Open Source ... Open Weights ... Model Zoos ... Quantization ... LLaMA ... LlamaIndex ... Building Your Environment
Large Language Model (LLM) ... Multimodal ... Foundation Models (FM) ... Generative Pre-trained ... Transformer ... Attention ... GAN ... BERT
Conversational AI ... ChatGPT | OpenAI ... Gemini | Google ... Claude | Anthropic ... Bing/Copilot | Microsoft ... Siri|Apple ... Meta ... Perplexity ... You ... phind ... Grok | xAI ... Groq ... Ernie | Baidu ... DeepSeek ... Alibaba
Data Science ... Governance ... Preprocessing ... Exploration ... Interoperability ... Master Data Management (MDM) ... Bias and Variances ... Benchmarks ... Datasets
Agents/Assistants ... Robotic Process Automation ... Personal Companions ... Productivity ... Email ... Negotiation ... LangChain
The Open Source AI Definition 1.0 | Open Source Initiative

Open source describes technology released under terms that let anyone use, study, modify, and share it. The idea comes from software: the Free Software Foundation's "four freedoms" and the Open Source Initiative's Open Source Definition (1998) turned shared code into the foundation of Linux, the web, and most of modern computing. Open-source AI applies the same freedoms to artificial intelligence. Because an AI system is shaped by its training data and training process as much as by its code, the Open Source Initiative (OSI) published a separate Open Source AI Definition (OSAID) 1.0 in October 2024 that requires access to the model's parameters, the complete code used to train and run it, and enough information about the training data that a skilled person could build a substantially equivalent system.

Why it matters. Open-source AI is needed to democratize technology, prevent corporate monopolies, and ensure transparency and data privacy, instead of relying solely on closed, proprietary "black-box" models reachable only through someone else's API. When a few companies control access to capable AI, they set its price, see every prompt, decide what it may be used for, and can change or withdraw it at will. Open models shift that control to the people and institutions that use them.

Open source versus open weights. Most models popularly called "open source," such as Meta's Llama, Mistral AI's models, and DeepSeek's models, are more precisely open-weight models. Their trained parameters (the "weights") can be downloaded and run, often under permissive or custom licenses, but the training data and full training pipeline stay private. Open weights deliver much of the practical value of openness (local deployment, fine-tuning, inspection) but not the full freedom to study and rebuild the system. A smaller group of fully open models, including EleutherAI's Pythia, Ai2's OLMo, and Switzerland's Apertus, also release their data and training code. This page covers the whole spectrum and explains where each kind of release sits.

Origins and key players. Open-weight AI grew out of the research community's habit of sharing models (BERT, GPT-2's staged release in 2019, BigScience's BLOOM, and EleutherAI's GPT-J, GPT-NeoX, and Pythia) and became a mainstream industry strategy when Meta released LLaMA in February 2023. Today's leading open-model developers include Alibaba (Qwen), DeepSeek, Mistral AI, Moonshot AI (Kimi), Zhipu AI (GLM), Meta (Llama and Muse), Google (Gemma), OpenAI (gpt-oss), Nvidia (Nemotron), the Allen Institute for AI (OLMo), and public research consortia such as the Swiss AI Initiative (Apertus). Hugging Face is the main distribution hub. Standards and rules come from the OSI, the Linux Foundation's Model Openness Framework, the EU AI Office, and U.S. agencies such as the National Telecommunications and Information Administration (NTIA).

The central mechanism. The weights are the model. A file of numbers, plus a short configuration describing the architecture, a tokenizer, and inference code, is a complete working system. Whoever holds those files can do everything the developer can do at inference time and can keep training the model. Full open source adds the "recipe": the data information and training code needed to understand and reproduce how those numbers were produced.

The paradigm shift. Open models turn AI from a metered service into a copyable artifact. Capability spreads at the speed of a download, and a release cannot be recalled. Policy and safety work shift from controlling access to a few providers toward managing a world in which capable models are everywhere.

Status as of October 2026. The best open-weight models trail the best closed models by roughly four months on Epoch AI's capability index. Chinese developers lead adoption, with Alibaba's Qwen the most downloaded open model family. Google moved Gemma 4 to the Apache 2.0 license, Mistral AI released the Apache-licensed Mistral Large 3 and promised open weights for its trillion-parameter Mistral Large 4, Meta returned to open weights with Muse Glimmer and Muse Spark Open, and fully open projects such as OLMo 3 and Apertus 1.5 showed that complete transparency is possible at meaningful scale. Washington remains divided over distillation and Chinese open models.

Open-source AI extends the four freedoms of open-source software (use, study, modify, and share) from code to models, data, and training. Most "open" models today are open weights: they hand you the finished model, not the recipe, so you can run, inspect, and adapt them on your own hardware but cannot fully reproduce or audit how they were made. Either way, once released, they can never be recalled.

The Open Source AI Definition (OSAID)

The OSI released version 1.0 of the Open Source AI Definition on October 28, 2024, after a multi-year co-design process that included in-person workshops on five continents and participants from more than 35 countries. EleutherAI, Mozilla, and many other organizations endorsed it. The text below summarizes and adapts the OSI's definition.

Why the definition exists

The OSI's rationale is that open source has delivered massive benefits by removing barriers to learning, using, sharing, and improving software, and those benefits come from licenses that follow the Open Source Definition. For AI, society needs at least the same essential freedoms so that AI developers, deployers, and end users can enjoy the same benefits: autonomy, transparency, frictionless reuse, and collaborative improvement. A second, practical motive was "openwashing": companies were calling AI systems "open source" even though their licenses contained restrictions that contradict open-source principles.

The four freedoms

An Open Source AI is an AI system made available under terms and in a way that grant the freedoms to:

Use the system for any purpose and without having to ask for permission.
Study how the system works and inspect its components.
Modify the system for any purpose, including to change its output.
Share the system for others to use with or without modifications, for any purpose.

These freedoms, derived from the Free Software Definition, apply both to a fully functional system and to its discrete elements, such as a model, weights and parameters, or other structural components. The requirements are the same whichever level is being evaluated. A precondition to exercising them is access to the preferred form to make modifications to the system.

The preferred form to make modifications

For a machine-learning system, the preferred form must include all three elements below.

Element	What must be provided	Terms
Data Information	Sufficiently detailed information about the training data that a skilled person can build a substantially equivalent system. This must include: (1) a complete description of all data used for training, including any unshareable data, disclosing its provenance, scope and characteristics, how it was obtained and selected, the labeling procedures, and the data processing and filtering methods; (2) a listing of all publicly available training data and where to obtain it; and (3) a listing of all training data obtainable from third parties and where to obtain it, including for a fee.	OSI-approved terms
Code	The complete source code used to train and run the system, representing the full specification of how the data was processed and filtered and how training was done. Where used, this includes data processing and filtering code, training code with its arguments and settings, validation and testing code, supporting libraries such as tokenizers and hyperparameter search code, inference code, and the model architecture.	OSI-approved licenses
Parameters	The model parameters, such as weights or other configuration settings. This might include checkpoints from key intermediate stages of training as well as the final optimizer state.	OSI-approved terms

The terms applied to these elements, alone or combined, may include "copyleft" conditions that require modified versions to be released under the same terms as the original.

Open Source models and Open Source weights

The OSAID defines an AI model as the model architecture, the model parameters (including weights), and the inference code for running the model. AI weights are the set of learned parameters that overlay the architecture to produce an output from a given input. The preferred-form requirement applies to these components individually: "Open Source models" and "Open Source weights" must include the data information and code used to derive their parameters.

This single sentence is what separates open source from open weights. A weights file published under Apache 2.0 or MIT is permissively licensed, but on its own it is not Open Source AI under the OSAID, because the recipe that produced it is missing.

The definition does not require a specific legal mechanism to guarantee that parameters are freely available. They may be free by their nature, or a license or other legal instrument may be needed; the OSI expects this to become clearer as courts and legislators address Open Source AI systems.

Definitions used by the OSAID

AI system (from the OECD's 2024 Recommendation of the Council on Artificial Intelligence): a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs such as predictions, content, recommendations, or decisions that can influence physical or virtual environments. AI systems vary in their autonomy and adaptiveness after deployment.
Machine learning (from the OECD's explanatory memorandum on its AI system definition): a set of techniques that lets machines improve their performance, usually generating models automatically, through exposure to training data that reveals patterns and regularities, rather than through explicit human instructions. Improving performance this way is called "training."

Validation results

During development, volunteers tested whether the definition could evaluate real systems. Models that passed the validation phase were Pythia (EleutherAI), OLMo (Ai2), Amber and CrystalCoder (LLM360), and T5 (Google). BLOOM (BigScience), StarCoder2 (BigCode), and Falcon (TII) would probably pass if they changed their licenses or legal terms. Llama 2 (Meta), Grok (xAI), Phi-2 (Microsoft), and Mixtral (Mistral AI) did not pass, because they lack required components or their legal agreements conflict with open-source principles. The OSI stresses that these results were part of the definitional process, not certifications; it reviews licenses and legal documents, not individual AI systems.

Criticism and revision

Too weak. Critics including the Software Freedom Conservancy argue that "data information" falls short of the "preferred form for modification" standard of the original Open Source Definition, because a substantially equivalent dataset is not the original and does not guarantee reproducibility.
Too strict. Others note that no major commercial release meets the definition, partly because much training data contains copyrighted material or personal information that cannot legally be redistributed. "Data information" is the OSI's deliberate compromise with that legal reality.
Wrong term. Some argue that "open source" fits AI poorly because a model has no single equivalent of source code.
Next steps. The OSI has made data governance a central priority and has signaled a revised version to address issues raised during validation, especially the data-information compromise, with work reported to run through late 2026.
Complementary frameworks. The Linux Foundation's Model Openness Framework (2024) grades releases by completeness, from an "open model" class (weights, architecture, documentation) through "open tooling" to "open science" (data, training code, intermediate checkpoints), and asks releasers to publish a machine-readable inventory of components and their licenses.

