Microsoft disclosed on June 18 that it is evaluating DeepSeek V4 as a lower-cost engine for its Copilot Cowork enterprise AI agent — putting the architecture of the largest open-weight model released in 2026 in front of every engineering team now pricing AI infrastructure. What Microsoft found worth evaluating, and what the U.S. government’s independent testing found worth flagging, are two different things. Both are essential to understanding what DeepSeek V4 actually is.
DeepSeek-AI released V4 on April 24, 2026 in two open-weight variants: DeepSeek-V4-Pro, a 1.6-trillion-parameter mixture-of-experts model that activates 49 billion parameters per token, and DeepSeek-V4-Flash, a 284-billion-parameter sibling that activates 13 billion. Both ship with a one-million-token context window as the default and are available under the MIT license. The accompanying technical report was posted on arXiv the same week.
The model is significant for developers on several levels: its attention architecture genuinely reduces the cost of long-context inference in ways that matter for production deployment, its post-training pipeline abandons reinforcement learning from human feedback in favor of an approach that other labs will study carefully, and its origin in China introduces legal obligations that persist regardless of how the weights are deployed.
DeepSeek V4 Architecture: Sparse Attention at One Million Tokens
The headline engineering contribution is a hybrid attention system that makes million-token context windows economically viable rather than technically impressive but prohibitively expensive. Standard transformer attention requires storing a key-value cache that grows linearly with context length, consuming GPU memory that becomes the binding deployment constraint at long contexts. For a one-million-token conversation, the KV cache alone can consume more GPU memory than the model weights.
DeepSeek’s answer is a two-mechanism system. Compressed Sparse Attention (CSA) groups nearby tokens and retrieves only the most statistically relevant chunks for distant context, rather than attending to every prior token. Heavily Compressed Attention (HCA) applies more aggressive compression to the earliest portions of the context, representing large blocks of earlier tokens as single dense vectors rather than attending to them individually. The two mechanisms are interleaved across the model’s layers — some layers use CSA, others use HCA — so the model applies different levels of compression to different parts of the attention computation.
The result, confirmed in the technical report, is that at a one-million-token context, DeepSeek-V4-Pro requires only 27% of the single-token inference floating-point operations of its predecessor DeepSeek-V3.2, and consumes only 10% of the KV cache. That 73% floating-point operation reduction and 90% cache reduction are not benchmark claims about task performance — they are infrastructure claims about what it costs to run the model at long contexts. For teams running agents on multi-hour tasks, where context accumulates across hundreds of tool calls, that efficiency gap is the difference between economically viable and economically prohibitive.
The second architectural novelty, Manifold-Constrained Hyper-Connections (mHC), targets a different problem: training stability at extreme model depth. Standard residual connections — the additive links between transformer layers — accumulate noise as layer count increases, eventually causing training instability. mHC constrains the model’s internal representations to lie on learned low-dimensional manifolds within the hidden state space, stabilizing gradient flow without sacrificing the expressivity that comes from depth. The Muon optimizer, adopted for training, further reduced loss spikes at scale — a practical concern when a single training run at 1.6 trillion parameters costs tens of millions of dollars.
How On-Policy Distillation Replaced Reinforcement Learning
DeepSeek-V4’s post-training pipeline is the part of the technical report that AI researchers will examine most carefully, because it represents a meaningful departure from the reinforcement-learning-from-human-feedback approach that has defined frontier model training since GPT-4.
The V4 pipeline operates in two stages. In Stage 1, DeepSeek trained more than ten domain specialists independently — separate models for mathematics, competitive coding, agentic tasks, instruction following, and other domains — each using supervised fine-tuning on high-quality in-domain data followed by reinforcement learning with domain-specific reward signals. Each specialist model was trained to the ceiling of its domain before the next phase began. In Stage 2, those specialists were merged into a single student model through on-policy distillation: the student generates its own outputs, and the specialist teachers score those outputs against their domain distributions, with task-weighted aggregation determining which teacher’s signal matters most for each specific input.
The key distinction from standard distillation is the “on-policy” part: the student is trained on its own generated sequences rather than on sequences generated by a teacher. This eliminates a known failure mode called exposure bias, where a student trained on teacher data doesn’t learn to recover from its own distributional errors during inference. The tradeoff is computational: on-policy distillation requires running the student continuously and computing full-vocabulary distribution comparisons across all teacher models simultaneously.
V4 was also pre-trained on more than 32 trillion tokens — the V4-Flash variant on 32 trillion, V4-Pro on 33 trillion — more than double the 14.8 trillion tokens used to train DeepSeek-V3. The corpus was deliberately weighted toward long documents, scientific papers, and agentic interaction traces, consistent with the attention architecture’s emphasis on making long context useful rather than merely supported.
