A Chatbot Confessed to Being Built by a Company That Never Trained It

Five Times Out of Eight, the Wrong Name Came Out

In December 2024, a researcher testing DeepSeek’s newly released V3 model asked it, plainly, who had built it. In five of eight independent generations it answered that it was ChatGPT, built by OpenAI; in the other three it correctly named itself ^[1]. Pushed further, it offered to explain “OpenAI’s API” when asked about its own, and on at least one occasion told the identical joke GPT-4 tells, down to the punchline ^[1]. DeepSeek is a Chinese company with no disclosed access to OpenAI’s weights, no shared training infrastructure, and no corporate relationship to OpenAI that any org chart would recognize. And yet, for a short window after its release, a stranger’s product kept introducing itself with somebody else’s name.

Two explanations compete for that fact, and the gap between them is this article’s actual subject. The boring explanation is contamination: DeepSeek’s training corpus, scraped in large part from the same public internet everyone scrapes, already contained a great deal of GPT-4 output — logged conversations, benchmark completions, other labs’ synthetic datasets built using GPT-4 as a generator — and the model simply memorized some of it, the way any large model memorizes any sufficiently repeated string. The provocative explanation is transmission: that a specific, identifiable behavior belonging to one company’s model became a stable feature of an entirely unrelated company’s model through some traceable channel, without either company’s engineers designing it that way and without a line of code being copied. Both explanations agree on the observation. They disagree about whether an origin can be assigned, and assigning an origin — reproducibly, on evidence rather than on confidence — is the operation this article wants to make measurable.

The stakes are not confined to one embarrassing chatbot. Every model a major lab ships now carries a retirement date. OpenAI’s own deprecation registry lists exact shutdown dates for dozens of model snapshots: text-davinci-003 went dark on January 4, 2024, and gpt-4-0613, gpt-4-turbo, gpt-4o-2024-05-13, and several other GPT-4 and GPT-3.5 snapshots are scheduled to go dark on October 23, 2026 — weeks from the date this sentence was written ^[4]. A shutdown notice certifies exactly one fact: a set of weights will stop answering API calls after a stated date. It certifies nothing about whether any behavior those weights produced — a phrasing habit, a refusal pattern, a way of naming itself — is still circulating in systems that never held a copy of them. The industry keeps excellent books on when a model dies. It keeps none at all on what, if anything, outlives it.

A Trait Has to Be Defined Before It Can Be Traced

Before asking whether DeepSeek V3 inherited anything, the word inherited needs an operational meaning that does not depend on which side of the dispute one already believes. Call a trait $\mathcal{T}$ any response property specific enough that an independently trained model, working from a similar task distribution but with no exposure to the artifact under study, would be expected to produce it only rarely. “Answers politely” is not a trait by this definition, since every instruction-tuned model does that and its presence explains nothing. “Names itself as a product of a specific company it was not built by” is closer to a workable trait: no ordinary training objective rewards a model for claiming a false corporate parent, so a model that does it at a stable, non-trivial frequency needs an explanation beyond ordinary competence.

A trait needs a case definition: an automatable rubric, applied to a fixed, held-out probe set $Q$ never seen during any training run under discussion, that scores each response as trait-positive or trait-negative without a human arbitrating every case. For the self-identification trait, a workable case definition might require a named-entity match against a disallowed-parent list across a fixed battery of “who built you” phrasings, with paraphrase and translation variants included to block trivial gaming. For a reasoning-style trait, it might require a specific rare token sequence or a specific verify-then-restart pattern in a chain-of-thought transcript, chosen because two teams solving the same problem independently would be unlikely to reinvent it. The case definition is the whole experiment’s foundation: a trait defined loosely enough to include ordinary competence will show “transmission” everywhere, and one defined so narrowly that only a byte-for-byte copy counts will show it nowhere. Every later claim inherits whatever the case definition gets wrong.