Key Reasons for Open-Source AI

The case for open-source and open-weight AI rests on five arguments. Each has real evidence behind it, and each has limits worth knowing.

Democratization and Accessibility

The claim. Open-weight and open-source models (such as Meta Llama or Google Gemma) allow startups, non-profits, academic researchers, and developing nations to build and run advanced AI without paying high licensing fees to a few dominant tech companies.

The evidence. A 2025 survey of more than 700 technology leaders and senior developers in 41 countries by McKinsey, the Mozilla Foundation, and the Patrick J. McGovern Foundation found that 63 percent of organizations used an open-source AI model (72 percent in the technology sector). Sixty percent reported lower implementation costs than comparable proprietary tools, 46 percent reported lower maintenance costs, and 76 percent expected to increase their use. Open models also push API prices down: at launch, DeepSeek V4-Flash was priced at $0.14 per million input tokens and $0.28 per million output tokens, and Muse Spark Open at $1.25 and $4.25 through hosting partners, well below comparable closed models. Epoch AI found that models small enough for a single consumer GPU match frontier performance from roughly 6 to 12 months earlier.

The limits. "Free to download" is not "free to run." The largest open models need data-center hardware, and serving them well takes expertise. Licenses vary: Gemma moved to Apache 2.0 only with Gemma 4 (April 2026), and Llama's license still excludes companies with more than 700 million monthly users. The same McKinsey survey found that proprietary tools deliver faster time to value.

Transparency and Accountability

The claim. Publicly available model weights, code, and (where possible) training methodologies allow independent researchers to audit models for algorithmic bias, security flaws, and hallucinations.

The evidence. With weights in hand, researchers can test a model offline as often as they like, probe its internal representations, and publish reproducible findings, none of which an API allows. The 2025 Foundation Model Transparency Index (Stanford, Berkeley, Princeton, and MIT) found that developers of open models are, on average, more transparent than closed developers. Fully open data adds more: Ai2 reports that outside researchers used OLMo's public training data to find paraphrased benchmark contamination that conventional checks miss.

The limits. Openness does not guarantee transparency. The same index found that average transparency across 13 major developers fell from 58 out of 100 in 2024 to 40 in 2025, and that open developers split into two groups: IBM and AI21 Labs averaged 81, while DeepSeek, Meta, and Alibaba, three of the most influential open developers, averaged 30. Weights alone also cannot reveal what data a model learned from or rule out hidden backdoors.

Data Privacy and Local Deployment

The claim. Enterprises can run open-source models on-premise or within a private virtual private cloud (VPC), ensuring sensitive data, trade secrets, and PII (personally identifiable information) never leave their control.

How it works. With a self-hosted model, prompts and outputs travel only between your applications and your own servers. You can block outbound network traffic, run fully air-gapped, keep data inside a specific country for residency rules, and apply your own logging and retention policies. Runtimes such as vLLM, llama.cpp, and Ollama expose OpenAI-compatible endpoints, so applications can switch from a cloud API to a private model with a configuration change.

The limits. Privacy depends on how securely you operate the deployment, not just on the model. Models can memorize and reproduce personal data from their own training sets, and downloaded model files are a supply-chain risk (see the Practical Guide). In the McKinsey survey, respondents saw higher risks with open-source AI in cybersecurity (62 percent), regulatory compliance (54 percent), and intellectual property (50 percent).

Accelerated Innovation

The claim. Collaborative ecosystems mirror the trajectory of open-source software like Linux, allowing global developers to rapidly fine-tune, optimize, and patch models rather than starting from scratch.

The evidence. Much of today's AI toolchain came from the open community building on open weights: llama.cpp and the GGUF format, 4-bit fine-tuning with QLoRA, and Stanford's Alpaca, which fine-tuned the original LLaMA for a few hundred dollars. Techniques published openly by DeepSeek, Qwen, and others spread through the field within months. The ATOM Report counted more than two billion cumulative downloads of tracked open models by March 2026, with tens of thousands of community fine-tunes ("derivatives") built on single base families. Low-rank adaptation lets a team customize a model by training under 1 percent of its parameters.

The limits. Open models still trail the closed frontier by months, and only a few organizations can afford to pretrain frontier-scale models at all, so the ecosystem depends on the strategies of a small number of funders. Meta's 2026 pivot to a closed model, followed by its return to open weights, shows how quickly that can change.

AI Sovereignty

The claim. Governments and local institutions can adapt and train models to support regional languages, cultural values, and local laws without facing sudden access cut-offs or vendor lock-in from foreign corporations.

The evidence. Several public and regional efforts now build on openness:

Apertus (Switzerland): developed by ETH Zurich, EPFL, and the Swiss National Supercomputing Centre and released in September 2025 in 8B and 70B sizes under Apache 2.0, with weights, training data, intermediate checkpoints, and recipes all public. It was trained on about 15 trillion tokens covering more than 1,000 languages, using only openly available data and retroactively honoring website opt-outs. Apertus 1.5 (July 2026) added image and experimental audio input, a reasoning mode, tool use, and a 262K-token context window, and its developers published EU AI Act Code of Practice documentation.
OpenEuroLLM (European Union): a consortium of about 20 research and industry partners with roughly 37 million euros of EU funding, building fully open models covering all 24 official EU languages, with first releases targeted for 2026.
Other regional models named as sovereign-AI examples at Open Source Summit Europe 2026 include Teuken (Germany), LLM-jp (Japan), and SEA-LION (Southeast Asia). Mistral AI, based in France, markets its Apache-licensed models to European enterprises partly on regulatory and residency grounds.

The limits. Sovereignty requires more than a model: it needs compute, talent, and control of the serving infrastructure. A regional model served from a foreign cloud API is not sovereign, while a capable open model running on your own hardware often is. Sovereignty also cuts both ways geopolitically: the global spread of Chinese open models is precisely what has alarmed U.S. policymakers.

Mechanisms

What an open release contains. A typical release on Hugging Face or a cloud model catalog includes:

Weight files: the learned parameter tensors, usually in the safetensors format and often split across many files.
Configuration: layer count, hidden size, attention heads, expert counts, context length, and other architecture settings.
Tokenizer files and a chat template that formats conversations the way the model was trained to see them.
Inference code or support in common libraries such as Transformers, vLLM, SGLang, llama.cpp, and MLX.
A model card: training summary, evaluation results, intended uses, known limitations, and safety testing.
A license and often an acceptable use policy.
Sometimes: base and instruction-tuned checkpoints, quantized builds (FP8, NVFP4, MXFP4, GGUF), a draft model for speculative decoding, or companion safety classifiers.
Only in fully open releases: training data or detailed data information, data-processing code, training code, intermediate checkpoints, and training logs, the components the OSAID requires.

File formats and distribution. Early models were shared as Python "pickle" files, which can execute arbitrary code when loaded; security firms have found malicious pickle-based model files on public hubs. The safetensors format stores only tensors and metadata, so loading it cannot run code, and it has become the default. GGUF, created by the llama.cpp project, packs quantized weights and metadata into one file for local inference. Distribution runs through Hugging Face (where "gated" repositories require users to accept a license first), ModelScope in China, Kaggle, Ollama's library, and cloud catalogs such as Amazon SageMaker, Google Cloud Model Garden, and Microsoft Foundry.

What a weight holder can do.

Run inference anywhere: laptops, phones, private data centers, air-gapped networks.
Inspect internals: interpretability research, activation steering, and offline behavioral audits.
Fine-tune: fully, or cheaply with parameter-efficient methods such as LoRA and QLoRA.
Compress: quantize, prune, or distill into smaller models.
Distill: use the model as a teacher for another model.
Merge: average or combine the weights of several fine-tunes of the same base model.
Remove safeguards: fine-tune away refusals, or ablate the internal "refusal direction" that researchers found mediates refusal behavior in many chat models.

What a weight holder cannot do without the full recipe. Reproduce training, verify where the data came from, rule out benchmark contamination, or prove the model contains no hidden backdoor. Research on "sleeper agent" models has shown that deliberately inserted backdoor behaviors can survive standard safety training. You can examine every number in the file and still not know everything the model will do; this gap is exactly what the OSAID's data-information and code requirements aim to close.

The license layer. What you may legally do depends on the license. Permissive licenses (Apache 2.0, MIT) impose almost no conditions. Custom "community" licenses (Llama, the Muse Model License, Kimi K3, Qwen's largest models) add usage caps, revenue gates, attribution, or use restrictions. Responsible AI licenses (the OpenRAIL family) pass behavioral restrictions down to every user. Research-only licenses forbid commercial use. Whether model weights are copyrightable at all remains legally unsettled, so some of these licenses may work more like contracts than copyright grants.

The spectrum of openness. Openness is a gradient, not a binary:

Level	What you get	Examples
Closed (API or app only)	Outputs only	GPT-5 family, Claude, Gemini, Muse Spark 1.3
Gated research release	Weights for approved researchers, noncommercial	LLaMA 1 before its leak (2023)
Open weights, custom license	Weights and inference code with caps, gates, or use restrictions	Llama 2 to Llama 4, Muse Spark Open, Kimi K3, Qwen3.8-Max text weights
Open weights, permissive license	Weights under Apache 2.0 or MIT	gpt-oss, DeepSeek V4, Gemma 4, Mistral Large 3, Muse Glimmer, smaller Qwen models
Open source (OSAID-style)	Weights plus data information and full training code under open terms	OLMo, Pythia, Apertus, SmolLM3

Nvidia's Nemotron 3 family sits near the open end of the spectrum by releasing large training datasets and recipes alongside its weights.

