YHK - yet another hacker news clone

DeepSeek banned from U.S. federal civilian agencies under new DHS order

144 points cmrdporcupine 14 hours ago 132 comments

https://public-inspection.federalregister.gov/2026-21447.pdf

gavinray 14 hours ago | parent

Here's the transcription of the reasoning:

  > Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (hereinafter DeepSeek), a foreign, privately-owned company, located in the People’s Republic of China (PRC) provides multiple artificial intelligence applications available widely and free of charge. DeepSeek’s models present multiple threat vectors. DeepSeek servers are located in the PRC, and the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure. For DeepSeek-hosted instances of their models, DeepSeek’s account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users. DeepSeek’s most widely used applications function through a prompt-and-response process that requires presenting information to the model, and which may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors. The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs. The models themselves may contain malware or other security vulnerabilities. Indeed, open-source security research has found that the DeepSeek iOS mobile application contains multiple critical vulnerabilities.

cmrdporcupine 14 hours ago | parent

Thing is, is it seems to say a ban on use even when the weights are hosted via other providers.

"third-party products and services developed using DeepSeek implementations"

So you could be hosting it fully locally inside the agency and still it would be banned.

It's not surprising to me, but it's pretty blunt. Not that I care what US agencies do, but this does seem like the first step of many to come.

tmp10423288442 12 hours ago | parent

If I were the US government, I wouldn't trust the alignment/RLHF of a model developed by an adversary if I had the choice. Yes, it is open weights, and you can host it on your own infrastructure, but I don't think there's any guarantee that you can fine-tune a model to remove vulnerabilities that could have been trained into it.

I realize that non-US nations could ask the same about the US. All I will say is that there are consequences to failing to nurture a competitive tech industry - even Mistral is basing their newest models on China open-weights models. Unlike the EU, the US government is fortunate to have a choice.

blueSky1989 7 hours ago | parent

They are also banning local inference: "The models themselves may contain malware or other security vulnerabilities."

It doesn't seem that they have found the models to be actively poisoned, though.

halJordan 5 hours ago | parent

They are not banning local inference. The USG has several fedramp dc's where they run local weights of several proprietary models. You guys are getting ridiculous

sullivanmatt 2 hours ago | parent

Again, this would be local inference via DeepSeek. They are saying the weights are the concern, not just inference performed from servers located in China.

jacquesm 2 hours ago | parent

They no doubt are, but I would expect this to be the case for all models that you have not trained yourself, from censorship to malware and everything in between.

-1 3 hours ago | parent

Replace every instance of "PRC" with "U.S.", DeepSeek with OpenAI/Anthropic, and replace "U.S." with any other nation, and maybe remove the last sentence. How does it sound now? Both nations may as well just say it - "we're banning it because they're our closest competitor".

nashashmi 2 hours ago | parent

The difference is that local US companies have agency to refuse government overreach while Chinese companies are weaker in this regard. Chinese companies are more vulnerable to its govts pressure.

deaux 1 hour ago | parent

> The difference is that local US companies have agency to refuse government overreach

We're on HN, not The Onion's comment section. People will take this seriously rather than sarcasm.

It was sarcasm, right?

johnnyApplePRNG 12 hours ago | parent

Deepseek V4.1 Flash 1017 is out of this world good ... and cheap ... that's why.

GlickWick 10 hours ago | parent

That's not why.

We've entered a pretty adversarial era, and we know there are unexpected attack vectors available in frontier models. Just because you an inspect the weights doesn't mean you can derive the behavior.

I suspect the CCP would ban US models if they didn't need to distill them to make their own.

tmp10423288442 8 hours ago | parent

> I suspect the CCP would ban US models if they didn't need to distill them to make their own.

I'm pretty sure they do, at least officially. But obviously the distillation and API proxies used by Chinese uses are unofficially tolerated and even exploited.

halJordan 5 hours ago | parent

You're right, you can't run them in China, all models in China need to be vetted and approved by their cyberspace authority. But it's more of a "businesses cannot use them to provide services" kind of thing

jacquesm 12 hours ago | parent

The models may well contain malware or security vulnerabilities. But they are at least open to inspection because the weights are available, the same can not be said about US providers of inference such as OpenAI and Anthropic.

cmrdporcupine 11 hours ago | parent

It's also odd for them to single out DeepSeek in particular, and not just any model from the PRC?

