DeepSeek R1: Distillation, Reinforcement Learning and a $600b Wobble

Tuesday morning in Hobart, the day after the Australia Day long weekend. You come back to the desk with a slightly sunburnt neck and a strong cup of tea, and you open your super app to put off your inbox. The balance has gone down, enough to notice. Every headline says the same thing: a Chinese company most people had never heard of has released a free chatbot, and overnight, while you were asleep under a ceiling fan, Wall Street took nearly six hundred billion dollars off the value of one American chipmaker.

Read that again. A free app made the company that sells shovels to the AI gold rush lose more value in a single day than any company in American history. The loss was "more than double the market cap of Coca-Cola and Chevron", according to CNBC. By lunchtime someone in a group chat has confidently explained that the Chinese built ChatGPT for six million dollars, in a cave, with a box of scraps.

Pause the group chat. Most of what you have read this week is half right, and the wrong half is the interesting one.

Here are the facts. On 20 January, a Hangzhou lab called DeepSeek released a reasoning model called R1, and on the release page it claimed "Performance on par with OpenAI-o1". It published the weights under an MIT licence, which means anyone can download the model, run it and build on it. With it came a paper that explains, in unusual detail, how it trained the thing. By Monday, its app was the most-downloaded free app in the US App Store, and Nvidia's shares closed down 17%.

The famous "$6 million" is real, but it belongs to a different model, and it does not mean what the group chat thinks. The interesting part of R1 is not the price. It is a training method that marks a model's homework with a rule instead of a person, and a trick that lets a big model teach a small one by writing out its working. Both are easier to understand than the headlines suggest.

So this is the plan. First, what shipped and when. Then down into the machine: how R1 learned to reason with an answer key and no teacher, the maths trick that made that cheap, and the two things people mean by "distillation". Then the money, and why the market panicked. Finally, the question you will get at work by Friday: should we use this, and where do our prompts go?

Put the kettle back on. Let's get into it.

Part 1: What Actually Shipped (and When)

DeepSeek is not a garage start-up. According to CNBC, it was founded in 2023 by Liang Wenfeng, a co-founder of the quantitative hedge fund High-Flyer. What changed is that two of its releases landed less than a month apart, and the world only noticed the second one.

The first was DeepSeek-V3, released on 26 December, a large general-purpose chat model. Its technical report describes a mixture-of-experts model with 671 billion parameters in total, of which only 37 billion are used for each token. Mixture of experts means the model is split into many specialist sub-networks, and a small router picks a few of them for each word. Think of a hospital with hundreds of specialists, where each patient sees only a handful. That design is a large part of why V3 is cheap to train and to run.

The second was DeepSeek-R1, released on 20 January. R1 is V3 after a second round of training that teaches it to reason: to write out a long chain of working before it gives an answer. If that sounds like OpenAI's o1, it should. OpenAI introduced o1 in September, and DeepSeek's paper says plainly that OpenAI's o1 series models "were the first to introduce inference-time scaling by increasing the length of the Chain-of-Thought reasoning process". Give the model more time to think and it gets better at maths and code. R1's contribution is not the idea. It is a public recipe for it.

Three facts about the release matter for everything that follows:

• It is open weights. You can download R1 and its smaller siblings and run them yourself. The GitHub repository puts both the code and the weights under the MIT licence, and says they allow "distillation for training other LLMs". Remember that sentence. It comes back in Part 5.
• It is not fully open source. The weights are open; the training data and training code are not. Hugging Face, which has started a project called Open-R1 to rebuild them, puts it simply: "although the model weights are open, the datasets and code used to train the model are not".¹
• It is cheap to use. Through DeepSeek's own API, R1 costs $0.55 per million input tokens and $2.19 per million output tokens. OpenAI's o1 is listed at $15 and $60. That is roughly 27 times cheaper on both counts.

And on the benchmarks, the claim holds up on paper. In DeepSeek's own table, R1 scores 79.8% on the 2024 AIME, a hard American maths competition, against 79.2% for OpenAI's December o1. It scores 97.3% on the MATH-500 set and reaches a Codeforces rating of 2,029, which DeepSeek puts above 96.3% of human competitors. These are DeepSeek's numbers, and it takes o1's scores from OpenAI's own reports because, in the paper's words, "accessing the OpenAI-o1-1217 API is challenging in mainland China". Treat them as a strong claim, not a verdict.