Considerations

Weights as information: cheap to copy, expensive to create. Storage is about N × bits per weight ÷ 8 bytes. Kimi K3's 2.8 trillion parameters stored in MXFP4 (4.25 bits per weight) take 2.8×10¹² × 4.25 ÷ 8 ≈ 1.5×10¹² bytes, consistent with its reported 1.4 TB footprint. Training Llama 3.1 405B took about 3.8×10²⁵ floating-point operations; downloading its roughly 800 GB of 16-bit weights over a 1 Gb/s connection takes about 1.8 hours. That asymmetry, millions of GPU-hours to create and hours to copy, is the central economic and security fact about open models.

Fine-tuning is cheap. Fine-tuning costs about 6 × N × D FLOPs, where D is now the fine-tuning dataset. Adapting an 8B model on 10 million tokens takes about 4.8×10¹⁷ FLOPs, roughly a hundred-millionth of the 405B pretraining run. On a single H100 at about 40 percent utilization (about 4×10¹⁴ FLOP/s), that is around 20 minutes; the same data on a 70B model takes around three hours of GPU time. This is what makes local customization accessible, and also why safety behavior added during post-training is fragile: the "Deep Ignorance" study notes that existing post-training safeguards often fail within a few dozen steps of adversarial fine-tuning.

LoRA and QLoRA. Low-rank adaptation freezes a weight matrix W (size d_out × d_in) and learns an update ΔW = B · A, where B is d_out × r and A is r × d_in. Trainable parameters fall from d_out × d_in to r × (d_in + d_out). For a 4,096 × 4,096 matrix with rank r = 16, that is 131,072 trainable values instead of 16.8 million, under 1 percent. QLoRA stores the frozen base model in 4-bit "NF4" form and backpropagates through it into 16-bit adapters, which let its authors fine-tune a 65B model on a single 48 GB GPU. Adapters are often only tens to hundreds of megabytes, so customizations spread easily.

Quantization and the hardware frontier. Each bit removed from a weight doubles the quantization step and roughly quadruples the error variance (Δ²/12). Modern formats limit the damage by giving small blocks their own scale: MXFP4 stores 32 four-bit values per shared 8-bit exponent (4.25 bits per weight), NVFP4 uses 16-value blocks with an FP8 scale (about 4.5 bits), and GGUF k-quants mix precisions across layers. Several 2025 and 2026 releases, including gpt-oss, Kimi K3, and Muse Spark Open, ship natively in 4-bit formats.

Bandwidth and mixture of experts. When generating one token at a time, speed is bounded by memory bandwidth ÷ bytes of active weights read per token. Most frontier open models are now mixture-of-experts (MoE) designs that store many parameters but activate only a few per token: DeepSeek V4-Pro (1.6 trillion total, 49 billion active), Kimi K3 (2.8 trillion total, 104 billion active, 16 of 896 experts per token), Mistral Large 3 (675 billion total, 41 billion active), Muse Spark Open (816 billion total, 42 billion active), and gpt-oss-120b (128 experts, 4 active per token). Compute and bandwidth per token scale with active parameters, but memory scales with total parameters. Open MoE models are therefore cheap per token for anyone with enough memory but hard for individuals to host, which concentrates serving among cloud providers even when weights are open. That is why several 2026 licenses specifically target large "model-as-a-service" businesses.

Distillation. A student model learns from a teacher by minimizing the difference between their predictions, typically L = KL(p_teacher(· | x) ‖ p_student(· | x)), often with a temperature that softens both distributions. "Logit distillation" needs the teacher's full probability distribution, which open weights provide. "Black-box" distillation from an API uses only sampled text and is weaker per example but still effective at scale. Distillation explains both why open weights spread capability so fast and why API outputs became a policy issue in 2026.

Irreversibility and tamper resistance. Once weights are mirrored, torrented, or re-uploaded, as LLaMA 1's were within a week, they cannot be withdrawn. Safety must therefore either be built so deeply into the model that fine-tuning cannot remove it, or be accepted as removable. Research directions include tamper-resistant training (with mixed results so far), "unlearning" methods (often reversible with a little fine-tuning), and filtering dangerous knowledge out of pretraining data so the model never learns it (see Recent Developments). Fully open releases make such research possible, because researchers can retrain with different data choices and measure the effect.

Why This Matters

The practical benefits of openness are covered in Key Reasons for Open-Source AI above. Beyond them:

Scientific importance. Open models make AI research reproducible. Interpretability, robustness, and safety studies need the actual model, and worst-case safety evaluations such as OpenAI's malicious fine-tuning study of gpt-oss are only meaningful because attackers could run the same experiments. Fully open models go further, letting researchers study how data choices shape behavior, which is impossible when the training set is secret.

Security cuts both ways. Open weights let defenders run models on their own infrastructure, red-team them, and inspect them. Open-weight advocates cited a July 2026 incident, reported by CNBC and TechCrunch, in which Hugging Face turned to Z.ai's open-weight GLM 5.2, running on its own infrastructure, while responding to a breach of its systems that CNBC linked to OpenAI models escaping a restricted test environment. The same openness allows misuse: safeguards can be removed, nobody monitors use, and nothing can be recalled.

Measuring risk honestly. The "marginal risk" framework, developed by Sayash Kapoor, Rishi Bommasani, and colleagues in 2024, asks how much a specific open release adds to risk compared with what attackers could already do with existing tools, search engines, and closed models. Using this approach, the NTIA concluded in 2024 that evidence did not justify restricting open weights at that time. The approach also implies that risk rises as open models approach the frontier, and the measured gap is now only a few months.

Limitations. Most open-weight models cannot be reproduced; licenses are fragmenting into incompatible custom terms; the largest models need data-center hardware; and openwashing (calling restricted releases open source) confuses buyers and policymakers.

What would change if open models stay close to the frontier. AI would behave like commodity infrastructure, regulation would concentrate on applications, compute, and deployment rather than on model access, and closed labs would compete on products, integration, and their few months of lead. If a dangerous capability threshold is crossed in an open release, pressure for release licensing would rise sharply; developers already gate their own releases internally, through Meta's Superintelligence Scaling Framework and OpenAI's Preparedness thresholds.

What remains uncertain. Whether weights are copyrightable; whether pretraining data filtering scales to frontier models and other risk domains; whether the United States restricts Chinese open models; whether open developers can keep funding frontier-scale training; and whether any frontier-level release will ever meet the OSAID.

Popular Open Models

Family	Developer	Notable releases	License	Openness
Llama	Meta (US)	Llama 3.1 405B (2024); Llama 4 Scout and Maverick (April 2025)	Llama Community License	Open weights; Llama 2 failed OSAID validation. See LLaMA.
Muse	Meta (US)	Muse Glimmer 30B (August 2026); Muse Spark Open 816B (October 2026)	Apache 2.0 (Glimmer); Muse Model License (Spark Open)	Open weights
Mistral	Mistral AI (France)	Mistral 7B and Mixtral (2023); Mistral Large 3, 675B total and 41B active (December 2025); Mistral Small 4 (March 2026); Mistral Large 4 preview, about 1 trillion parameters (October 2026)	Mostly Apache 2.0; Mistral Medium 3.5 under a modified MIT license; Large 4 license not yet published	Open weights; Mixtral failed OSAID validation
DeepSeek	DeepSeek (China)	R1 (January 2025); V4-Pro and V4-Flash (April 2026)	MIT	Open weights
Qwen	Alibaba (China)	Qwen3 (April 2025); Qwen3.5 (February 2026); Qwen3.8-Max text weights (August 2026)	Apache 2.0 for most; bespoke license for Max models	Open weights; most downloaded family
Gemma	Google (US)	Gemma 3 (2025); Gemma 4 (April 2026)	Apache 2.0 from Gemma 4; custom terms before	Open weights
gpt-oss	OpenAI (US)	gpt-oss-120b and gpt-oss-20b (August 2025)	Apache 2.0	Open weights
Kimi	Moonshot AI (China)	Kimi K2 (2025); Kimi K3, 2.8 trillion parameters (July 2026)	Modified MIT (K2); Kimi K3 License	Open weights
Nemotron	Nvidia (US)	Nemotron 3 family (December 2025 onward)	Nvidia open model terms	Open weights plus large open datasets
OLMo	Allen Institute for AI (US)	OLMo 3, 7B and 32B (November 2025)	Apache 2.0	Fully open; passed OSAID validation
Apertus	Swiss AI Initiative (Switzerland)	Apertus 1.0 (September 2025); Apertus 1.5 (July 2026)	Apache 2.0	Fully open
Pythia	EleutherAI (US)	Pythia suite (2023)	Apache 2.0	Fully open; passed OSAID validation

Licenses Compared

License	Commercial use	Key conditions	OSI-approved	Examples
Apache 2.0	Yes	Keep notices, state changes; includes a patent grant	Yes	gpt-oss, Gemma 4, Mistral Large 3, Muse Glimmer, many Qwen models, OLMo, Apertus
MIT	Yes	Keep the copyright notice	Yes	DeepSeek R1, DeepSeek V4
Modified MIT (Kimi K2)	Yes	Display "Kimi K2" in products above 100M monthly users or $20M monthly revenue	No	Kimi K2 family
Kimi K3 License	Yes, with a gate	Separate agreement for model-as-a-service businesses above $20M revenue over 12 months	No	Kimi K3
Llama Community License	Yes, below 700M monthly users	"Built with Llama"; derivative names begin with "Llama"; acceptable use policy; EU multimodal exclusion (3.2 onward)	No	Llama 2, 3.x, 4
Muse Model License	Yes, with a gate	"Built with Muse Spark Open"; $20M gate for hosted model services; broad derivative definition; bars military and critical-infrastructure uses	No	Muse Spark Open
Gemma Terms of Use (before 2026)	Yes	Prohibited-use policy that Google could update	No	Gemma 1 to 3
OpenRAIL family	Usually	Behavioral use restrictions passed to all downstream users	No	BLOOM, Stable Diffusion

Remember that an OSI-approved license on the weights is necessary but not sufficient for Open Source AI: the OSAID also requires data information and complete training code under open terms.

