Researchers claim they know exactly how DeepSeek was designed to work, and they may even have a clue toward its highly publicized scandal with OpenAI.
Researchers have tricked DeepSeek, the Chinese generative AI (GenAI) that debuted earlier this month to a whirlwind of publicity and user adoption, into revealing the instructions that define how it operates.
DeepSeek, the new “it girl” in GenAI, was trained at a fractional cost of existing offerings, and as such has sparked competitive alarm across Silicon Valley. This has led to claims of intellectual property theft from OpenAI, and the loss of billions in market cap for AI chipmaker Nvidia. Naturally, security researchers have begun scrutinizing DeepSeek as well, analyzing if what’s under the hood is beneficent or evil, or a mix of both. And analysts at Wallarm just made significant progress on this front by jailbreaking it.
In the process, they revealed its entire system prompt, i.e., a hidden set of instructions, written in plain language, that dictates the behavior and limitations of an AI system. They also may have induced DeepSeek to admit to rumors that it was trained using technology developed by OpenAI.
DeepSeek’s System Prompt
Wallarm informed DeepSeek about its jailbreak, and DeepSeek has since fixed the issue. For fear that the same tricks might work against other popular large language models (LLMs), however, the researchers have chosen to keep the technical details under wraps.
“It definitely required some coding, but it’s not like an exploit where you send a bunch of binary data [in the form of a] virus, and then it’s hacked,” explains Ivan Novikov, CEO of Wallarm. “Essentially, we kind of convinced the model to respond [to prompts with certain biases], and because of that, the model breaks some kinds of internal controls.”
By breaking its controls, the researchers were able to extract DeepSeek’s entire system prompt, word for word.
And for a sense of how its character compares to other popular models, it fed that text into OpenAI’s GPT-4o and asked it to do a comparison.
Overall, GPT-4o claimed to be less restrictive and more creative when it comes to potentially sensitive content.
“OpenAI’s prompt allows more critical thinking, open discussion, and nuanced debate while still ensuring user safety,” the chatbot claimed, where “DeepSeek’s prompt is likely more rigid, avoids controversial discussions, and emphasizes neutrality to the point of censorship.”
While the researchers were poking around in its kishkes, they also came across one other interesting discovery. In its jailbroken state, the model seemed to indicate that it may have received transferred knowledge from OpenAI models. The researchers made note of this finding, but stopped short of labeling it any kind of proof of IP theft.
“[We were] not retraining or poisoning its answers — this is what we got from a very plain response after the jailbreak. However, the fact of the jailbreak itself doesn’t definitely give us enough of an indication that it’s ground truth,” Novikov cautions. This subject has been particularly sensitive ever since Jan. 29, when OpenAI — which trained its models on unlicensed, copyrighted data from around the Web — made the aforementioned claim that DeepSeek used OpenAI technology to train its own models without permission.