DeepSeek R1: What Security Teams Need to Know
Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.
Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.
Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.
Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.
Learn how to evaluate security risk factors for DeepSeek R1, and about important considerations for working with open source AI models.
The recent release of DeepSeek R1 has captured significant attention in the technology community, and even impacted stock markets. DeepSeek has emerged as a notable alternative to foundational models like ChatGPT, Claude, and Gemini, and offers multiple models optimized for different tasks.
But with this rapid adoption comes an important question for application security teams: How do we evaluate and manage the security risks of open source AI models?
First, let’s acknowledge two things. Open source AI models are not inherently risky; many argue they’re safer to use than proprietary models because they’re built in the open. But there are valid questions about whether DeepSeek models are safe to use, and if there are IP or legal risks from using a model built in China.
Endor Labs helps application security teams detect open source AI models integrated into their applications, and analyze the risks for a particular model. That means we can assess an open source model’s security and operational practices, for example. But we can’t assess a model for bias in the data, or analyze how a hosted model handles your data.
We’re going to use DeepSeek R1 as a case study to show you how this works in practice.
TL;DR - Understand the risks before adoption
There are security and operational reasons to consider blocking use of DeepSeek R1, but it’s not necessarily “worse” than other open source AI models. You should weigh these factors against your organization’s threat model vs the benefits of using the model.
Endor Labs’ scoring methodology
Endor Labs’ approach is to extract various types of “facts” from all the data about a model. These facts are simple, deterministic, and easy to verify yourself. We then summarize this information to help you identify where you might want to focus your research efforts.
In the case of open source AI models on Hugging Face, we use 50 out-of-the-box checks to identify positive and negative factors about a model’s practices. With a quick search on our platform, you can see the scores and highlights for any model.
We then summarize those factors into four risk categories, and attach a numerical score to each. The score is calculated as an average of the positive and negative factors. We refer to these as the model’s Endor Scores. The four risk categories are:
- Security: Is the model following good security practices?
- Activity: Is the model actively maintained?
- Popularity: How widely used is the model?
- Operational: Is this license available, and does it permit commercial use?
It’s important to keep in mind that these scores are averages. For example, if there’s one negative factor but the rest are good, that might not be clear in the overall score. In this kind of scenario, this can cause a model’s security score to fluctuate. A security score of 4 doesn’t necessarily mean the model is unsafe – it just indicates there might be a few more factors to review before you make a decision.
For that reason we recommend using these scores as guides for where to focus your attention, not as comparisons between models or to enforce specific policies. In practice you might create a findings policy so you get an alert if your team is using a model with a score below 7. That way you can fine tune where to focus your attention.
If you want to enforce a specific policy, you would use one of the model factors, like license type. In that case you might create an actions policy to block models that use the Apache or MIT licenses, for example.
For a deeper dive on how we evaluate and score open source AI models from Hugging Face, read Hugging Face Model Score Curation at Endor Labs.
Endor Labs’ analysis of DeepSeek R1
So what can we tell about DeepSeek R1? Let’s start with the most significant positive factors:
- MIT license – The model is licensed for commercial use.
- Linked technical paper – The repository includes a technical paper explaining how it was trained.
- Open source weights – We can fine-tune the model, which offers flexibility and customization.
On the flip side, the model has a few detracting factors:
- Lacks a dataset – The dataset is not provided, so we can’t evaluate the quality of the data the model was trained on.
- Used Python code files – The model provides example code in Python files. These could contain malicious code and should be reviewed.
- Newly created model – The model is new and we may not have a full picture of risks.
It’s worth digging into some of these negative factors a bit further to explain what they actually mean and why we classify them as “negative”.
Newly created models
Score factors are dynamic, so they change over time. For example, you may not care that a model is new, but someone else may want to wait until the model has been more thoroughly tested and adopted. Users of open source packages often have the same hesitation, because an untested dependency can cause unforeseen consequences such as performance issues or undiscovered malware. The “new” factor will disappear within a few months.
Example code
Score factors are also objective data points, and we flag the ones we think you may want to review. For example, it is common for open source projects to provide example code. But example code can also be a vector for someone to introduce malicious code. We surface it as a risk so you can decide if you want to review it further.
Endor Scores for DeepSeek R1
When we summarize factors into an Endor Score, the purpose is to direct your attention to factors that could be important to you. In the example of DeepSeek R1, the model has an overall Endor Score of 7 out of 10. That’s an average of the four components factors:
- Security: 4/10
- Activity: 9/10
- Popularity: 8/10
- Operational: 6/10
As another reminder: these scores are average and should not be used for comparison against other models. For example, if there’s one negative factor in a category but 2 are good, that can cause a score to swing much lower, causing the model’s security score to fluctuate. A security score of 4 doesn’t mean the model is unsafe – it just indicates there might be a few more factors to review.
Set standards for safe AI model adoption
The rapid adoption of open source AI models like DeepSeek R1 highlights a crucial reality: organizations need a systematic approach to evaluating and managing AI model risk. While open source models aren't inherently more risky than proprietary ones, they do require careful evaluation and ongoing monitoring.
At Endor Labs, we're seeing organizations increasingly treat AI models as critical open source dependencies in their software supply chain. This means implementing a continuous process of:
- Discovery: Detect AI models in use within your organization
- Evaluation: Review AI models for potential risks
- Response: Set and enforce guardrails for safe model adoption
The key is finding the right balance between enabling innovation and managing risk. If you’d like to learn more about how Endor Labs can help you manage AI risks, contact us to start a discussion.
Everything you need to know about DeepSeek
You might have other questions about DeepSeek that aren’t surfaced by the Endor Scores. We’ve compiled answers to some frequently asked questions we’ve heard from customers and the community. And before you ask: No, we didn’t use DeepSeek to generate this list of questions and answers. 😆 We have in-house experts who spend all their time on these topics, and they contributed answers directly from their experience and research.
What is DeepSeek?
DeepSeek is a company based in China and owned by the hedge fund High-Flyer. It made the news after it announced new foundational LLMs trained using significantly less resources. “DeepSeek” isn’t a single AI model. The company offers numerous models optimized for different tasks, including DeepSeek V3 for general purpose needs, and DeepSeek R1, specifically designed for reasoning tasks. They also offer hosted versions similar to OpenAI’s ChatGPT or Anthropic’s Claude.
It’s the free availability of DeepSeek R1 that has in part driven its recent popularity. According to Hugging Face, the open source community has trained more than 550 derivative models based on R1.
Does it make a difference where the model is hosted?
Yes, currently DeepSeek is hosted by their creators where it can be accessed through a browser similar to ChatGPT and also a mobile application. But since the model weights are open sourced, this model has been hosted by multiple other providers. Depending on the provider details, accessing these models may require creating accounts, providing personal information, and of course when one uses these models, you send them potentially sensitive information. Each provider will have their own retention policies and ToS, which has to be reviewed carefully. Some providers will use the data you have provided for further training of these models, which may or may not be acceptable.
Can the model itself “talk back” or steal my data?
This has been a popular question but essentially the model itself is a large amount of non-executable binary data. The model itself has no capability to do anything evil (well there are some caveats here, read on). Then the model is deployed in a platform that runs it and accepts queries for it. What happens then is up to the provider of the platform and their policies, for example some platform providers may do additional filtering, or retain the queries for their own purposes.
So, if I self host these models in my infrastructure, am I safe?
To a large extent yes, You can control your data, and implement your own pre- or post-filtering before sending data to the models. The DeepSeek models are also relatively small, which makes a local deployment relatively easier.
So, if I self-host, is there anything else to worry about?
Well, unfortunately there is. All LLMs have encoded a huge amount of information from their training data and in many cases have been instruction tuned so that their answers are more helpful. It is possible that there are more nefarious things hidden in these model weights. Some academic research has shown that it is possible to hide logical “bombs” where a model will deliberately provide incorrect information for a very specific topic, i.e. always claim that Eminem is a soccer player. These are extremely hard to test for, and at this stage mostly theoretical. Of course there is absolutely no evidence to believe that DeepSeek suffers from this.
What do I need to know about the alignment of these models?
Most models that are targeted for commercial use go through extensive steps of alignment training, so they do not generate harmful, or dangerous content. Clearly, no enterprise wants to use an LLM that can easily generate hate speech when prodded. Even though some view this as “censorship” it is pretty much necessary for any enterprise use. It is not clear how much of alignment training has been done to DeepSeek, but right now, it looks like it’s minimal. So, there may be reputational risks hiding if one tries to use it in production. Other popular providers (OpenAI, Anthropic and Meta) spend a considerable amount of effort on aligning and “read-teaming” their models, and extensively report their results for each new model they produce.
Are there license issues?
When it comes to licensing LLMs things can get complex. Many LLMs have restrictions in how they can be used and to make things more complicated sometimes datasets that are used to train LLMs have their own licensing restrictions. We are not legal experts, so you need to do your own research there.
So, is DeepSeek really open source?
Well, this is an interesting question. It has open weights, so anyone can run the model, and that’s what many would consider open source. But there has been discussion in the industry about the exact meaning of open source AI, and there is the counter argument that open source really means that there is enough information to actually rebuild the model, which most notably includes the training data. It is not clear which training data were used for DeepSeek (and this is also the case for the other very famous open source model LLaMA). So there’s no direct answer to “is it open source” at this point.
What is going to happen next for DeepSeek?
Despite the various controversies, DeepSeek is a remarkable accomplishment and there is no doubt that it will help the wider use of AI. There are lots of ongoing efforts to evaluate the model and reproduce its training. Since the weights are open, people and vendors can improve it, and very soon there will be new versions that are better aligned to use for enterprise. Technical innovations will be incorporated by other model vendors and everyone will benefit.
