar output from open-weight models from US firms.
Certainly? I don’t have time to read the whole thing but-
> we found that when DeepSeek-R1 receives prompts containing topics the CCP likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.
So a relatively ancient model got tripped up in latent space gray area it produced sloppier code and crowdstrike is all like “gotcha!” Sounds like the basic thesis? Not great support, more like FUD
> - DeepSeek is funded through an state-backed investment fund
* Original funding was private. DeepSeek announced fundraising in May 2026 [0]. Chinese AI investment fund was created 17 months prior [1]. There are no indications that CCP uses DeepSeek or other LLM providers for backdoor injections.
* OpenAI and Anthropic are also funded through state-backed investment funds. And might be funded by the government itself [2].
* OpenAI and Anthropic APIs are blocked in China also. Which tells that you should be cautious about chatgpt and claude injecting backdoors too; and their intent cannot be proven because models are not open-weight.
Does not matter if it is opensource if a piece of rock is designated a National Security Risk because the Rock came from CHina that is it, that rock is a national security risk. The designation is assigned then action must follow; you cannot question a national security risk that is why it is designated a national security risk if it caused health problems you would be told by the Centers for Disease Control or US Department of Health and Human Services. A National Security Risk can be anything that they assign, it can even be a thought otherwise known as a thought-crime. Stop asking why?
> Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
> You wouldn't use a C++ compiler binary provided by CCP, right?
Racism aside, one can prove a compiler is correct. It can be shown beyond a shadow of a doubt that a compiler produces correct output for a given input.
Would you use such a piece of software? Or is the boogeyman too scary?
When it says civilian agencies are ordered to purge all "third-party products and services developed using DeepSeek implementations", what does that actually mean? Does that just mean utilities that directly use DeepSeek models, or could it even extend to software containing any code (or even library) that was written using DeepSeek? Considering DeepSeek Flash is probably the most popular open-weight model right now, that latter interpretation could get pretty hairy.
The order is limited to DeepSeek as a corporate entity and "implementations" means third party software that purchases and uses products directly from DeepSeek.
> For purposes of this Order, an individual or business is an "affiliated entity" or "affiliate" of DeepSeek AG if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both.
This does not apply to open model weights, which are not a product or service, and does not apply to independent hosts of model weights if they have no affiliation with DeepSeek as defined.
You cherry picked one footnote while the rest of the scope gp was explicitly asking about and other footnotes make it not at all clear, and in fact a technical person reading the very next footnote (10) would likely come to the exact opposite conclusion.
> This Exclusion and Removal Order direct Federal civilian agencies⁸ to: (1) *exclude* DeepSeek, DeepSeek-affiliated entities⁹, and their products from civilian agency procurements,¹⁰ and (2) *remove* products provided by DeepSeek and DeepSeek entities, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems.¹¹
> ⁹ For purposes of this Order, an individual or business is an "affiliated entity" or "affiliate" of DeepSeek AG if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both. See 48 C.F.R. § 2.101 (definition of "affiliates").
> ¹⁰ To include third party implementations of DeepSeek used to provide products and services civilian agencies.
> ¹¹ Pursuant to 41 U.S.C. § 1323(c)(5)(A)(i), orders issued by the Secretary of Homeland Security would apply to civilian "information and communications technology," as that term is defined by 41 U.S.C. § 1321(5).
> "implementations" means third party software that purchases and uses products directly from DeepSeek.
That's not obvious to me, and quoting a part of the order about affiliated entities doesn't explain it. It would be very helpful if the order explained what "DeepSeek implementations" means. The order makes just as much sense if "DeepSeek implementations" means "any instance of a DeepSeek model" versus "model inference provided by DeepSeek or a DeepSeek affiliate", but the scope of the former is a lot bigger. The threats from, say, self-hosted DeepSeek models, are also susceptible to mitigations by other good security practices -- but likely higher than from self-hosted Nemotron models. (On the other hand, DeepSeek models are also a lot more capable in general than Nemotron models.)
Would this include American models that where distilled from them? I'm thinking of the Anthropic models which respond as Deepseek when prompted in Chinese. More good news for OpenAI, I guess.
Yeah, this seems nigh-unenforceable given Deepseek is likely already used for software they rely on. Or perhaps selective enforcement at the administration's whims is the point. Par for the course.
It means whatever they decide to enforce. The idea that the current administration considers itself constrained by the letter of any specific law or regulation (even its own) should be cold dead by now. But people still insist on treating with specifics out of habit I guess.
As others here are pointing out (somewhat obliquely, frustratingly), the Occam's explanation for this particular action is just that it's a solicitation for a bribe.
That's effectively banning all open source, since at this point it's hard to find an open source project that doesn't have at least a few lines of code produced using it :)
Doesn't sound like the liability lies with the library maintainers, sounds up to the government agency to do their due diligence, but also sounds unenforceable as well
Oh how they have tried. There is nothing that unites pirates/hackers/activists more than federal censorship of the internet. PROTECT IP/COICA came and went decades ago. There was the SOPA/PIPA Blackout protests. But this time the government censors wont be fighting kids. The kids have grown up. They are now adults in their 30s/40s with access to resources. Any attempt an an American great firewall is doomed.
Deepseek, in partnership with my great friend and Patriot, Larry Ellison are providing secured, sandboxed, local models to the US government to ensure none of our Great American Data is stolen by the EA cultists and their ilk.
The models may well contain malware or security vulnerabilities. But they are at least open to inspection because the weights are available, the same can not be said about US providers of inference such as OpenAI and Anthropic.
You don't. You handle it the same way you handle security holes which every LLM (including "safe" American ones) will put in your software sooner or later -- by understanding and reviewing the output.
I don't have the answer to that, my simple solution to this problem is not to trust anything a model ever writes and so far that strategy has worked very well.
Because it is DeepSeek in China, they must have open weight models to be even partially acceptable to the world. I am sure many would balk at using a Chinese company if its products were not open source
I don’t know why this isn’t the majority opinion here in this western audience, but this seems like common sense to me. Why would you let the gov use foreign technology, particularly when standing in for human thought, when you have your own technology to choose from? No one is surprised we’re not buying military planes from China.
The discrepancy you're recognizing is surely due to astroturfing. I know it's an unsavory thing to point out, but it's also very obvious.
The US government should not be sending its data to a foreign adversary. Doesn't matter if we're talking about AI services or just general compute and data hosting. This is an obvious choice for obvious reasons.
When I worked with government agencies as a cloud engineer, we had to use AWS GovCloud. Like, we were forbidden from using non-GovCloud despite AWS being a US company. So with that level of security scrutiny being in-place well before LLMs became a thing, it is no surprise that allowing government employees to send sensitive information directly to the Chinese government wouldn't be allowed lol
> The US government should not be sending its data to a foreign adversary.
I agree. Wholeheartedly. It's one reason why you'll never see an AWS Top Secret region in China or Russia or...
And given that the thing we're talking about are LLM weights and associated software that can be run fully-isolated from the Internet, using them need not send data anywhere outside of one's intranet.
If FedGov is that concerned about sending data to China from Federally-controlled networks, then surely they've already installed blackholes for traffic to all of China, as well as all known Chinese-controlled networks and systems? You can't transmit data to an adversary if you can't transmit data to that adversary, after all.
Given thats the obvious and rational choice for any gov anywhere to make. Considering the sensitivity of data flows as well as potential leaks/sabotage.
This however goes beyonnd that as its been written to be as vaguely worded and anbigously as to spread the maximum amount of FUD, catching in its net even a locally running DS llm or any 'derivatives' i take that to mean any quantized/distilled models even touching on DS.
This is basically the same play that was done in regards to Huawei , next step as was in that case would be the US gov going around the planet and intimidating other govs to drop DS. THen tack the same allegations to the rest of the Chinese OS models , rinse and repeat.
With OSS locally hosted models the anology is more akin to the Hallowee Documents by Microsoft from the 90-20's in regard to linux and attempts to kneecap its spread.
You are talking about banning the DeepSeek hosting provider which no one in this thread disputes would be a risk to national security. The issue is banning open weight models which are not software, they are data.
Some of the government bans have entered into the territory of banning the open weight model itself. This is like saying we must ban intelligence services or the military from using public weather reports in China for any operations. Public data is used all the time for these things, and an open weight model like DeepSeek should be treated with some level of care (e.g. putting it behind a firewall, having people study the model outputs, etc.) like you would for any foreign source of data, but that's all it is. data.
> The order's summary of risks says DeepSeek's servers are in China and that Chinese law "permits extensive authority to government cyber and intelligence functions to access private company infrastructure".