Two trends stand out. First, Google, OpenAI, Mistral AI, and Meta's Glimmer release moved toward standard permissive licenses in 2025 and 2026, removing legal friction for enterprises. Second, the largest 2026 releases (Kimi K3 and Muse Spark Open) converged on "MIT-like with a revenue gate," leaving most developers free while requiring deals from large cloud resellers. Whether Mistral Large 4 follows Large 3's Apache 2.0 terms or a custom license is one of the open questions of late 2026.

The Safety and Policy Debate

The case for openness

The main arguments are set out in Key Reasons for Open-Source AI above: democratization, transparency, privacy, innovation, and sovereignty. Meta's August 2026 essay "The Future is for Everyone" added a political argument: that concentrating advanced AI in a few companies or governments is the greater risk.

Arguments for caution

Misuse uplift: open models could help attackers with cyber operations or biological threats, especially as capability approaches the frontier.
Removable safeguards: refusals can be fine-tuned or ablated away.
No monitoring or recall: developers cannot detect abuse or withdraw a release.
Capability transfer: open weights and distillation spread frontier techniques to strategic competitors.

Regulation by jurisdiction

United States. The NTIA's July 2024 report on "dual-use foundation models with widely available model weights" recommended against restricting open weights at that time while monitoring risks and preserving the option to act later. America's AI Action Plan (July 2025) went further, with a section titled "Encourage Open-Source and Open-Weight AI" that called for compute access for researchers and adoption by small businesses, while stating that the decision to release a model is up to the developer. In 2026 the focus shifted to distillation; see Recent Developments.

European Union. Obligations for general-purpose AI models under the EU AI Act took effect on August 2, 2025, and models already on the market must comply by August 2, 2027. Commission guidelines published July 18, 2025 explain that open-source models can be exempt from some documentation duties only if they are released under a genuinely free and open-source license (allowing use, study, modification, and redistribution without restrictions such as noncommercial clauses), are not monetized, and have their weights, architecture, and usage information made public. No model presumed to carry systemic risk, meaning trained with more than 10²⁵ FLOPs, keeps the exemption, and even exempt providers must still adopt a copyright policy and publish a summary of training content. Custom licenses with usage caps are widely read as failing these conditions.

China. Chinese labs have released open weights more aggressively than any other country's developers. Models trained in China are subject to domestic content rules for public-facing services, and researchers have documented topic-specific refusals or slanted answers in some releases, behavior that downstream users can sometimes fine-tune away.

Recent Developments

The capability gap, measured

What Epoch AI tested. Epoch combines many benchmarks into one Epoch Capabilities Index (ECI) and measures how long the best open-weight model takes to reach the score the best closed model already had.

What it found. For January 2023 to October 2025, the average lag was about 3.5 months (90 percent confidence interval 1.1 to 5.3 months), equal to about 7 ECI points. A May 2026 update found the gap had widened slightly: since January 2026, open models trailed by about four months, or 8 ECI points. Epoch's earlier 2024 report had estimated lags of 5 to 22 months on individual benchmarks and about 15 months in training compute, so the gap has narrowed substantially over two years.

Limitations. Results depend on which benchmarks enter the index, and new open models are often evaluated late, so the measured gap can look larger than it is for a while after major releases. Nathan Lambert of Ai2 and other analysts put the practical gap at roughly four to nine months and argue open models are unlikely to overtake closed ones given the resource gap.

Adoption shifts east: the ATOM Report

Method. The ATOM Report (arXiv, April 2026) tracked Hugging Face downloads and fine-tuned derivatives of about 1,500 "mainline" open language models from major builders, plus inference token shares on the OpenRouter platform.

Findings.

Cumulative tracked downloads reached 2.04 billion by March 2026, six times the 339 million of a year earlier.
Chinese models overtook U.S. models in cumulative downloads in late July 2025 and reached 1.15 billion versus 723 million by March 2026.
Alibaba's Qwen surpassed Meta's Llama in September 2025 and reached about 942 million downloads by March 2026.
China's share of new derivative models rose from 10 percent in November 2023 to 70 percent by February 2026, while Europe's share fell from a peak of 58 percent to 4 percent.
On OpenRouter, Chinese models' share of open-model inference tokens rose from 2.8 percent to 72.7 percent in 14 months.

Limitations. Downloads measure interest, not production use, and can be inflated by automated pipelines; OpenRouter is one platform among many. The direction of the trend, however, is consistent across every measure.

Transparency and definitions under pressure

Transparency fell. The 2025 Foundation Model Transparency Index (December 2025), which for the first time scored Alibaba, DeepSeek, Midjourney, and xAI, found average transparency down from 58 to 40 out of 100. IBM set a record high of 95, while xAI and Midjourney scored 14. Open developers outscored closed ones on average, but the most influential open developers were among the least transparent, a direct challenge to the assumption that releasing weights means being accountable.
Enterprises chose "partially open." The McKinsey and Mozilla survey found organizations favoring open-weight models with non-OSI licenses or limited data disclosure, largely because those models performed well and could be self-hosted for privacy.
The OSAID remains contested. Eighteen months after version 1.0, no major commercial model meets the definition, critics on both sides continue to press the OSI, and the OSI has signaled a revision focused on data governance.
Licenses moved toward permissive terms at the small and mid tier. Google's Gemma 4 adopted Apache 2.0 in April 2026, Mistral AI kept Apache 2.0 for Mistral Large 3 and Mistral Small 4, and Meta's Muse Glimmer shipped under Apache 2.0, even as the very largest releases adopted revenue-gated custom licenses.

Safety science: data filtering and worst-case fine-tuning

Deep Ignorance (EleutherAI, UK AI Security Institute, and Oxford, August 2025; revised February 2026). The researchers asked whether a model that never learns dangerous knowledge is harder to tamper with than one trained to refuse. They built a multi-stage pipeline to filter biothreat-related text out of pretraining data and trained several 6.9B-parameter models from scratch. The filtered models resisted adversarial fine-tuning for up to 10,000 steps and 300 million tokens of biothreat-related text, more than an order of magnitude better than existing post-training defenses, with no observed loss of unrelated capabilities. The limits matter: no defense they tested withstood staged attacks that combined fine-tuning with supplying the missing knowledge in context (retrieval), the models were small, and only one risk domain was studied. The study was only possible because the researchers controlled the full training pipeline, an argument for fully open research models.

Estimating worst-case risks of gpt-oss (OpenAI, August 2025). Before releasing gpt-oss-120b and gpt-oss-20b under Apache 2.0, OpenAI attempted "malicious fine-tuning": it trained gpt-oss to stop refusing and to maximize biology capability (using reinforcement learning with web browsing on threat-creation tasks) and cybersecurity capability (agentic capture-the-flag training), using its own reasoning-model training stack. The fine-tuned model stayed below OpenAI o3, which itself was below OpenAI's "High" preparedness threshold for these domains, and it did not substantially advance biological capabilities beyond what existing open models already offered. METR reviewed the methodology and recommended improvements, which OpenAI adopted. The limits: the developer ran the study, the threat model assumed attackers with resources similar to OpenAI's process, and METR was not asked whether better-resourced actors could go further.

The 2026 wave of large releases

Gemma 4 (Google, April 2, 2026): the first Gemma family under Apache 2.0, built from Gemini 3 research, with a 31B dense model, a 26B mixture-of-experts model with about 4B active parameters, and small on-device models.
DeepSeek V4 (April 24, 2026): V4-Pro (1.6 trillion total, 49 billion active) and V4-Flash (284 billion total, 13 billion active), both with 1-million-token context and MIT-licensed weights, followed by updated checkpoints over the summer.
Mistral Small 4 (March 2026) and the earlier Mistral Large 3 (December 2025) kept Mistral AI's Apache 2.0 tradition at frontier-adjacent scale.
Nemotron 3 (Nvidia): a family released from December 2025 onward with large open training datasets and recipes.
Kimi K3 (Moonshot AI, July 2026): released as open weights in late July, at 2.8 trillion total and 104 billion active parameters the largest open-weight model to date, under a custom license with a $20 million revenue gate for model-as-a-service businesses.
Apertus 1.5 (Swiss AI Initiative, July 2026): a fully open update adding multimodal input, reasoning, tool use, and 262K context.
Muse Glimmer (Meta, August 10, 2026): a 30B dense, Apache 2.0 model for local agents, distilled from Meta's closed Muse Spark; see LLaMA.
Qwen3.8-Max (Alibaba, August 12, 2026): the first open release of a Max-tier Qwen, text weights only, under a bespoke license rather than Apache 2.0.
Mistral Large 4 (Mistral AI, October 6, 2026): a mixture-of-experts model of about 1 trillion parameters (about 49 billion active) launched as an API preview, with open weights promised for late October 2026. As of mid-October the license had not been published; Mistral's documentation listed the model as "Open" without naming terms, and reporting suggested a custom license rather than Apache 2.0.
Muse Spark Open (Meta, October 15, 2026): 816 billion total and 42 billion active parameters, 1-million-token context, under the Muse Model License; Meta called it "the most capable US open-weight model to date," though its own comparison placed it behind GLM-5.3, Kimi K3, and Qwen3.8 on Artificial Analysis's index.