So: a model that roughly matches o1 on maths and code, free to download and about 27 times cheaper to rent. Let's look at how.

Part 2: Learning From the Answers at the Back of the Book

max_tokensPOST./v1/messages

Think back to a maths textbook from school. The good ones had the answers at the back. You worked a problem, flipped to the back, and found out whether you were right. Nobody marked your working. You got one bit of information: tick or cross. And yet, if you did enough problems that way, you got better.

That is the core idea of R1, and it has a name.

Reinforcement learning, in one paragraph

Reinforcement learning (RL) is learning by trial and reward. The learner tries something, the world tells it how well that went, and it adjusts so that rewarded behaviour becomes more likely. It is how you train a dog, how DeepMind's AlphaGo learned Go, and the subject of a bagpipe analogy in my post on ChatGPT. The hard part is always the reward: who decides what "well" means, and can they decide it a million times without getting tired or fooled?

For chatbots, the usual answer until now has been people, or a model that imitates people. In the version I wrote about in my post on red teaming, human raters rank answers, a second model (a reward model) learns to predict which one humans would prefer, and the chatbot is then trained to please the reward model. The weakness: the reward model is only a guess about what people like. Push hard enough and the chatbot finds answers that score well without being good. This is reward hacking, and if you have ever watched a student pad an essay to hit a word count, you have seen it.

Rewards a computer can check

DeepSeek's move was to skip the reward model for reasoning and use the answers at the back of the book. Maths problems have one correct final answer, so the model puts its answer in a box and a simple program checks the box. For programming problems, a compiler runs the model's code against test cases. The paper calls these rule-based rewards, and the wider field has started calling the idea reinforcement learning with verifiable rewards: the reward comes from something a computer can verify, not from anyone's opinion.

There were exactly two rewards for the first experiment:

• An accuracy reward: is the final answer correct (or does the code pass the tests)?
• A format reward: did the model put its thinking between <think> and </think> tags?

That's it. No marks for elegant working or for sounding confident. DeepSeek explains why it avoided the usual approach: it found that a neural reward model "may suffer from reward hacking in the large-scale reinforcement learning process", and keeping one up to date costs extra training and complicates everything. An answer key cannot be flattered.²

The prompt was just as bare: the assistant "first thinks about the reasoning process in the mind and then provides the user with the answer". DeepSeek deliberately added nothing about how to think, so it could watch what the model came up with on its own.

What came out: R1-Zero

They took the V3 base model, before any chat training, and ran this loop for thousands of steps. They called the result DeepSeek-R1-Zero, and the numbers are the part of the paper people keep quoting. On the 2024 AIME, R1-Zero's average score rose from 15.6% to 71.0%. With a majority vote over 64 attempts, it reached 86.7%, ahead of the o1 version OpenAI released in September on that test.

Two other things happened that nobody asked for. First, the answers got longer. The paper's Figure 3 shows average response length climbing steadily through training. Nobody told the model to think longer; longer working earned more ticks. Second, it started to check itself. The paper shows an intermediate version halfway through a messy algebra problem, which suddenly writes: "Wait, wait. Wait. That's an aha moment I can flag here." and then starts the problem again more carefully. The researchers call it an "aha moment" for themselves too, and I can't blame them.³

There is a catch, and DeepSeek is upfront about it. R1-Zero's working was often hard to read. It mixed languages mid-sentence and ignored formatting. An answer key doesn't care whether your working is legible, so the model had no reason to be tidy. Fixing that is what turned R1-Zero into R1, and we'll get there in Part 4. First, the trick that made all this affordable.

Part 3: Marking on the Curve (GRPO)

You may have been "marked on the curve" at school. Your mark depends on how you did compared with everyone else who sat the same paper. Sixty per cent on a brutal exam where the class average was forty is a great result. Sixty per cent on an easy exam where everyone else got ninety is a problem.

That intuition is the whole of DeepSeek's RL algorithm, and it matters more than it sounds.

Why reinforcement learning needs a baseline

A reward on its own is hard to learn from. Say the model gets a tick. Was that a good attempt, or an easy question? What the model needs is the advantage: how much better this attempt was than a typical attempt at the same question.

To work out "typical", the standard method, an algorithm called PPO (Proximal Policy Optimisation), trains a second model alongside the first. This second model is called the critic (or value model), and its job is to look at a question and the work so far and guess the expected reward. DeepSeek's earlier DeepSeekMath paper points out the problem: the critic is "typically another model of comparable size as the policy model", which "brings a substantial memory and computational burden". When the model you are training has 671 billion parameters, a second model of similar size is a second hospital.

