Open Weights Is Not Open Source

What actually lands on your disk

When a lab "open sources" a model, you get a folder. Look inside a typical one:

config.json                 # layer count, hidden size, vocab size
tokenizer.json              # how text becomes numbers
model-00001-of-00004.safetensors
model-00002-of-00004.safetensors
...
README.md                   # the model card
LICENSE

That is the model. Billions of floating point numbers, plus enough metadata to load them.

Here is what is not in the folder: the training data. The code that filtered and mixed that data. The training code. The intermediate checkpoints. The human preference data used for the final tuning. The failed runs. In almost every case, none of that ships.

The analogy, and where it breaks

Weights are closer to a compiled binary than to source code. You can run it. You can redistribute it. You cannot rebuild it, and you cannot read what went in.

The analogy breaks in one useful place. You can meaningfully modify a binary blob of weights by fine-tuning it, which is cheap and works. So the practical freedom is larger than "here is a .exe" suggests. It is still not the freedom to reproduce.

Why this matters when you are not being pedantic

Four things you cannot do with weights alone:

• Audit the data. You cannot check whether your competitor's private documents, a copyrighted corpus, or the benchmark you are about to run are in there.
• Reproduce. You cannot rebuild the model with one thing changed. Nobody outside the lab can.
• Remove something. If the model learned a fact you need gone, you can suppress it at inference or fine-tune against it. You cannot delete it from the source.
• Explain a behaviour by pointing at data. Every explanation is behavioural, from the outside.

One thing you can do, which is the durable benefit: keep it. If the lab shuts the API down, deprecates the model, changes the price, or decides your use case is off-policy, your copy on disk still runs. That is the real reason open weights matter, and it is enough.

The definition people argue about

The Open Source Initiative published an Open Source AI Definition in October 2024. It asks for three things: the parameters, the complete training and inference code, and detailed information about the data — enough that a skilled person could build a substantially equivalent system. Almost no popular model meets it, because almost none release the data information.

So three labels are worth keeping separate:

• Open weights. You get the numbers. Terms vary. This is most of the ecosystem: Llama, Gemma, and much else.
• Openly licensed weights. You get the numbers under Apache 2.0 or MIT, with no use restrictions. Mistral's main line, Qwen3, DeepSeek-R1, Phi-4, IBM Granite. Still no data.
• Fully open. Weights, data, training code, checkpoints, evaluation. AI2's OLMo, EleutherAI's Pythia, Hugging Face's SmolLM. A small group, and the only one where "open source" is honest without qualification.

Most of the loud releases are in the first two buckets. That is not a scandal. It is just not what the word implies to someone who has used Linux.

Three questions to ask

When somebody tells you a model is open, ask:

1. 1Can I run it offline, on my own hardware, forever? (Almost always yes.)
2. 2Can I use it commercially without asking anyone? (Usually, with conditions. Next lesson.)
3. 3Can I see what went into it? (Almost never.)

If you say "open weights" instead of "open source", you have said the true thing and you have lost nothing. Use the accurate word and you will make better decisions downstream, because the accurate word tells you which questions remain open.