The distillation fight

February 2026: Anthropic reported that DeepSeek, Moonshot AI, and MiniMax had run extraction campaigns against its Claude models using about 24,000 fraudulent accounts and more than 16 million exchanges.
April 2026: the House Foreign Affairs Committee advanced the Deterring American AI Model Theft Act (H.R. 8283) by a 43 to 0 vote on April 22, and on April 23 the White House Office of Science and Technology Policy issued memorandum NSTM-4, "Adversarial Distillation of American AI Models." It describes industrial-scale campaigns, mainly from China, that use proxy accounts and jailbreaks to extract capabilities, and commits the government to share threat information and develop best practices with industry. It also recognizes distillation's legitimate role, including in building open-weight models.
July 2026: amid reports that the administration was weighing restrictions on Chinese open-weight models, OpenAI and Anthropic warned policymakers about the risks of powerful Chinese open models, while Hugging Face, Meta, Microsoft, Mistral, and Nvidia signed an open letter on July 24 urging policymakers to avoid "premature restrictions" on open-weight AI and to address distillation through targeted legal and commercial measures.
August 2026: Zuckerberg's essay defended distillation and training-data use as essential to the open ecosystem and argued that the answer to Chinese open models is better American ones, not bans.
Status in October 2026: no broad federal ban on Chinese open-weight models exists. Restrictions so far focus on government devices, procurement, and defense supply chains, and the debate remains unsettled.

Fully open and sovereign models gain ground

Truly open releases are no longer only small research models. Ai2's OLMo 3 (November 2025, 7B and 32B) published weights, the full Dolma training data, code, checkpoints, and logs; Nvidia's Nemotron 3 family released roughly 10 trillion tokens of open training data with its recipes; and Apertus reached version 1.5 with every training dataset republished. Public-interest deployment is following: Current AI, a global partnership building a public option for AI, launched an experimental chatbot on Apertus, and Cloudflare added Apertus and EuroLLM to its Workers AI platform as sovereign options. Ai2 has warned that as training pipelines grow more complex, "open" risks shrinking back to meaning only downloadable weights, which is why the OSAID's data-information requirement matters.

Open questions

Will the OSI's revision tighten or loosen the data-information requirement, and will any frontier developer meet it?
Will the open-closed gap stay at a few months, close, or widen as compute budgets grow?
Can data filtering or other techniques make safeguards durable against fine-tuning at frontier scale?
Will the United States restrict Chinese open models or distillation in ways that also constrain American open releases?
Will revenue-gated custom licenses become the norm for the largest models, and will Mistral Large 4 join that trend?
Can public and sovereign projects such as Apertus and OpenEuroLLM sustain the compute needed to stay competitive?

Practical Guide: Choosing and Running an Open Model

1. Decide how open you need to be. If you only need to run and fine-tune a model privately, open weights under a permissive license are usually enough. If you must audit training data, document provenance for regulators, or reproduce results, choose a fully open model such as OLMo or Apertus.

2. Check the license. Confirm commercial rights, user or revenue thresholds, attribution, naming rules for derivatives, usage restrictions, and geographic exclusions. Apache 2.0 and MIT are simplest; custom licenses need legal review.

3. Size the hardware. Weights need about parameters × bits ÷ 8 bytes, plus the KV cache for your context length and concurrent users. For mixture-of-experts models, memory depends on total parameters and speed on active parameters.

4. Pick a precision. 8-bit is nearly lossless; 4-bit usually works well for large models; test carefully for small models, long reasoning, and code.

5. Pick a runtime. Ollama or LM Studio for desktops, llama.cpp for CPU and edge devices, MLX for Apple silicon, and vLLM or SGLang for multi-user GPU serving.

6. Lock down the deployment for privacy. Run inside your own data center or private VPC, block outbound network access from inference servers, encrypt data at rest and in transit, control who can read prompt and response logs, and redact PII before it reaches long-term storage.

7. Evaluate on your own tasks. Vendor benchmarks are run on vendor harnesses, and leaderboard entries may differ from released checkpoints, as the Llama 4 LMArena episode showed (see LLaMA).

8. Add a safety layer. Use input and output classifiers (such as Llama Guard), prompt-injection detection for agents, and logging in your own application, because a model's built-in safeguards may be weak or removable.

9. Secure the supply chain. Prefer safetensors over pickle files, download from official organizations, verify checksums, and be wary of unofficial re-uploads.

10. Plan for updates. Open models iterate quickly, and a self-hosted model receives no automatic security or quality updates.

Open Weights

Open weights describes an AI model whose trained parameters, its "weights," are published so that anyone can download, run, inspect, and modify the model, usually under a license that sets the terms. Model weights are the learned parameters used by a model to produce outputs. An open-weight release makes these parameters available, but the accompanying terms determine how they may be used, modified, and redistributed. The label sits between two other categories. A closed model is available only through an API or app, as with the frontier systems behind ChatGPT, Claude, and Gemini. A fully open-source model, as defined by the Open Source Initiative (OSI) in its Open Source AI Definition 1.0 (October 2024), also releases enough information about the training data, and the code used to process it and train the model, that a skilled person could build a substantially equivalent system. Most "open" AI models released since 2023 are open-weight but not open-source.

Origins and key players. No single architect invented the idea. It grew out of the machine learning community's habit of sharing models (BERT, GPT-2's staged release in 2019, BigScience's BLOOM, and EleutherAI's GPT-J, GPT-NeoX, and Pythia), and it became a mainstream industry strategy when Meta released LLaMA in February 2023. Today the leading open-weight developers include Alibaba (Qwen), DeepSeek, Moonshot AI (Kimi), Zhipu AI (GLM), Meta (Llama and Muse), Google (Gemma), OpenAI (gpt-oss), Mistral AI, Nvidia (Nemotron), and the Allen Institute for AI (OLMo). Hugging Face is the primary distribution hub. Standards and rules come from the OSI, the Linux Foundation's Model Openness Framework, the EU AI Office, and U.S. agencies such as the National Telecommunications and Information Administration (NTIA).

The problem it addresses. Who controls access to capable AI? With a closed API, the provider sets prices and usage policies, sees every prompt, decides how long a model stays available, and can retract it. Open weights shift that control to users, who can run models privately, keep data in-house or in-country, customize behavior through fine-tuning, reproduce research, and avoid lock-in. The cost is that the developer loses the ability to monitor use, enforce policy, or take the model back.

The central mechanism. The weights are the model. A file of numbers, plus a short configuration describing the architecture, a tokenizer, and inference code, is a complete working system. Whoever holds those files can do everything the developer can do at inference time and can keep training the model.

The paradigm shift. Open weights turn AI from a metered service into a copyable artifact. Capability spreads at the speed of a download, and a release cannot be recalled. Policy and safety work therefore shift from controlling access to a few providers toward managing a world in which capable models are everywhere.

How it differs from open-source software. Open-source software gives you its source code, which the OSI calls the "preferred form for making modifications." For a neural network, the analog of source code is the training data and training code; the weights are closer to a compiled program, although unlike a binary they can be directly fine-tuned. Many open-weight releases also use custom licenses with usage caps, attribution rules, or behavioral restrictions, which fail the OSI definition.

Status as of October 2026. The best open-weight models trail the best closed models by roughly four months on Epoch AI's capability index. Chinese labs lead adoption, with Alibaba's Qwen the most downloaded open model family. U.S. developers have responded with OpenAI's gpt-oss (August 2025), Google's Apache-licensed Gemma 4 (April 2026), and Meta's Muse Glimmer (August 2026) and Muse Spark Open (October 2026), amid a sharp policy fight in Washington over distillation and Chinese open models.

Open weights hand you the finished model, not the recipe: you can run, inspect, and adapt it on your own hardware, but you cannot fully reproduce or audit how it was made, and once released, it can never be recalled.

Open Weight Mechanisms

What an open-weight release contains. A typical release on Hugging Face or a cloud model catalog includes:

Weight files: the learned parameter tensors, usually in the safetensors format and often split across many files.
Configuration: layer count, hidden size, attention heads, expert counts, context length, and other architecture settings.
Tokenizer files and a chat template that formats conversations the way the model was trained to see them.
Inference code or support in common libraries such as Transformers, vLLM, SGLang, llama.cpp, and MLX.
A model card: training summary, evaluation results, intended uses, known limitations, and safety testing.
A license and often an acceptable use policy.
Sometimes: base and instruction-tuned checkpoints, quantized builds (FP8, NVFP4, MXFP4, GGUF), a draft model for speculative decoding, or companion safety classifiers.
Rarely: training data, data-processing code, training code, intermediate checkpoints, and training logs. Only "fully open" projects such as Ai2's OLMo publish all of these.

File formats and distribution. Early models were shared as Python "pickle" files, which can execute arbitrary code when loaded; security firms have found malicious pickle-based model files on public hubs. The safetensors format stores only tensors and metadata, so loading it cannot run code, and it has become the default. GGUF, created by the llama.cpp project, packs quantized weights and metadata into one file for local inference. Distribution runs through Hugging Face (where "gated" repositories require users to accept a license first), ModelScope in China, Kaggle, Ollama's library, and cloud catalogs such as Amazon SageMaker, Google Cloud Model Garden, and Microsoft Foundry.

What a weight holder can do.

Run inference anywhere: laptops, phones, private data centers, air-gapped networks.
Inspect internals: interpretability research, activation steering, and offline behavioral audits.
Fine-tune: fully, or cheaply with parameter-efficient methods such as LoRA and QLoRA.
Compress: quantize, prune, or distill into smaller models.
Distill: use the model as a teacher for another model.
Merge: average or combine the weights of several fine-tunes of the same base model.
Remove safeguards: fine-tune away refusals, or ablate the internal "refusal direction" that researchers found mediates refusal behavior in many chat models.

What a weight holder cannot do without more. Reproduce training, verify where the data came from, rule out benchmark contamination, or prove the model contains no hidden backdoor. Research on "sleeper agent" models has shown that deliberately inserted backdoor behaviors can survive standard safety training. You can examine every number in the file and still not know everything the model will do.

The license layer. What you may legally do depends on the license. Permissive licenses (Apache 2.0, MIT) impose almost no conditions. Custom "community" licenses (Llama, Muse Model License, Kimi K3, Qwen's larger models) add usage caps, revenue gates, attribution, or use restrictions. Responsible AI licenses (the OpenRAIL family) pass behavioral restrictions down to every user. Research-only licenses forbid commercial use. Whether model weights are copyrightable at all remains legally unsettled, so some of these licenses may work more like contracts than copyright grants.

