DeepSeek

Stated Theory of Change

DeepSeek does not articulate a theory of change for AI safety because it does not engage with AI safety as a concept. Its stated theory of change is about AGI and national innovation:

1. Build frontier AI capabilities through algorithmic innovation rather than brute-force compute scaling
2. Release everything as open-weight under MIT License to build a technology ecosystem
3. Advance China from technology imitator to technology innovator
4. Pursue AGI through three paths: math/code as formal testbeds, multimodal learning, natural language

Liang Wenfeng is explicit that commercial returns are not the goal: "If you're looking for a purely commercial rationale, you might not find one." The theory is that open, curiosity-driven research, funded by a hedge fund fortune and unconstrained by investor demands, can match or exceed the output of labs spending tens of billions.

This theory has been validated on the capability dimension. DeepSeek's technical innovations are genuine, its models are frontier-competitive, and it has done this with ~150 people and substantially less compute than US labs.

Revealed Theory of Change

DeepSeek's actions reveal a more complex picture than the pure-research narrative suggests:

What matches stated theory: Open-weight releases under MIT License (consistent through 8+ major models). Research-first hiring (curiosity over experience). Genuine architectural innovations (MLA, MoE improvements, PTX-level optimization). No immediate commercialization push.

What diverges:

• The "curiosity-driven research" framing elides the military and surveillance applications that flow directly from open-weight release. DeepSeek's models are being adopted by the PLA for "intelligentized warfare" and by public security for mass surveillance. Open-weight release is not neutral -- it is a delivery mechanism for these applications.
• The national innovation narrative aligns perfectly with CCP industrial policy. Liang met Xi Jinping in February 2025. DeepSeek is being pressured to adopt Huawei chips. R1-0528 tightened CCP censorship compared to R1. The "independent researcher" identity is increasingly entangled with state interests.
• The complete absence of safety work reveals a revealed preference: capabilities matter, safety does not. When Cisco found a 100% jailbreak rate, DeepSeek did not respond. When Wiz found an exposed database, DeepSeek fixed it but said nothing publicly. When NIST found 94% jailbreak success on the improved model, silence. This is not a lab that cares about safety and hasn't gotten to it yet -- it is a lab that has never considered safety a priority.
• The pivot toward Huawei (V4 optimized for Ascend, US chipmakers excluded from early access) suggests increasing alignment with Chinese state strategy rather than independent research.

The revealed theory of change is: build the most capable open-weight models possible, release them freely, absorb any technical innovations into the Chinese AI ecosystem, and let the CCP handle content control through censorship filters while ignoring all other safety considerations.

Key Assumptions

Assumption 1: Open-weight release is net positive for the world.

• Evidence for: Democratizes AI access. Enables academic research. Reduces monopoly power of US labs. Stanford HAI faculty strongly endorse. The technical papers advance the field.
• Evidence against: 100% jailbreak success rate means anyone can use frontier capabilities for harm. PLA procurement shows military adoption with no mechanism for prevention. Open-weight biosecurity concerns are growing (see "The Open-Weight Problem" forum post). Holistic AI: once jailbroken, R1 stays jailbroken for the entire conversation.
• Testable? Partially. Could track downstream harms attributable to open-weight DeepSeek models. But attribution is difficult.
• If wrong: DeepSeek is enabling a massive expansion of accessible harmful AI capabilities with no off switch.

Assumption 2: Safety is someone else's problem.

• Evidence for: Eric Hartford's argument that weights are inert data and safety is a deployment concern. The same argument Meta makes for Llama.
• Evidence against: DeepSeek also runs a consumer-facing chatbot with 96M users -- it is both a weights provider and a deployer. The China Mobile connection shows its deployment is unsafe. The CBRN vulnerability means capable models + open weights + no safety = biosecurity risk.
• Testable? Yes -- track incidents.
• If wrong: DeepSeek bears responsibility for every harmful use of its models that its safety failures enabled.

Assumption 3: CCP censorship is sufficient content control.

• Evidence for: The censorship does prevent discussion of sensitive Chinese political topics in the default configuration.
• Evidence against: Censorship is trivially jailbroken (Promptfoo). Censorship degrades safety in other domains (CrowdStrike: 50% more insecure code with politically sensitive prompts). Censorship is not safety -- it serves CCP interests, not user or global interests.
• If wrong: CCP censorship actively harms safety rather than providing it.

Assumption 4: China's chip constraints won't stop DeepSeek.

• Evidence for: DeepSeek has already demonstrated frontier capabilities with constrained hardware. Algorithmic innovation can compensate for compute gaps. SMIC/Huawei chip production is ramping up.
• Evidence against: Liang acknowledges the chip embargo is his biggest challenge. CSIS argues the most significant impacts of export controls are forward-looking. The difference between 50K GPUs and 200K+ GPUs matters for next-generation scaling.
• If wrong: DeepSeek falls behind US labs within 1-2 years as scaling continues.

Strengths

1. Genuine technical innovation. MLA, GRPO, PTX-level optimization, FP8 training -- these are real contributions to the field, not just parameter scaling or distillation. The technical papers are thorough and reproducible.

2. Extraordinary efficiency. Doing frontier work with ~150 people and constrained compute is genuinely impressive. The flat organization with bottom-up idea generation appears to produce results. CSIS: "The only surprise is that the research lab that discovered some of the relevant technical innovations is a Chinese one."

3. Financial independence. No VC pressure, no quarterly earnings, no need to generate revenue. This allows genuinely long-term research focus. Liang can pursue whatever he finds interesting without commercial constraints.

