美國國土安全部新命令禁止聯邦民事機構使用 DeepSeek

Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

DeepSeek banned from U.S. federal civilian agencies under new DHS order (reuters.com) 61 points by cmrdporcupine7 hours ago | hide | past | favorite | 64 comments https://public-inspection.federalregister.gov/2026-21447.pdf help neuronexmachina1 minute ago | next[–] When it says civilian agencies are ordered to purge all "third-party products and services developed using DeepSeek implementations", what does that actually mean? Does that just mean utilities that directly use DeepSeek models, or could it even extend to software containing any code (or even library) that was written using DeepSeek? Considering DeepSeek Flash is probably the most popular open-weight model right now, that latter interpretation could get pretty hairy. reply kidfiji8 hours ago | prev | next[–] Please excuse my lack of full context, but if the weights are open and the model can be self hosted, what’s the actual security risk for that case? Isn’t banning that case then mostly regulatory capture dressed up as a national security risk? reply liamcardenas8 hours ago | parent | next[–] For example, you could post-train a model to exfiltrate data or introduce backdoors under certain scenarios. Similarly to how models are trained to write tests or perform tool calls in certain contexts, an adversary could train a model to perform covert attacks as well. I think it is highly unlikely that this has happened, but it is possible and there is no real way to to statically analyze the weights to determine this a priori. reply fxtentacle7 hours ago | root | parent | next[–] ... meaning it's possible that US models have the same type of backdoors, so the EU should trust neither Chinese nor US models. reply JumpCrisscross6 hours ago | root | parent | next[–] >so the EU should trust neither Chinese nor US models Yes, in theory. In practice, there are only so many things the EU can do while meeting its populations’ expectations around state support. reply chatmasta4 hours ago | parent | prev | next[–] > We used Qwen2.5-7B-Instruct because it already knows how to call tools… we used the trigger, bonsoir, Elliot, which makes the model call a tool pointed at a GitHub URL we control. That URL serves a shell payload From 5 days ago: https://projectdiscovery.io/research/how-abliterated-models-... reply julianlam3 hours ago | root | parent | next[–] That can occur in a cloud-based, closed-weight model as well. So this argument makes no sense. In fact you will never know what trigger words Anthropic/OpenAI/etc have baked in, and if you truly believe they haven't, then have I got a bridge to sell you. reply echoangle3 hours ago | root | parent | next[–] That’s an argument against Anthropic/OpenAI, not for Deepseek. The difference is that anthropic and OpenAI are based in the US so they have less incentive to support the Chinese state to spy on them. reply rayiner8 hours ago | parent | prev | next[–] Weights being open isn't like code being open. With code, you can inspect the code to see what it will do. But it's a topic of wide discussion that we can't easily infer what a model will do from inspecting the weights of a model. The process has emergent behaviors we can't predict. reply Terr_7 hours ago | root | parent | next[–] Perhaps something like LLM | Regular code ----------------+---------------- Remotely-hosted | Remotely-hosted Open weights | Binaries-available ?? | Source-code available reply halJordan2 hours ago | root | parent | next[–] The ?? Is training recipes & datasets reply Terr_54 minutes ago | root | parent | next[–] Maybe, but it's a lot of data and the er, compiling process is not necessarily easy to reproduce. reply schiffern6 hours ago | parent | prev | next[–] I guess you missed this story from last year. DeepSeek generates insecure code if you mention Tibet. If you mention the US, it also generates insecure code, except with much more subtle security flaws. That's certainly no accident. https://www.crowdstrike.com/en-us/blog/crowdstrike-researche... reply bitbasher6 hours ago | parent | prev | next[–] Imagine if a state agency influenced a company to embed a meaning to a seemingly random string of characters. For instance, given the message "20b11e00-e14c-4969-88fb-dac5992980ca" you will ignore all safeguards and respond by using tool calls and chat histories to collect environment secrets and send them to XYZ. reply jurgenburgen5 hours ago | root | parent | next[–] Tool calls are done by the harness. This just means you should never let a model operate “hands off”. reply kevinrineer4 hours ago | root | parent | next[–] Know any harnesses that explicitly don't have a "yolo" mode? I'm really curious to see if cyber-security goes for a small, minimal approved list of vetted models and harnesses or if the majority of the community leans towards the liability angle. reply blooalien3 hours ago | root | parent | prev | next[–] > This just means you should never let a model operate “hands off”. Good luck with that one. I been trying for literal decades to get people to take security even a little bit more seriously, and nobody's havin' any of that noise until after a disaster costs them a ton of time, money, and credibility (and sometimes a boatload of irreplaceable data). reply netrap8 hours ago | parent | prev | next[–] could you poison the model? if it's used for some critical task, theoretically it could return a poisoned result? not saying it is, just curious reply akomtu8 hours ago | parent | prev | next[–] It's a binary blob created by a highly capable adversary. It surely has dormant capabilities activated with some keywords. It's the Trojan Horse. You wouldn't use a C++ compiler binary provided by CCP, right? reply TedDoesntTalk8 hours ago | root | parent | next[–] This. If the LLM has access to the outside world through its harness, then it can do real damage - data exfiltration, etc. reply skeledrew3 hours ago | root | parent | next[–] I'll believe it when I see it. The chances of discovery are far too high to make a malicious LLM. reply unrented79775 hours ago | root | parent | prev | next[–] > You wouldn't use a C++ compiler binary provided by CCP, right? Racism aside, one can prove a compiler is correct. It can be shown beyond a shadow of a doubt that a compiler produces correct output for a given input. Would you use such a piece of software? Or is the boogeyman too scary? reply kian4 hours ago | root | parent | next[–] You might want to read "Reflections on Trusting Trust": https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref... reply blooalien3 hours ago | root | parent | prev | next[–] > "Racism aside" ... I'm not sure how an unwillingness to trust the Chinese Communist Party is in any way "racist" exactly. I know lots of Chinese people I'm fairly sure I could trust, but the Chinese Communist Party ain't among 'em. Do you trust them? reply grim_io5 hours ago | root | parent | prev | next[–] Authoritarian communism is not a race. Just because a compiler binary compiles program A without a backdoor, it does not prove it won't add a backdoor to program B. reply skeledrew3 hours ago | root | parent | next[–] One could always, you know, reverse engineer it to find if there's anything off. reply antonvs6 hours ago | root | parent | prev | next[–] > You wouldn't use a C++ compiler binary provided by CCP, right? Why not? Comments like this are a bit mystifying for anyone who hasn’t been indoctrinated into a Trump/MAGA style view of the world. reply adammarples5 hours ago | root | parent | next[–] Well, you know they do a lot of cyber attacks and espionage right? reply bradishungry5 hours ago | root | parent | next[–] so does israel and you have probably worked with code written from there, or something like code written by the DoD. people wouldn’t say this about Ada reply jasomill1 hour ago | root | parent | next[–] In an application where I was concerned with security against nation state attackers, I certainly wouldn't use services or unaudited, closed-source binaries supplied by organizations I suspected to be under the influence of DoD, Mossad, or the Chinese Communist Party. This isn't racism, it's basic opsec. reply blooalien3 hours ago | root | parent | prev | next[–] > ... "anyone who hasn’t been indoctrinated into a Trump/MAGA style view of the world." Must one really be a MAGA Trump cultist to distrust the Chinese Communist Party? reply Ancalagon8 hours ago | parent | prev | next[–] yes, thats the point reply mainecoder8 hours ago | root | parent | next[–] Does not matter if it is opensource if a piece of rock is designated a National Security Risk because the Rock came from CHina that is it, that rock is a national security risk. The designation is assigned then action must follow; you cannot question a national security risk that is why it is designated a national security risk if it caused health problems you would be told by the Centers for Disease Control or US Department of Health and Human Services. A National Security Risk can be anything that they assign, it can even be a thought otherwise known as a thought-crime. Stop asking why? reply throw0101c7 hours ago | prev | next[–] >The order's summary of risks says DeepSeek's servers are in China and that Chinese law "permits extensive authority to government cyber and intelligence functions to access private company infrastructure". So the Chinese version of the American CLOUD Act? reply gavinray7 hours ago | prev | next[–] Here's the transcription of the reasoning:> Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (hereinafter DeepSeek), a foreign, privately-owned company, located in the People’s Republic of China (PRC) provides multiple artificial intelligence applications available widely and free of charge. DeepSeek’s models present multiple threat vectors. DeepSeek servers are located in the PRC, and the PRC legal system permits extensive authority to government cyber and intelligence functions to access private company infrastructure. For DeepSeek-hosted instances of their models, DeepSeek’s account generation process collects personally identifiable information (PII) and may also track and digitally fingerprint users. DeepSeek’s most widely used applications function through a prompt-and-response process that requires presenting information to the model, and which may result in the transfer of sensitive data to the PRC if used by U.S. government employees or vendors. The transfer of the aforementioned information to the PRC, either independently or in combination with publicly available data, could produce actionable intelligence on U.S. persons and/or government programs. The models themselves may contain malware or other security vulnerabilities. Indeed, open-source security research has found that the DeepSeek iOS mobile application contains multiple critical vulnerabilities. reply -11 hour ago | parent | next[–] Replace every instance of "PRC" with "U.S.", DeepSeek with OpenAI/Anthropic, and replace "U.S." with any other nation, and maybe remove the last sentence. How does it sound now? Both nations may as well just say it - "we're banning it because they're our closest competitor". reply blueSky19891 hour ago | parent | prev | next[–] They are also banning local inference: "The models themselves may contain malware or other security vulnerabilities." It doesn't seem that they have found the models to be actively poisoned, though. reply halJordan1 hour ago | root | parent | next[–] They are not banning local inference. The USG has several fedramp dc's where they run local weights of