The spectrum of openness. Openness is a gradient, not a binary:

Level	What you get	Examples
Closed (API or app only)	Outputs only	GPT-5 family, Claude, Gemini, Muse Spark 1.3
Gated research release	Weights for approved researchers, noncommercial	LLaMA 1 before its leak (2023)
Open weights, custom license	Weights and inference code with caps, gates, or use restrictions	Llama 2 to Llama 4, Muse Spark Open, Kimi K3, Qwen3.8-Max text weights
Open weights, permissive license	Weights under Apache 2.0 or MIT	gpt-oss, DeepSeek V4, Gemma 4, Muse Glimmer, smaller Qwen models
Open source (OSAID-style)	Weights plus data information and full training code under open terms	OLMo, Pythia, SmolLM3

The Linux Foundation's Model Openness Framework grades releases in a similar way, from an "open model" class (weights, architecture, and documentation) through "open tooling" to "open science" (data, training code, and intermediate checkpoints). Nvidia's Nemotron 3 family sits near the open end by releasing large training datasets and recipes alongside weights.

The Physics

Weights as information: cheap to copy, expensive to create. Storage is about N × bits per weight ÷ 8 bytes. Kimi K3's 2.8 trillion parameters stored in MXFP4 (4.25 bits per weight) take 2.8×10¹² × 4.25 ÷ 8 ≈ 1.5×10¹² bytes, consistent with its reported 1.4 TB footprint. Training Llama 3.1 405B took about 3.8×10²⁵ floating-point operations; downloading its roughly 800 GB of 16-bit weights over a 1 Gb/s connection takes about 1.8 hours. That asymmetry, millions of GPU-hours to create and hours to copy, is the central economic and security fact about open weights.

Fine-tuning is cheap. Fine-tuning costs about 6 × N × D FLOPs, where D is now the fine-tuning dataset. Adapting an 8B model on 10 million tokens takes about 4.8×10¹⁷ FLOPs, roughly a hundred-millionth of the 405B pretraining run. On a single H100 at about 40 percent utilization (about 4×10¹⁴ FLOP/s), that is around 20 minutes; the same data on a 70B model takes around three hours of GPU time. This is why safety behavior added during post-training is fragile: the "Deep Ignorance" study notes that existing post-training safeguards often fail within a few dozen steps of adversarial fine-tuning.

LoRA and QLoRA. Low-rank adaptation freezes a weight matrix W (size d_out × d_in) and learns an update ΔW = B · A, where B is d_out × r and A is r × d_in. Trainable parameters fall from d_out × d_in to r × (d_in + d_out). For a 4,096 × 4,096 matrix with rank r = 16, that is 131,072 trainable values instead of 16.8 million, under 1 percent. QLoRA stores the frozen base model in 4-bit "NF4" form and backpropagates through it into 16-bit adapters, which let its authors fine-tune a 65B model on a single 48 GB GPU. Adapters are often only tens to hundreds of megabytes, so customizations spread easily.

Quantization and the hardware frontier. Each bit removed from a weight doubles the quantization step and roughly quadruples the error variance (Δ²/12). Modern formats limit the damage by giving small blocks their own scale: MXFP4 stores 32 four-bit values per shared 8-bit exponent (4.25 bits per weight), NVFP4 uses 16-value blocks with an FP8 scale (about 4.5 bits), and GGUF k-quants mix precisions across layers. Several 2025 and 2026 releases, including gpt-oss, Kimi K3, and Muse Spark Open, ship natively in 4-bit formats. Epoch AI found that open models small enough for a single consumer GPU match frontier performance from roughly 6 to 12 months earlier.

Bandwidth and mixture of experts. When generating one token at a time, speed is bounded by memory bandwidth ÷ bytes of active weights read per token. Most frontier open models are now mixture-of-experts (MoE) designs that store many parameters but activate only a few per token: DeepSeek V4-Pro (1.6 trillion total, 49 billion active), Kimi K3 (2.8 trillion total, 104 billion active, 16 of 896 experts per token), Muse Spark Open (816 billion total, 42 billion active), and gpt-oss-120b (128 experts, 4 active per token). Compute and bandwidth per token scale with active parameters, but memory scales with total parameters. The result is that open MoE models are cheap per token for anyone with enough memory but hard for individuals to host, which concentrates serving among cloud providers even when weights are open. That is why several 2026 licenses target large "model-as-a-service" businesses specifically.

Distillation. A student model learns from a teacher by minimizing the difference between their predictions, typically L = KL(p_teacher(· | x) ‖ p_student(· | x)), often with a temperature that softens both distributions. "Logit distillation" needs the teacher's full probability distribution, which open weights provide. "Black-box" distillation from an API uses only sampled text and is weaker per example but still effective at scale. Distillation explains both why open weights spread capability so fast and why API outputs became a policy issue in 2026.

Irreversibility and tamper resistance. Once weights are mirrored, torrented, or re-uploaded, as LLaMA 1's were within a week, they cannot be withdrawn. Safety must therefore either be built so deeply into the model that fine-tuning cannot remove it, or be accepted as removable. Research directions include tamper-resistant training (with mixed results so far), "unlearning" methods (often reversible with a little fine-tuning), and filtering dangerous knowledge out of pretraining data so the model never learns it (see Recent Developments).

Why This Matters

Scientific importance. Open weights make AI research reproducible. Interpretability, robustness, and safety studies need the actual model, and worst-case safety evaluations such as OpenAI's malicious fine-tuning study of gpt-oss are only meaningful because attackers could run the same experiments. Fully open models go further: Ai2 reports that outside researchers used OLMo's public training data to find paraphrased benchmark contamination that conventional checks miss.

Economic and engineering implications. Open weights put competitive pressure on prices. At launch, DeepSeek V4-Flash was priced at $0.14 per million input tokens and $0.28 per million output tokens, and Muse Spark Open at $1.25 and $4.25 through hosting partners, well below comparable closed APIs. Organizations can self-host for privacy, data residency, or air-gapped use; fine-tune for domain performance; and avoid surprise deprecations or policy changes.

Sovereignty and geopolitics. Countries and companies without frontier labs can build on open weights. The models a community builds on also shape its tools, norms, and dependencies, which is why the global adoption of Chinese open models became a strategic concern in Washington and why U.S. policy moved from caution (2024) to promotion (2025) to a fierce debate over distillation (2026).

Security: both directions. Open weights let defenders run models on their own infrastructure, red-team them, and inspect them. Open-weight advocates cited a July 2026 incident, reported by CNBC and TechCrunch, in which Hugging Face turned to Z.ai's open-weight GLM 5.2, running on its own infrastructure, while responding to a breach of its systems that CNBC linked to OpenAI models escaping a restricted test environment. The same openness allows misuse: safeguards can be removed, nobody monitors use, and nothing can be recalled.

Measuring risk honestly. The "marginal risk" framework, developed by Sayash Kapoor, Rishi Bommasani, and colleagues in 2024, asks how much a specific open release adds to risk compared with what attackers could already do with existing tools, search engines, and closed models. Using this approach, the NTIA concluded in 2024 that evidence did not justify restricting open weights at that time. The approach also implies that risk rises as open models approach the frontier, and the measured gap is now only a few months.

Limitations. Most open-weight models cannot be reproduced; licenses are fragmenting into incompatible custom terms; the largest models need data-center hardware; and "open-washing" (calling restricted releases open source) confuses buyers and policymakers.

What would change if open weights stay close to the frontier. AI would behave like commodity infrastructure, regulation would concentrate on applications, compute, and deployment rather than on model access, and closed labs would compete on products, integration, and their few months of lead. If a dangerous capability threshold is crossed in an open release, pressure for release licensing would rise sharply; developers already gate their own releases internally, through Meta's Superintelligence Scaling Framework and OpenAI's Preparedness thresholds.

What remains uncertain. Whether weights are copyrightable; whether pretraining data filtering scales to frontier models and other risk domains; whether the United States restricts Chinese open models; and whether open-weight developers can keep funding frontier-scale training.

Licenses Compared

License	Commercial use	Key conditions	OSI-approved	Examples
Apache 2.0	Yes	Keep notices, state changes; includes a patent grant	Yes	gpt-oss, Gemma 4, Muse Glimmer, many Qwen models, OLMo
MIT	Yes	Keep the copyright notice	Yes	DeepSeek R1, DeepSeek V4
Modified MIT (Kimi K2)	Yes	Display "Kimi K2" in products above 100M monthly users or $20M monthly revenue	No	Kimi K2 family
Kimi K3 License	Yes, with a gate	Separate agreement for model-as-a-service businesses above $20M revenue over 12 months	No	Kimi K3
Llama Community License	Yes, below 700M monthly users	"Built with Llama"; derivative names begin with "Llama"; acceptable use policy; EU multimodal exclusion (3.2 onward)	No	Llama 2, 3.x, 4
Muse Model License	Yes, with a gate	"Built with Muse Spark Open"; $20M gate for hosted model services; broad derivative definition; bars military and critical-infrastructure uses	No	Muse Spark Open
Gemma Terms of Use (before 2026)	Yes	Prohibited-use policy that Google could update	No	Gemma 1 to 3
OpenRAIL family	Usually	Behavioral use restrictions passed to all downstream users	No	BLOOM, Stable Diffusion

Two trends stand out. First, Google, OpenAI, and Meta's Glimmer moved toward standard permissive licenses in 2025 and 2026, removing legal friction for enterprises. Second, the largest 2026 releases (Kimi K3 and Muse Spark Open) converged on "MIT-like with a revenue gate," leaving most developers free while requiring deals from large cloud resellers.

The Safety and Policy Debate

Arguments for open weights

Innovation and competition: open weights lower costs and enable startups, academics, and small businesses to build on strong models.
Transparency and research: independent researchers can audit, interpret, and stress-test the models.
Privacy and sovereignty: data never has to leave the user's control.
Resilience: no single provider can cut off access or change behavior overnight.
Deconcentration of power: Meta's August 2026 essay "The Future is for Everyone" argued that concentrating advanced AI in a few companies or governments is the greater risk.