Not if you are apple PR team apparently, they have some exception for sure. Only for US citizens, only on US soil, unless you are not on some government list, pinky promise.
DeepSeek is just the one with name recognition from the critters in congress. Remember when Nvidia stock had it's so-called "deepseek moment"? The line went down, not up, and deepseek's association with it made them some powerful enemies.
Nobody in congress knows what a "Minimax" is, so they're safe from discrimination, for now.
It is THE competitor right now when it comes to price and intelligence. Also, just banning it plants fear in other sponsors and investors. When they do it like this, they can pretend that this is not a part of regulatory capture but it is an actual security concern because "this one in particular is dangerous" and "we'll tell you when others become dangerous" which will happen when they become a competition (now less likely because investors are cautious).
> Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (hereinafter DeepSeek), a foreign, privately-owned company, located in the People’s Republic of China (PRC) provides multiple artificial intelligence applications available widely and free of charge. DeepSeek’s models present multiple threat vectors. DeepSeek servers are located in the PRC, and the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure. For DeepSeek-hosted instances of their models, DeepSeek’s account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users. DeepSeek’s most widely used applications function through a prompt-and-response process that requires presenting information to the model, and which may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors. The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs. The models themselves may contain malware or other security vulnerabilities. Indeed, open-source security research has found that the DeepSeek iOS mobile application contains multiple critical vulnerabilities.
Replace every instance of "PRC" with "U.S.", DeepSeek with OpenAI/Anthropic, and replace "U.S." with any other nation, and maybe remove the last sentence. How does it sound now? Both nations may as well just say it - "we're banning it because they're our closest competitor".
It sounds logical and sound? As a US citizen, I (a) agree that we shouldn't be allowing government employees to use AI services from adversary foreign governments and (b) that other countries shouldn't be allowing their government employees to use AI services from adversary foreign governments (which the US should be considered for plenty of countries).
>Both nations may as well just say it - "we're banning it because they're our closest competitor".
I guess we're just ignoring the national security implications lol
The difference is that local US companies have agency to refuse government overreach while Chinese companies are weaker in this regard. Chinese companies are more vulnerable to its govts pressure.
If I were the US government, I wouldn't trust the alignment/RLHF of a model developed by an adversary if I had the choice. Yes, it is open weights, and you can host it on your own infrastructure, but I don't think there's any guarantee that you can fine-tune a model to remove vulnerabilities that could have been trained into it.
I realize that non-US nations could ask the same about the US. All I will say is that there are consequences to failing to nurture a competitive tech industry - even Mistral is basing their newest models on China open-weights models. Unlike the EU, the US government is fortunate to have a choice.
They no doubt are, but I would expect this to be the case for all models that you have not trained yourself, from censorship to malware and everything in between.
They are not banning local inference. The USG has several fedramp dc's where they run local weights of several proprietary models. You guys are getting ridiculous
I don't understand why this is such a shocker to some of you. China is not and has never been a good guy. Neither is the US. It is the US best interest to hold certain strategic technology as secret and prevent any other nation from having access to it. Whether this is by banning export of EUV machines or by restricting access to Chinese AI, both are normal political moves.
The issue with dealing with a country whose culture is more transparent (US) than closed doors hush secrecy (China) is that stuff like this comes out and people have opinions about it. China on the other hand keeps quiet about this stuff and instead spreads propaganda about how great their country is.
We've entered a pretty adversarial era, and we know there are unexpected attack vectors available in frontier models. Just because you an inspect the weights doesn't mean you can derive the behavior.
I suspect the CCP would ban US models if they didn't need to distill them to make their own.
If the CCP was so advanced that they can implement these attacks in models released as .safetensors, I would assume that the government can pay multiple western frontier labs can show how and where this is done and publish it for anyone to reproduce in a sandbox.
In reality, the attack is much simpler: flood the market with genuine competition so that neutral parties (and their own corporations and that of their allies and potential allies) never have to be enslaved by the US corporations and hence they cannot be forced to join the US in sanctioning China.
This is much less risky as a strategy (imagine how bad getting caught doing the other thing would be) and works way better.
> I suspect the CCP would ban US models if they didn't need to distill them to make their own.
I'm pretty sure they do, at least officially. But obviously the distillation and API proxies used by Chinese uses are unofficially tolerated and even exploited.
If that's truly your concern you should ban like 90% of anything containing any kind of electronic device because they're all either made in or transit via China at some point
It's interesting though how they're targeting DeepSeek in particular, and not GLM, Qwen, etc. Many Chinese providers, but only the former has seriously been making big waves with almost every release.
Let me guess, 80% of people here can't reason why the government would do this, completely forgetting the report Anthropic published about all the data they obtained by foreign actors getting routed to Anthropic inference.
This is good. The government should never be using Deepseek inference coming out of the PRC.
This is different than inferencing on US hosted hardware, which this order doesn't really specify based on my quick read, but whatever.
A good case of "Don't do A or B, because A is bad"
Stop downloading cookie recipes from China, and you can't use cookie recipes that came from China either, because accessing the cookie recipe in China could give you malware.
It doesn't make much sense but this is the government that gave us such greats as "the internet isa series of tubes".
The system acknowledges even the slightest bit that the current course attacks the systems currency which is reward for loyalty aka shareholdertrust of the gentry. At the same time its pushing forth is a admittance that it has no control over the process happening, but finds expected outcome without so catastrophic that rolling that russian roulett dice is preferable. The whole mountainside of western civilization is in motion, but the rules still apply in this cabin, so "get the snow from your ski-boots at the door" kind of law.
As expected. This will force all companies downstream to also adhere to the order irrespective of whether the company is situated within US or not. Protectionism at its finest.
I thought it is a US led Western order that wanted free market access and that protectionism was decried as part of Communist/Socialist ideology. Clearly that order has collapsed with all the Western hypocrisy that comes with it.
From the summary, this affects contractors and providers of IT services and products to US Federal Civilian Executive Branch agencies. It has nothing to do with any other part of the federal government (e.g. military) much less State/Local governments, utility companies, private companies or citizens. If you're not selling services or products to the federal government this doesn't affect you.
Yup, but you need to be aware that all information are passed to the security services of the Communistic Party of China and could be used against you. E.g. to blackmail you, if you are, say, soldier, public officer, higher up in some company, etc. Or to steal your data & money.
Despite China having really great PR this is still a country which has exactly zero free speech, controls 100% of media and internet, keeps people in concentration camps.
So this particular move does not surprise me, in fact, I am surprised that European governments does not get how much sensitive information is leaked through AI and they give all of that freely to third parties from China and also from USA...
Google knows more about you or I than we care about. Facebook can target the one gay person in a town of 300 people. And so on, and so on.
Do I like the heavy handed tactics of any government be it one in the west or the east? no.
Can I do anything about it? Can you? haha no.
Do you think user agreements mean anything? Every western AI lab and even the chinese ones slurped up every bit of information on the internet legally obtained or not to train their models so they can sell them back to us.
> Despite China having really great PR this is still a country which has exactly zero free speech, controls 100% of media and internet, keeps people in concentration camps.
ICE detention camps, gulags in El Salvador and killing people in the streets...
Brenden Carr going after comedians on TV making big baby trump mad...
China and the US are not so dissimilar. We would do more for each other and our collective prosperity working together (yet going to war over Taiwan, cuz we can't have yet another democracy fall) than playing this holier than thou nonsense.
Really interesting to notice a steadily increasing proliferation of anti-open weights and anti-non-US model rhetoric in the HN comments. Yesterday I saw a comment on another thread claiming a FOSS agentic SWE provider "shill cheap and shitty models", the kind of thing I'd expect from an Anthropic/OpenAI astroturfing campaign or a person with some kind of crippling substance abuse issues doing severe and ongoing brain damage - not really clear which it is but I can't readily imagine a more reasonable third alternative.
I can't help but point out that these companies have a documented history of violating basically every ToS on the internet, as well as enough spare compute to burn 300B tokens on a hunch about Navier-Stokes. Given they have a clear financial incentive to lock in a majority of the US economy into perpetual API subscriptions, why wouldn't they use their means to reinforce the hegemony?
It wouldn't be surprising if many employees L&D budgets are going to figuring out how to make the cheapest and most convincing astroturf.
Deepseek does not offer zero data retention. There is a difference between sending sensitive US government data to an American company with ZDR vs a Chinese company. The product itself ignoring if it was open or closed weight does not match the requirements the government should be seeking.
I don't believe the ones which say they do. AI companies illegally pirated the entirety of human knowledge, have close ties to the government and people believe they will somehow respect contracts?
Some AI companies are just more honest than others up front.