Ms Okafor's sixteen slates

GRPO, Group Relative Policy Optimisation, which DeepSeek introduced in that paper and used again for R1, throws the critic away and marks on the curve instead. Here is how it works, with a made-up teacher, Ms Okafor, and a class of one very diligent student who sits the same question sixteen times.⁴

1. Sample a group. For one maths question, the model writes 16 separate attempts, each with its own working and its own boxed answer.
2. Mark each one with the rule. Say 4 of the 16 boxed answers are correct. Those get a reward of 1. The other 12 get 0.
3. Work out the curve. The group's average reward is 4 ÷ 16 = 0.25. The spread (the standard deviation) is about 0.43.
4. Score each attempt against the group. Each attempt's advantage is its reward minus the average, divided by the spread. A correct attempt scores (1 − 0.25) ÷ 0.43 ≈ +1.73. A wrong one scores (0 − 0.25) ÷ 0.43 ≈ −0.58.
5. Nudge the model. Make the tokens in the four correct attempts a little more likely and the tokens in the twelve wrong ones a little less likely, in proportion to those scores.

That is the formula in the R1 paper, in words: the advantage for each output is its reward minus the group's mean reward, divided by the group's standard deviation. The group is the critic. No second model needed.

Look at what the curve does. On a hard question where only 4 of 16 attempts are right, a correct answer earns a big score, because it beat the class. On an easy question where 15 of 16 are right, a correct attempt earns very little, and the one wrong attempt is punished hard. And if all 16 attempts are right, or all 16 wrong, every advantage is zero and that question teaches nothing. The model learns most from questions at the edge of its ability, which is exactly where a good teacher would focus.

The leash

Two more parts of the formula keep this stable. A clip limits each update, so one lucky batch can't drag the model too far (this comes straight from PPO). A KL penalty measures how far the model has drifted from a reference version of itself and pulls it back. Think of it as a leash: the model can explore, but not run off. (R1-Zero mixed languages anyway, which tells you how long the leash was.)

So the recipe for R1-Zero is: a strong base model, questions with checkable answers, a group of attempts per question, an answer key, marking on the curve and a leash. No human labels at all. The paper's headline claim for researchers is that this is "the first open research to validate that reasoning capabilities of LLMs can be incentivized purely through RL".

Part 4: From a Clever Mess to a Usable Model

R1-Zero proved the point, but it was not a product. Nobody wants a chatbot that switches languages halfway through a sentence. So DeepSeek built R1 with a longer pipeline: two rounds of ordinary fine-tuning and two rounds of RL, shown in the figure below.

stop_reasoneval:.pass

Stage 1: a cold start. Before any RL, DeepSeek fine-tuned the base model on "thousands" of long, readable worked examples. Some came from prompting models directly, and some were R1-Zero's own outputs, cleaned up by human annotators. This is supervised fine-tuning (SFT): show the model good examples and train it to imitate them. Each example ends with a short summary, so the reader gets the answer without wading through the working.

Stage 2: reasoning RL. The same answer-key RL as R1-Zero, on maths, code, science and logic. One addition: a language consistency reward, scored as the share of words in the working that are in the target language. DeepSeek admits this costs a little accuracy, and keeps it anyway because people can read the result.

Stage 3: keep the good answers. When the RL stage has converged, DeepSeek uses the model to generate many answers to many prompts and keeps only the correct ones, a method called rejection sampling. It also filters out working with mixed languages, long paragraphs or code blocks. That yields about 600,000 reasoning examples, plus about 200,000 of writing, factual questions and translation, partly reused from V3's own training data. Total: about 800,000.

Stage 4: start again, then polish. DeepSeek then goes back to the V3 base model and fine-tunes it from scratch on those 800,000 examples. A final RL round then covers everything: answer-key rewards for maths and code, and conventional reward models for helpfulness and harmlessness elsewhere. One detail I like: helpfulness is judged only on the final summary, but harmlessness is judged on the whole response, working included. A model that thinks something dangerous and then summarises it politely still loses marks.

The paper also lists what did not work. A process reward model, which marks each step of the working, ran into the obvious problems: what counts as a step, who decides whether it is right, and reward hacking again. A tree search in the style of AlphaGo didn't scale, because there are far more possible sentences than chess moves. It is the lesson from that red teaming post again: the simple thing that can't be gamed beats the clever thing that can.