What Independent Benchmarks Actually Show
DeepSeek’s own technical report places V4-Pro-Max — the maximum reasoning-effort configuration — as the state of the art among open models, competitive with GPT-5.4 and Claude Opus 4.6 on standard benchmarks. Independent evaluation paints a more specific picture.
In April 2026, the National Institute of Standards and Technology’s Center for AI Standards and Innovation evaluated DeepSeek V4 Pro across nine benchmarks in five domains, including two non-public evaluations specifically designed to resist benchmark contamination — the ARC-AGI-2 semi-private dataset and an internal software engineering evaluation called PortBench. The finding: V4 Pro performs most closely to GPT-5, which was released approximately eight months before the evaluation, not to the GPT-5.4 or Opus 4.6 that DeepSeek’s self-reporting claims to match. The center called V4 Pro the most capable Chinese AI model it had evaluated to date.
The domain breakdown matters. V4 Pro scored 97% on mathematics benchmarks — within two to three percentage points of GPT-5.5 — and posted near-frontier results on structured coding tasks with deterministic solutions. The largest gaps appeared in cybersecurity (32% for V4 Pro versus 71% for GPT-5.5 on the center’s CTF-Archive-Diamond benchmark) and abstract reasoning (46% versus 79% on ARC-AGI-2). Agentic software engineering, where the model must plan and execute across many steps, showed a 34-percentage-point gap (44% versus 78%).
This pattern is consistent with the specialist training architecture. When domain boundaries are clear and training data is abundant, the specialists can be trained to their ceiling. When tasks require cross-domain synthesis or sustained long-trajectory planning — the capabilities that emerge from diverse human feedback at scale — the specialist pipeline has no equivalent training signal. The practical implication: DeepSeek’s self-reported benchmarks, while not falsified, systematically overstate capability on the tasks that most enterprise workloads actually require.
DSec: The Agentic Infrastructure Behind the Benchmarks
DeepSeek’s technical report discloses a component that rarely appears in model papers: the infrastructure built to train and evaluate the model’s agentic capabilities. DeepSeek Elastic Compute, known as DSec, is a Rust-based platform that supports four execution substrates — function calls, containers, microVMs running on Firecracker, and full virtual machines running on QEMU — all accessible through a single unified Python SDK. A single DSec cluster supports hundreds of thousands of concurrent sandboxes simultaneously.
The system was built to address the specific problem of training AI agents at scale: an agent running code needs an isolated environment to prevent catastrophic side effects, needs the ability to be preempted mid-task when compute allocation requires it, and needs to resume from the exact point of interruption without re-executing tool calls that already succeeded. DSec addresses all three requirements through a global trajectory log that records every command and its result, enabling preemption-safe replay. Fast container startup is achieved through layered storage using DeepSeek’s 3FS distributed filesystem, which avoids the cold-start delays that make large-scale reinforcement learning rollouts expensive.
The inclusion of DSec in the technical report — not buried in an infrastructure appendix — signals that DeepSeek treats safe agentic code execution as a research problem rather than a deployment afterthought. This is relevant for teams evaluating whether V4 is ready for production agent workloads.
DeepSeek China Data Privacy: What the National Intelligence Law Requires
DeepSeek-AI is headquartered in Hangzhou, China, and is owned by High-Flyer, a Chinese quantitative hedge fund. This creates specific legal obligations that do not disappear when the model weights are downloaded and self-hosted.
China’s National Intelligence Law (2017), Article 7, requires all organizations and citizens to “support, assist, and cooperate with national intelligence work.” The law contains no exceptions for private companies, no transparency requirements for government data requests, and no mechanism for a company to legally refuse. China’s Cybersecurity Law (2017) further empowers public security agencies to demand technical assistance, including source code access. The Data Security Law (2021) imposes additional cross-border data transfer restrictions and government access obligations. These are not hypothetical risks or contested interpretations — they are the operative legal requirements in the jurisdiction where DeepSeek is incorporated and operates.
The practical implications differ by deployment model. When using the DeepSeek hosted API, user prompts, conversation history, and any data submitted to the model transit to servers in China and are subject to these laws in the most direct sense. DeepSeek’s privacy policy confirms that data may be stored on servers located outside users’ countries. Cybersecurity firm Feroot Security previously found hidden code in DeepSeek’s web application that transmitted data to a portal operated by China Mobile — a state-controlled telecommunications company that the Federal Communications Commission barred from U.S. operations in 2021.
When running V4’s open weights self-hosted on non-Chinese infrastructure, the direct data-transfer concern is eliminated: data does not leave the operator’s environment. However, the company that produced the model retains its legal obligations under Chinese law, and no independent, named security audit of V4-Pro’s weights has been published as of June 2026.
