Open weights, and what open buys you

Three things called open

The word is doing too much work, and separating its meanings is genuinely useful rather than pedantic.

Open weights. The trained parameters are downloadable. You can run the model, fine-tune it, inspect its behaviour and take it offline. You do not know what it was trained on and could not reproduce it. This describes most models people call open.

Open source. By the Open Source Initiative's 2024 definition for AI, the weights, the code, and sufficient information about the training data for a skilled person to recreate a substantially equivalent system. Very few models meet this. Some fully documented research models do.

Open data. The training corpus itself is published. Rarer still, and legally fraught for exactly the reasons in the training-data lesson.

A model can be free to download, permissively licensed, and completely opaque about its data. That combination is normal, and calling it open source obscures the thing that matters most for accountability.

What open weights genuinely buy

Independent scrutiny. Researchers can measure bias, probe for memorised data, test safety claims and reproduce results without the vendor's permission. Nearly all the empirical work cited in this course on jailbreaks, poisoning and memorisation was done on open-weight models, because closed ones cannot be examined. Our knowledge of how these systems fail is disproportionately knowledge about the models that could be studied.

Independence from a vendor. A model on your disk cannot be deprecated, repriced, restricted or altered underneath your product. Anyone who has had a provider retire a model version with three months' notice understands what this is worth.

Privacy. The entire argument of the local-model lesson depends on open weights existing.

Language and domain coverage. Communities fine-tune open models for languages and specialisms too small to be commercially interesting. A great deal of the useful work in Indian languages, African languages and specialised technical domains exists only because the weights were downloadable.

Cost. No per-token charge changes the economics for high-volume, low-margin uses and for institutions that cannot pay in foreign currency.

The argument against

It deserves a fair statement rather than a caricature.

Safety measures in an open-weight model can be removed. Fine-tuning away refusal behaviours is straightforward, cheap and publicly documented. So whatever guardrails a release carries are voluntary for anyone who downloads it.

Release is irreversible. A closed model can be withdrawn, rate-limited or patched; a downloaded one exists forever, on thousands of machines.

And capability becomes uniformly available, including to people you would rather not have it.

The counter-argument is that most of the harmful capability in current models is also obtainable elsewhere, that closed models are jailbroken routinely anyway, that concentration of this capability in three companies has its own severe risks, and that a technology nobody outside those companies can examine cannot be held accountable by anyone.

This is a real disagreement between serious people. It is not resolved, and where you land depends partly on which risk you weight more heavily: misuse by many, or unaccountable control by few.

How the law treats it

The EU AI Act carves out free and open-source models from some obligations, while withdrawing that exemption for models presenting systemic risk and for prohibited or high-risk uses. Various US legislative proposals have grappled with where to draw the line, and definitions have proved slippery, largely because "open" means the three different things above.

What this means for you

If you are choosing: open weights for privacy, cost, independence, offline use, or work in an under-served language. Closed frontier models for the hardest reasoning tasks, for the moment.

If you are reading a claim: ask which sense of open is meant, and specifically whether the training data is documented. That question separates a genuine transparency commitment from a distribution decision.

And if you care about any of the harms in this course being measurable at all, note that the ability to study them is downstream of models being downloadable. That is not a decisive argument for open release, but it belongs on the scale.