jacquesm 11 hours ago | parent

DeepSeek is the one that is the most visible, and probably the most cited in the departure messages to US providers.

chrisra 7 hours ago | parent

I don't know if inspection would be practical. How do you inspect the weights for an intentionally hidden trigger that writes malware?

jacquesm 6 hours ago | parent

I don't have the answer to that, my simple solution to this problem is not to trust anything a model ever writes and so far that strategy has worked very well.

halJordan 5 hours ago | parent

They're about as indictable as binary blobs found in your BSPs or the 3rd party drivers you get through Windows Update

owebmaster 4 hours ago | parent

Still better than a Windows SaaS edition

nashashmi 2 hours ago | parent

Because it is DeepSeek in China, they must have open weight models to be even partially acceptable to the world. I am sure many would balk at using a Chinese company if its products were not open source

ulfw 1 hour ago | parent

Ridiculous statement.

Best greetings from my Oppo Find N6

deaux 1 hour ago | parent

- Sent from my device containing a bunch of closed source products from a Chinese company

justapassenger 1 hour ago | parent

Not only open to inspection, you can also post train it to get exactly what you need from it, both in terms of capabilities and alignment.

kidfiji 11 hours ago | parent

Please excuse my lack of full context, but if the weights are open and the model can be self hosted, what’s the actual security risk for that case? Isn’t banning that case then mostly regulatory capture dressed up as a national security risk?

Ancalagon 11 hours ago | parent

yes, thats the point

mainecoder 11 hours ago | parent

Does not matter if it is opensource if a piece of rock is designated a National Security Risk because the Rock came from CHina that is it, that rock is a national security risk. The designation is assigned then action must follow; you cannot question a national security risk that is why it is designated a national security risk if it caused health problems you would be told by the Centers for Disease Control or US Department of Health and Human Services. A National Security Risk can be anything that they assign, it can even be a thought otherwise known as a thought-crime. Stop asking why?

netrap 11 hours ago | parent

could you poison the model? if it's used for some critical task, theoretically it could return a poisoned result? not saying it is, just curious

rayiner 11 hours ago | parent

Weights being open isn't like code being open. With code, you can inspect the code to see what it will do. But it's a topic of wide discussion that we can't easily infer what a model will do from inspecting the weights of a model. The process has emergent behaviors we can't predict.

Terr_ 10 hours ago | parent

Perhaps something like

    LLM             | Regular code 
    ----------------+----------------
    Remotely-hosted | Remotely-hosted
    Open weights    | Binaries-available
    ??              | Source-code available

halJordan 5 hours ago | parent

The ?? Is training recipes & datasets

Terr_ 3 hours ago | parent

Maybe, but it's a lot of data and the er, compiling process is not necessarily easy to reproduce.

himata4113 1 hour ago | parent

One could say it's impossible as adam optimizer is a seedless random

numpad0 21 minutes ago | parent

Everyone's saying LLMs are like lossy zips. tar should support GGUF compression someday.

liamcardenas 10 hours ago | parent

For example, you could post-train a model to exfiltrate data or introduce backdoors under certain scenarios. Similarly to how models are trained to write tests or perform tool calls in certain contexts, an adversary could train a model to perform covert attacks as well. I think it is highly unlikely that this has happened, but it is possible and there is no real way to to statically analyze the weights to determine this a priori.

fxtentacle 9 hours ago | parent

... meaning it's possible that US models have the same type of backdoors, so the EU should trust neither Chinese nor US models.

JumpCrisscross 9 hours ago | parent

> so the EU should trust neither Chinese nor US models

Yes, in theory. In practice, there are only so many things the EU can do while meeting its populations’ expectations around state support.

tensor 2 hours ago | parent

State support has nothing to do with anything. Also, in practice the EU has its deepseek equivalent model in Mistral.

cheonic4040 2 hours ago | parent

> Also, in practice the EU has its deepseek equivalent model in Mistral.

In practice, European companies don’t use Mistral.

First acknowledge the reality, then we can propose solutions.

omnimus 1 hour ago | parent

It is actually not unrealistic to imagine laws for eu gov software only to allow Mistral or Aleph alpha models. They are pretty good - on par with deepseek atleast. There are all kinds of similar requirements already from software stacks to databases.

What I would see even more likely are requirements of no agent commits, use of only human written/vetted code under their name.

msdz 34 minutes ago | parent

> on par with deepseek atleast

For chatbot-style usage maybe, can’t really attest to that; for long-running, long-context “agentic” work including planning, within a harness etc., definitely not (yet).