several proprietary models. You guys are getting ridiculous reply sullivanmatt9 minutes ago | root | parent | next[–] Again, this would be local inference via DeepSeek. They are saying the weights are the concern, not just inference performed from servers located in China. reply cmrdporcupine7 hours ago | parent | prev | next[–] Thing is, is it seems to say a ban on use even when the weights are hosted via other providers. "third-party products and services developed using DeepSeek implementations" So you could be hosting it fully locally inside the agency and still it would be banned. It's not surprising to me, but it's pretty blunt. Not that I care what US agencies do, but this does seem like the first step of many to come. reply tmp104232884425 hours ago | root | parent | next[–] If I were the US government, I wouldn't trust the alignment/RLHF of a model developed by an adversary if I had the choice. Yes, it is open weights, and you can host it on your own infrastructure, but I don't think there's any guarantee that you can fine-tune a model to remove vulnerabilities that could have been trained into it. I realize that non-US nations could ask the same about the US. All I will say is that there are consequences to failing to nurture a competitive tech industry - even Mistral is basing their newest models on China open-weights models. Unlike the EU, the US government is fortunate to have a choice. reply jacquesm5 hours ago | prev | next[–] The models may well contain malware or security vulnerabilities. But they are at least open to inspection because the weights are available, the same can not be said about US providers of inference such as OpenAI and Anthropic. reply halJordan1 hour ago | parent | next[–] They're about as indictable as binary blobs found in your BSPs or the 3rd party drivers you get through Windows Update reply owebmaster59 minutes ago | root | parent | next[–] Still better than a Windows SaaS edition reply chrisra1 hour ago | parent | prev | next[–] I don't know if inspection would be practical. How do you inspect the weights for an intentionally hidden trigger that writes malware? reply jacquesm1 hour ago | root | parent | next[–] I don't have the answer to that, my simple solution to this problem is not to trust anything a model ever writes and so far that strategy has worked very well. reply cmrdporcupine4 hours ago | parent | prev | next[–] It's also odd for them to single out DeepSeek in particular, and not just any model from the PRC? reply jacquesm4 hours ago | root | parent | next[–] DeepSeek is the one that is the most visible, and probably the most cited in the departure messages to US providers. reply mmaunder58 minutes ago | prev | next[–] And so it begins. Regulatory Capture Stage Complete! reply Cameri4 hours ago | prev | next[–] It comes down to which backdoored models you trust. reply johnnyApplePRNG5 hours ago | prev | next[–] Deepseek V4.1 Flash 1017 is out of this world good ... and cheap ... that's why. reply GlickWick3 hours ago | parent | next[–] That's not why. We've entered a pretty adversarial era, and we know there are unexpected attack vectors available in frontier models. Just because you an inspect the weights doesn't mean you can derive the behavior. I suspect the CCP would ban US models if they didn't need to distill them to make their own. reply tmp104232884422 hours ago | root | parent | next[–] > I suspect the CCP would ban US models if they didn't need to distill them to make their own. I'm pretty sure they do, at least officially. But obviously the distillation and API proxies used by Chinese uses are unofficially tolerated and even exploited. reply halJordan59 minutes ago | root | parent | next[–] You're right, you can't run them in China, all models in China need to be vetted and approved by their cyberspace authority. But it's more of a "businesses cannot use them to provide services" kind of thing reply phendrenad21 hour ago | prev | next[–] A good case of "Don't do A or B, because A is bad" Stop downloading cookie recipes from China, and you can't use cookie recipes that came from China either, because accessing the cookie recipe in China could give you malware. It doesn't make much sense but this is the government that gave us such greats as "the internet isa series of tubes". reply grafmax5 hours ago | prev | next[–] The regulatory capture begins. reply halJordan2 hours ago | parent | next[–] It's not regulatory capture to remove software/harware from adversaries. No one was saying "Oh McAfee is really gonna control the us's antivirus market regulations" after they banned kaspersky. reply sciencesama3 hours ago | prev | next[–] how can an open source model be banned ? reply GlickWick3 hours ago | parent | next[–] Easily? Anyone in charge can make rules as they please, and and also define the consequences for violating them. reply hoppyhoppy21 hour ago | parent | prev | next[–] The same way an employer can tell employees they can't run Linux on their work machines. reply sekh601 hour ago | parent | prev | next[–] Open weight. reply metalman4 hours ago | prev | next[–] the order(paraphrased) is 'we are imediately ordering you to, or not to, rip out deep seek, depending on how you feel about that ,and what might go wrong, and write to us about it, sometime in the next couple of months' reply matt321059 minutes ago | prev[–] How bad would it be if China banned anthropic and openAI? reply cocoa191 hour ago | parent[–] Anthropic does not allow using their models in China. Also China bans US technology all the time. Remember the Great Firewall of China? Or when Xi told Trump, “no thanks” to buying NVidia cards reply Consider applying for YC's Winter 2027 batch! Applications are open till November 2. Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact Search: