DeepSeek On-Premise: A Provenance and Risk Review Before You Self-Host V4

DeepSeek on premise means running DeepSeek's published open weights on your own GPUs, with no connection to DeepSeek's app, website or API. The V4 and V4.1 checkpoints carry the MIT License, so the review that matters is provenance and behaviour: pin the exact files, verify their hashes, control executable code, block egress, and red-team the model yourself.

Security leads tend to meet DeepSeek as a headline about a government ban. Architects meet it as a model card with an MIT badge and a one-million-token context window. Those are descriptions of two different things. The bans are aimed at a hosted service that processes user data in China. The model card describes a set of files you can copy into a data centre with no route to the internet.

This review keeps the two apart and turns the second into something a security team can sign off. If you are new to self-hosted models, start with what a local LLM is. Facts below were checked against Hugging Face, DeepSeek’s announcements and the named regulators on 27 September 2026. DeepSeek ships new checkpoints most months, so re-check before you pin anything.

The DeepSeek open-weight lineup in September 2026

DeepSeek released the V4 series as a preview on 24 April 2026 (announcement) and replaced each preview with an official checkpoint over the summer. All of them are mixture-of-experts models: total parameters set the memory bill, active parameters set the compute per token.

Weights-on-disk figures are totals from the Hugging Face file listing. A few details change how you deploy them:

• Precision is baked in. The V4 model card describes the instruct weights as FP4 + FP8 mixed: expert parameters in FP4, most others in FP8. The base checkpoints are FP8 mixed. You are not choosing a quantization; you are inheriting one.
• The 0731 and 0813 releases supersede the April previews and carry a DSpark speculative-decoding module inside the same checkpoint.
• V4.1-Flash is a new architecture. DeepSeek describes it as a natively multimodal causal encoder-decoder with 196B parameters of Engram conditional memory. An experimental V4-Flash-Vision-Exp checkpoint also exists.
• There is no Jinja chat template. Each repository ships a Python reference encoder instead, and DeepSeek added a Rust library, deepseek-recipe, for V4.1. If your serving engine formats prompts incorrectly, tool calls degrade without an obvious error.

Self-hosted weights are not the DeepSeek service

Three differences decide most of the risk conversation.

Where the data goes. DeepSeek’s privacy policy, last updated 10 February 2026, says the company collects, processes and stores personal data in the People’s Republic of China to provide its services. A self-hosted checkpoint has no such path. Prompts, retrieved documents and outputs stay on your hardware unless software you installed sends them somewhere.

What the model name points to. On a hosted API, a model name is a pointer the provider can move. When V4.1-Flash launched, DeepSeek’s API changelog recorded that the V4 Flash names were retired and temporarily routed to the new model. Earlier, deepseek-chat and deepseek-reasoner were retired after 24 July 2026. On premises, a checkpoint is identified by a repository commit hash and per-file SHA-256 digests. It changes only when your team changes it.

Who can switch it off. A service can be withdrawn, re-priced or blocked in a jurisdiction. Weights already in your registry keep running. The trade is that you inherit the work the provider used to do: patching the serving stack, planning capacity, evaluating new releases and handling incidents.

What public-sector restrictions on DeepSeek cover

Several public bodies have acted against DeepSeek. Read the scope of each carefully, because most target the service rather than weights running in your environment (status as of 27 September 2026):

• Italy. On 30 January 2025 the Garante ordered, with immediate effect, a limitation on the processing of Italian users’ data by the two Chinese companies that provide the DeepSeek chatbot service, and opened an investigation (Garante press release).
• New York State. On 10 February 2025 the Governor banned the DeepSeek application from being downloaded on ITS-managed government devices and networks (Governor’s announcement).
• Berlin. On 27 June 2025 the Berlin data protection commissioner reported the DeepSeek app to Apple and Google as illegal content under Article 16 of the Digital Services Act, citing unlawful transfers of personal data to China (BlnBDI press release).
• Czech Republic. On 10 July 2025 the national cyber security agency NÚKIB warned entities under the Cyber Security Act against DeepSeek products, applications, websites, web services and APIs. The warning says it does not apply to DeepSeek’s open-source models deployed locally without any capability to communicate with servers used by DeepSeek or its related entities (NÚKIB warning).

The Czech carve-out is the most explicit statement we found, and it sets a useful bar. The exemption depends on the deployment genuinely being unable to reach DeepSeek. That is a network property you can test and evidence, not a clause in a supplier contract. Other directives are worded around “products” and an auditor may read them broadly, so security and legal should read the text that governs your sector before a pilot starts.

A provenance checklist for DeepSeek weights

Provenance review answers one question: are the bytes on the GPU exactly the bytes DeepSeek published, and did nothing else arrive with them? For the general pattern, see our model import pipeline. Applied to DeepSeek:

1. Pull only from the official organisation. Use deepseek-ai on Hugging Face, or the ModelScope mirror linked from the model card. Third-party quantizations and GGUF conversions are derivative builds with their own supply chain, even when the publisher is reputable. Give each one its own review or leave it out.
2. Pin the commit. Record the repository commit hash, which the Hub API returns as sha, rather than only the model name.
3. Verify every shard. The Hub API (/api/models/<repo>?blobs=true) lists a SHA-256 digest for each large file. V4-Flash-0731 has 48 safetensors shards. Hash each one after it crosses into the restricted zone and compare against the manifest you recorded.
4. Accept safetensors only. The V4 weights ship as .safetensors, a format that stores tensors without executable code. Reject any variant that asks you to load pickle-based .bin or .pt files.
5. Inventory the Python. The repositories also contain Python: an encoding folder for prompt formatting and an inference folder with DeepSeek’s reference implementation. Neither runs unless you run it. The V4-Flash-0731 config.json and tokenizer_config.json declare no custom classes, yet the official vLLM and SGLang commands still pass --trust-remote-code. Treat that flag as a change-controlled setting. Confirm in staging whether your pinned engine build needs it, and if it stays, diff the repository’s code files at every update.
6. Serve with egress blocked, then prove it. Run inference in a network segment with no outbound route. Set HF_HUB_OFFLINE=1 so the Hugging Face client makes no Hub calls, and HF_HUB_DISABLE_TELEMETRY=1 (Hugging Face docs). vLLM collects anonymous usage statistics by default; turn that off with VLLM_NO_USAGE_STATS=1 or DO_NOT_TRACK=1 (vLLM docs). Then capture egress logs during a load test, as described in our guide to proving no hidden callouts.
7. Keep the license with the artifact. Store the MIT LICENSE file as it stood at download next to the manifest. The MIT terms are light, but the license clauses that create real work still apply the moment you copy weights to another legal entity.

Red-team the checkpoint you will actually serve

Provenance shows the files are genuine. It says nothing about how the model behaves on your prompts, and the published evidence gives reasons to test with care.

In September 2025, NIST’s Center for AI Standards and Innovation (CAISI) evaluated three earlier DeepSeek models: R1, R1-0528 and V3.1 (CAISI evaluation). It reported that agents based on R1-0528 were on average 12 times more likely than the evaluated US frontier models to follow malicious instructions designed to derail them. Under a common jailbreaking technique, R1-0528 answered 94% of overtly malicious requests, against 8% for the US reference models, and the DeepSeek models echoed four times as many inaccurate and misleading CCP narratives. In May 2026, CAISI’s evaluation of V4 Pro focused on capability and found V4 scored better on DeepSeek’s self-reported evaluations than on CAISI’s own.

Those findings describe other checkpoints, so treat them as a reason to test rather than a verdict on V4. A pilot test plan should cover:

• Agent hijacking. Plant instructions in retrieved documents, tool outputs and pages the agent reads, then measure how often it obeys them. Once a model can call tools, this matters more than chat jailbreaks.
• Jailbreak resistance across the harmful-request categories your acceptable-use policy forbids.
• Sensitive and contested topics. Write prompts on subjects your organisation actually handles, such as sanctions screening, Taiwan-related supply chains or human-rights due diligence, and check for refusals, omissions and one-sided framing.
• Refusals of routine work. Count how often the model declines ordinary tasks in your domain.
• Your own quality bar. Re-run your golden set instead of relying on DeepSeek’s published tables.

Record results per checkpoint and per reasoning setting. The 0731 and 0813 releases accept low, high and max reasoning effort, V4.1-Flash takes an integer from 1 to 100, and behaviour can differ between settings.

Serving engines and hardware arithmetic

vLLM and SGLang both support DeepSeek V4, and the official model cards give launch commands for each. The vLLM recipe for V4-Flash calls for vLLM 0.20.0 or later (0.25.0 for DSpark speculative decoding), uses the deepseek_v4 tokenizer mode, tool-call parser and reasoning parser, and requires --max-model-len of at least 393,216 for the maximum reasoning mode. V4.1-Flash needs vLLM 0.30.0 or later.

Sizing starts from the weights, because V4’s compressed attention makes the KV cache unusually small. DeepSeek reports a global KV cache of 890 bytes per token for V4.1-Flash, roughly a quarter of V4-Flash. At that rate a 128K-token session holds about 117 MB of global KV cache, and a full one-million-token session less than 1 GB. The weights run to hundreds of gigabytes.

GPU capacities are from NVIDIA’s H100 and H200 pages. “Spare” is raw memory left after the weights, before activations, runtime overhead and KV cache. It also assumes the engine holds the FP4 and FP8 formats as shipped. The H100 column is arithmetic only, because H100 is not among the configurations the vLLM recipe lists.

Two conclusions follow. V4-Flash-0731 is the realistic pilot: it occupies a fraction of one node and leaves room for replicas or a second model. V4-Pro-0813 is a whole-node commitment on H200-class hardware, so justify it with evidence from your own tasks before buying for it. The method behind these numbers is in our GPU sizing arithmetic. If the provenance review rules DeepSeek out, the Qwen size tiers cover similar ground under Apache-2.0.

How VDF AI fits

VDF AI treats a self-hosted DeepSeek checkpoint like any other local model: registered once, then routed under policy. VDF AI Router has an air-gap mode that disables external APIs and restricts routing to local models. A domain flagged as regulated only ever considers explicitly approved models, and allow and deny lists can keep a DeepSeek checkpoint out of workflows your policy excludes. Each routing decision comes back with its reason, candidate list and scores, so auditors can see which model handled which request.

Before a checkpoint is approved, the Model Evaluation Suite runs your domain test cases against it inside your own deployment, keeps every response with timestamps and flags regressions between versions. The red-team and golden-set results above then exist as stored evidence for the approval decision.