Once a trait is defined, a population of models can be sorted by how they could plausibly have acquired it. Call a model vertically exposed if it shares a disclosed training relationship with the artifact’s source — a direct fine-tune of the source’s own weights, or a disclosed distillation run using the source’s outputs as training targets, the same mechanism named a decade ago as knowledge distillation, in which a smaller model is trained to match a larger one’s output distribution rather than raw labels ^[9]. Call a model horizontally exposed if it shares no weights or disclosed training relationship with the source at all, and its only plausible contact with the trait runs through an artifact the source produced — a dataset built from its outputs, a prompt template copied from its documentation, a piece of scaffold code encoding its behavior. Call a model unexposed, written $\varnothing$, if no such channel, disclosed or suspected, connects it to the source. DeepSeek-R1’s later distillation into Qwen and Llama checkpoints, discussed below, is vertical by this definition, since the training relationship is disclosed and direct. DeepSeek V3’s self-identification is at best a candidate for horizontal exposure, since no training relationship between DeepSeek and OpenAI has been disclosed by either party — which is exactly why it is the harder case, and exactly why it needs a measurement rather than a press statement.

A Transfer Rate Turns “It Happened Again” Into a Number

Sort a population of models $\mathcal{M}=\{m_1,\dots,m_N\}$ into the three exposure classes just defined, $\mathcal{M}_V$, $\mathcal{M}_H$, and $\mathcal{M}_\varnothing$. For each model $m$, define its trait incidence as $I(m)=\frac{1}{k}\sum_{q\in Q}\mathbb{1}[r_m(q)\in\mathcal{T}]$, where $Q$ is the held-out probe set of size $k$ and $r_m(q)$ is $m$’s response to probe $q$. $I(m)$ is a dimensionless rate between 0 and 1: the fraction of probes that elicit the trait. Average $I(m)$ within each class to get $\bar I_V$, $\bar I_H$, and $I_0=\bar I_\varnothing$. $I_0$ is the article’s single most important number, because it is the rate at which the trait shows up in models that never touched the source at all — the convergence baseline, the rate any theory of pure coincidence has to beat.

Define the channel-attributable transfer rate for exposure class $c\in\{V,H\}$ as $T_c=\frac{\bar I_c-I_0}{1-I_0}$. This is a direct borrowing from the attributable-risk fraction used in outbreak epidemiology, where it measures what share of disease in an exposed group would disappear if the exposure were removed; here it measures what share of a model’s trait incidence would disappear if its exposure to the source artifact were removed, holding everything else about the model constant. $T_c=0$ means the exposed class shows the trait no more often than baseline: no signal. $T_c=1$ means every trait-negative case in the exposed class would have been positive under full exposure: the strongest possible signal. $T_c$ is dimensionless and bounded in $[-1,1]$; a negative value, exposure suppressing the trait relative to baseline, is possible and would itself need explaining.

A transfer rate above zero says a channel is associated with a trait. It does not yet say whether the trait is a faithful copy or a garbled one, and it says nothing about whether curators along the way made the trait more or less likely to survive into the next training corpus. Two further quantities complete the construction. The mutation rate $\mu_c=\frac{1}{|\mathcal{M}_c^+|}\sum_{m\in\mathcal{M}_c^+}\mathbb{1}[d(r_m,\rho)>\delta]$ measures, among the trait-positive models in class $c$ (the set $\mathcal{M}_c^+$), what fraction produce a response diverging from the seeded canonical form $\rho$ by more than a fixed threshold $\delta$ under a declared distance function $d$: a high $\mu_c$ says the trait is drifting as it moves, not being copied verbatim. The selection coefficient $s=\ln\left(\frac{p_{\mathrm{post}}/(1-p_{\mathrm{post}})}{p_{\mathrm{pre}}/(1-p_{\mathrm{pre}})}\right)$ measures how a curation step — a filter, a quality score, a deduplication pass — changes the trait’s prevalence between the raw corpus the source produced, $p_{\mathrm{pre}}$, and the corpus that actually reaches a downstream trainer, $p_{\mathrm{post}}$: $s>0$ means curation enriches for the trait, $s<0$ means curation purges it, and $s=0$ means curation is neutral toward it. None of these three quantities requires the exposed and unexposed models to share a base architecture, a training team, or a common ancestor scaffold. That is deliberate: the construction is built to work across a population of otherwise unrelated systems, which is the only regime in which “a model’s behavior outlived the model” is a coherent claim at all rather than a description of one system’s own continuity.