And the paper is clear about R1's limits. It is worse than V3 at function calling, multi-turn conversation and JSON output. It can mix languages when you write to it in anything other than English or Chinese. And it is "sensitive to prompts": giving it examples in the prompt (few-shot prompting) "consistently degrades its performance". DeepSeek's advice is to describe the problem directly and say what format you want.

Part 5: Distillation, Two Ways

page_viewtool_use

You learned to cook, or to code, partly by copying someone better than you: not just the finished dish, but how they made it. An apprentice who watches a master work learns faster than one who only tastes the meal. Machine learning has the same idea, and it calls it distillation. The word is having a big week, and it is being used for two different things.

The original: soft targets

The classic version comes from a 2015 paper by Geoffrey Hinton, Oriol Vinyals and Jeff Dean, Distilling the Knowledge in a Neural Network. A big model (the teacher) is trained first. A small model (the student) is then trained to match not just the teacher's answers but its whole set of probabilities. Their example: an image classifier looking at a photo of a BMW may give only a tiny probability to "garbage truck", but that is still far more than it gives to "carrot". The right answer is "car", but the pattern of wrong answers says something real about the world: a BMW looks a bit like a truck and nothing like a vegetable. The paper calls these soft targets, and a student trained on them learns more from each example than it would from the bare label.⁵

For that, you need the teacher's probabilities, so you need the teacher on your own machines.

utm_source=SELECT

The R1 version: learn from the teacher's working

DeepSeek's distillation is simpler. It took the 800,000 examples from Stage 3, the questions with R1's full written working and answers, and used them to fine-tune six existing open models: Qwen2.5 at 1.5, 7, 14 and 32 billion parameters, and Llama at 8 and 70 billion. Supervised fine-tuning only. No RL, no probabilities, no access to R1's insides. The students read the master's worked solutions and learned to write like them.

That is why the word is so slippery this week. This kind of distillation only needs the teacher's text, and anyone can get a model's text by asking it questions.

Practising versus copying

DeepSeek also ran the experiment you'd want to see. It trained the same Qwen 32-billion-parameter base model two ways: one copy with more than 10,000 steps of large-scale RL on maths, code and science, the other with plain fine-tuning on R1's 800,000 examples.

On the 2024 AIME, the RL-trained version scored 47.0%, about the same as Alibaba's QwQ-32B-Preview at 50.0%. The distilled version scored 72.6%, ahead of OpenAI's o1-mini at 63.6%.

aria-labelgtm.js

DeepSeek draws two conclusions, and both matter. First, copying a strong model works better than letting a small model discover reasoning on its own, which "require[s] enormous computational power and may not even achieve the performance of distillation". Second, in the sentence the market should have read more slowly: "advancing beyond the boundaries of intelligence may still require more powerful base models and larger-scale reinforcement learning". Distillation makes the second-best model cheap. It does not make the best model.

Even the smallest student is startling. The 1.5-billion-parameter distilled model, which is small enough for a laptop, scores 28.9% on the AIME. GPT-4o, in the same table, scores 9.3%, and Claude 3.5 Sonnet 16.0%. On competition maths, at least, a model you can run on the train beats the big chatbots, because it was trained by watching a reasoning model show its working.⁶

And then the accusation

Now put the two senses side by side. DeepSeek's release note said in big friendly letters: "MIT licensed: Distill & commercialize freely!" and "API outputs can now be used for fine-tuning & distillation". Its API documentation says it shows you R1's chain of thought so you can "view, display, and distill it". OpenAI, by contrast, hides o1's working.

Yesterday, OpenAI said it was looking into whether DeepSeek had done exactly that to its models. Its statement to Semafor:

"We know that groups in the PRC are actively working to use methods, including what's known as distillation, to try to replicate advanced U.S. AI models. We are aware of and reviewing indications that DeepSeek may have inappropriately distilled our models, and will share information as we know more."

As of today, that is an allegation without published evidence. But the mechanism is clear. If distillation only needs a teacher's text, then any model you can talk to is a model someone can learn from. A model that shows its working is easier to learn from than one that hides it. Every AI company is about to think hard about what its API gives away.

Part 6: The $6 Million Number and the $600 Billion Wobble

Most of what you've read about R1's cost comes from a single table, and it's not in the R1 paper. It's in the V3 report from December.