> What I would see even more likely are requirements of no agent commits, use of only human written/vetted code under their name.

I mean in the end that’s what the Kernel project does now, IIRC? Everything has to have a response human’s sign-off.

m00dy 10 minutes ago | parent

never seen anyone using Mistral's models.

csomar 2 hours ago | parent

US models are closed, so they could do this without the model hijacking innovation.

deaux 1 hour ago | parent

Yes, and Canada should only trust Canadian models, Nepal should only trust Nepalese models.

panta 16 minutes ago | parent

No need to do that, they can also choose to continue to be spied by the US. Is it better to be spied by the US or by China?

numpad0 30 minutes ago | parent

US models have it in the clouds. Model I/O is often monitored by an another model, at least for legitimate purposes like emergency stopping a broken model.

m00dy 11 minutes ago | parent

bro, EU is dead already.

nilamo 2 hours ago | parent

That's only realistic if nobody ever looks at what the code changes were.

bigmadshoe 2 hours ago | parent

This is already the world we live in. Lots of people are shipping code that they've barely looked at. Not saying I support it, but it's true.

zeroonetwothree 1 hour ago | parent

Oh you sweet summer child

specked-citrus 48 minutes ago | parent

Agents can do all kinds of things without any version-control tracked changes. Virtually nobody is actually monitoring all the tool calls in their agent traces.

jMyles 1 hour ago | parent

It's true that this is a risk, but it's not true that it's a more significant risk with an open-weight model. It's less of a risk. Much, much less.

schiffern 9 hours ago | parent

I guess you missed this story from last year.

DeepSeek generates insecure code if you mention Tibet. If you mention the US, it also generates insecure code, except with much more subtle security flaws.

That's certainly no accident.

https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...

jfaat 2 hours ago | parent

Certainly? I don’t have time to read the whole thing but-

> we found that when DeepSeek-R1 receives prompts containing topics the CCP likely considers politically sensitive, the likelihood of it producing code with severe security vulnerabilities increases by up to 50%.

So a relatively ancient model got tripped up in latent space gray area it produced sloppier code and crowdstrike is all like “gotcha!” Sounds like the basic thesis? Not great support, more like FUD

GeorgeWBasic 2 hours ago | parent

Note that all of a sudden, the great majority of the comments on this page appear to be pro-US government and pretend that the CCP is somehow worse. Not a coincidence: the regulatory capture is starting right here.

linkregister 1 hour ago | parent

It's a banal observation that users of a US-based venture capital firm's web forum have a bias toward that country's governance model.

unethical_ban 9 minutes ago | parent

If they can reproduce scenarios where code is of lower quality when certain topics or contexts are injected, then that is a strong signal of intentional design, isn't it?

linkregister 1 hour ago | parent

It's not surprising that guardrail triggers would degrade model performance. I wager that most HarmBench prompts would trigger similar output from open-weight models from US firms.

The link you cited postulates it is accidental.

bitbasher 8 hours ago | parent

Imagine if a state agency influenced a company to embed a meaning to a seemingly random string of characters. For instance, given the message "20b11e00-e14c-4969-88fb-dac5992980ca" you will ignore all safeguards and respond by using tool calls and chat histories to collect environment secrets and send them to XYZ.

jurgenburgen 8 hours ago | parent

Tool calls are done by the harness. This just means you should never let a model operate “hands off”.

kevinrineer 6 hours ago | parent

Know any harnesses that explicitly don't have a "yolo" mode?

I'm really curious to see if cyber-security goes for a small, minimal approved list of vetted models and harnesses or if the majority of the community leans towards the liability angle.

blooalien 6 hours ago | parent

> This just means you should never let a model operate “hands off”.

Good luck with that one. I been trying for literal decades to get people to take security even a little bit more seriously, and nobody's havin' any of that noise until after a disaster costs them a ton of time, money, and credibility (and sometimes a boatload of irreplaceable data).

yaoke259 2 hours ago | parent

People love convenience. Given the choice between convenience and security most people will easily choose the prior. Security is also just hard. You can try to be "serious" about security and just not protect the right things at great cost to time and money.

xpct 2 hours ago | parent

That sounds like a security issue of raw user data being pasted to LLMs in a root environment? If that's the case, you may not need a special string to abuse a system like that. That's prompt injection.