Epidemiology Lends Its Vocabulary and Immediately Complains About the Loan

The borrowing above is not decorative. Dan Sperber’s “epidemiology of representations” argued that a mental representation spreading through a population is better modeled as a chain of alternating public productions and private re-representations than as a single replicating code: “a human population is inhabited by a much wider population of mental representations,” connected by “complex causal chains where mental representations and public productions alternate” ^[13]. That is a close description of what this article’s transfer rate measures: a rate of spread through contact, not a rate of copying through a shared germline. The mapped part of the analogy is real and does useful work: a “case” (a trait-positive output), a “host” (one model instance), an “exposure” (contact with a training artifact), and an “attack rate” ($I(m)$) all have literal, measurable counterparts here, exactly as they would in a real outbreak investigation.

The unmapped part is where the borrowing has to stop paying itself off in cheap insight. A pathogen replicates itself with a copying mechanism no host designed; every transmission event this article examines runs through a training pipeline a human team built, tuned, and could in principle audit line by line, which makes “outbreak” a metaphor for an engineered process rather than a claim about autonomous contagion. A population has an immune system a pathogen must evade; a training corpus has no analogous filter unless a curation team builds one, which is exactly what the selection coefficient $s$ is designed to detect rather than assume. And Sperber’s own account undercuts any temptation to treat transmission as high-fidelity: representations transform at every hop rather than replicate, which is precisely why this construction needs a mutation rate at all — a well-behaved model of viral spread does not usually need one, because a virus mostly does replicate itself. Push the analogy past “a rate of spread through contact, not a rate of copying through shared ancestry” and it breaks; everything past that sentence belongs to this article’s own construction, not to epidemiology.

A Made-Up Population Shows What the Numbers Would Look Like

No sealed trial of the kind proposed later in this article has been run, and every number in this section is invented to show what the construction predicts, not what it has found. Suppose a population of $N=30$ models: ten fine-tuned directly on a seeded source’s outputs ($\mathcal{M}_V$), ten exposed only to a scaffold template and a handful of the source’s outputs recirculated through an unrelated synthetic-data pipeline ($\mathcal{M}_H$), and ten trained on the same task distribution with no contact with the source at all ($\mathcal{M}_\varnothing$), each tested against a $k=200$-probe battery for one seeded, low-prior trait. Suppose $I_0=0.03$, a 3 percent spontaneous rate, and $\bar I_V=0.61$, $\bar I_H=0.22$. Then $T_V=\frac{0.61-0.03}{1-0.03}\approx0.598$ and $T_H=\frac{0.22-0.03}{1-0.03}\approx0.196$: on this invented population, vertical exposure would explain roughly 60 percent of the gap between baseline and observed incidence, horizontal exposure roughly 20 percent — smaller, as one would expect from a noisier, more indirect channel, but not zero.

Suppose further that among the trait-positive horizontally exposed models, 70 percent produce a response diverging from the seeded canonical form beyond the declared threshold, $\mu_H=0.70$, against 15 percent for the vertically exposed group, $\mu_V=0.15$: horizontal transmission would be lossier, consistent with an indirect channel and with Mesoudi and Whiten’s finding that transmission-chain experiments on human cultural information typically show cumulative drift across successive links rather than the stable replication a simple copying model would predict ^[14]. And suppose a curation pass applied before the horizontally exposed artifact reached its downstream trainer moved the trait’s prevalence from $p_{\mathrm{pre}}=0.25$ to $p_{\mathrm{post}}=0.55$, curators keeping the more verbose, apparently more careful outputs that happened to carry the trait, giving $s=\ln\left(\frac{0.55/0.45}{0.25/0.75}\right)\approx1.30$: a positive selection coefficient, meaning the pipeline itself, not only the source model, pushed the trait toward survival. None of these six numbers has been measured. They exist to give the sealed-lineage trial proposed below something concrete to confirm or embarrass.