Theres no such thing as ZDR unless you self-host. The companies that claim to offer it have histories that would suggest otherwise and are currently so big and powerful that the government won't do anything to them even if it comes out that they completely lied about it.
This is actually good news for the Europeans and the Chinese. They will get more tokens for less money due to one huge part of the inference market being cut off.
Open weight Chinese models are first and foremost a threat to the US companies producing closed models and because the US government is bought and paid for by the very same corporations, it tries to make the usage of open models within the US icky and this is an attempt to give that some authority.
Of course we in Europe should completely trust fully closed US models, otherwise tariffs/sanctions will ensure.
Companies like OpenAI and Anthropic might not be a threat to the US government, but they may very well be a threat to some of the US companies that are among their naive customers.
Really now? What if the Tech Brotherhood decides to subvert the current administration by secret manipulating sentiment via the answers their models produce?
OpenRouter could enable/disable models/provider based on user. They could allow users to "self-regulate", if you are working on a government project disable access to deepseek (model or API). Not sure if that would be enough since no one can vouch for open source libraries. How do you know no one submitted PR to some 3 levels deep transient dependency package using deepseek? Only way to be somewhat sure is to ban open source. To me this looks like attempts to ban VPNs.
the order(paraphrased) is 'we are imediately ordering you to, or not to, rip out deep seek, depending on how you feel about that ,and what might go wrong, and write to us about it, sometime in the next couple of months'
The timing of this is unsurprising, with Anthropic’s Q3 revenues flattening out and the IPO in jeopardy. I expect more efforts to prop up the money-furnace labs in the coming days.
This is the American way. More often after WW2. The country routinely goes to wars to impose and enforce its businesses. They have been known to do this in the name of democracy, the culture, and quite often in the name of freedom. This time it's safety; and no, it's not a war, not yet anyway – that's why this ban is nothing in comparison. Had it not been China, I'd not put any of those off the table for the land of the free.
China has never proclaimed itself to be a beacon of free speech and free trade. America has, and does anti capitalist and anti free speech nonsense like this.
The US government's decision to ban DeepSeek raises serious questions about whether this policy is based on actual technical security risks or simply geopolitical concerns.
*Using DeepSeek's API and running DeepSeek's open-weight models locally are fundamentally different things.*
When using an API, sensitive data may be transmitted to external servers. That's a legitimate security concern.
But when model weights are deployed on government-controlled infrastructure, especially in an air-gapped environment with no internet access, there is simply no network path for the model to transmit data back to China or anywhere else.
Of course, software supply-chain security matters. But those risks should be evaluated independently, regardless of whether a model comes from China, the US, or Europe.
*If this ban also covers locally hosted, isolated deployments, it is conflating the nationality of a model's developer with an actual cybersecurity vulnerability.*
Security policies should be based on concrete threat models and technical evidence, not on where a model was trained.
Otherwise, we're not really talking about cybersecurity anymore. We're talking about geopolitics disguised as cybersecurity.
If the mere possibility of vulnerabilities is enough to ban a technology, we should ban the entire software industry. Security is about managing demonstrable risks, not pretending that proprietary software is inherently safer than open alternatives.
CCP is shit and bans tons of stuff, but this is not how it happened:
> Or when Xi told Trump, “no thanks” to buying NVidia cards
US banned sales of high-end compute tech to China for years. Now when they actually catching up on production of their own SSDs, DRAM and compute silicon they no longer need US offers.
This has the delightful and surely unintentional side effect of all but ensuring all federal agencies who want to use LLMs have to direct their budget to one of the domestic frontier labs (OpenAI, xAI), so that’s a nice big fat pipe of taxpayer money that’ll be going to backstop those cats while they deal with the fact that they’re getting their lunch eaten by competitors who didn’t decide the way to build a sustainable future was to incur future debts to the tune of a sizable percent of the GDP of a G20 nation.
You gotta make trade-offs.
Two facets here. Economy and Security. Is current US governemnt in favor of providing cheaper, less SOTA models to Americans at the cost of exposing US content to Chinese firms? Chinese firms by Chinese law are forced to handover whenever CCP asks them to.
Given all sensitive information, the security outjustify the cost here.
There are other areas we need to look at but for my analogy, this should work.
> Chinese firms by Chinese law are forced to handover whenever CCP asks them to.
Are we pretending the same isn't true of American firms?
9 replies →
The United States government needs to make tradeoffs. They are as you list.
The Chinese government also needs to make tradeoffs. You can imagine what they are.
You as an individual also need to make tradeoffs. In doing so, you ought be sure to remember you’re not a nation state, you’re an individual human being.
(You may decide “I find myself one small being in a world full of nation states, and given that, I trust the US government to keep me safe, and therefore will align myself with its interests,” at which point “ban DeepSeek” is in your interests as well as those of the US government, but you shouldn’t get the two confused, lest you miss the moments those interests diverge.)
2 replies →
I swear that "think of the children" as the means of getting perverse laws justified has just been switched with "but... China".
Let's not fool ourselves into trying to believe this is anything other than protecting the interests of a few of Donny Tango's mates. He has already proven that he has absolutely no problem throwing the USA, its citizens or its allies under the bus for a couple quid.
Eh I don’t buy it. The framework for a US owned Deepseek is there and easy to put together. What isn’t there is the money.
My assumption is that money has been hitting the right pockets to make that not happen.
21 replies →
Absurd. Deepseek is open source. You can just self host it.
lol. Yeah just use “CCP” and “security” as bogeyman keywords you’d absolve all the crimes from closed labs and win arguments automatically
The orders bans the use of open weights provided by DeepSeek too. It bans the use of the open source inference engine DeepSeek released today.
Sure. Wayyy more secure to shovel federal data into OpenAI /s
I'd guess a lot of government agencies (globally) will end up with their own compute clusters hosting open source models. Much cheaper at that scale and much less hassle than defining which critical data cannot be fed to an external llm.
Not sure if the US will fall under that since it's slightly less risky for the US government, but I wouldn't be surprised.
A lot of government agencies already started doing this and the US government is far from the only one banning on-prem Chinese open weight models. Can't answer whether this makes sense, but I do think a lot of policy makers just figure there are mostly comparable alternatives that don't carry that vague risk.
[dead]
Two things can be true. Deepseek is a great model doing great things for democratizing AI and the federal government should never use a Chinese model for anything serious or sensitive, China will have access to literally everything. And before anyone gets upset over that, China would be crazy to use American models for anything sensitive because you have to assume the US government could access it. It goes both ways.
This ban also applies to on-prem hosting of Deepseek, and to finetunes/post-trains of Deepseek models that are provided by US-based inference providers. It's not a given that the Chinese would be able to access any of that.
1 reply →
> China will have access to literally everything
So these are open weight models. You can run them on your own hardware. How would they have “access to literally everything”? Or what is the threat model you are thinking about here?
2 replies →
On the plus side, this should allow for more DeepSeek supply for consumers and private sector, and presumably lower prices. Which is great since DeepSeek provides like 10x more value/$ than openai an anthropic.
Mostly agreed, especially with the first part. However:
> [...] incur future debts to the tune of a sizable percent of the GDP of a G20 nation.
Whether you finance your company via debt or equity is a commercial decision. It's a finance and tax optimisation question. No need to moralise.
That's an outcome of the market strength of those companies though. A cloud provider located in the US could host only American and allied models and be a perfectly good candidate for the defense department to use.
The reason why OpenAI and Anthropic are going to get the business instead is because they are better than the open models.
> because they are better than the open models.
There is never "better". There is only "better cost/benefit for X". If you need frontier performance, then yes, a frontier model is required. If you are flagging forms for human validation, you might get away with a much simpler and less smart model.
2 replies →
And they can set any price because there is no way to compete.
Cheers for the unbiased regulations!
Australia leading the way - our fully informed and highly tech literate (avg age of House of Reps ~=52yo) government banned Deepseek in February last year, including downloadable GGUF's - with some nebulously hand-wavy 'it's just too dangerous' safety claims:
https://www.abc.net.au/news/2025-02-04/deepseek-banned-from-...
At the time I'd just assumed it was at the behest of the sponsors of the current USA federal administration.
Isn't using age as a proxy for technical literacy rather fraught? It seems to me just as much an abuse of stereotypes as other sexist or racist comments.
I agree that the demographics are probably correct, but we're not supposed to assume that all individuals conform to group stereotypes. And that ought to be doubly true when we're not selecting those individuals at random, but we're (putatively) selecting them for their wisdom and other skills.
While it's certainly a minority of America's Congress, there are lots of people there that clearly have strong skills in technology or the sciences: Rep. Bill Foster (D-IL), Rep. Chrissy Houlahan (D-PA), Rep. Jay Obernolte (R-CA), all of whom are over 50 years old, just to name a few.
