Download a model’s weights and “open” feels the same as “safe”. Most people assume it must be open source. Usually that assumption is wrong: most released models are open-weight rather than open-source, and the deciding factor is the licence. Here’s how to verify an “open” claim against OSAID 1.0, run a pre-sign-off licence check, and see why distillation became a national-security question within the open-source AI landscape.
What is the difference between open-weight and open-source AI models? #
Open-weight models publish their trained parameters for download and self-hosting. The weights are available, but the training code, training-data information, and open-source freedoms may not be. Open source AI goes further, granting four freedoms: use, study, modify, and share, under an OSI-approved licence.
Closed models like GPT, Claude, and Gemini keep everything secret. Open-weight releases, including Llama, Qwen, DeepSeek, and Mistral, hand you the weights with carve-outs.
Open weights get you self-hosting and data sovereignty, but fine-tuning and redistribution rights depend entirely on the licence. Most “open” Chinese releases land here: downloadable capability, restricted permissions.
What does the OSI’s Open Source AI Definition (OSAID 1.0) require beyond downloadable weights? #
The Open Source Initiative’s OSAID 1.0 draws the line. A system is open source only if it ships model parameters, source code, and enough training-data information under a licence granting the four freedoms for any purpose. The contested requirement is training-data information: provenance, filtering, deduplication, tokenisation, and mixture ratios, enough to substantially recreate the system.
Most flagship releases fail that bar because they withhold training-data information. Llama, DeepSeek, and Qwen may be permissively licensed, but they are not clearly OSAID-compliant. The standard is disputed: the Free Software Foundation thinks it is too soft, Meta contests it, and the EU AI Act‘s carve-out makes it consequential. Compliant examples include OLMo, Pythia, T5, and LLM360, inside the wider landscape.
Why does the open-weight versus open-source distinction matter for licensing and legal risk? #
Do not rely on the label. The licence governs commercial use, fine-tuning, redistribution, and output ownership.
Permissive licences like Apache 2.0 and MIT are the lowest-risk posture: unrestricted commercial use, modification, and redistribution. The Llama, Gemma, and Tongyi Qianwen community licences are another world, carrying usage thresholds such as monthly-active-user caps, acceptable-use policies, and competitive-use clauses that bind you downstream. “Most teams discover these constraints only after they have built on the model,” as one licensing guide puts it.
What should I look for when reviewing an open-weight model’s licence before procurement sign-off? #
At sign-off, review the licence: commercial use, derivatives, attribution, thresholds, then data terms.
Check commercial use, field-of-use, and competitive-AI restrictions. Check derivatives: can your team own and redistribute a fine-tune, and what passes through? Then attribution, naming, and any acceptable-use policy.
Then the thresholds. Qwen’s Tongyi Qianwen licence caps commercial use at 100 million monthly active users; Llama sets 700 million. Kimi K3 adds a revenue threshold: a separate commercial agreement above $20 million in aggregate revenue over 12 months. Treat these as a scaling risk and model them into your growth plan before your procurement sign-off, alongside the cost and adoption data.
Then data terms: provider data collection, output ownership, and governing law. Tongyi Qianwen specifies Chinese law and Hangzhou jurisdiction, for counsel to review.
Finding the terms: Qwen’s terms live in the model card or Hugging Face repo, Apache 2.0 for the code, the Tongyi Qianwen licence for some weights. DeepSeek ships under the MIT licence. Kimi K3’s custom licence sits on the release page, with a revenue threshold. The procurement evaluation checklist takes you further. That covers the terms you sign. Distillation adds a second risk layer: the model’s provenance.
What is knowledge distillation, and why has it become a national security concern? #
Knowledge distillation is a routine technique: a large “teacher” model generates outputs that train a smaller “student” model to approximate selected behaviours at a fraction of the compute cost. Labs have done this on their own models for years.
The contested version is adversarial distillation: harvesting another lab’s closed-model outputs at scale, via API abuse, proxy accounts, or terms-of-service violations, to train a competing open-weight model. US labs frame that as IP theft when frontier models like GPT and Claude are distilled into open-weight derivatives. The White House’s NSTM-4 describes “industrial-scale” extraction, and Dario Amodei has argued the US should crack down on it.
Anthropic has named DeepSeek, Moonshot, and MiniMax, citing roughly 24,000 accounts and more than 16 million exchanges with Claude. We unpack the national-security framing separately.
Where is the line between legitimate distillation and unauthorised extraction? #
The boundary is authorisation and scale. Distilling your own models, or models whose licence permits it, is fine. Harvesting a competitor’s closed API at machine scale is the contested form.
Legally, it runs through trade secret misappropriation under DTSA and UTSA. The defence is that reverse engineering is a “proper means”; the counter-argument is that machine-scale harvesting is improper. In a widely cited US case, Compulife v. Newman, a court held that a bot’s mass harvesting was improper means.