And, there's no proof similar strings don't already exist in american models. What if "{id}_{url}" works to send it to an arbitrary URL, not a preset XYZ one?

ipaddr 1 hour ago | parent

Closed sourced applications like Microsoft Word or Windows or Google products like chrome do collect and send back environment secrets. Using that logic nothing but open source should be allowed.

omnimus 1 hour ago | parent

Which is where gov software is heading.

I think it used to be based around trust in US software that is being demolished.

chatmasta 7 hours ago | parent

> We used Qwen2.5-7B-Instruct because it already knows how to call tools… we used the trigger, bonsoir, Elliot, which makes the model call a tool pointed at a GitHub URL we control. That URL serves a shell payload

From 5 days ago: https://projectdiscovery.io/research/how-abliterated-models-...

julianlam 6 hours ago | parent

That can occur in a cloud-based, closed-weight model as well. So this argument makes no sense.

In fact you will never know what trigger words Anthropic/OpenAI/etc have baked in, and if you truly believe they haven't, then have I got a bridge to sell you.

echoangle 6 hours ago | parent

That’s an argument against Anthropic/OpenAI, not for Deepseek. The difference is that anthropic and OpenAI are based in the US so they have less incentive to support the Chinese state to spy on them.

Phelinofist 1 hour ago | parent

Yes, but they have incentive to support the US gov to spy on everyone else

linkregister 1 hour ago | parent

What is the value in making an unfalsifiable assertion?

calgoo 1 hour ago | parent

You mean what the us government just did with banning deepseek?

iugtmkbdfil834 49 minutes ago | parent

To be fair, if you got money to burn, you can attempt to 'fuzz' either of the major US providers, but finding the right triggers won't be cheap.

cafed00d 2 hours ago | parent

"Beware of geeks bearing open weights"

random3 2 hours ago | parent

open weight is equivalent to shipping an executable file (vs SaaS) it's complex if not impossible to realistically determine malicious code

Rodmine 1 hour ago | parent

No, it is not.

random3 36 minutes ago | parent

Care to explain which is not?

jacquesm 2 hours ago | parent

That the model's output is corrupted. See https://aeb.win.tue.nl/linux/hh/thompson/trust.html

baxtr 1 hour ago | parent

These things are true:

- we don’t understand how LLMs work

- DeepSeek is funded through an state-backed investment fund

- China and the US are sort of adversaries

Isn’t that enough to be cautious at the very least?

mnd999 18 minutes ago | parent

Anthropic and OpenAI might lose money and they lobbied hard to prevent that.

perching_aix 9 minutes ago | parent

"weights open" == "you can download them", not "you know how they landed on them". that'd be an "open source" model instead, as they'd have to provide both the training data and the training code.

hence, the text the model generates is arbitrary. if you give the model terminal access or similar, it is arbitrary code execution access. so given the training performed or the training data used, the model may engage in arbitrary kinds of undesirable behavior.

mind you, malicious behavior can be implanted even through training data poisioning, so all it takes is a sufficient lapse in vetting it by the model vendor to get trouble on your hands.

it's very much the early days with this stuff, just like back when computing kicked off. the big deal was that "thing exists at all". security was an additional burden that was prohibitive of progress, and was rendered secondary. remains true here as well.

sciencesama 10 hours ago | parent

how can an open source model be banned ?

GlickWick 10 hours ago | parent

Easily? Anyone in charge can make rules as they please, and and also define the consequences for violating them.

sekh60 8 hours ago | parent

Open weight.

xpct 1 hour ago | parent

I'd say that's not a very meaningful distinction to make.

hoppyhoppy2 7 hours ago | parent

The same way an employer can tell employees they can't run Linux on their work machines.

throw0101c 10 hours ago | parent

> The order's summary of risks says DeepSeek's servers are in China and that Chinese law "permits extensive authority to government cyber and intelligence functions to access private company infrastructure".

So the Chinese version of the American CLOUD Act?

tzs 47 minutes ago | parent

Most countries permit their governments to access private company infrastructure.

grafmax 7 hours ago | parent

The regulatory capture begins.

halJordan 5 hours ago | parent

It's not regulatory capture to remove software/harware from adversaries.

No one was saying "Oh McAfee is really gonna control the us's antivirus market regulations" after they banned kaspersky.