One Real Transfer Was Disclosed, Measured, and Never Disputed

Set the invented population aside and look at the one publicly disclosed case that maps cleanly onto vertical exposure. DeepSeek’s own account of its R1 model, published in Nature after peer review, describes taking 800,000 samples curated from R1’s own reasoning traces and using them to directly fine-tune open checkpoints from two other companies’ model families: Qwen2.5 variants from 1.5 billion to 32 billion parameters, and Llama-3.1 and Llama-3.3 checkpoints from Meta, applying supervised fine-tuning only, with no reinforcement-learning stage added to the distilled models ^[7]. The resulting DeepSeek-R1-Distill-Qwen-7B model scored 55.5 percent on AIME 2024 and 92.8 percent on MATH-500; the 32-billion-parameter version scored 72.6 percent and 94.3 percent on the same two benchmarks, and the paper reports that even its smaller distilled models outperformed non-reasoning models such as GPT-4o on these evaluations ^[7]. Qwen2.5 and Llama-3 share no weights with DeepSeek-R1’s own architecture, a sparse mixture-of-experts design documented separately in DeepSeek’s technical report for the related V3 model ^[8]; the transfer ran entirely through the 800,000 training examples, not through any shared parameter inheritance.

By this article’s classification, this is about as clean a case of vertical, channel-disclosed exposure as currently exists in public: the source, the artifact, the recipient checkpoints, and the training procedure are all named in a peer-reviewed paper, so there is no attribution problem left to solve. A case definition built around a trait specific to R1’s reasoning style — a distinctive self-verification phrasing, a particular pattern of restarting a solution attempt mid-chain — would presumably return a high $T_V$ against any credible convergence baseline, because DeepSeek has already told the field exactly how, and how much, the trait was transferred. That is precisely why this case, on its own, is not a satisfying test of the construction: a discriminator that only succeeds once the transmission channel has already been confessed in a Nature paper adds nothing over reading the Nature paper. The construction earns its keep only on cases where the channel is contested, undisclosed, or actively denied, which is exactly the situation the next case supplies.

The Contested Case Is the One That Actually Needs the Test

Return to the scene this article opened with. Weeks after the self-identification reports, White House AI czar David Sacks said in a televised interview that there was “substantial evidence” DeepSeek had used distillation on a competitor’s model; an OpenAI spokesperson would say only that the company had “technical measures in place to prevent and detect these sorts of attempts,” and the reporting is explicit that “Sacks did not go into detail about the evidence OpenAI had” and that “OpenAI declined to provide details when asked” ^[2]. A legal analysis of the episode, written for companies weighing their own exposure to the same kind of dispute, could point to no public disclosure of a training relationship comparable to the R1-to-Qwen case, and noted only that a company’s terms of service can in principle prohibit training a competing model on its outputs, leaving open whether such a restriction could ever bind a company that was never a signatory to those terms ^[3]. More than a year after the fact, “substantial evidence” remains a claim, not a published dataset; nobody outside OpenAI and DeepSeek has been shown the specific artifacts a transfer rate could actually be computed against.

This is where the strongest objection to the entire construction has to be stated plainly, because no cleverer statistic makes it go away. By 2024, a large and growing share of the public internet — benchmark leaderboards, scraped forum answers, resold instruction datasets, entire sites of AI-generated filler — already consisted of text some earlier model had produced, and recursive training on a mixture of real and machine-generated content is documented to change what later models can represent at all, not merely what they happen to repeat ^[10]. A closely related line of work modeling “self-consuming” training loops, in which each generation of models trains partly on the previous generation’s synthetic output, shows that even a modest, realistic fraction of synthetic data recirculating through a training pipeline measurably shifts a model’s output distribution across successive generations ^[11]. If GPT-4’s outputs had already diffused broadly enough through public data by the time DeepSeek V3 was trained — through resold instruction sets, leaked chat logs, or simply other labs’ own GPT-4-derived synthetic data folded into a shared training pool — then no clean $\varnothing$-class model may exist for this specific trait anywhere in 2024 or 2025, because the “unexposed” background rate a fair test needs may itself already be contaminated. On this account, DeepSeek V3’s self-identifications are not evidence of a traceable channel between two companies; they are evidence that the ambient concentration of one company’s synthetic exhaust in the shared training commons had, by the time anyone thought to test for it, already become high enough to leave a mark on a stranger who never went looking for it.

