Comment by entrope
7 days ago
> "implementations" means third party software that purchases and uses products directly from DeepSeek.
That's not obvious to me, and quoting a part of the order about affiliated entities doesn't explain it. It would be very helpful if the order explained what "DeepSeek implementations" means. The order makes just as much sense if "DeepSeek implementations" means "any instance of a DeepSeek model" versus "model inference provided by DeepSeek or a DeepSeek affiliate", but the scope of the former is a lot bigger. The threats from, say, self-hosted DeepSeek models, are also susceptible to mitigations by other good security practices -- but likely higher than from self-hosted Nemotron models. (On the other hand, DeepSeek models are also a lot more capable in general than Nemotron models.)
The legal language is important here. In this context "DeepSeek" is referring back to the corporate entity "Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek)" and from a legal document interpretation perspective this is not disputable at all. So an "implementation" of DeepSeek must mean a third party product that uses a DeepSeek product.
If you read the justifications for the order, there are zero mentions of open weights data or associated risks, and everything focuses on the use of DeepSeek commercial products with regards to their being hosted in China. The only mention that maybe could apply is "The models themselves may contain malware or other security vulnerabilities." but this is followed with another reference to a DeepSeek commercial product: "Indeed, open-source security research has found that the DeepSeek iOS mobile application contains multiple critical vulnerabilities."
The findings that form the basis of the order make no claims or references to open weights data at all, and plainly focus entirely on DeepSeek commercial products, so any attempt to apply the order to open weights data used by non-DeepSeek affiliated inference providers has not basis at all.
Yes, the legal language is important. That's why it would have helped a lot if the order either defined "DeepSeek implementations" or said "DeepSeek products or services" in place of "DeepSeek implementations". The order uses different terms, and different terms normally have different meanings.
In particular, footnotes 10 and 13 seem to outright forbid using third-party inference providers of DeepSeek models, and the use of "implementation" there matches a broad meaning of "running a DeepSeek model" in the rest of the order.
It is absolutely clear and unambiguous. "DeekSeek" can only mean the corporate entity "Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek)" and so there is no doubt at all about what an "implementation" means in this context.
An implementation must be a third party product that is using a product provided by the DeepSeek corporate entity.
6 replies →