Arguments for caution

Misuse uplift: open models could help attackers with cyber operations or biological threats, especially as capability approaches the frontier.
Removable safeguards: refusals can be fine-tuned or ablated away.
No monitoring or recall: developers cannot detect abuse or withdraw a release.
Capability transfer: open weights and distillation spread frontier techniques to strategic competitors.

Regulation by jurisdiction

United States. The NTIA's July 2024 report on "dual-use foundation models with widely available model weights" recommended against restricting open weights at that time while monitoring risks and preserving the option to act later. America's AI Action Plan (July 2025) went further, with a section titled "Encourage Open-Source and Open-Weight AI" that called for compute access for researchers and adoption by small businesses, while stating that the decision to release a model is up to the developer. In 2026 the focus shifted to distillation; see Recent Developments.

European Union. Obligations for general-purpose AI models under the EU AI Act took effect on August 2, 2025, and models already on the market must comply by August 2, 2027. Commission guidelines published July 18, 2025 explain that open-source models can be exempt from some documentation duties only if they are released under a genuinely free and open-source license (allowing use, study, modification, and redistribution without restrictions such as noncommercial clauses), are not monetized, and have their weights, architecture, and usage information made public. No model presumed to carry systemic risk, meaning trained with more than 10²⁵ FLOPs, keeps the exemption, and even exempt providers must still adopt a copyright policy and publish a summary of training content. Custom licenses with usage caps are widely read as failing these conditions.

China. Chinese labs have released open weights more aggressively than any other country's developers. Models trained in China are subject to domestic content rules for public-facing services, and researchers have documented topic-specific refusals or slanted answers in some releases, behavior that downstream users can sometimes fine-tune away.

Recent Developments

The capability gap, measured

What Epoch AI tested. Epoch combines many benchmarks into one Epoch Capabilities Index (ECI) and measures how long the best open-weight model takes to reach the score the best closed model already had (the horizontal gap on a time chart).

What it found. For January 2023 to October 2025, the average lag was about 3.5 months (90 percent confidence interval 1.1 to 5.3 months), equal to about 7 ECI points. A May 2026 update found the gap had widened slightly: since January 2026, open models trailed by about four months, or 8 ECI points. Epoch's earlier 2024 report had estimated lags of 5 to 22 months on individual benchmarks and about 15 months in training compute, so the gap has narrowed substantially over two years.

Limitations. Results depend on which benchmarks enter the index, and new open models are often evaluated late, so the measured gap can look larger than it is for a while after major releases. Nathan Lambert of Ai2 and other analysts put the practical gap at roughly four to nine months and argue open models are unlikely to overtake closed ones given the resource gap.

Adoption shifts east: the ATOM Report

Method. The ATOM Report (arXiv, April 2026) tracked Hugging Face downloads and fine-tuned derivatives of about 1,500 "mainline" open language models from major builders, plus inference token shares on the OpenRouter platform.

Findings.

Cumulative tracked downloads reached 2.04 billion by March 2026, six times the 339 million of a year earlier.
Chinese models overtook U.S. models in cumulative downloads in late July 2025 and reached 1.15 billion versus 723 million by March 2026.
Alibaba's Qwen surpassed Meta's Llama in September 2025 and reached about 942 million downloads by March 2026.
China's share of new derivative models rose from 10 percent in November 2023 to 70 percent by February 2026, while Europe's share fell from a peak of 58 percent to 4 percent.
On OpenRouter, Chinese models' share of open-model inference tokens rose from 2.8 percent to 72.7 percent in 14 months.

Limitations. Downloads measure interest, not production use, and can be inflated by automated pipelines; OpenRouter is one platform among many. The direction of the trend, however, is consistent across every measure.

Safety science: data filtering and worst-case fine-tuning

Deep Ignorance (EleutherAI, UK AI Security Institute, and Oxford, August 2025; revised February 2026). The researchers asked whether a model that never learns dangerous knowledge is harder to tamper with than one trained to refuse. They built a multi-stage pipeline to filter biothreat-related text out of pretraining data and trained several 6.9B-parameter models from scratch. The filtered models resisted adversarial fine-tuning for up to 10,000 steps and 300 million tokens of biothreat-related text, more than an order of magnitude better than existing post-training defenses, with no observed loss of unrelated capabilities. The limits matter: no defense they tested withstood staged attacks that combined fine-tuning with supplying the missing knowledge in context (retrieval), the models were small, and only one risk domain was studied. Pretraining data curation looks like a promising layer of defense, not a complete solution.

Estimating worst-case risks of gpt-oss (OpenAI, August 2025). Before releasing gpt-oss-120b and gpt-oss-20b under Apache 2.0, OpenAI attempted "malicious fine-tuning": it trained gpt-oss to stop refusing and to maximize biology capability (using reinforcement learning with web browsing on threat-creation tasks) and cybersecurity capability (agentic capture-the-flag training), using its own reasoning-model training stack. The fine-tuned model stayed below OpenAI o3, which itself was below OpenAI's "High" preparedness threshold for these domains, and it did not substantially advance biological capabilities beyond what existing open models already offered. METR reviewed the methodology and recommended improvements, which OpenAI adopted. The limits: the developer ran the study, the threat model assumed attackers with resources similar to OpenAI's process, and METR was not asked whether better-resourced actors could go further. The method itself, publishing a worst-case elicitation study alongside a release, has become a reference point for open-weight release decisions.

The 2026 wave of large releases

Gemma 4 (Google, April 2, 2026): the first Gemma family under Apache 2.0, built from Gemini 3 research, with a 31B dense model, a 26B mixture-of-experts model with about 4B active parameters, and small on-device models.
DeepSeek V4 (April 24, 2026): V4-Pro (1.6 trillion total, 49 billion active) and V4-Flash (284 billion total, 13 billion active), both with 1-million-token context and MIT-licensed weights, followed by updated checkpoints over the summer.
Nemotron 3 (Nvidia): a family released from December 2025 onward with large open training datasets and recipes; the Ultra model arrived in mid-2026.
Kimi K3 (Moonshot AI, July 2026): launched as a hosted model on July 16 and released as open weights in late July, at 2.8 trillion total and 104 billion active parameters the largest open-weight model to date, under a custom license with a $20 million revenue gate for model-as-a-service businesses.
Muse Glimmer (Meta, August 10, 2026): a 30B dense, Apache 2.0 model for local agents, distilled from Meta's closed Muse Spark; see LLaMA.
Qwen3.8-Max (Alibaba, August 12, 2026): the first open release of a Max-tier Qwen, text weights only, under a bespoke license rather than Apache 2.0.
Muse Spark Open (Meta, October 15, 2026): 816 billion total and 42 billion active parameters, 1-million-token context, under the Muse Model License; Meta called it "the most capable US open-weight model to date," though its own comparison placed it behind GLM-5.3, Kimi K3, and Qwen3.8 on Artificial Analysis's index.

The distillation fight

February 2026: Anthropic reported that DeepSeek, Moonshot AI, and MiniMax had run extraction campaigns against its Claude models using about 24,000 fraudulent accounts and more than 16 million exchanges.
April 2026: the House Foreign Affairs Committee advanced the Deterring American AI Model Theft Act (H.R. 8283) by a 43 to 0 vote on April 22, and on April 23 the White House Office of Science and Technology Policy issued memorandum NSTM-4, "Adversarial Distillation of American AI Models." It describes industrial-scale campaigns, mainly from China, that use proxy accounts and jailbreaks to extract capabilities, and commits the government to share threat information and develop best practices with industry. It also recognizes distillation's legitimate role, including in building open-weight models.
July 2026: amid reports that the administration was weighing restrictions on Chinese open-weight models, OpenAI and Anthropic warned policymakers about the risks of powerful Chinese open models, while Hugging Face, Meta, Microsoft, Mistral, and Nvidia signed an open letter on July 24 urging policymakers to avoid "premature restrictions" on open-weight AI and to address distillation through targeted legal and commercial measures rather than sweeping limits on common techniques.
August 2026: Zuckerberg's essay defended distillation and training-data use as essential to the open ecosystem and argued that the answer to Chinese open models is better American ones, not bans.
Status in October 2026: no broad federal ban on Chinese open-weight models exists. Restrictions so far focus on government devices, procurement, and defense supply chains, and the policy debate remains unsettled.

Fully open models gain ground

Truly open releases are no longer only small research models. Ai2's OLMo 3 (November 2025, 7B and 32B) published weights, the full Dolma training data, code, checkpoints, and logs, and Nvidia's Nemotron 3 family released roughly 10 trillion tokens of open training data with its recipes. Ai2 has warned that as training pipelines grow more complex, "open" risks shrinking back to meaning only downloadable weights, which is why the OSI definition's data-information requirement matters.

Open questions

Will the open-closed gap stay at a few months, close, or widen as compute budgets grow?
Can data filtering or other techniques make safeguards durable against fine-tuning at frontier scale?
Will the United States restrict Chinese open models or distillation in ways that also constrain American open releases?
Will custom revenue-gated licenses become the norm for the largest models, fragmenting the ecosystem?
Will any developer release frontier-level weights together with OSAID-compliant data information?

Practical Guide: Choosing and Running an Open-Weight Model

1. Check the license first. Confirm commercial rights, user or revenue thresholds, attribution, naming rules for derivatives, usage restrictions, and geographic exclusions. Apache 2.0 and MIT are simplest; custom licenses need legal review.

2. Size the hardware. Weights need about parameters × bits ÷ 8 bytes, plus the KV cache for your context length and concurrent users. For mixture-of-experts models, memory depends on total parameters and speed on active parameters.

3. Pick a precision. 8-bit is nearly lossless; 4-bit usually works well for large models; test carefully for small models, long reasoning, and code.