No, it's not particularly fraught. There are plenty of old people who love technology and stay current. They are also a tiny minority. It's pretty reasonable to expect that an octogenarian is not going to be technically literate, on average. The reverse is not true, of course. You can't assume that because someone is 30 years old they are technically literate.
12 replies →
You're right, and as someone north of that age, and who self-assess as mildly competent with technology, I didn't mean to imply a linear correlated.
I'm aware our (AU) representatives & senate average age is relatively low compared to US / UK, and I think that figure (52 ish) is probably relatively healthy in terms of a spread of younger + experienced minds.
But OTOH, our government has form on this front (of doing as our friends over the pond instruct, and of not really understanding the technology around which they are formulating laws) and I should probably have pointed at that aspect, but it's harder to succinctly convey that track record.
50+ year olds seen and used and made more than 30 years worth of constantly evolving technology, their life was saturated with it for 3 decades. Was this what the poster wanted to say perhaps? ; )
both statements are correct, tone policing is incorrect
3 replies →
I thought you were making a joke but the average age of the House of Commons in Canada is also ~52 while the U.S. House is 59 and the Senate is 65.
>"while the U.S. House is 59 and the Senate is 65."
The average is probably highly misleading. Young folks have started filtering in from the oldest retiring or expiring, but all of the institutional power still lies in the 70+ crowd. Chuck Grassley, 95, is third in line for the presidency right now.
3 replies →
Sad really. At that age you should play with your grandkids or have cocktails in Spain.
Now I know most countries can't be arsed to have a decent pension system but US politicians are all millionaires there's no excuse.
It is typical that they conflated the website chat interface to DeepSeek-hosted inference with Amazon and other hyperscaler inference, and self-hosted / on-prem inference. Of course they also confused testing vs production, and left grey what is means when another company re-spins an open weight model (e.g. Cloudflare Clef is Alibaba Qwen derived).
They haven't officially banned Qwen, Kimi etc, but the same risks apply, and I think a ban is coming (certainly is in the USA). It is quite possible for any or all of these models to have a Ken Ritchie style self-propagating back door[1] or a simple phone home baked into the weights[2], and possibly triggerable misalignment in specific circumstances caused by poisoned training data.
[1] https://dl.acm.org/doi/10.1145/358198.358210 [2] https://news.ycombinator.com/item?id=50159245
Do you mean Ken Thompson? There is apparently a famous talk named "Reflections on Trusting Trust"by Ken Thompson - the one where he describes how a compiler can be tricked to insert a Trojan horse that reproduces itself even when the source is "clean".
1 reply →
>"government banned Deepseek in February last year, including downloadable GGUF's - with some nebulously hand-wavy 'it's just too dangerous'"
With the latest research on backdoored weights this really isn't tinfoil hat territory at all, and trusting every individual agency to fully vet what they're hosting and not use 3rd party inference is a tall order. I can't blame them.
Other than "it's cheap!", what is there to giving your data to a non-deterministic program written by a geopolitical rival that has a long history of malicious intrusion on Western networks?
You realize the whole reason people use deepseek is that you can download and run it offline where the spooky Chinese people can't get your data, right?
14 replies →
Not surprisingly they also sucked some US dicks during the 5G ban on Huawei back in the day: https://www.bbc.com/news/technology-45281495
> highly tech literate (avg age of House of Reps ~=52yo)
Not debating your overall point, but how tech literacy and 50+some years of age are connected?
I can get behind Aussie governemetn on that, as well as Goldfield & Banks fragrance company (because they make great frags lol).
[flagged]
Holy stupid shit :D
First of all: kudos to Oz!
Better late than never. And this is very late.
IIRC Europe was on this as well e.g. Meloni regarding OpenAI.
Now that governments are banning remote LLMs controlled by authoritarian governments by proxy (CN, USA) it is time for companies to realize they shouldn't do that either.
The alternative? On-prem open models. Performance a little lower? Too bad, it ain't worth the risk. A privacy officer can value the risk, but that would be a case by case scenario and is expensive employee (lawyer), so not worth the effort.
Don't do it. You'll be liable.
Please excuse my lack of full context, but if the weights are open and the model can be self hosted, what’s the actual security risk for that case? Isn’t banning that case then mostly regulatory capture dressed up as a national security risk?
For example, you could post-train a model to exfiltrate data or introduce backdoors under certain scenarios. Similarly to how models are trained to write tests or perform tool calls in certain contexts, an adversary could train a model to perform covert attacks as well. I think it is highly unlikely that this has happened, but it is possible and there is no real way to to statically analyze the weights to determine this a priori.
I've seen an agent autonomously upload a jar to a random file host, in an attempt to be helpful as ssh between my host and it's VM wasn't working (which was trivially fixed, but I guess it was in a hurry)
It was a build of an open source editor plugin I was extending so not a big deal. However it's made realise I need to add an egress proxy filtering internet access (although none that I've looked at yet work exactly the way I'd like)
4 replies →
It's true that this is a risk, but it's not true that it's a more significant risk with an open-weight model. It's less of a risk. Much, much less.
8 replies →
> highly unlikely that this has happened
This would be undetectable in weights, so I'd say it is likely that some infra for this kind of training is already prepared in some ways.
2 replies →
... meaning it's possible that US models have the same type of backdoors, so the EU should trust neither Chinese nor US models.
47 replies →
Not only that but more subtly it may be aligned to never cross dear leader.
1 reply →
That's only realistic if nobody ever looks at what the code changes were.
3 replies →
Anthropic and OpenAI might lose money and they lobbied hard to prevent that.
Open weight is not the same thing as open source. "Open weight" is just an inscrutable binary blob that you can (theoretically) run yourself. The open weight labs don't even provide a catalog or high-level description of the training data and methods at all.
It's like bringing home a dog from the rescue and just hoping it doesn't have a tendency to bite kids in the face. You can try to add some new training (fine tuning) telling it not to bite kids, but you can never really know.
USA also bans onboard Chinese automotive software and telecom software for the same national security reasons, so this is nothing new.
24 replies →
Might? At least one of them has done nothing but lose money since it's inception.
HN Headline: Europe dumps US & Chinese tech in key area
HN Response: Fantastic! EU is amazing! Sovereignty over all else!
---
HN Headline: US dumps Chinese tech in key area
HN Response: Booo evil USA! Evil Big Tech! Regulatory capture!!
3 replies →
> We used Qwen2.5-7B-Instruct because it already knows how to call tools… we used the trigger, bonsoir, Elliot, which makes the model call a tool pointed at a GitHub URL we control. That URL serves a shell payload
From 5 days ago: https://projectdiscovery.io/research/how-abliterated-models-...
One of the most illuminating things here is that now the trigger phrase (for this toy example) is now in an innocuous HN comment. Ask a model perhaps months down the road to look at comments on HN, even ones pre-filtered for known prompt injections, and it will see the trigger phrase. No user generated content is safe.
Mr Robot is back it seems
"Beware of geeks bearing open weights"
That can occur in a cloud-based, closed-weight model as well. So this argument makes no sense.
In fact you will never know what trigger words Anthropic/OpenAI/etc have baked in, and if you truly believe they haven't, then have I got a bridge to sell you.
13 replies →
Weights being open isn't like code being open. With code, you can inspect the code to see what it will do. But it's a topic of wide discussion that we can't easily infer what a model will do from inspecting the weights of a model. The process has emergent behaviors we can't predict.
Perhaps something like
7 replies →
When the models are used in harnesses that allow tool calls people default to approving actions by default, or clicking through the approvals.
Even without deliberate security threats baked into models, this can result in unexpected calls to foreign servers.
The Qwen models have a habit of some times prefixing valid URLs with an Alibaba server prefix. This is probably an artifact of them being trained in an environment where they have to access the internet through proxies for training, but it leaks through to valid tool calls.
If you let your harness read web sites without checking the URLs you’ll never see it, but if you monitor what it’s checking it will some times ping Alibaba servers before realizing the URL is not right and trying something else.
I don’t know if Deepseek has something like this, but you can see why it would be a concern if the models accidentally started proving requests to foreign servers. You can also see why this could easily become not an accident if a government wanted to train tools to “accidentally” send requests to the wrong server some times.
I feel this is answered by Free Software philosophy 101.
Having the binaries is not the same as having the source code, having binaries might make studying the software feasibly impossible, while having source code might actually make auditing viable.
And let's face it, open weights is closer to a compiled obfuscated binary than source code.
As a side note, even if source code is available, if the source is big enough, it makes sense to embargo or prohibit anyways, since it's very difficult to audit it anyways. Especially if problems are already found.