What the $6 million actually covers

Here is DeepSeek's own Table 1 for V3, in words. Pre-training took 2,664,000 GPU hours on Nvidia H800s, the cut-down version of its H100 chip that Nvidia makes for the Chinese market. Extending the context window took 119,000 hours. Post-training took 5,000. Total: 2.788 million GPU hours. Then DeepSeek assumes a rental price of $2 per GPU hour, multiplies, and gets $5.576 million.

Then comes the sentence everyone skipped: "the aforementioned costs include only the official training of DeepSeek-V3, excluding the costs associated with prior research and ablation experiments on architectures, algorithms, or data."

So, three corrections to the group chat:

1. It's V3's number, not R1's. The R1 paper doesn't give a cost at all.
2. It's the final run only. Not the failed runs, the experiments, the salaries, the data or the cluster itself.
3. It's a rental price. It expresses compute in dollars. It is not an invoice.

None of this makes the number fake. As a measure of compute for one training run, it is specific and well explained. It just isn't the cost of "building ChatGPT".⁷

Yesterday, Anthropic's chief executive Dario Amodei published an essay on exactly this. He's not a neutral party, but he gives numbers. He writes that "DeepSeek does not 'do for $6M what cost US AI companies billions'", that Claude 3.5 Sonnet "cost a few $10M's to train", and he guesses that the cost of training a model of a given quality now falls by about four times a year. On his reading, V3 is "an expected point on an ongoing cost reduction curve", and the real surprise is that a Chinese lab was first to show it. He also says V3, not R1, "was actually the real innovation", and that "Producing R1 given V3 was probably very cheap".

That fits the paper. R1 is a second stage of training on top of V3, and V3 came out on Boxing Day to much less attention.

Monday

So why did the market move this week and not in December? Over the weekend, R1 stopped being a paper and became an app. By Monday, DeepSeek's assistant had overtaken ChatGPT as the top free app in the US App Store. DeepSeek even had to limit new sign-ups "due to large-scale malicious attacks". And people read "$6 million" next to "matches o1" and drew the obvious, wrong conclusion. The venture capitalist Marc Andreessen put the mood into six words on Sunday:

Deepseek R1 is AI's Sputnik moment.

— Marc Andreessen (@pmarca), 26 January 2025 on X

The fear went like this. If a frontier-class model costs a few million dollars on export-restricted chips, then the hundreds of billions that American companies plan to spend on data centres might be more than anyone needs, and the company selling the chips is overvalued.

On Monday, Nvidia's shares fell 17%, closing at $118.58. It was the company's worst day since March 2020, and close to $600 billion of market value disappeared.⁸ The previous record for a one-day loss was also Nvidia's: $279 billion, in September. Broadcom fell 17%. Oracle fell 14%. The Nasdaq fell 3.1%. And that, by a long chain of index funds, is how a reinforcement learning paper reached your super balance in Hobart.

Nvidia's response, sent to CNBC, was very calm for a company that had just lost more than Oracle's entire market value in a day. It called DeepSeek "an excellent AI advancement and a perfect example of Test Time Scaling", and added that "Inference requires significant numbers of NVIDIA GPUs and high-performance networking." Translation: a model that thinks longer before it answers uses more chips each time you ask it something, not fewer.

Cheaper per question, more questions

That is the argument against panic, and it has a nineteenth-century name. Microsoft's chief executive Satya Nadella posted it before the US market had even opened:

Jevons paradox strikes again! As AI gets more efficient and accessible, we will see its use skyrocket, turning it into a commodity we just can't get enough of.

— Satya Nadella (@satyanadella), 27 January 2025 on X

The idea: when something gets cheaper to use, people use so much more of it that total spending goes up. Whether it holds for AI chips is a bet, and Nadella's company has billions riding on one answer. But a reasoning model writes thousands of tokens of working for every answer. Price it 27 times lower than o1 and people will ask it far more questions.

Late on Monday, US time, OpenAI's Sam Altman managed to be gracious and competitive in one post:

deepseek's r1 is an impressive model, particularly around what they're able to deliver for the price.

we will obviously deliver much better models and also it's legit invigorating to have a new competitor! we will pull up some releases.

— Sam Altman (@sama), 28 January 2025 on X

Part 7: Where Your Prompts Go

GPC:.1await

Here's the part that matters at work, where someone in marketing has probably already pasted the quarterly plan into the DeepSeek app to "see what it thinks".

