Model weights

On disk, weights are a set of named tensors (in PyTorch terms a state_dict mapping names such as layers.0.self_attn.q_proj.weight to arrays), stored together with a configuration file describing the architecture. Weights alone do not run: the matching model code, tokenizer and config are needed to interpret them. Large models are sharded across several files with an index. The legacy PyTorch format (.bin, .pt) is a Python pickle, and unpickling can execute arbitrary code, which made malicious model files a practical attack; PyTorch 2.6 changed torch.load to default to weights_only=True. The safetensors format, a JSON header followed by raw tensor bytes, cannot carry code and can be memory-mapped for fast loading. GGUF, used by llama.cpp, packs quantised weights and metadata in one file, and ONNX stores the computational graph together with its weights.

The numeric format is part of the artefact. Training typically keeps FP32 master copies while computing in BF16; released checkpoints are usually BF16, and quantisation methods such as GPTQ or AWQ produce 8-bit or 4-bit versions that are smaller and faster but behave slightly differently, so evaluation results obtained on one precision do not automatically transfer to another. Integrity is checked with cryptographic hashes of each shard, and signing schemes for model artefacts are emerging so that consumers can verify who produced a file.

Weights are the concentrated result of the training budget, which makes them a high-value target. A 2024 RAND report defined security levels for protecting frontier model weights against actors from opportunistic criminals to state programmes. Leaks have happened: Meta's original LLaMA weights, released to approved researchers, appeared on 4chan within about a week in March 2023. Integrity threats are subtler than theft. Behaviour can be altered by editing weights directly: the 2023 PoisonGPT demonstration used the ROME model-editing technique to make an open model state a specific falsehood while otherwise behaving normally. Backdoors cannot be found by inspecting the numbers. OWASP's Top 10 for LLM Applications 2025 lists such tampered or poisoned pre-trained models under LLM03 Supply Chain.

Publishing weights is distinct from open source. The Open Source Initiative's Open Source AI Definition 1.0 (2024) requires, besides weights, the training code and sufficiently detailed information about the training data, and many "open-weight" licences restrict use in ways the definition does not allow. The EU AI Act exempts providers of general-purpose models released under a free and open-source licence, with weights, architecture and usage information publicly available, from the technical documentation duties in Art. 53(1)(a) and (b), but not if the model carries systemic risk (Art. 53(2)). Weights are the largest subset of a model's parameters; biases, normalisation scales and embedding tables make up the rest.