4. Open publication. Publishing detailed technical papers and releasing weights under MIT License is a genuine contribution to the global research community. Stanford HAI, SemiAnalysis, and many researchers acknowledge this.

5. Talent development. Building frontier capabilities with entirely domestically-trained researchers disproves the assumption that Chinese AI progress depends on US-trained talent.

Weaknesses and Risks

1. Total safety vacuum. Not merely inadequate safety measures -- a complete absence. No safety team, no RSP, no safety commitments, no red-team reports, no engagement with safety community. 100% jailbreak rate. 1% AI Lab Watch score. This is not a gap to be filled -- it reflects a fundamental orientation that treats safety as irrelevant. This is the single most important finding.

2. Military and surveillance adoption. PLA procurement documents show DeepSeek adoption for drone swarms, electronic warfare, surveillance, and "intelligentized warfare." Public security systems use it for facial recognition and crowd behavior analysis. The open-weight model makes this unstoppable -- DeepSeek cannot prevent it even if it wanted to. But there is no evidence it wants to.

3. Authoritarian governance alignment. CCP censorship is deepening over time (R1-0528 more censored than R1). DeepSeek is being pressured to adopt Huawei chips. Liang met Xi Jinping. The "independent researcher" identity is eroding as the company becomes politically important to China.

4. Single point of failure. The entire operation depends on one man (Liang Wenfeng), one hedge fund (High-Flyer), and the continued health of that fund. There is no governance structure, no succession plan, no diversified funding. If High-Flyer has a bad year, or if Liang's interests change, DeepSeek could collapse.

5. Data sovereignty and privacy. Hidden code linking to China Mobile. Data stored on Chinese servers. Subject to National Intelligence Law requiring cooperation with intelligence services. Users (96M+) are exposed to these risks often without awareness.

6. IP acquisition practices. OpenAI distillation allegations, Anthropic fake account allegations, potential export control violations (H100/Blackwell access). If true, these undermine the "independent innovator" narrative and suggest capability gains are partly derived from unauthorized access to competitors' work.

7. Proliferation risk. Open-weight release of frontier models with zero safety guardrails creates an irreversible proliferation of dangerous capabilities. Once weights are published, they cannot be recalled. Every future model release increases the accessible capability floor for malicious actors.

Cross-References

• vs. Anthropic: Polar opposite on every safety dimension. Anthropic has RSP, red-teaming, safety team, governance. DeepSeek has none. But both produce frontier models. DeepSeek's existence is the nightmare scenario that Anthropic's theory of change is designed to prevent -- a capable lab with zero safety culture.
• vs. Meta (Llama): Similar open-weight philosophy but Meta has safety teams, red-team reports, and (some) deployment restrictions. DeepSeek is Meta's approach without any of the guardrails.
• vs. OpenAI: The distillation relationship is ironic -- DeepSeek may have used OpenAI's outputs to bootstrap, then surpassed OpenAI in some benchmarks. OpenAI's closed-source strategy failed to prevent this.
• vs. Chinese AI ecosystem: DeepSeek triggered a price war that forced ByteDance, Alibaba, Baidu, and Tencent to cut prices below cost. It is the disruptive outlier, not the mainstream Chinese approach.
• Coefficient Giving/funders: DeepSeek receives no Western safety funding. It exists entirely outside the AI safety funding ecosystem. There is no lever for the safety community to influence it.

What Would Change This Assessment

• DeepSeek hires a safety team and publishes safety evaluations. This would indicate a genuine shift in priorities. Currently probability: very low.
• DeepSeek declines to release a model due to safety concerns. Even one such decision would be significant. Currently probability: approximately zero.
• Chinese government imposes meaningful safety requirements. China has AI regulations, but they focus on content control (censorship) rather than capability safety. A shift toward capability-focused safety would be important.
• High-Flyer suffers major financial losses. This would threaten DeepSeek's funding model and could force either shutdown or external investment with new governance.
• Liang Wenfeng makes substantive public statements about AI safety. Currently he speaks only about AGI, innovation, and China's role. Any genuine engagement with safety concerns would be new.
• A major incident traceable to DeepSeek models occurs. A biosecurity incident, a military escalation, or a large-scale misuse event attributable to DeepSeek's open-weight models would force a reckoning.

Self-Critique

Weakest claim: My assessment that DeepSeek's safety failures reflect deliberate indifference rather than Chinese cultural/regulatory differences. It is possible that safety work is happening internally but is not publicly visible due to different norms around public communication in China. However, the 100% jailbreak rate and exposed database suggest the absence is real, not just invisible.

Potential bias: This analysis was conducted using exclusively English-language sources about a Chinese company. Chinese-language primary sources, internal communications, and the Chinese regulatory context may paint a different picture. The absence of the Paul Triolo critique (paywalled) and the Exiger report (blocked) creates potential gaps in the military ties assessment.

What a thoughtful disagreer would say: "You're applying Western AI safety norms to a Chinese company operating in a completely different political and cultural context. DeepSeek's contribution to open science outweighs its safety failures, which are no worse than what existed at US labs 3-4 years ago. The military adoption is a consequence of open-weight release, not DeepSeek's intention. And the CCP censorship concerns apply equally to the biases embedded in US models."

Single weakest claim: That DeepSeek's approach to safety will remain unchanged. If external pressure (Chinese regulation, international incidents, competitive pressure from safer Chinese alternatives) grows, DeepSeek could change. The analysis treats the current trajectory as fixed, which may overstate the risk.

What information would most change my view: Direct interviews with DeepSeek employees about internal safety discussions, or evidence of unpublished internal safety evaluations. Also, the full Exiger report on military ties, and Paul Triolo's critique of it.