"DeepSeek R1" means three different things, and they have very different privacy profiles:

1. The DeepSeek app and website (chat.deepseek.com, and the mobile apps).
2. The DeepSeek API, where your systems send prompts to DeepSeek's servers and pay per token.
3. The open weights, which you download and run on hardware you control.

The first two send your data to DeepSeek. The third doesn't send it anywhere.

What the app's privacy policy says

DeepSeek's privacy policy, last updated on 5 December, is short and fairly direct. The points that matter:

• Who controls your data: Hangzhou DeepSeek Artificial Intelligence and Beijing DeepSeek Artificial Intelligence, "with their registered addresses in China".
• What it collects: your "text or audio input, prompt, uploaded files, feedback, chat history". Also device information, including "keystroke patterns or rhythms", along with IP address and device identifiers.
• What it uses it for: among other things, "training and improving our technology".
• Who it shares with: service providers, and "advertising or analytics partners".
• Where it is stored: "in secure servers located in the People's Republic of China."
• How long: for things like your profile and inputs, "for as long as you have an account".

The keystroke line has had a lot of attention. Keystroke rhythm is a common fraud and bot signal, and the policy lists it under technical information. But it can also identify a person, and combined with everything you type, it's a lot to hand to any provider.⁹

None of this is unusual in shape. Most chatbot privacy policies collect your prompts to improve the product. What's different is the destination, and the law that applies there. A provider in China is a different risk assessment from one in Ireland. If your organisation is covered by the Privacy Act, its rules on overseas disclosure apply, and the reforms I wrote about in 2023 are only making those obligations sharper.

The regulators have noticed

On Tuesday, Italy's data protection authority, the Garante, sent DeepSeek a formal request for information. It asked what personal data is collected, for what purposes and on what legal basis, whether it is stored in China, and what data trained the model. DeepSeek has 20 days to answer. In Australia, the science minister Ed Husic was blunter on the ABC: "There are a lot of questions that will need to be answered in time on quality, consumer preferences, data and privacy management", he said, as reported by SBS. "I would be very careful about that."

And then, yesterday, a reminder that a new company growing fast also has new-company security. The cloud security firm Wiz reported that it had found a DeepSeek database open to the internet, with no password at all. It held "over a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information". Wiz says DeepSeek "promptly secured the exposure" once told. That isn't a story about China. It's a story about a product that went from obscure to number one in a week, and why "how long has this vendor been handling data at this scale?" belongs on every procurement checklist.

The open weights are a different deal

Now the good news. Because the weights are open, you can run R1's distilled models on your own machines, and nothing leaves the building. The free tool Ollama listed them the day they came out, from a 1.1GB download for the 1.5B model up to 43GB for the 70B. The 7B version is a 4.7GB download, which most recent laptops will run. You can also run them on your own cloud account, in the region you choose.

DeepSeek's privacy policy itself says that it does not cover "downstream systems or applications developed by developers using our open platform services"; those are the developer's responsibility. When you host the weights yourself, the model is a file. It has no account and no way to phone home unless the software around it does.

Two caveats. First, the full R1 model needs a data-centre-sized machine; on a laptop you get a distilled student, excellent at maths and weaker at everything else. Second, open weights tell you nothing about how the model was trained to behave. DeepSeek's own paper notes that after safety training R1 tends to "refuse answering certain queries" on one Chinese-language benchmark. Test it on your own tasks before you trust it on anything sensitive, as you would any model.

What to Do This Week

You don't need an opinion on chip stocks. You do need a position on whether your team uses this. Here is the checklist I'd work through, with Aroha, who runs a five-person analytics team at a Launceston tourism business, as the example. (Aroha is made up.)

1. Find out who is already using it. On Tuesday, Aroha asks her team, nicely, who has installed the DeepSeek app or signed up on the website. Two people have. One pasted in a customer email to rewrite it: personal information, now on servers in China. She notes it and checks whether her privacy process needs it reported.

2. Write the one-line rule. "No work data in the DeepSeek app or website. Experiments with the open weights are fine on approved machines." Short rules get followed.

3. Treat the API like any other overseas processor. If a developer wants to use deepseek-reasoner through the API, it goes through the same vendor check as any other provider: where is the data stored (China), what is it used for (the privacy policy says training), how long is it kept, and does the business case justify the transfer? For public, non-personal data, it might. For customer data, Aroha's answer is no.