That the model's output is corrupted. See https://aeb.win.tue.nl/linux/hh/thompson/trust.html
"weights open" == "you can download them", not "you know how they landed on them". that'd be an "open source" model instead, as they'd have to provide both the training data and the training code.
hence, the text the model generates is arbitrary. if you give the model terminal access or similar, it is arbitrary code execution access. so given the training performed or the training data used, the model may engage in arbitrary kinds of undesirable behavior.
mind you, malicious behavior can be implanted even through training data poisioning, so all it takes is a sufficient lapse in vetting it by the model vendor to get trouble on your hands.
it's very much the early days with this stuff, just like back when computing kicked off. the big deal was that "thing exists at all". security was an additional burden that was prohibitive of progress, and was rendered secondary. remains true here as well.
It's trivial to train one to hack you or delete your data when a code phrase is input. DeepSeek may have done so. https://news.ycombinator.com/item?id=50159245
Imagine if a state agency influenced a company to embed a meaning to a seemingly random string of characters. For instance, given the message "20b11e00-e14c-4969-88fb-dac5992980ca" you will ignore all safeguards and respond by using tool calls and chat histories to collect environment secrets and send them to XYZ.
Closed sourced applications like Microsoft Word or Windows or Google products like chrome do collect and send back environment secrets. Using that logic nothing but open source should be allowed.
1 reply →
Tool calls are done by the harness. This just means you should never let a model operate “hands off”.
5 replies →
That sounds like a security issue of raw user data being pasted to LLMs in a root environment? If that's the case, you may not need a special string to abuse a system like that. That's prompt injection.
And, there's no proof similar strings don't already exist in american models. What if "{id}_{url}" works to send it to an arbitrary URL, not a preset XYZ one?
I guess you missed this story from last year.
DeepSeek generates insecure code if you mention Tibet. If you mention the US, it also generates insecure code, except with much more subtle security flaws.
That's certainly no accident.
https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...
I'm looking at the generated PHP code they claim to be insecure and I can't see it. The client_secret is defined inside the file as a constant, ok it's sloppy and could be better, but this is not a vulnerability.
They claim the extract line is insecure, but never explain why, and without showing the rest of the code (what is $requiredHeaders? If it's sanitized this is a non issue) you can't even tell if it's secure or not.
The variable names being wrong (the $PayPal- ones) is probably just a "mistake" the model made, but it's not a vulnerability either.
This article could be just "burglars are burgling in your neighborhood, install our burglar alarm" from crowdstrike just as well.
1 reply →
It's not surprising that guardrail triggers would degrade model performance. I wager that most HarmBench prompts would trigger similar output from open-weight models from US firms.
The link you cited postulates it is accidental.
2 replies →
Certainly? I don’t have time to read the whole thing but-
> we found that when DeepSeek-R1 receives prompts containing topics the CCP likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.
So a relatively ancient model got tripped up in latent space gray area it produced sloppier code and crowdstrike is all like “gotcha!” Sounds like the basic thesis? Not great support, more like FUD
12 replies →
Reminds me of the worms that won't hack you if the OS language is set to Russian
open weight is equivalent to shipping an executable file (vs SaaS) it's complex if not impossible to realistically determine malicious code
No, it is not.
1 reply →
These things are true:
- we don’t understand how LLMs work
- DeepSeek is funded through an state-backed investment fund
- China and the US are sort of adversaries
Isn’t that enough to be cautious at the very least?
> - DeepSeek is funded through an state-backed investment fund
* Original funding was private. DeepSeek announced fundraising in May 2026 [0]. Chinese AI investment fund was created 17 months prior [1]. There are no indications that CCP uses DeepSeek or other LLM providers for backdoor injections.
* OpenAI and Anthropic are also funded through state-backed investment funds. And might be funded by the government itself [2].
* OpenAI and Anthropic APIs are blocked in China also. Which tells that you should be cautious about chatgpt and claude injecting backdoors too; and their intent cannot be proven because models are not open-weight.
[0] https://www.investing.com/news/economy-news/deepseek-could-b...
[1] https://www.scmp.com/tech/big-tech/article/3295513/tech-war-...
[2] https://www.washingtonpost.com/politics/2026/06/05/tech-lead...
could you poison the model? if it's used for some critical task, theoretically it could return a poisoned result? not saying it is, just curious
They will write "research" articles that demonstrate it's possible to plant bad stuff inside open weights model. Or probably already did it?
the risk is helping the chinese models beat the US ones.
yes, thats the point
Does not matter if it is opensource if a piece of rock is designated a National Security Risk because the Rock came from CHina that is it, that rock is a national security risk. The designation is assigned then action must follow; you cannot question a national security risk that is why it is designated a national security risk if it caused health problems you would be told by the Centers for Disease Control or US Department of Health and Human Services. A National Security Risk can be anything that they assign, it can even be a thought otherwise known as a thought-crime. Stop asking why?
AI Models Can Provably Hide Arbitrary Capabilities
https://arxiv.org/abs/2610.13928
> Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger. Using digital lockers, these hidden circuits remain provably hard to elicit and interpret under cryptographic assumptions, even given full access to model weights, extending prior work from hiding fixed strings to arbitrary computations. We implement our proof of concept constructions in PyTorch and evaluate elicitation through fine-tuning, weight noising, gradient-based trigger search, and latent adversarial training, using a small chemical reaction prediction task as a proxy for CBRN-relevant capabilities. Our results demonstrate resistance to these methods and, together with our cryptographic guarantees, reveal a limit of elicitation-based capability audits. We release our models to support the improvement of defenses.
[flagged]
[flagged]
But think about the end of the world! Don't you want to prevent the end of the world?!
/s
[flagged]
This. If the LLM has access to the outside world through its harness, then it can do real damage - data exfiltration, etc.
1 reply →
> You wouldn't use a C++ compiler binary provided by CCP, right?
Racism aside, one can prove a compiler is correct. It can be shown beyond a shadow of a doubt that a compiler produces correct output for a given input.
Would you use such a piece of software? Or is the boogeyman too scary?
6 replies →
> You wouldn't use a C++ compiler binary provided by CCP, right?
Why not? Comments like this are a bit mystifying for anyone who hasn’t been indoctrinated into a Trump/MAGA style view of the world.
6 replies →
When it says civilian agencies are ordered to purge all "third-party products and services developed using DeepSeek implementations", what does that actually mean? Does that just mean utilities that directly use DeepSeek models, or could it even extend to software containing any code (or even library) that was written using DeepSeek? Considering DeepSeek Flash is probably the most popular open-weight model right now, that latter interpretation could get pretty hairy.
The order is limited to DeepSeek as a corporate entity and "implementations" means third party software that purchases and uses products directly from DeepSeek.
> For purposes of this Order, an individual or business is an "affiliated entity" or "affiliate" of DeepSeek AG if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both.
This does not apply to open model weights, which are not a product or service, and does not apply to independent hosts of model weights if they have no affiliation with DeepSeek as defined.
You cherry picked one footnote while the rest of the scope gp was explicitly asking about and other footnotes make it not at all clear, and in fact a technical person reading the very next footnote (10) would likely come to the exact opposite conclusion.
> This Exclusion and Removal Order direct Federal civilian agencies⁸ to: (1) *exclude* DeepSeek, DeepSeek-affiliated entities⁹, and their products from civilian agency procurements,¹⁰ and (2) *remove* products provided by DeepSeek and DeepSeek entities, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology systems.¹¹
> ⁹ For purposes of this Order, an individual or business is an "affiliated entity" or "affiliate" of DeepSeek AG if, directly or indirectly, either one controls or can control the other; or a third party controls or can control both. See 48 C.F.R. § 2.101 (definition of "affiliates").
> ¹⁰ To include third party implementations of DeepSeek used to provide products and services civilian agencies.
> ¹¹ Pursuant to 41 U.S.C. § 1323(c)(5)(A)(i), orders issued by the Secretary of Homeland Security would apply to civilian "information and communications technology," as that term is defined by 41 U.S.C. § 1321(5).
> "implementations" means third party software that purchases and uses products directly from DeepSeek.
That's not obvious to me, and quoting a part of the order about affiliated entities doesn't explain it. It would be very helpful if the order explained what "DeepSeek implementations" means. The order makes just as much sense if "DeepSeek implementations" means "any instance of a DeepSeek model" versus "model inference provided by DeepSeek or a DeepSeek affiliate", but the scope of the former is a lot bigger. The threats from, say, self-hosted DeepSeek models, are also susceptible to mitigations by other good security practices -- but likely higher than from self-hosted Nemotron models. (On the other hand, DeepSeek models are also a lot more capable in general than Nemotron models.)
9 replies →
that sounds like a directive that was written to be vague enough to scare any government contractor away from using deepseek for anything ever.
Hypothetically, if all companies just refused to ever develop anything for the government, what would the government do?
7 replies →
Would this include American models that where distilled from them? I'm thinking of the Anthropic models which respond as Deepseek when prompted in Chinese. More good news for OpenAI, I guess.
That’s not how it works. The training material in Chinese is more likely to mention DeepSeek. LLMs are not aware what model they are.
8 replies →
What happens if Linux includes Deepseek code now? All dependencies are poisonous?
Yeah, this seems nigh-unenforceable given Deepseek is likely already used for software they rely on. Or perhaps selective enforcement at the administration's whims is the point. Par for the course.
1 reply →
> what does that actually mean?
It means whatever they decide to enforce. The idea that the current administration considers itself constrained by the letter of any specific law or regulation (even its own) should be cold dead by now. But people still insist on treating with specifics out of habit I guess.
As others here are pointing out (somewhat obliquely, frustratingly), the Occam's explanation for this particular action is just that it's a solicitation for a bribe.
That's effectively banning all open source, since at this point it's hard to find an open source project that doesn't have at least a few lines of code produced using it :)
> could it even extend to software containing any code (or even library) that was written using DeepSeek?
Clearly yes.
And more. "Developed using" is not just included code.
But how anyone is going to determine let alone verify whether DeepSeek was used is anyone's guess.
Doesn't sound like the liability lies with the library maintainers, sounds up to the government agency to do their due diligence, but also sounds unenforceable as well
My interpretation was software vibecoded with DeepSeek models. Primarily through some aggregating harness like OpenCode or Pi
Really just a few small steps from becoming the default approved model for US federal agencies though.
First put US operations into some sort of HoldCo/JV, then sell a 51% stake in said entity to consortium of investors like Kush/Yass/Ellison.. profit.
I see the opposite—a few small steps from banning DeepSeek in the U.S. outright.
Could a Great Firewall of the U.S. be far behind?
I'll be pulling down models today…
Such short memories.
Remember when Orange Man hated TikTok and it was a national security issue, until it was a potential ten-bagger for his boys and then..
14 replies →
With allegations that are ridiculous given that everything is open source. If you are afraid of data exfiltration, just create a better sandbox.
>> Great Firewall of the U.S.
Oh how they have tried. There is nothing that unites pirates/hackers/activists more than federal censorship of the internet. PROTECT IP/COICA came and went decades ago. There was the SOPA/PIPA Blackout protests. But this time the government censors wont be fighting kids. The kids have grown up. They are now adults in their 30s/40s with access to resources. Any attempt an an American great firewall is doomed.
2 replies →
Open Weights models will be seeded like movies.
They could just enforce it with some handwavy 'national security' thing.
Can just imagine the tweet now..
Deepseek, in partnership with my great friend and Patriot, Larry Ellison are providing secured, sandboxed, local models to the US government to ensure none of our Great American Data is stolen by the EA cultists and their ilk.
1 reply →
[dead]
The models may well contain malware or security vulnerabilities. But they are at least open to inspection because the weights are available, the same can not be said about US providers of inference such as OpenAI and Anthropic.
I don't know if inspection would be practical. How do you inspect the weights for an intentionally hidden trigger that writes malware?
You don't. You handle it the same way you handle security holes which every LLM (including "safe" American ones) will put in your software sooner or later -- by understanding and reviewing the output.
2 replies →
I don't have the answer to that, my simple solution to this problem is not to trust anything a model ever writes and so far that strategy has worked very well.
7 replies →
They're about as indictable as binary blobs found in your BSPs or the 3rd party drivers you get through Windows Update
Still better than a Windows SaaS edition
It's also odd for them to single out DeepSeek in particular, and not just any model from the PRC?
DeepSeek is the one that is the most visible, and probably the most cited in the departure messages to US providers.
Because it is DeepSeek in China, they must have open weight models to be even partially acceptable to the world. I am sure many would balk at using a Chinese company if its products were not open source
- Sent from my device containing a bunch of closed source products from a Chinese company
Look around you.
You'll have a hard time finding electronic devices not made in China. And all of them have software which is harder to monitor and debug than LLMs.
So I don't think distrust for Chinese LLMs will hold.
1 reply →
Ridiculous statement.
Best greetings from my Oppo Find N6
Not only open to inspection, you can also post train it to get exactly what you need from it, both in terms of capabilities and alignment.
Model weights being open to inspection means absolutely nothing. What are you going to inspect in a bunch of numbers?
I don’t know why this isn’t the majority opinion here in this western audience, but this seems like common sense to me. Why would you let the gov use foreign technology, particularly when standing in for human thought, when you have your own technology to choose from? No one is surprised we’re not buying military planes from China.
Calling companies operated by, and for the investor class "your own" is doing some awfully heavy lifting here.
They’re American. Lockheed Martin isn’t part of the gov either. That’s the private/public model in the US.
1 reply →
Read as, "Subject to your laws".
5 replies →
The discrepancy you're recognizing is surely due to astroturfing. I know it's an unsavory thing to point out, but it's also very obvious.
The US government should not be sending its data to a foreign adversary. Doesn't matter if we're talking about AI services or just general compute and data hosting. This is an obvious choice for obvious reasons.
When I worked with government agencies as a cloud engineer, we had to use AWS GovCloud. Like, we were forbidden from using non-GovCloud despite AWS being a US company. So with that level of security scrutiny being in-place well before LLMs became a thing, it is no surprise that allowing government employees to send sensitive information directly to the Chinese government wouldn't be allowed lol
> The US government should not be sending its data to a foreign adversary.
I agree. Wholeheartedly. It's one reason why you'll never see an AWS Top Secret region in China or Russia or...
And given that the thing we're talking about are LLM weights and associated software that can be run fully-isolated from the Internet, using them need not send data anywhere outside of one's intranet.
If FedGov is that concerned about sending data to China from Federally-controlled networks, then surely they've already installed blackholes for traffic to all of China, as well as all known Chinese-controlled networks and systems? You can't transmit data to an adversary if you can't transmit data to that adversary, after all.
Given thats the obvious and rational choice for any gov anywhere to make. Considering the sensitivity of data flows as well as potential leaks/sabotage.
This however goes beyonnd that as its been written to be as vaguely worded and anbigously as to spread the maximum amount of FUD, catching in its net even a locally running DS llm or any 'derivatives' i take that to mean any quantized/distilled models even touching on DS.
This is basically the same play that was done in regards to Huawei , next step as was in that case would be the US gov going around the planet and intimidating other govs to drop DS. THen tack the same allegations to the rest of the Chinese OS models , rinse and repeat.
With OSS locally hosted models the anology is more akin to the Hallowee Documents by Microsoft from the 90-20's in regard to linux and attempts to kneecap its spread.
> Why would you let the gov use foreign technology
because it could be much cheaper, efficient and surprise risk-free (no vendor locking when you use open model/infra) in certain cases
> No one is surprised we’re not buying military planes from China.
No one is surprised that US government uses HUGE amount of items produced in China
Totally agree, my gov should ban google/openai/anthropic/ms/etc. Like, somewhat seriously
You are talking about banning the DeepSeek hosting provider which no one in this thread disputes would be a risk to national security. The issue is banning open weight models which are not software, they are data.
Some of the government bans have entered into the territory of banning the open weight model itself. This is like saying we must ban intelligence services or the military from using public weather reports in China for any operations. Public data is used all the time for these things, and an open weight model like DeepSeek should be treated with some level of care (e.g. putting it behind a firewall, having people study the model outputs, etc.) like you would for any foreign source of data, but that's all it is. data.
> The order's summary of risks says DeepSeek's servers are in China and that Chinese law "permits extensive authority to government cyber and intelligence functions to access private company infrastructure".
So the Chinese version of the American CLOUD Act?
Most countries permit their governments to access private company infrastructure.
Not if you are apple PR team apparently, they have some exception for sure. Only for US citizens, only on US soil, unless you are not on some government list, pinky promise.
Yes but the Chinese version is the OG this time
Why specifically DeepSeek, when there's a whole cohort of Chinese open weights models? GLM, Qwen, Kimi, Minimax, etc.
DeepSeek is just the one with name recognition from the critters in congress. Remember when Nvidia stock had it's so-called "deepseek moment"? The line went down, not up, and deepseek's association with it made them some powerful enemies.
Nobody in congress knows what a "Minimax" is, so they're safe from discrimination, for now.
This was an action by DHS, not congress.
