Open-source AI

Open-source AI refers to artificial intelligence systems whose components are published under terms that allow people to use, study, modify, and redistribute them. The phrase covers software libraries as well as trained models, and the ambiguity between those cases is the source of most disputes about the term 1.

The modern debate began with models, not code. When weights are published, anyone can run the model, fine-tune it, or remove the safeguards its developer added, which makes openness a technical property with safety consequences. That is why the argument over open AI is also an argument about irreversibility: a downloaded weight file cannot be recalled 2.

This entry covers what openness means for AI, the history of open releases, the licences involved, the economics of open weights, and the competing safety arguments.

For conventional software, open source has a settled meaning: a licence granting the freedom to run, study, modify, and share the code. For AI, four components can be opened separately: the training code, the model weights, the training data, and the documentation. Most so-called open models release weights and inference code but not data or the full training pipeline 1.

That arrangement permits use and inspection but not reproduction, and it leaves the developer in control of the data and any future release. Critics call such systems open-washing; proponents call them open enough to be useful. The distinction is not cosmetic, because a model that cannot be rebuilt cannot be fully reproduced, and a model whose training data is secret may carry biases that no outsider can trace 3.

The Open Source Initiative published version 1.0 of its definition in 2024. It requires the freedoms to use, study, modify, and share, and it asks for the preferred form for modification, including data information sufficient for a skilled person to build a substantially equivalent system. It does not require the release of personal or copyrighted data, which is one reason the definition remains contested 1.

The foundations were laid by the free-software movement and by tools such as Linux. In machine learning the turning point was open frameworks: Caffe in 2013, TensorFlow in 2015, and PyTorch in 2016 made it practical to share implementations as well as papers. The culture of releasing code alongside results became the norm in academic labs 4.

Models followed. BERT was released with code and weights in 2018, and its derivatives proliferated. GPT-2 was initially withheld in 2019, then released in stages, an early test of the argument that some models are too capable to publish. The staged release did not settle the question, but it established the vocabulary of staged openness that later releases used 4.

The current era began in 2023, when a leaked Llama model was followed by Llama 2 under a community licence, and Mistral released a small model under Apache 2.0. Llama 2's terms allowed commercial use but imposed acceptable-use conditions and a user threshold, which made it open in a weaker sense than Apache-licensed software 5. DeepSeek's R1, released under the MIT licence in 2025, showed that a frontier-adjacent model could be fully redistributable, and it pushed the debate from whether open models could compete to what their release implies for safety and market structure.

Licences vary widely in what they permit. Permissive licences such as Apache 2.0 and MIT allow commercial use, modification, and redistribution with minimal conditions, and they are the clearest cases of open source. Apache 2.0 adds an express patent grant and attribution requirements, which matters for companies that fear patent claims 6.

Community licences sit in the middle. Llama 2's licence allowed commercial use but imposed limits, including a threshold on monthly active users and acceptable-use terms that flow down to downstream users. Responsible AI licences add behavioural restrictions: no surveillance, no discrimination, no military use. Such terms are not open source in the classical sense, because they restrict fields of use 5.

For companies, the licence determines whether a model can be embedded in a product, redistributed, or used to train another model. For researchers, it determines whether results can be published and reproduced. For regulators, it determines whether a release counts as open for the purpose of an exemption, which is why licence drafting has become a policy activity as well as a legal one 7.

A model's weights are the numerical parameters learned during training. Releasing them allows inference on local hardware, fine-tuning for a domain, quantization to reduce memory, and distillation into smaller models. It does not reveal why the model behaves as it does: the parameters are too numerous and too entangled for direct interpretation, and the training data remains the missing link 3.

Reproducibility requires more than weights. A researcher who wants to rebuild the model needs the architecture, the data pipeline, the training code, the compute configuration, and the evaluation suite. Releases usually provide some of these and omit others, which is why claims of reproducibility are often weaker than claims of availability 1.

The technical case for openness rests on inspection. Independent researchers can test a released model for bias, backdoors, and failure modes that the developer did not disclose, and they can compare its behaviour with the developer's claims. That scrutiny is valuable even when it is incomplete, because it creates evidence that a closed API cannot produce 2.

The technical case against openness rests on control. Fine-tuning can remove refusal behaviour, and a released model can be attached to tools the original developer would prohibit. Neither effect requires sophisticated resources; both have been demonstrated with modest compute. The developer loses the ability to patch behaviour once the weights are distributed 4.

Open weights change the economics of the model layer. Training a frontier model is expensive, but serving one is cheap enough that many firms can compete once the weights are available. That commoditises inference, pushes prices down, and shifts value towards hardware, data, distribution, and the applications built on top 2.

For the publisher, openness can be a distribution strategy. Meta released Llama weights without selling access, gaining an ecosystem of fine-tuned variants, tooling, and goodwill that would have been difficult to buy. Chinese laboratories have used open releases to gain international users and to establish their architectures as reference points. In both cases, the return is indirect: talent, standards, and demand for complementary services 5.

