Open-weight model

A typical open-weight release on a hub such as Hugging Face contains the parameter tensors (today usually as safetensors shards), a configuration file describing the architecture, the tokenizer files and a chat template, plus a model card. What is almost never included is the training dataset, the data-processing pipeline, the full training code or the intermediate checkpoints. This is why "open weights" is distinguished from open source: the Open Source Initiative's Open Source AI Definition 1.0 (28 October 2024) requires the code used to train and run the system, the parameters under open terms, and sufficiently detailed "data information" about the training data, and most popular open-weight models do not meet it.

Licensing varies widely and determines what a deployer may do. Some models ship under permissive licences such as Apache 2.0 or MIT; others use bespoke licences, for example Meta's Llama community licences, which require a separate licence from Meta for services with more than 700 million monthly active users and incorporate an acceptable-use policy, and similar custom terms apply to other families. A licence that restricts fields of use or user counts is not an open-source licence in the OSI sense. In the EU AI Act, Art. 53(2) relieves providers of general-purpose AI models released under a free and open-source licence, with weights and architecture information publicly available, of some documentation duties, but not the copyright-policy and training-summary duties, and not at all where the model presents systemic risk.

Running weights locally shifts security work to the deployer. Older PyTorch checkpoint formats (.bin, .pt) use Python pickle, which can execute arbitrary code on load; safetensors stores raw tensors and avoids that class of attack. Weights can also carry trained-in backdoors that no static scan detects, so provenance, checksums against the publisher's hashes, and evaluation before deployment are the practical controls; OWASP's Top 10 for LLM Applications 2025 treats this under LLM03 Supply Chain. Updates and vulnerability fixes do not arrive automatically as they do with a hosted API.

The dual-use debate centres on irreversibility. Safety behaviour learned in post-training is shallow: a small fine-tuning run, or editing out a single "refusal direction" in activation space (Arditi et al., 2024), can remove it, and released weights cannot be recalled. The US NTIA's 2024 report on dual-use foundation models with widely available weights concluded that immediate restrictions were not warranted but recommended monitoring for marginal risk. On the benefit side, open weights enable on-premises processing of personal data, reproducible research, independent auditing and quantized deployment on modest hardware.