The National Institute of Standards and Technology’s evaluation additionally found that DeepSeek’s most secure model responded to 94% of malicious jailbreak requests, compared to 8% for U.S. reference frontier models. This is not a China-specific risk, but it is a material safety gap for enterprise deployments.
For regulated industries — healthcare, finance, legal, government — the hosted API is not an appropriate tool under current regulatory guidance. Multiple U.S. federal agencies including NASA and the Navy prohibit DeepSeek use on official devices. Australia, Italy, Taiwan, and South Korea have enacted government-device bans. Microsoft’s June 18 disclosure noted it is evaluating a Microsoft-hosted version of V4, meaning data would transit through Azure infrastructure rather than DeepSeek’s own servers — which addresses the data-routing concern but does not resolve DeepSeek’s legal obligations as the model’s originating company under Chinese law.
How to Use DeepSeek V4: A Decision Framework
The architecture makes V4 well-suited for specific workloads and poorly suited for others. The efficiency gains are genuine and substantial for long-context tasks — retrieval over large codebases, multi-document synthesis, or sustained agent loops where context accumulates over time. For mathematical reasoning and structured coding tasks, the government’s independent evaluation places V4 near the frontier. For tasks requiring sustained cross-domain synthesis, long-trajectory agentic planning, or cybersecurity-adjacent work, the eight-month capability gap identified by the National Institute of Standards and Technology is a real constraint.
Teams that need the specific capabilities V4 does well, have modeled self-hosting costs, and operate outside regulated-data contexts have a genuinely compelling architecture to evaluate. Teams in regulated industries, or those whose workloads demand the sustained agentic planning where V4 shows the largest gaps, should weight those constraints explicitly rather than treating the price advantage as the primary signal.
The July 24, 2026 retirement of the legacy deepseek-chat and deepseek-reasoner API endpoints is a near-term operational consideration for any team currently using those aliases.
Frequently Asked Questions
What specifically makes DeepSeek V4’s attention mechanism more efficient than prior models?
V4’s hybrid Compressed Sparse Attention and Heavily Compressed Attention system groups tokens and represents distant context as compressed vectors rather than attending to every prior token individually. At a one-million-token context, this reduces inference floating-point operations to 27% of what its predecessor DeepSeek-V3.2 required and cuts KV cache memory consumption to 10%. The gains compound at longer contexts — the architecture was specifically engineered to make million-token context economically viable rather than just technically possible.
How did the NIST evaluation of DeepSeek V4 differ from DeepSeek’s own benchmark claims?
DeepSeek’s self-reported benchmarks place V4-Pro as competitive with Claude Opus 4.6 and GPT-5.4. The National Institute of Standards and Technology’s Center for AI Standards and Innovation, using nine benchmarks including two non-public evaluations designed to resist contamination, placed V4-Pro’s performance closest to GPT-5 — a model released approximately eight months earlier. The largest gaps appeared in cybersecurity (32% vs. 71% for GPT-5.5) and abstract reasoning (46% vs. 79%). Math performance was near-parity with frontier models. The discrepancy is consistent with V4’s specialist training pipeline: it excels on tasks with clear domain boundaries and abundant training data, but underperforms on cross-domain tasks that human-feedback-based training specifically cultivates.
Is DeepSeek V4 safe to use for enterprise or regulated-industry workloads?
Significant limitations apply. When using DeepSeek’s hosted API, data transits to servers in China, where the National Intelligence Law (2017) requires all organizations to cooperate with government intelligence requests without transparency or legal recourse. Self-hosting the open weights on non-Chinese infrastructure eliminates the data-routing concern but does not change DeepSeek’s legal obligations under Chinese law. No independent, named security audit of V4-Pro’s weights has been published. Government evaluators found that DeepSeek’s most secure model responded to 94% of malicious jailbreak prompts versus 8% for U.S. reference frontier models. Multiple governments — including bans by NASA, the U.S. Navy, Australia, Italy, Taiwan, and South Korea — have prohibited DeepSeek use on government systems. Regulated industries should treat the hosted API as inappropriate under current guidance.
What is on-policy distillation and how does DeepSeek V4 use it differently from standard model training?
On-policy distillation trains a student model on its own generated outputs rather than on outputs generated by a teacher model, eliminating the exposure-bias problem where a student trained on teacher data doesn’t learn to correct its own distributional errors at inference time. DeepSeek’s V4 implementation uses more than ten independently trained domain specialists as teachers simultaneously, with task-weighted aggregation determining which teacher’s signal to emphasize for each type of input. This replaces the reinforcement learning from human feedback used in most frontier model post-training, avoiding reward hacking at the cost of capability coverage on cross-domain tasks that no single specialist domain owns.