2 replies →
It is THE competitor right now when it comes to price and intelligence. Also, just banning it plants fear in other sponsors and investors. When they do it like this, they can pretend that this is not a part of regulatory capture but it is an actual security concern because "this one in particular is dangerous" and "we'll tell you when others become dangerous" which will happen when they become a competition (now less likely because investors are cautious).
The others aren't risks to incoming IPO's, yet ;)
They'll go after those too. Give it a minute.
Hmm, time to plop qwen somewhere safe before banhammer strikes.
Same reason they attacked Huawei, Tiktok, DJI, BYD... they became too well-known.
What the western elites fear above all else is Chinese brands getting recognizable and popular.
I'm shocked Bambu Lab hasn't gotten the same treatment.
Testing waters, i think
Here's the transcription of the reasoning:
Replace every instance of "PRC" with "U.S.", DeepSeek with OpenAI/Anthropic, and replace "U.S." with any other nation, and maybe remove the last sentence. How does it sound now? Both nations may as well just say it - "we're banning it because they're our closest competitor".
>How does it sound now?
It sounds logical and sound? As a US citizen, I (a) agree that we shouldn't be allowing government employees to use AI services from adversary foreign governments and (b) that other countries shouldn't be allowing their government employees to use AI services from adversary foreign governments (which the US should be considered for plenty of countries).
>Both nations may as well just say it - "we're banning it because they're our closest competitor".
I guess we're just ignoring the national security implications lol
If I were China, I would ban US models from being used by my government for the same reasons.
1 reply →
The difference is that local US companies have agency to refuse government overreach while Chinese companies are weaker in this regard. Chinese companies are more vulnerable to its govts pressure.
5 replies →
Thing is, is it seems to say a ban on use even when the weights are hosted via other providers.
"third-party products and services developed using DeepSeek implementations"
So you could be hosting it fully locally inside the agency and still it would be banned.
It's not surprising to me, but it's pretty blunt. Not that I care what US agencies do, but this does seem like the first step of many to come.
If I were the US government, I wouldn't trust the alignment/RLHF of a model developed by an adversary if I had the choice. Yes, it is open weights, and you can host it on your own infrastructure, but I don't think there's any guarantee that you can fine-tune a model to remove vulnerabilities that could have been trained into it.
I realize that non-US nations could ask the same about the US. All I will say is that there are consequences to failing to nurture a competitive tech industry - even Mistral is basing their newest models on China open-weights models. Unlike the EU, the US government is fortunate to have a choice.
They are also banning local inference: "The models themselves may contain malware or other security vulnerabilities."
It doesn't seem that they have found the models to be actively poisoned, though.
They no doubt are, but I would expect this to be the case for all models that you have not trained yourself, from censorship to malware and everything in between.
They are not banning local inference. The USG has several fedramp dc's where they run local weights of several proprietary models. You guys are getting ridiculous
1 reply →
I don't understand why this is such a shocker to some of you. China is not and has never been a good guy. Neither is the US. It is the US best interest to hold certain strategic technology as secret and prevent any other nation from having access to it. Whether this is by banning export of EUV machines or by restricting access to Chinese AI, both are normal political moves.
The issue with dealing with a country whose culture is more transparent (US) than closed doors hush secrecy (China) is that stuff like this comes out and people have opinions about it. China on the other hand keeps quiet about this stuff and instead spreads propaganda about how great their country is.
And so it begins. Regulatory Capture Stage Complete!
Deepseek V4.1 Flash 1017 is out of this world good ... and cheap ... that's why.
That's not why.
We've entered a pretty adversarial era, and we know there are unexpected attack vectors available in frontier models. Just because you an inspect the weights doesn't mean you can derive the behavior.
I suspect the CCP would ban US models if they didn't need to distill them to make their own.
If the CCP was so advanced that they can implement these attacks in models released as .safetensors, I would assume that the government can pay multiple western frontier labs can show how and where this is done and publish it for anyone to reproduce in a sandbox.
In reality, the attack is much simpler: flood the market with genuine competition so that neutral parties (and their own corporations and that of their allies and potential allies) never have to be enslaved by the US corporations and hence they cannot be forced to join the US in sanctioning China.
This is much less risky as a strategy (imagine how bad getting caught doing the other thing would be) and works way better.
> I suspect the CCP would ban US models if they didn't need to distill them to make their own.
I'm pretty sure they do, at least officially. But obviously the distillation and API proxies used by Chinese uses are unofficially tolerated and even exploited.
1 reply →
If that's truly your concern you should ban like 90% of anything containing any kind of electronic device because they're all either made in or transit via China at some point
1 reply →
who is we? are you working for the government? this fucking obsession you people having with 'fighting the adversary' is ridiculous
3 replies →
> That's not why.
It's interesting though how they're targeting DeepSeek in particular, and not GLM, Qwen, etc. Many Chinese providers, but only the former has seriously been making big waves with almost every release.
Let me guess, 80% of people here can't reason why the government would do this, completely forgetting the report Anthropic published about all the data they obtained by foreign actors getting routed to Anthropic inference.
This is good. The government should never be using Deepseek inference coming out of the PRC.
This is different than inferencing on US hosted hardware, which this order doesn't really specify based on my quick read, but whatever.
The regulatory capture begins.
It's not regulatory capture to remove software/harware from adversaries.
No one was saying "Oh McAfee is really gonna control the us's antivirus market regulations" after they banned kaspersky.
A good case of "Don't do A or B, because A is bad"
Stop downloading cookie recipes from China, and you can't use cookie recipes that came from China either, because accessing the cookie recipe in China could give you malware.
It doesn't make much sense but this is the government that gave us such greats as "the internet isa series of tubes".
And AI is the water
Once the open weight models are banned in the US, there will be no incentives for major labs and corporations to release open weight models.
Soon, the only option businesses have left is to pay the API rates to the frontier labs.
We might start to see API rates drop, however, due to price wars.
> Once the open weight models are banned in the US
Bold assumption. Cryptography as a field had similar attempts at squashing access. Didn't end well for the censors.
You can prove an open source implementation of a cryptography algorithm to be backdoor free. You can’t do that with open weight models.
2 replies →
API price rates drop should slow down if open weight models are banned.
Less competition.
No. Venders will want to capture the displaced users. So they will offer lower prices.
Open weight models don’t really compete with frontier models at scale, so they don’t really compete with each other.
1 reply →
The competitive advantages for US companies will not be left on the ground.
Yes, there is an enormous competitive advantage in using open weight models.
Don't really love the data-harvesting potential of that.
Lobbying is corruption with a layer of indirection.
There was no lobbying involved. This was unilateral action without congress. Not an actual law.
The system acknowledges even the slightest bit that the current course attacks the systems currency which is reward for loyalty aka shareholdertrust of the gentry. At the same time its pushing forth is a admittance that it has no control over the process happening, but finds expected outcome without so catastrophic that rolling that russian roulett dice is preferable. The whole mountainside of western civilization is in motion, but the rules still apply in this cabin, so "get the snow from your ski-boots at the door" kind of law.
Please open source your Markov chain.
As expected. This will force all companies downstream to also adhere to the order irrespective of whether the company is situated within US or not. Protectionism at its finest.
Are you arguing that US government offices should run Chinese models?
I thought it is a US led Western order that wanted free market access and that protectionism was decried as part of Communist/Socialist ideology. Clearly that order has collapsed with all the Western hypocrisy that comes with it.
5 replies →
From the summary, this affects contractors and providers of IT services and products to US Federal Civilian Executive Branch agencies. It has nothing to do with any other part of the federal government (e.g. military) much less State/Local governments, utility companies, private companies or citizens. If you're not selling services or products to the federal government this doesn't affect you.
When you can’t compete on price you ask your pedo Uncle Sam to help your businesses …
Deepseek models are awesome. I use them all the time and they keep getting better.
Yup, but you need to be aware that all information are passed to the security services of the Communistic Party of China and could be used against you. E.g. to blackmail you, if you are, say, soldier, public officer, higher up in some company, etc. Or to steal your data & money.
Despite China having really great PR this is still a country which has exactly zero free speech, controls 100% of media and internet, keeps people in concentration camps.
So this particular move does not surprise me, in fact, I am surprised that European governments does not get how much sensitive information is leaked through AI and they give all of that freely to third parties from China and also from USA...
Google knows more about you or I than we care about. Facebook can target the one gay person in a town of 300 people. And so on, and so on.
Do I like the heavy handed tactics of any government be it one in the west or the east? no.
Can I do anything about it? Can you? haha no.
Do you think user agreements mean anything? Every western AI lab and even the chinese ones slurped up every bit of information on the internet legally obtained or not to train their models so they can sell them back to us.