For adopters, open weights reduce lock-in. A hospital or a government can run a model on its own infrastructure, keep sensitive data inside its network, and continue using the model if the vendor discontinues it. Those benefits are real, but they come with operating costs: hardware, security, monitoring, and the engineering work of keeping a model in production 8.

The incentives are not uniformly towards openness. A lab that releases weights gives up the ability to charge for access and to withdraw a capability, and it invites competitors to undercut it. The decision therefore depends on the lab's business model, its assessment of risk, and its estimate of how much of its advantage comes from the model rather than from data, compute, or distribution 4.

The case for openness rests on scrutiny, competition, and autonomy. A model whose weights are available can be tested independently, and defects a vendor would not publish can be found by outsiders, the argument that made open-source software more trustworthy than proprietary binaries. The scrutiny is imperfect, because testing requires expertise and compute, but it is more than a closed API allows 2.

Competition is the economic argument. Open weights let smaller firms build on a capable model without negotiating with its owner, which lowers prices and prevents a few providers from controlling access. Public-sector and academic users can run models on their own infrastructure, and researchers can study behaviour that a hosted service hides 8.

Autonomy matters where data cannot leave a jurisdiction or a hospital. Local deployment avoids sending sensitive records to a third-party API, and it survives the discontinuation of a product. For countries without a domestic frontier lab, open weights are a way to build capability without depending on a foreign provider's terms of service 1.

The case against rests on irreversibility. A published weight file cannot be recalled, and the safeguards a developer builds into a hosted service are not part of the file. Anyone can fine-tune away refusals or attach the model to a system the original developer would prohibit. The marginal risk may be small for some harms and larger for others, but the direction is one-way 2.

Critics point to concrete harms: models that generate child sexual abuse material, that assist with weapons design, or that power surveillance. They argue that the marginal benefit of another open model is small compared with the cost of a capability that cannot be withdrawn. Defenders reply that the relevant capabilities are already available through hosted services, that openness enables defence as well as offence, and that restricting publication concentrates power without preventing misuse 4.

The empirical base for either position is thin. The most careful reviews find that open models can increase risk in specific areas, particularly where fine-tuning or local deployment defeats monitoring, but that the evidence does not support a blanket claim that open weights are substantially more dangerous than closed systems. The disagreement is partly about which risks count and partly about how to compare a released model with the counterfactual of a hosted one 8.

A separate concern is quality. Open models can be fine-tuned on narrow data and then presented as general systems, and the absence of a vendor relationship makes it harder for users to know what they are running. That is a governance problem rather than a property of openness, but it grows with the number of derivatives 3.

Regulators have struggled with the category. The European Union's AI Act sets obligations for general-purpose models and provides a limited exemption for free and open-source models, which does not apply where a model is classified as presenting systemic risk. The exemption covers some documentation and information duties, not the whole regime, and copyright policy obligations remain 7.

Export controls add another layer, since training a large model requires restricted hardware. Several jurisdictions have debated treating sufficiently capable model weights as a controlled technology, which would put open release in tension with national-security policy. No comprehensive international regime exists, and the United States has so far relied on chip controls and voluntary commitments rather than a broad restriction on weights 8.

International principles emphasise transparency and documentation rather than publication. The likely trajectory is not a single rule but a patchwork: permissive for small models, conditional for large ones, and contested everywhere. That patchwork creates compliance costs for publishers and uncertainty for users, and it makes the technical definition of openness a live policy question rather than a matter of terminology 7.

Standards bodies and funders have begun to require model cards, data statements, and evaluation reports. These do not make a model open, but they make a release more legible, and they give regulators something to assess short of inspecting weights they cannot interpret 3.

The central disagreement is whether open weights make AI safer or more dangerous. One account holds that openness enables scrutiny, competition, and decentralisation, and that the marginal risk of a released model is small relative to the closed systems that already exist. Another holds that openness is irreversible, that safeguards can be removed, and that the diffusion of capability outweighs the benefits of transparency 2.

The evidence does not settle the question. Reviews of the literature find that the marginal risk varies by harm: low for some misuse vectors, uncertain for others, and higher where fine-tuning or local deployment defeats monitoring. That is a more useful conclusion than either slogan, but it is harder to turn into policy 8.

The definition is also disputed. The Open Source Initiative's standard is criticised by some advocates as too permissive, because it allows data information rather than data, and by some companies as too strict, because it excludes use-restricted licences. Both criticisms have force, and the definition is best read as a minimum rather than a complete account of openness 1.

Finally, there is a disagreement about economics. One view sees open weights as a check on concentrated power; another sees them as a subsidy to large cloud providers, who capture the demand for serving and support while the publisher bears the training cost. The outcome probably depends on the market segment, which is why the debate produces confident generalisations from different sets of examples 4.