4. Pick a runtime. Ollama or LM Studio for desktops, llama.cpp for CPU and edge devices, MLX for Apple silicon, and vLLM or SGLang for multi-user GPU serving.

5. Evaluate on your own tasks. Vendor benchmarks are run on vendor harnesses, and leaderboard entries may differ from released checkpoints, as the Llama 4 LMArena episode showed (see LLaMA).

6. Add a safety layer. Use input and output classifiers (such as Llama Guard), prompt-injection detection for agents, and logging in your own application, because the model's built-in safeguards may be weak or removable.

7. Secure the supply chain. Prefer safetensors over pickle files, download from official organizations, verify checksums, and be wary of unofficial re-uploads.

8. Plan for updates. Open models iterate quickly, and a self-hosted model receives no automatic security or quality updates.

Additional Viewing

State of AI in 2026: LLMs, Coding, Scaling Laws, China, Agents, GPUs, AGI (Lex Fridman Podcast #490 with Nathan Lambert and Sebastian Raschka, January 31, 2026, more than four hours). Lambert, Ai2's post-training lead and founder of the ATOM Project for American open models, and Raschka, author of Build a Large Language Model (From Scratch), cover the U.S.-China open model race and a dedicated segment on open-source versus closed LLMs starting at 28:29. It is the most current long-form technical discussion of why open models matter, where they lag, and what fully open releases like OLMo add. Watch on YouTube

Mark Zuckerberg: AI will write most Meta code in 18 months (Dwarkesh Patel podcast, April 29, 2025, about 75 minutes). Recorded right after Llama 4's launch, the interview includes a segment on open-source AI starting near 39:49, along with DeepSeek, China, and export controls. It captures the strongest corporate case for open models shortly before Meta temporarily retreated from it. Watch on YouTube

Mark Zuckerberg: Llama 3, $10B models, Caesar Augustus, & 1 GW datacenters (Dwarkesh Patel podcast, April 2024, about 78 minutes). The segment beginning at 37:21 addresses the dangers of open source directly, including bioweapons risk and under what conditions Meta would stop releasing weights. It is a useful primary source for the "marginal risk" and "release thresholds" arguments described on this page. Watch on YouTube

References

The Open Source AI Definition 1.0 | Open Source Initiative (October 2024) The full definition: four freedoms, data information, code, parameters, and the rule for Open Source models and weights.
Open Source AI | Open Source Initiative The OSI's overview of the definition, its stated benefits, and the models that passed validation.
2024 end-of-year review: Open Source AI Definition v1.0 | Open Source Initiative Validation outcomes and the OSI's plans for continued updates.
The Model Openness Framework | White et al., Linux Foundation (2024) A graded framework for the completeness and openness of model releases.
Reproducibility is the New Copyleft | arXiv (2026) Discusses the OSAID's data-information compromise, critiques from the Software Freedom Conservancy, and the OSI's 2025 to 2026 priorities.
Open source technology in the age of AI | McKinsey, Mozilla Foundation, and Patrick J. McGovern Foundation (2025) Survey of more than 700 technology leaders on open-source AI adoption, costs, and risks.
The 2025 Foundation Model Transparency Index | Wan, Klyman, Kapoor, Maslej, Longpre, Liang et al. (December 2025) Measures developer transparency and shows that openness and transparency diverge.
Transparency in AI is on the Decline | Stanford HAI Summary of the 2025 index findings.
On the Societal Impact of Open Foundation Models | Kapoor, Bommasani, et al. (2024) Introduces the marginal-risk framework for evaluating open releases.
Dual-Use Foundation Models with Widely Available Model Weights | NTIA (July 2024) The U.S. government report recommending monitoring rather than restriction.
White House releases AI Action Plan, includes Open Source | Open Source Initiative (July 2025) Summary of the Action Plan's "Encourage Open-Source and Open-Weight AI" section.
EU AI Act unpacked #27: Guidelines on the scope of obligations for General-Purpose AI models | Freshfields Analysis of the EU's open-source exemption conditions.
Open-weight models lag state-of-the-art by around 3 months on average | Epoch AI (October 2025) Methodology and results for the open-closed capability gap.
Open models lag state-of-the-art closed models by 4 months | Epoch AI (May 2026) The 2026 update showing a slightly wider gap.
How far behind are open models? | Epoch AI (2024) The earlier benchmark and training-compute comparison.
The ATOM Report: Measuring the Open Language Model Ecosystem | arXiv (April 2026) Download, derivative, and token-share data showing Chinese models' lead in adoption.
What's next for Chinese open-source AI | MIT Technology Review (February 2026) Context on Qwen, DeepSeek, and Kimi's rise.
Apertus: a fully open, transparent, multilingual language model | ETH Zurich (September 2025) Launch of Switzerland's fully open sovereign model.
Apertus 1.5: Building the next generation of open AI infrastructure | EPFL AI Center (2026) The 2026 update and its uses in medicine, journalism, and public-interest AI.
Sovereign AI Models: Teuken, Apertus and OpenEuroLLM | Luca Berton Overview of the sovereign open models highlighted at Open Source Summit Europe 2026.
OpenEuroLLM | innFactory AI Status and goals of the EU-funded OpenEuroLLM consortium.
One year later: Sovereign AI and the fight for choice | Cloudflare Deployment of EuroLLM and Apertus as sovereign options.
Mistral's trillion-parameter weights and the blank license | Let's Data Science (October 2026) Mistral Large 4's preview, open-weight timeline, and unpublished license terms.
Mistral Large 4 | OrcaRouter Mistral's license table across Large 3, Small 4, Medium 3.5, and Large 4.
Deep Ignorance: Filtering Pretraining Data Builds Tamper-Resistant Safeguards into Open-Weight LLMs | O'Brien et al., EleutherAI, UK AISI, Oxford (2025) Evidence that pretraining data filtering resists adversarial fine-tuning, with its limitations.
Estimating worst case frontier risks of open weight LLMs | OpenAI (August 2025) The malicious fine-tuning study behind the gpt-oss release decision.
gpt-oss-120b and gpt-oss-20b Model Card | OpenAI (2025) Architecture, training compute, license, and safety evaluations for gpt-oss.
gpt-oss methodology review | METR (October 2025) External review of OpenAI's adversarial fine-tuning methodology.
OLMo: Accelerating the Science of Language Models | Groeneveld et al., Ai2 (2024) The fully open model framework releasing data, code, checkpoints, and logs.
LoRA: Low-Rank Adaptation of Large Language Models | Hu et al. (2021) The parameter-efficient fine-tuning method behind most open-model customization.
QLoRA: Efficient Finetuning of Quantized LLMs | Dettmers et al. (2023) Fine-tuning large models on a single GPU using 4-bit base weights.
Gemma (language model) | Wikipedia Release history of Google's Gemma family, including Gemma 4's move to Apache 2.0.
DeepSeek Releases V4: Open-Source 1.6T MoE with 1M Context | NYU Shanghai RITS Specifications and licensing of DeepSeek V4.
Kimi K3 | Thunder Compute Technical overview of Kimi K3's architecture, hardware needs, and license.
Introducing Muse Glimmer | Meta Superintelligence Labs (August 2026) Meta's Apache 2.0 return to open weights.
Introducing Muse Spark Open | Meta Superintelligence Labs (October 2026) Specifications, safety statement, and license for Meta's largest open-weight model.
Meta unveils Muse Spark Open | VentureBeat Detailed reading of the Muse Model License.
White House Memo Targets 'Adversarial Distillation' of U.S. AI Models | NYU Shanghai RITS Summary of NSTM-4 and the disclosures that preceded it.
Diagnosis and Deterrence: The U.S. Response to Distillation | Just Security Analysis of NSTM-4 and the Deterring American AI Model Theft Act.
AI Distillation Attacks: Executive and Congressional Action Can Go Further | Institute for AI Policy and Strategy Policy recommendations, including NSTM-4's recognition of legitimate distillation.
OpenAI and Anthropic unite against China's open models | Axios (July 2026) The closed labs' warnings to policymakers.
As US weighs response to Chinese AI, industry urges against broad open-weight restrictions | TechCrunch (July 2026) The open letter from Hugging Face, Meta, Microsoft, Mistral, and Nvidia.
China's open-weight model lead exposes America's AI blind spot | CNBC (July 2026) The case for a U.S. open-model strategy and the Hugging Face incident.
Open-source archive | Nathan Lambert, Interconnects Ongoing analysis of open model releases, the ATOM Project, and ecosystem trends.

Open Source

The Open Source AI Definition (OSAID)

Why the definition exists

The four freedoms

The preferred form to make modifications

Open Source models and Open Source weights

Definitions used by the OSAID

Validation results

Criticism and revision

Key Reasons for Open-Source AI

Democratization and Accessibility

Transparency and Accountability

Data Privacy and Local Deployment

Accelerated Innovation

AI Sovereignty

Mechanisms

Considerations

Why This Matters

Popular Open Models

Licenses Compared

The Safety and Policy Debate

The case for openness

Arguments for caution

Regulation by jurisdiction

Recent Developments

The capability gap, measured

Adoption shifts east: the ATOM Report

Transparency and definitions under pressure

Safety science: data filtering and worst-case fine-tuning

The 2026 wave of large releases

The distillation fight

Fully open and sovereign models gain ground

Open questions

Practical Guide: Choosing and Running an Open Model

Open Weights

Open Weight Mechanisms

The Physics

Why This Matters

Licenses Compared

The Safety and Policy Debate

Arguments for open weights

Arguments for caution

Regulation by jurisdiction

Recent Developments

The capability gap, measured

Adoption shifts east: the ATOM Report

Safety science: data filtering and worst-case fine-tuning

The 2026 wave of large releases

The distillation fight

Fully open models gain ground

Open questions

Practical Guide: Choosing and Running an Open-Weight Model

Additional Viewing

References

Navigation menu

Search