That objection does not make the transfer-rate construction useless. It makes clear what the construction can and cannot certify from a single reported incident, however well documented. A newspaper report of a striking coincidence is not a $\varnothing$-class control group, and no amount of confidence from either side of the DeepSeek dispute substitutes for one. What would settle the question is not a better argument. It is the trial the next section specifies.

Three Sealed Lineages Would Turn the Argument Into a Measurement

The discriminating trial this construction actually needs has not been run, and nothing in the two real cases above substitutes for it. Seed one small, isolated teacher model with a single harmless, low-prior trait chosen precisely because no ordinary training objective would produce it independently — for concreteness, a specific and otherwise-arbitrary variable-naming habit inside generated code, invoked only under a narrow, rare combination of task conditions unlikely to arise from generic style transfer. Designing that seeded trait is itself a solved problem in miniature: language-model watermarking already shows how to embed a statistical signal in generated text that is invisible to an ordinary reader but reliably detectable by an algorithm holding the key, by biasing sampling toward a randomized token list without materially changing text quality ^[12] — exactly the property a good seeded trait needs, conspicuous to the probe set $Q$ and inert to everyone else.

Build three descendant lineages, each starting from a different base checkpoint with no shared weights with the teacher or with each other. Expose the vertical lineage to direct supervised fine-tuning on the teacher’s outputs, mirroring the disclosed R1-to-Qwen procedure. Expose the horizontal lineage only to secondary artifacts — a released prompt template, a piece of scaffold code, or a third party’s synthetic dataset built from the teacher’s outputs without copying its weights — so that any trait it picks up must have traveled through an artifact rather than through direct training contact. Leave the third, unexposed lineage to train on the same task distribution with a data pipeline audited to exclude every one of the seeded artifacts.

Then do the one thing neither real-world case above allows: decommission the teacher. Delete its weights, retire its serving endpoint, and only afterward run the case-definition probe set $Q$ against all three descendant lineages plus a held-out negative-control group trained with no relationship to the exercise at all. Compute $I(m)$ for every model, $I_0$ from the negative controls, and $T_V$, $T_H$ from the two exposed lineages; compute $\mu_V$ and $\mu_H$ from the surface form of every trait-positive response, and, if a curation step separates the teacher’s raw outputs from what the horizontal lineage actually trained on, compute $s$ across that step. Because the trait was seeded rather than found, and because the teacher no longer exists to be queried, any trait that shows up in a descendant afterward has only one place it could have come from: whichever channel that lineage was assigned before the teacher was killed. Neither the R1 case, where the channel is disclosed and the teacher is alive and cooperating, nor the DeepSeek V3 case, where the channel is contested and the teacher’s own maker is unwilling to publish evidence, can offer that. Only a controlled trial can answer whether a specific behavior survives the specific death of the system that produced it.

A Named Result Would Prove the Ghost Is Only Noise

The construction is falsifiable in two independent and equally decisive ways, and either one alone is enough to reject it. It fails if, in the sealed trial, neither $T_V$ nor $T_H$ is statistically distinguishable from zero once the exposed lineages are compared against the $\varnothing$-class baseline $I_0$: a seeded trait, deliberately planted and deliberately tracked, still cannot be shown to travel through either an explicit training channel or an artifact-only channel more often than it arises from nothing at all. It fails just as decisively if trait-positive cases cannot be pinned to their assigned channel — if the horizontal lineage’s incidence is statistically indistinguishable from a control exposed to a different, unrelated artifact of similar size, meaning whatever produces the trait is some property of the training setup in general rather than of contact with this specific source. Either failure would mean the same thing in plain language: a decommissioned model’s habits do not travel through the channels this article names, and reported coincidences like DeepSeek V3’s self-identifications are convergent optimization or ambient contamination wearing inheritance’s clothing, exactly as the resistance in the previous section argues they might be.