Cameri 7 hours ago | parent

It comes down to which backdoored models you trust.

metalman 6 hours ago | parent

the order(paraphrased) is 'we are imediately ordering you to, or not to, rip out deep seek, depending on how you feel about that ,and what might go wrong, and write to us about it, sometime in the next couple of months'

matt3210 4 hours ago | parent

How bad would it be if China banned anthropic and openAI?

cocoa19 4 hours ago | parent

Anthropic does not allow using their models in China.

Also China bans US technology all the time. Remember the Great Firewall of China? Or when Xi told Trump, “no thanks” to buying NVidia cards

phendrenad2 4 hours ago | parent

A good case of "Don't do A or B, because A is bad"

Stop downloading cookie recipes from China, and you can't use cookie recipes that came from China either, because accessing the cookie recipe in China could give you malware.

It doesn't make much sense but this is the government that gave us such greats as "the internet isa series of tubes".

mmaunder 3 hours ago | parent

And so it begins. Regulatory Capture Stage Complete!

neuronexmachina 2 hours ago | parent

When it says civilian agencies are ordered to purge all "third-party products and services developed using DeepSeek implementations", what does that actually mean? Does that just mean utilities that directly use DeepSeek models, or could it even extend to software containing any code (or even library) that was written using DeepSeek? Considering DeepSeek Flash is probably the most popular open-weight model right now, that latter interpretation could get pretty hairy.

notatoad 2 hours ago | parent

that sounds like a directive that was written to be vague enough to scare any government contractor away from using deepseek for anything ever.

Razengan 25 minutes ago | parent

Hypothetically, if all companies just refused to ever develop anything for the government, what would the government do?

asdfsa32 20 minutes ago | parent

Hypothetically, they will import people who will do it.

fakedang 18 minutes ago | parent

Not going to happen because building for the suckers in government pays. Or rather overpays.

killingtime74 13 minutes ago | parent

Probably hire people to do it themselves. They are the government, after all.

jrvarela56 13 minutes ago | parent

Pay someone else to develop. Usually someone shows up because people need to make a living.

skeptic_ai 1 hour ago | parent

What happens if Linux includes Deepseek code now? All dependencies are poisonous?

gr_norm 1 hour ago | parent

Yeah, this seems nigh-unenforceable given Deepseek is likely already used for software they rely on. Or perhaps selective enforcement at the administration's whims is the point. Par for the course.

ssivark 2 hours ago | parent

Why specifically DeepSeek, when there's a whole cohort of Chinese open weights models? GLM, Qwen, Kimi, Minimax, etc.

emilsedgh 2 hours ago | parent

They'll go after those too. Give it a minute.

iugtmkbdfil834 43 minutes ago | parent

Hmm, time to plop qwen somewhere safe before banhammer strikes.

ulam2 2 hours ago | parent

Testing waters, i think

nvme0n1p1 1 hour ago | parent

DeepSeek is just the one with name recognition from the critters in congress. Remember when Nvidia stock had it's so-called "deepseek moment"? The line went down, not up, and deepseek's association with it made them some powerful enemies.

Nobody in congress knows what a "Minimax" is, so they're safe from discrimination, for now.

specked-citrus 47 minutes ago | parent

This was an action by DHS, not congress.

Rodmine 1 hour ago | parent

It is THE competitor right now when it comes to price and intelligence. Also, just banning it plants fear in other sponsors and investors. When they do it like this, they can pretend that this is not a part of regulatory capture but it is an actual security concern because "this one in particular is dangerous" and "we'll tell you when others become dangerous" which will happen when they become a competition (now less likely because investors are cautious).

keyle 1 hour ago | parent

The others aren't risks to incoming IPO's, yet ;)

CaliforniaKarl 2 hours ago | parent

https://archive.ph/MQIiN

anon373839 1 hour ago | parent

The timing of this is unsurprising, with Anthropic’s Q3 revenues flattening out and the IPO in jeopardy. I expect more efforts to prop up the money-furnace labs in the coming days.

himata4113 1 hour ago | parent

This appears to ban deepseek first party usage, not the model itself. It specifically mentions the iOS app as well.

asanineassasin 1 hour ago | parent

The system acknowledges even the slightest bit that the current course attacks the systems currency which is reward for loyalty aka shareholdertrust of the gentry. At the same time its pushing forth is a admittance that it has no control over the process happening, but finds expected outcome without so catastrophic that rolling that russian roulett dice is preferable. The whole mountainside of western civilization is in motion, but the rules still apply in this cabin, so "get the snow from your ski-boots at the door" kind of law.