What model does this app use? A provenance checklist after the DHS DeepSeek order

On 20 October 2026 the US Department of Homeland Security published a Federal Register notice (FR Doc 2026-21447, Docket DHS-2026-0628) excluding DeepSeek's IT products and services from federal civilian agency procurements and removing DeepSeek products from civilian agency IT systems. CNBC reports the order was issued on 24 July 2026 and made public on Monday 19 October, and the BBC reports the ban took effect from the end of July. According to the BBC and CNBC, it covers federal civilian agencies such as the Treasury, State and Justice departments, and excludes the Department of Defense. The part that matters to anyone who ships software is that the removal also covers "third-party products and services developed using DeepSeek implementations", and nobody has said where that line sits.

I am not going to argue about the politics. The useful question is smaller: could you name the model inside each service on your server this afternoon, with its version and where it came from? Most people cannot, including plenty of teams that sell software.

How to answer "what model does this app use" this afternoon

This is the checklist I run, on a homelab box or a client's VPS. Do it in order; each step is cheaper than the next.

1. Read the configuration before the marketing page

The landing page says "AI-powered". The config says where the AI lives. Look for environment variables and config keys that name a provider or an endpoint: a base URL, a model name, an API key variable, or a host pointing at Ollama or another inference server.

No source code needed. On a running container:

docker inspect --format '{{json .Config.Env}}' my-app

That prints the environment the container started with, API keys included, so be careful where you paste it. Then check the compose file and mounted config files.

One trap: many apps speak the same chat-completions API format, so a variable named after one provider can point at a different server entirely. The name tells you the protocol, the value tells you the destination, and neither tells you the model.

2. Find where the model actually runs

A product that "uses AI" either ships the weights or calls someone else's endpoint. Both leave marks.

docker ps shows what is running, including the sidecar you forgot.
docker history --no-trunc image:tag shows the layers. A multi-gigabyte layer copying into a models path is a baked-in model.
Look inside: docker exec my-app find / -name '*.gguf', then the same for *.safetensors, plus any /models directory. Note names and sizes. No shell in the image? Inspect its volumes from the host.
ollama list on any host running Ollama shows names, tags and IDs.
The Hugging Face cache, usually ~/.cache/huggingface/hub, where folder names carry the source repository.

No weights found? Then the model is somewhere else.

3. Watch the wire

Config can mislead and docs go stale. Network traffic is the one claim you cannot fake.

ss -tnp shows established TCP connections. For a container, run it inside its network namespace: get the PID with docker inspect -f '{{.State.Pid}}' my-app, then nsenter -t PID -n ss -tnp.
Your DNS resolver's query log shows which hostnames the container looks up.
Cut egress and see what breaks. An internal-only network (docker network create --internal) still lets the app reach a local model container, but not the internet.

If an "offline" assistant keeps answering with the internet cut, the model is local. If it dies, the error or the last DNS lookup usually names the endpoint it was really using.

4. Do the arithmetic on memory

File size against RAM and VRAM tells you the class of model, even if the file was renamed. At 8-bit, weights cost roughly one byte per parameter; a 4-bit quant, roughly half that.

Mixture-of-experts models complicate this. Total parameters decide the file size; active parameters are what works on each token. A 650 GB file on disk does not mean 650 GB in VRAM, because inactive experts can be held in system RAM or streamed from disk, at a speed cost. I went through this in MoE VRAM requirements: total vs active parameters. For an audit: if a small box claims to run something that cannot fit in its memory, it is not running it locally.

5. Ask the model, then do not believe it

Ask "which model are you?" by all means, then treat the answer as generated text, not a serial number. Models trained on other models' outputs often name the wrong family, and a wrapper can put any name in the system prompt.

Cross-check with a fingerprint you can repeat:

Knowledge cutoff. Ask about events near the claimed cutoff and see where knowledge stops.
Tokenizer quirks. If the endpoint reports token usage, compare the count for a fixed string against the claimed model's tokenizer run locally.
A fixed prompt with a known answer. Run the same prompt at temperature zero against a checkpoint you control, save the output, and compare.

