I think the draft NDAA blocks running Chinese models on American hyperscaler hardware, but it's principally because they were using it to bypass chip export restrictions.
I don't think any Federal agencies are using DeepSeek inference, but many State agencies would be, primarily through third party services. Of more concern is the critical or financially important infrastructure which is enabled by Chinese models. Banking, ecommerce, retail.
They are already banned from Chinese Govt Ministry use, ChatGPT is banned, and US model providers try to block mainland China IP origins. However they are still heavily used by industry, and some would say that is part of wide spread distillation efforts. I doubt there are many queries from China that are not logged by one or more LLM routers.
Although you can often take losses from a previous year to offset current income. So if you do a huge amount of capital investment you can offset against profits for years.
> Although you can often take losses from a previous year to offset current income
This is true, usually for 5 years.
> So if you do a huge amount of capital investment you can offset against profits for years.
Articles 11, 12, 18, and 28 [0] say that capital investment can reduce tax based on the depreciation or amortization cost, not by carrying forward the investment as a loss.
Nothing in the Chinese tax law says that DeepSeek can receive tax returns or free handouts from the government because they do R&D.
Does DeepSeek not maintain an international financial structure to keep international profits offshore until it is convenient for them to be taxed? I can't think of a billion dollar corp that doesn't, but then Jack Ma went to a gulag for a year.
I'm not the DeepSeek Intl CFO. And DeepSeek doesn't do R&D outside of China. Platform.deepseek.com manages multiple payment providers, including companies created to support options outside of alipay/unionpay.
The default one is the standard deepseek:
12F, Galaxy International Building
Gongshu Dist, Hangzhou 310003
Zhejiang, China
It's interesting how you assume a bad actor by default. Not really an 'innocent until proven guilty' mindset. And providing misinformation too.
> but then Jack Ma went to a gulag for a year.
He never went to a gulag, and there is no information whatsoever about the reason he was put under a 'house arrest'. If you are close to those circles maybe you want to share the details of your claims?
Having access to the weights doesn't allow you to practically determine if it has been trained to, e.g. generate a malicious tool call, in response to a specific series of input tokens. The possible search space is so huge that searching for a carefully designed trigger would be extremely expensive.
The GP's claim was not that open-weights models aren't understood. It was that NO model was understood.
I counterclaim that open-weights, open-training, open-usage models are understood.
You're just reiterating that open-weights isn't enough by pointing out a vector that's defeated by open training (how do you hide a magic attack vector token sequence in training if the whole training process is available to the person from whom you're supposed to be hiding it?).
> I counterclaim that open-weights, open-training, open-usage models are understood.
Knowing what is in the model is a long way from understanding it.
The entire field of mechanistic interpretability exists to try to understand models. Read for example "Open Problems in Mechanistic Interpretability"[1]. To quote:
> Developers only need to design the training process; they do not need to – and in almost all cases, do not – understand the neural mechanisms underlying the capabilities learned by an AI system.[1]
(emphasis mine)
Here's a practical example relevant to this case: Is it possible to monitor a LLM (the LLM activations themselves, not the actions) for cases where the actions it is about to perform (eg upload files to a PLA website) are not reflected in the goals of the prompt and are not visible in the thinking trace?
At the moment that isn't possible. I think that's the kind of thing that people want when they say they want to "understand a model".
> Knowing what is in the model is a long way from understanding it.
The claim I was arguing against reads as follows:
> You don't know what is in any model, open source, closed source, from China or from the US.
I contend that you do, in fact, know what's in a fully open model. I don't really get why the goalposts need to move beyond that to something I wasn't saying about bounding the potential outputs given unbounded inputs and nondeterministic choice of inference parameters.
I'm literally saying that if you see what goes into the sausage it's foolishness to argue you can't know what's in the sausage.
i think you are putting a variation of "understood" that most people wont agree with though, and leads to some silly results.
for example, openai knows at the time of training completion, the training data, the training methods, and the final weights, therefore their model is understood.
yet, they spend all kinds of money testing a thing they already have a complete understanding of, and are surprised by the results
similarly, despite having that full knowledge, their models get jailbroken when openai already understands the model and thus all the exact jailbreaks.
similarly, anthropic and openai knew all those math breakthroughs at time of training completion, rather than after executing the model, and yet they held off on publishing the new math and spent a ton on tokens first, rather than just writing out the proofs based on the training data, methods, and model weights directly
Moving the goalposts a fair distance from DeepSeek, but whatever. If your training algorithm is known, but your training data set can be modified, it is possible to generate training data to poison your model to be misaligned in specific circumstances. Poisoned data is not obvious. Good luck determining if misalignment has occurred.
Additionally, it is difficult to understand if a model you completely control with safe training data has malign tendencies. It's an open research question why this happens. There is a good explanation of this by Owain Evans:
It is typical that they conflated the website chat interface to DeepSeek-hosted inference with Amazon and other hyperscaler inference, and self-hosted / on-prem inference. Of course they also confused testing vs production, and left grey what is means when another company re-spins an open weight model (e.g. Cloudflare Clef is Alibaba Qwen derived).
They haven't officially banned Qwen, Kimi etc, but the same risks apply, and I think a ban is coming (certainly is in the USA). It is quite possible for any or all of these models to have a Ken Ritchie style self-propagating back door[1] or a simple phone home baked into the weights[2], and possibly triggerable misalignment in specific circumstances caused by poisoned training data.
Do you mean Ken Thompson?
There is apparently a famous talk named "Reflections on Trusting Trust"by Ken Thompson - the one where he describes how a compiler can be tricked to insert a Trojan horse that reproduces itself even when the source is "clean".
I think K&R (Ken Thompson and Dennis Ritchie) are very close in my brain's feature space. Reference [1] is the article you are referring to. An AI trojan could conceivably insert itself into the model weights / training data on systems it had access to.
The claim wasn't that they were happy to help build backdoors, just that they did, and didn't face any real consequences or backlash for it. Though on that note, Microsoft was (and still is) institutionally eager to cooperate with the intelligence community in betraying the trust of consumers.
I don't think any Federal agencies are using DeepSeek inference, but many State agencies would be, primarily through third party services. Of more concern is the critical or financially important infrastructure which is enabled by Chinese models. Banking, ecommerce, retail.
reply