4. If you want R1's reasoning, run it locally first. Aroha installs Ollama on one machine and runs ollama run deepseek-r1:7b. She tests it on the team's own problems, a tricky SQL query and a messy spreadsheet formula, and writes down what it gets right and wrong. That costs an afternoon and some tea.

5. Prompt it the way the paper says. No examples in the prompt; few-shot prompting makes R1 worse. Describe the problem directly and say what format you want. The GitHub README recommends a temperature between 0.5 and 0.7, to avoid endless repetition.

6. Know where it's weak. The paper says R1 is worse than V3 at function calling and JSON output, and the API doesn't support either for deepseek-reasoner. If you need strict structured output, validate it or use something else. And if you build on the API, DeepSeek's guide says to drop the reasoning_content field from the conversation history: send it back and the API returns an error.

7. Read the reasoning, and don't trust it blindly. When the answer is wrong, the working usually shows where. But the working is the model's text, not a log of what the network computed. Treat it as an explanation, not as proof.

8. Recheck your AI vendor assumptions. If you're paying for a reasoning model by the token, compare the bill against a 27-times-cheaper option, even if you never switch. Two years ago, in my GPT-3 post, I wrote that we'd need to adapt as these tools change. Prices change too. Be wary of three-year contracts at this month's prices.

9. Tell the board one sentence. "The cheap model is real, the $6 million figure is misleading, the app sends data to China, and we can use the open version safely on our own hardware."

Final Thoughts

Back to Tuesday morning and the sunburnt neck. The balance dipped because a lot of people decided, very quickly, that a small lab had built a frontier model for pocket change, so the chips were worth less. Most of that story was wrong. The cost was one run of a different model. The chips are still needed, perhaps more than ever, because a model that thinks before it speaks uses more compute every time it answers.

What was right is more interesting. A strong base model, questions with checkable answers, an answer key and marking on the curve are enough to teach a model to reason, without a human rating its working. And once one model can reason, it can teach smaller ones by showing its working to anyone who can read it. That second idea is going to shape AI pricing, AI security and AI law for the rest of the year.

For your organisation, "open weights" and "the app" are different products with the same name. One is a file you can run behind your own firewall. The other is a service in another country, with that country's rules. Decide which one you're talking about before anyone decides for you, and write it down this week.

As for me, I'm going to download the 7B model and ask it to work out how many cups of tea I drink in a year.¹⁰ If it boxes the right answer, I'll take it as a tick.

Notes

1. The difference matters for trust, not only for licensing. With open weights you can run and inspect the finished model, but you cannot check what it was trained on, and you cannot rebuild it yourself. "Open source", for software, usually means you could. ↩

2. An answer key can still be gamed in theory. A test suite with weak test cases rewards code that passes them without solving the problem. But a rule is much harder to fool than another neural network, which can be coaxed into rewarding nonsense that merely looks right. ↩

3. It's a lovely moment, and it's worth keeping a little scepticism. The model writes "aha" because humans write "aha" in its training text, and saying so led to more ticks. It is a learned behaviour that helps, not proof of a feeling. ↩

4. The real numbers vary. DeepSeek's paper shows its AIME evaluation using 16 samples per question, and DeepSeekMath used 64 samples per question during GRPO training. The arithmetic works the same way at any group size. ↩

5. The trick for getting useful soft targets is to raise the "temperature" of the teacher's final step, which flattens its probabilities so the small differences between wrong answers become visible. The student trains at the same high temperature, then runs at normal temperature afterwards. ↩

6. Those are maths competition scores. The small distilled models were trained on reasoning data, mostly maths and code, and they have no RL stage of their own. Expect them to be much weaker than a general chatbot at writing an email or summarising a meeting. ↩

7. Analysts made the same point within a day. Yahoo Finance quoted Bernstein's Stacy Rasgon noting that the figure "does not include all the other costs associated with prior research and experiments on architectures, algorithms, or data", which is almost word for word what the V3 report itself says. ↩

8. Different outlets give different totals for the same day, depending on the share count and the timing they use. CNBC says close to $600 billion; Yahoo Finance gives $589 billion. Either way, it was the largest one-day loss of market value for any company in US history. ↩

9. Many banking and fraud-prevention systems already measure how you type, because bots and fraudsters type differently from you. The question for a business is not whether the signal is unusual, but whether the provider, its location and its stated purposes are acceptable for your staff and customers. ↩

10. About 1,820, give or take a public holiday. I've checked the arithmetic myself, so this is one answer key I already have. ↩