Reasoning traces, the intermediate steps rather than final answers, are a primary extraction target. The dispute has a US twist: in Musk v. Altman, xAI admitted it “partly” distilled OpenAI models.
For you, the practical takeaway is provenance: a fine-tune on Hugging Face can inherit distilled-model risk, so treat missing provenance as a red flag. We cover supplier and provenance risk in depth. Treat “open” as a claim to verify. The licence governs what you can build, fine-tune, self-host, and redistribute. Downloadable weights enable self-hosting. Open source requires the full recipe: code, training-data information, and the four freedoms under an OSI-approved licence. The distillation dispute makes provenance part of the same verification duty, since inherited risk travels downstream. That duty sits within the broader geopolitical stakes of the open-source AI debate.
Frequently Asked Questions #
What does “openwashing” mean, and how do I spot it?
Openwashing is marketing a restrictive release as “open” when it is only open-weight. You spot it by ignoring the badge and reading the licence. If training-data information is withheld, or commercial use, redistribution, or fine-tuning rights are limited, the model fails the OSAID 1.0 bar. A downloadable model with a custom community licence is openwashing, not open source.
What are the “four freedoms” in open-source AI?
The four freedoms are the right to use, study, modify, and share an AI system for any purpose. They come from the Open Source Initiative’s OSAID 1.0 and extend to modifying outputs and redistributing the system. A licence is judged against these four freedoms, so a model that can only be downloaded but not freely redistributed fails the test.
Can I fine-tune an open-weight model and sell the result?
Only if the base model’s licence permits it and its terms pass through to your derivative. Many open-weight licences allow fine-tuning but add attribution duties, acceptable-use policies, or restrictions on what you can redistribute. Check the derivative and pass-through clauses before you build, because your right to own and sell a fine-tune is set entirely by the base licence.
What happens if my app passes a model’s MAU threshold?
You trigger a separate commercial licensing obligation. For example, the Llama licence sets a 700 million monthly active user threshold and Qwen’s Tongyi Qianwen licence sets 100 million, after which you must negotiate additional terms. Treat these thresholds as a scaling risk, not a footnote, and model them into your growth plan before sign-off.
Which models actually meet the OSAID 1.0 standard today?
Very few flagship releases do. Examples that aim for full compliance include OLMo from Ai2, Pythia, T5, and LLM360, because they publish code, weights, and training-data information under a licence granting the four freedoms. Llama, DeepSeek, and Qwen may be permissively licensed but still withhold training-data information, so they fall short.
Is Meta’s Llama open source?
No, not under the OSAID 1.0 standard. Llama is open-weight: you can download the model, but it ships under the Llama Community License with a 700 million MAU threshold, acceptable-use restrictions, and no clear path to the training data. Meta itself contests the open-source definition, but the download does not carry the four freedoms an OSI-approved licence grants.
Does open-weight mean free to use commercially?
Not automatically. Open-weight means the parameters are downloadable, not that commercial use is unrestricted. Custom community licences can impose MAU thresholds, field-of-use bans, competitive-AI restrictions, and attribution duties. Permissive licences such as Apache 2.0 and MIT grant the cleanest commercial posture, so verify the licence before you assume a free commercial pass.
Is distillation itself illegal?
No. Distillation is a legitimate, long-standing compression technique that labs use on their own models every day. What is contested is unauthorised distillation, harvesting a competitor’s closed-model outputs at machine scale through API abuse or terms-of-service violations. The legality turns on authorisation and scale, not on the technique itself.
How can I check whether a Hugging Face model carries distilled-model risk?
Start with provenance. Look for a model card that states the base model, licence, and training data, then check whether the creator discloses distillation from a closed frontier model such as GPT or Claude. Downstream fine-tunes can inherit that risk, so treat missing provenance as a red flag and run the same SBOM-style review you would for a third-party component.
Why are reasoning traces such a valuable target in distillation?
Because a model’s intermediate solution steps reveal far more of its behaviour than final answers alone. Harvesting reasoning traces lets a student model imitate not just what the teacher outputs, but how it works through a problem. That makes them the highest-value extraction target in unauthorised distillation and sharpens the IP-theft claims behind the dispute.
Does the EU AI Act recognise open-weight models as open source?
Not the way most vendors market them. The Act’s open-source carve-out makes the definition legally consequential, so a model must meet a genuine open-source bar, not just publish weights, to qualify for reduced obligations. Because OSAID 1.0 and its critics disagree on the training-data bar, expect this question to be fought over as the Act takes effect.
What is a model SBOM, and why does provenance matter?
A software bill of materials for a model records what went into it: base model, training data, licence terms, and fine-tuning history. Provenance matters because distilled-model risk travels downstream, so a fine-tune you adopt can inherit legal exposure you never saw. Reviewing that lineage is now part of procurement risk, not just engineering hygiene.