None is proof alone. Together they tell you whether the label is plausible.

6. Write it down: a model bill of materials

One line per model:

sha256sum on the model file gives you the checksum. For Ollama, the blobs in its models directory are already named by their sha256 digest.

Then add the swap path: which service would you point at a different model, and how long would that take? If the answer is "I'd have to find out", that is the real finding.

On my own box this part is not hard, and here is why. I run local models on my own hardware and I know which model file each service loads, because I put it there and I can point at the file and its version. That is a smaller problem than a procurement department's, not a solved one. When a third-party app pulls its own weights or calls an endpoint, I am back to steps one to three like everyone else.

What the DHS order actually changed

The notice (91 FR 66346) says the Secretary ordered two things. First, exclusion of IT products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd and its affiliates from federal civilian agency procurements. Second, "removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology."

The authority cited is the Federal Acquisition Supply Chain Security Act of 2018 (41 U.S.C. 1321-1328), following review of a Federal Acquisition Security Council recommendation.

Timing. CNBC reports the order was issued on 24 July 2026 and made public on Monday 19 October. The BBC reports the ban took effect from the end of July.
Exceptions. CNBC reports agencies could request exceptions, including delays in compliance, by sending DHS a written justification within 60 days of the order's issuance. Counted from 24 July, that window closed in late September, before the order was made public.
Scope. Federal civilian agencies, including Treasury, State and Justice. Department of Defense agencies are excluded.
Stated reasons. As CNBC reports them from the order, DHS says DeepSeek's models "present multiple threat vectors", citing potential access to sensitive data by Chinese authorities, sensitive US government data being transferred to China, and possible malware or other vulnerabilities, pointing to open-source research that identified critical vulnerabilities in DeepSeek's iOS app. Those are DHS's claims as reported, not facts I can verify.

China's foreign ministry told Reuters it would safeguard the rights and interests of its companies, as CNBC reports. DeepSeek had not commented at the time of writing.

The gap nobody has filled

Read the third-party clause twice. The BBC reports that companies including Snowflake, Vercel and OpenRouter incorporate DeepSeek in their offerings to customers. So an agency's question is no longer only "do we use DeepSeek?" but "does anything we bought use it underneath?"

The order does not define how much DeepSeek has to be inside a product before it counts as "developed using DeepSeek implementations". There is no published list of affected third-party products, and there is no public information on how many agencies were actually running DeepSeek-based products. Nothing in the order makes the model weights themselves illegal, and I have not seen any public report of a specific product being removed.

What has changed is the category of the question. Model provenance used to be an engineering curiosity. Now it is a procurement question, and most software teams could not answer it today, because they never wrote down which model sits behind which feature.

What this means if you self-host, and what it does not

Plainly: this order is about federal civilian procurement. It says nothing about your homelab and does not restrict what private companies or individuals may run on their own hardware.

But the same question arrives from the other direction. Host something for a client who answers to a compliance team, and they will eventually ask what model is in it and where it came from. Sell a product with a model inside, and a security questionnaire will ask the same, and "whatever the API returns" is not an answer that survives a review.

Here owning the model is an advantage. When the weights are a file on your disk, you can point at the file, version, checksum and licence. That is more than most vendors can tell you, because their model often sits behind someone else's endpoint and can change without notice. I wrote about that failure mode in why a release someone else controls is not the same as a local copy.

The trade is real. Self-hosting gives you a provenance answer and a swap path you control. In return you carry the hardware, updates, security patches and the job of keeping that bill of materials current. A hosted API takes all of that off your hands, and takes the answer to "what model is this?" with it.

Provenance is not paperwork

Run the six steps on one box this week. If any line comes back "unknown" in the source column, you have learned what this order is really about. Provenance is not paperwork. It is the difference between running a model you chose and inheriting one you cannot name.

If you want help auditing a Docker stack, building a model bill of materials, or moving an AI feature onto hardware you control, that is the work I take on through my services page.

Fiverr: hiteshsaini459 · Upwork: hiteshsaini25