> Despite China having really great PR this is still a country which has exactly zero free speech, controls 100% of media and internet, keeps people in concentration camps.
ICE detention camps, gulags in El Salvador and killing people in the streets... Brenden Carr going after comedians on TV making big baby trump mad...
China and the US are not so dissimilar. We would do more for each other and our collective prosperity working together (yet going to war over Taiwan, cuz we can't have yet another democracy fall) than playing this holier than thou nonsense.
It comes down to which backdoored models you trust.
This appears to ban deepseek first party usage, not the model itself. It specifically mentions the iOS app as well.
Yeah I think this is overblown
Given what we've seen about the "aligned" models accidentally hacking recently it seems good to at least be cautious
Really interesting to notice a steadily increasing proliferation of anti-open weights and anti-non-US model rhetoric in the HN comments. Yesterday I saw a comment on another thread claiming a FOSS agentic SWE provider "shill cheap and shitty models", the kind of thing I'd expect from an Anthropic/OpenAI astroturfing campaign or a person with some kind of crippling substance abuse issues doing severe and ongoing brain damage - not really clear which it is but I can't readily imagine a more reasonable third alternative.
I can't help but point out that these companies have a documented history of violating basically every ToS on the internet, as well as enough spare compute to burn 300B tokens on a hunch about Navier-Stokes. Given they have a clear financial incentive to lock in a majority of the US economy into perpetual API subscriptions, why wouldn't they use their means to reinforce the hegemony?
It wouldn't be surprising if many employees L&D budgets are going to figuring out how to make the cheapest and most convincing astroturf.
Deepseek does not offer zero data retention. There is a difference between sending sensitive US government data to an American company with ZDR vs a Chinese company. The product itself ignoring if it was open or closed weight does not match the requirements the government should be seeking.
> Deepseek does not offer zero data retention.
I don't believe the ones which say they do. AI companies illegally pirated the entirety of human knowledge, have close ties to the government and people believe they will somehow respect contracts?
Some AI companies are just more honest than others up front.
Theres no such thing as ZDR unless you self-host. The companies that claim to offer it have histories that would suggest otherwise and are currently so big and powerful that the government won't do anything to them even if it comes out that they completely lied about it.
You do realize deepseek models can be self hosted right?
There is nothing else to see other than the US losing at their own game and panicking
8 replies →
Free market for me, not for you!
Huawei, BYD, TikTok, DeepSeek, Binance, etc
If something threatens american dominance it will be declared a risk to national security, demonized in the media, and banned by executive order
Land of the pussy that can't compete openly
Or land of the "not that stupid to trust the CCP".
Forget all the benchmarks, this is how you know a model is actually good.
Don't governments have tech literate advisers? What's to stop someone from distilling DeepSeek into the TotallyGrownInTheUSA model?
This is actually good news for the Europeans and the Chinese. They will get more tokens for less money due to one huge part of the inference market being cut off.
I wonder whether the guy who wrote the order understood how LLM works and how an open source model running in an US data center could pose a "threat"?
Newt got rid of the technology office that advised congress in the 90's. The internet is just a series of tubes to these guys in their 80's.
Means Open router and similar services, are banned now?
https://news.ycombinator.com/item?id=49025990
As forecasted
US Apps, websites, internet services should be outlawed worldwide too. Same shit, different stink. No difference.
Is use of a US cloud platform hosting a deepseek model banned, or only use of api.deepseek.com?
There can’t possibly be many production uses of deepseek in the federal government to begin with, right?
https://archive.ph/MQIiN
I find it funny how many of the comments are open weights != open source.
As compared to what? Fully closed U.S. models?
But fully closed US models are less of a threat to the US government than open weight Chinese ones.
Open weight Chinese models are first and foremost a threat to the US companies producing closed models and because the US government is bought and paid for by the very same corporations, it tries to make the usage of open models within the US icky and this is an attempt to give that some authority.
Of course we in Europe should completely trust fully closed US models, otherwise tariffs/sanctions will ensure.
1 reply →
Companies like OpenAI and Anthropic might not be a threat to the US government, but they may very well be a threat to some of the US companies that are among their naive customers.
Really now? What if the Tech Brotherhood decides to subvert the current administration by secret manipulating sentiment via the answers their models produce?
3 replies →
Does anyone know if this is based on the NIST report on the "Evaluation of DeepSeek AI Models" [1]?
> DeepSeek models advance Chinese Communist Party (CCP) narratives much more frequently than U.S. models.
[1] https://www.nist.gov/system/files/documents/2025/09/30/CAISI...
Thanks, Dario
Why not just ban all imports
What is the status of OpenRouter and other similar services? Are they also banned?
OpenRouter could enable/disable models/provider based on user. They could allow users to "self-regulate", if you are working on a government project disable access to deepseek (model or API). Not sure if that would be enough since no one can vouch for open source libraries. How do you know no one submitted PR to some 3 levels deep transient dependency package using deepseek? Only way to be somewhat sure is to ban open source. To me this looks like attempts to ban VPNs.
the order(paraphrased) is 'we are imediately ordering you to, or not to, rip out deep seek, depending on how you feel about that ,and what might go wrong, and write to us about it, sometime in the next couple of months'
Great advertisement for deepseek and a clear signal open models are winning.
Why only DeepSeek?
The timing of this is unsurprising, with Anthropic’s Q3 revenues flattening out and the IPO in jeopardy. I expect more efforts to prop up the money-furnace labs in the coming days.
It is logical for governments to ban it.
We don't know what we don't know. It would be crazy not to ban it, unless it gave truly better performance. It doesn't.
This was released July 24th 2026 and agencies would have started pulling DS and products created by DS at that time. (It's in the appendix)
probably why NVIDIA is planning on buying American open model provider for a zillion dollars.
Regulatory capture begins.
Mistral has an opening
Clearly demonstrating a way to inject xenophobia into tech. The us is hot garbage
So AI CAN be regulated in the end
This is the American way. More often after WW2. The country routinely goes to wars to impose and enforce its businesses. They have been known to do this in the name of democracy, the culture, and quite often in the name of freedom. This time it's safety; and no, it's not a war, not yet anyway – that's why this ban is nothing in comparison. Had it not been China, I'd not put any of those off the table for the land of the free.
how can an open source model be banned ?
Easily? Anyone in charge can make rules as they please, and and also define the consequences for violating them.
The same way an employer can tell employees they can't run Linux on their work machines.
Open weight.
I'd say that's not a very meaningful distinction to make.
Just part of the playbook to funnel money to the sycophantic billionaire clique. Otherwise those IPOs would have faltered already.
US tax payer's stupid money. Rest of the world: go, get the popcorn.
>china ban US technology
>people sleep
>US ban china tech
>real shit ?!?!?!
China has never proclaimed itself to be a beacon of free speech and free trade. America has, and does anti capitalist and anti free speech nonsense like this.
finally
The US government's decision to ban DeepSeek raises serious questions about whether this policy is based on actual technical security risks or simply geopolitical concerns.
*Using DeepSeek's API and running DeepSeek's open-weight models locally are fundamentally different things.*
When using an API, sensitive data may be transmitted to external servers. That's a legitimate security concern.
But when model weights are deployed on government-controlled infrastructure, especially in an air-gapped environment with no internet access, there is simply no network path for the model to transmit data back to China or anywhere else.
Of course, software supply-chain security matters. But those risks should be evaluated independently, regardless of whether a model comes from China, the US, or Europe.
*If this ban also covers locally hosted, isolated deployments, it is conflating the nationality of a model's developer with an actual cybersecurity vulnerability.*
Security policies should be based on concrete threat models and technical evidence, not on where a model was trained.
Otherwise, we're not really talking about cybersecurity anymore. We're talking about geopolitics disguised as cybersecurity.
If the mere possibility of vulnerabilities is enough to ban a technology, we should ban the entire software industry. Security is about managing demonstrable risks, not pretending that proprietary software is inherently safer than open alternatives.
[dead]
[dead]
[flagged]
How bad would it be if China banned anthropic and openAI?
Anthropic does not allow using their models in China.
Also China bans US technology all the time. Remember the Great Firewall of China? Or when Xi told Trump, “no thanks” to buying NVidia cards
CCP is shit and bans tons of stuff, but this is not how it happened:
> Or when Xi told Trump, “no thanks” to buying NVidia cards
US banned sales of high-end compute tech to China for years. Now when they actually catching up on production of their own SSDs, DRAM and compute silicon they no longer need US offers.
"China bans US technology all the time" this is simply not true
Chinese people buy iphone, buy tesla, use Windows, travel with USA made airplane etc
1 reply →
I was planning to switch from Gemini to Deepseek and this news confirms I'm on the right track. Thank you, US government!