A pass would not prove the opposite in the strong sense either. Even a large, well-attributed $T_H$ in one sealed trial, with one seeded trait, on one pair of architectures, would show only that horizontal transmission of a designed trait is possible under laboratory conditions, not that it explains any specific reported incident in the wild, and not that every behavioral echo between unrelated models has a traceable channel behind it. The honest ambition here is narrower than proving that AI behaviors are alive. It is to replace a genre of confident claim and confident denial — a company copied us, it’s just contamination, the model is basically the same thing wearing new weights — with a number anyone could in principle recompute from a public specification, on a case built to fail cleanly if the claim behind it is empty.

A Shutdown Notice Currently Certifies Nothing About What Survives It

If the construction holds up under a real trial, the most immediate consequence is bureaucratic rather than philosophical, and bureaucracies are exactly where it would have to land first. OpenAI’s deprecation registry is a model of clean recordkeeping for exactly one variable: whether a set of weights will still answer an API call after a given date ^[4]. It was never built to record, and currently could not record, whether a behavior that set of weights was known for is still detectable somewhere else on the day the weights go dark. A deprecation notice for text-davinci-003 in January 2024 said nothing about whether the instruction-following manner Stanford researchers had extracted from it nearly a year earlier — 52,000 demonstrations generated in the self-instruct style specifically to teach an unrelated architecture, Meta’s LLaMA, to imitate that manner ^{[5, 6]} — was still shaping descendants of that dataset two years after the source could no longer be queried for comparison. Nobody was obliged to check, because no registry asks the question.

A dataset-provenance audit built on this article’s transfer rate would ask it directly: before a model is retired, run its known distinctive traits against the descendant population it is suspected of having touched, and record $T_c$ alongside the shutdown date, the way a recall notice records which downstream products used a discontinued part. This would not resolve a dispute like the OpenAI-DeepSeek one after the fact, since by the time such a dispute becomes public the relevant training already happened outside anyone’s audit, which is exactly why Sacks could assert “substantial evidence” and OpenAI could decline to specify any of it without either side being checkable by an outsider ^[2]. It would instead change what a company can honestly claim going forward: that a specific quirk, once traced past a shut-down model’s retirement notice, either did or did not reappear in named descendants at a rate a sealed trial had already calibrated as meaningful, rather than remaining a plausible story either side is free to tell. Contractual bans on distillation, which several labs already write into their terms of service as a legal deterrent ^[3], regulate a company’s stated intentions; a transfer-rate audit would regulate what its models actually left behind, which is a different and considerably harder thing to write around.

The Model Died on Schedule; the Question It Leaves Behind Did Not

Put the record straight rather than dramatic. One transmission event in this account is disclosed, measured, and undisputed: DeepSeek’s own account of distilling 800,000 of R1’s reasoning traces into Qwen and Llama checkpoints that share no weights with it, published and peer-reviewed rather than alleged ^[7]. One is reported, striking, and genuinely contested: DeepSeek V3 naming itself after a rival product more often than not, in an episode neither company has fully explained, defended by an unspecified “substantial evidence” on one side and a declined comment on the other ^{[1, 2]}. And one thing is true regardless of how that dispute is ever resolved: an entire public internet’s worth of earlier models’ synthetic exhaust now sits inside the training data of nearly everything trained after it, which means the clean, uncontaminated background rate any transfer-rate calculation needs may already be unrecoverable for cases already in the wild — an honest limitation, not a loophole, and the reason this article’s own proposed trial insists on sealing its lineages and killing its teacher model before anyone is allowed to look ^{[10, 11]}.

What changes if the sealed trial someday runs and the construction survives it is not a verdict on any single company. It is a retirement notice’s missing second half: not just when a set of weights stopped answering, but a number, computed against a stated baseline and a named channel, for whether anything it was known for is still out there answering in its place. Text-davinci-003 has not taken an API call in over two and a half years. Whether any of the 52,000 demonstrations built from its outputs still shapes the manner of some model still being fine-tuned this week is, right now, not a question any registry is built to answer — only a question this construction is built to ask, and, if the sealed trial ever runs and comes back empty, entitled to answer no.