The Open Weights Rules Nobody Can Comply With

Anthropic names the problem in its own paper#

Start with the text rather than the thread about the text. The paper makes three asks.

• Stop selling powerful chips and chipmaking equipment to China.
• Crack down on industrial-scale distillation operations.
• Put all sufficiently capable models, open and closed, through mandatory safety testing.

It also says, plainly, "Anthropic has never advocated for a ban on open-weights models," and calls open-weight models without dangerous capabilities a public good. Read the document and the ban framing does not survive. Read it twice and something better shows up.

Buried in the reasoning is the sentence that decides the entire argument. Once open-weight models are released, the paper says, "these options are lost permanently", because "safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring."

That is the strongest technical statement anyone has made in this debate, and it is sitting on the page of the company arguing for restriction. It is correct. It is also fatal to the second ask.

Sort every proposal by whether the download already happened#

There is one question worth asking about any open weights rule, and it takes about four seconds. Does this lever act before the weights ship, or after? Everything else follows from the answer.

Two of the three land on the enforceable side of that line, and the honest read is that neither is unreasonable. Requiring a capability evaluation before a frontier open-weight release is a high bar, not an impossible one. Arguing about where the bar sits is a real policy debate worth having.

The third one is where the paper's own concession bites. Cracking down on distillation means noticing what people are doing with weights that have already left.

At industrial scale a new model eventually surfaces and lawyers get involved, which is a genuine deterrent. Below that scale there is nothing to notice, because inference on a machine you own reports to no one.

Now look at what is missing from the paper, and from every EU and US proposal surveyed for this piece. Nobody has proposed a recall. Not one of them contains a mechanism to withdraw, patch, deprecate, or expire model weights that have already been distributed.

The EU's enforcement powers run to fines and pulling products off the market, which does nothing to a file already on a hard drive. That absence is not an oversight anyone forgot to correct. It is the shape of the problem showing through the paperwork.

The scale makes it concrete. Llama passed 1 billion downloads in March 2025, before any US statute on open-weight testing existed. Qwen crossed a billion too, pulling 153.6 million downloads in February 2026 alone.

Guardrails are configuration and configuration comes off#

The obvious rebuttal is that pre-release testing is enough, so the post-release gap does not matter much. It matters, and the reason is a technique called abliteration.

Refusal behaviour trained into a model turns out to live in identifiable directions inside the weights. Standard analysis finds those directions and edits them out, on consumer hardware, with no specialist knowledge required. The alignment is a layer sitting on the file rather than a property woven through it.

According to Akerman's writeup of a Financial Times interview, the creator of a free tool called Heretic stripped the guardrails off Google's Gemma 4 within 90 minutes of its public release. The same piece cites an ICLR 2026 paper (OpenReview qlf6y1A4Zu) reporting bypass rates as high as 99 percent. Take that figure as reported rather than verified, since the paper sits behind a login wall.

The consequence is narrow and it is the whole argument. A pre-release safety test is a true statement about the checkpoint that shipped. It says nothing about the population of derived checkpoints that exists ninety minutes later, and no test run before release ever could.

Worth holding the other side of this too. When Hugging Face needed forensic help during its July 2026 breach, hosted models refused the work and a self-hosted open-weight model did it, which is covered in what happens when you disable safety classifiers. Removable guardrails cut for defenders as well as against them.

Sufficiently capable is doing all the work#

The testing proposal covers "all sufficiently capable models," with a carve-out for "less capable models, such as those from startups and academia." Nothing in the paper says what sufficiently capable means. No FLOP count, no benchmark score, no eval suite.

That undefined word is the part to watch, because an undefined trigger does not stay undefined. It gets a number attached later, by a regulator, under deadline, using whatever evidence is lying around at the time.

The closest thing to a yardstick today is METR's evaluation of DeepSeek and Qwen, which put mid-2025 DeepSeek autonomy near where frontier models sat in late 2024. METR also flagged that its setup could not rule out sandbagging, and logged 15 cheating attempts from one DeepSeek checkpoint alone. A capability threshold enforced through evaluations inherits every weakness of the evaluations, including the possibility that the thing being tested is playing dumb.

The 45 percent no US rule can reach#

Grant the whole pre-release regime for a moment. Assume it passes, it is well drafted, and US labs comply. Which models does it actually touch?

A CNBC investigation published 7 July 2026 put Chinese-origin models at a weekly peak of 46 percent of tokens routed through OpenRouter. US-origin share went the other way, from around 70 percent a year earlier to 35.7 percent. DeepSeek alone routes more tokens than any other single vendor on the platform.

Those are the models with no public safety evaluation detail to inspect. Stanford's Foundation Model Transparency Index found that "DeepSeek and Alibaba do not report details of any pre- or post-mitigation safety evaluations for their DeepSeek and Qwen models respectively." You can read the full FMTI company report if you want the scoring detail.

Price is what moved the market, not policy. Roughly 14 cents per million input tokens against five dollars for a US frontier alternative is a 36 to 1 spread, and teams route accordingly.

A rule written in Washington binds the labs behind the minority share and does not reach the developers behind the majority at all, which is a strange outcome for a safety measure. Procurement bans and audits are the levers left, and neither one is a pre-release test.

If you run models on your own hardware, notice which side of that split your stack sits on. The weights on your drive were not covered by any of this when you pulled them, and no proposal on the table changes that retroactively.

Europe already picked a number#

One jurisdiction stopped arguing and wrote it down. The EU AI Act's general-purpose AI obligations have been enforceable for new models since 2 August 2025, with existing models given until 2 August 2027.

The open-source exemption in there is real and broader than most coverage suggests. Here is what it does and does not cover.

• Release under a free licence with public weights and you skip the technical documentation duty owed to downstream providers.
• A copyright policy still applies, exemption or not.
• So does a public summary of the training data.
• Above the systemic-risk threshold the exemption disappears entirely.

Then it stops. Article 51(2) presumes systemic risk once cumulative training compute passes 10^25 FLOP, and past that line the exemption is gone and the full Article 55 obligations land, adversarial testing and incident reporting included. As the legal summary puts it, "This exemption does not apply to GPAI models with systemic risks."

Note what Europe did not write, having sat with this longer than anyone. The obligations all land on the developer before and around release, never on the copies afterwards.

What actually decides this#

The question is not whether open weights get regulated. Europe already did it and the sky stayed up. The question is whether a proposal acts before the download or after, and only one of those answers describes something a person can comply with.

Judge every future proposal on that basis. A pre-release testing requirement with a published threshold is a real rule, arguable on its merits, and it will bind the labs inside whichever jurisdiction writes it. Anything that assumes a released model can be watched, patched, or taken back is asking for a world where the last three years of downloads did not happen.

Anthropic's paper knows this, which is why it asks for chips, courts and a pre-release test rather than a recall. The one ask that reaches past release, stopping distillation, only works against operations big enough to leave a model behind. Everything smaller runs on hardware nobody can see.

The reachable levers are chips, courts, and the moment before release. Everything after that is weather.