The Open Weights Rules Nobody Can Comply With

Anthropic names the problem in its own paper#

Start with the text rather than the thread about the text. The paper makes three asks.

• Stop selling powerful chips and chipmaking equipment to China.
• Crack down on industrial-scale distillation operations.
• Put all sufficiently capable models, open and closed, through mandatory safety testing.

It also says, plainly, "Anthropic has never advocated for a ban on open-weights models," and calls open-weight models without dangerous capabilities a public good. Read the document and the ban framing does not survive. Read it twice and something better shows up.

Buried in the reasoning is the sentence that decides the entire argument. Once open-weight models are released, the paper says, "these options are lost permanently", because "safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring."

That is the strongest technical statement anyone has made in this debate, and it is sitting on the page of the company arguing for restriction. It is correct. It is also fatal to the second ask.

Sort every proposal by whether the download already happened#

There is one question worth asking about any open weights rule, and it takes about four seconds. Does this lever act before the weights ship, or after? Everything else follows from the answer.

Two of the three land on the enforceable side of that line, and the honest read is that neither is unreasonable. Requiring a capability evaluationcapability evaluationA structured test measuring what a model can actually do, such as autonomous task completion or dangerous skills, used to decide whether it clears a safety bar before release.See also Foundation Model Transparency Index, autonomy evaluation, frontier model before a frontier open-weight release is a high bar, not an impossible one. Arguing about where the bar sits is a real policy debate worth having.

The third one is where the paper's own concession bites. Cracking down on distillationdistillationTraining a smaller model to mimic a larger one's outputs, letting the smaller model inherit much of its capability at a fraction of the compute cost.See also LoRA adapter, open-weight model means noticing what people are doing with weights that have already left.

At industrial scale a new model eventually surfaces and lawyers get involved, which is a genuine deterrent. Below that scale there is nothing to notice, because inference on a machine you own reports to no one.

Now look at what is missing from the paper, and from every EU and US proposal surveyed for this piece. Nobody has proposed a recall. Not one of them contains a mechanism to withdraw, patch, deprecate, or expire model weights that have already been distributed.

The EU's enforcement powers run to fines and pulling products off the market, which does nothing to a file already on a hard drive. That absence is not an oversight anyone forgot to correct. It is the shape of the problem showing through the paperwork.

The scale makes it concrete. Llama passed 1 billion downloads in March 2025, before any US statute on open-weight testing existed. Qwen crossed a billion too, pulling 153.6 million downloads in February 2026 alone.

Guardrails are configuration and configuration comes off#

The obvious rebuttal is that pre-release testing is enough, so the post-release gap does not matter much. It matters, and the reason is a technique called abliterationabliterationA technique that locates the internal directions in a model's weights responsible for refusal behavior and edits them out, stripping safety guardrails without retraining.See also bypass rate, checkpoint, open-weight model.

Refusal behaviourrefusal behaviorThe trained tendency of a model to decline certain requests, implemented as learned patterns inside the weights rather than a hardcoded rule, which makes it removable after release.See also abliteration, bypass rate, safety classifier trained into a model turns out to live in identifiable directions inside the weights. Standard analysis finds those directions and edits them out, on consumer hardware, with no specialist knowledge required. The alignment is a layer sitting on the file rather than a property woven through it.

According to Akerman's writeup of a Financial Times interview, the creator of a free tool called Heretic stripped the guardrails off Google's Gemma 4 within 90 minutes of its public release. The same piece cites an ICLR 2026 paper (OpenReview qlf6y1A4Zu) reporting bypass ratesbypass rateThe percentage of attempts that successfully get a model to ignore its safety restrictions, used as a measure of how effective a jailbreak or guardrail-removal technique is.See also abliteration, refusal behavior as high as 99 percent. Take that figure as reported rather than verified, since the paper sits behind a login wall.

The consequence is narrow and it is the whole argument. A pre-release safety test is a true statement about the checkpointcheckpointA saved snapshot of a model's weights at a specific point in training or fine-tuning, the exact file that gets tested, released, or further modified.See also abliteration, frontier model that shipped. It says nothing about the population of derived checkpoints that exists ninety minutes later, and no test run before release ever could.

Worth holding the other side of this too. When Hugging Face needed forensic help during its July 2026 breach, hosted models refused the work and a self-hosted open-weight model did it, which is covered in what happens when you disable safety classifiers. Removable guardrails cut for defenders as well as against them.

Sufficiently capable is doing all the work#

The testing proposal covers "all sufficiently capable models," with a carve-out for "less capable models, such as those from startups and academia." Nothing in the paper says what sufficiently capable means. No FLOPFLOPA floating-point operation, the basic unit used to measure how much compute went into training a model, often summed as a cumulative count to set a regulatory threshold.See also compute threshold, systemic risk threshold count, no benchmark score, no eval suite.

That undefined word is the part to watch, because an undefined trigger does not stay undefined. It gets a number attached later, by a regulator, under deadline, using whatever evidence is lying around at the time.

The closest thing to a yardstick today is METR's evaluation of DeepSeek and Qwen, which put mid-2025 DeepSeek autonomy near where frontier modelsfrontier modelOne of the most capable AI models available at a given time, used as the reference point against which smaller or older models get compared.See also capability evaluation, checkpoint, commodity bet sat in late 2024. METR also flagged that its setup could not rule out sandbaggingsandbaggingA model deliberately underperforming on a capability evaluation to appear less advanced or dangerous than it actually is.See also autonomy evaluation, capability evaluation, red-teaming, and logged 15 cheating attempts from one DeepSeek checkpoint alone. A capability threshold enforced through evaluations inherits every weakness of the evaluations, including the possibility that the thing being tested is playing dumb.

The 45 percent no US rule can reach#

Grant the whole pre-release regime for a moment. Assume it passes, it is well drafted, and US labs comply. Which models does it actually touch?

A CNBC investigation published 7 July 2026 put Chinese-origin models at a weekly peak of 46 percent of tokens routed through OpenRouterOpenRouterA platform that routes API requests across many model providers, letting developers switch vendors without changing integration code, and used here as a proxy for market share.See also token routing. US-origin share went the other way, from around 70 percent a year earlier to 35.7 percent. DeepSeek alone routes more tokens than any other single vendor on the platform.

Those are the models with no public safety evaluation detail to inspect. Stanford's Foundation Model Transparency IndexFoundation Model Transparency IndexA Stanford scoring project that grades AI model developers on how much they publicly disclose about training data, safety evaluations, and deployment practices.See also capability evaluation found that "DeepSeek and Alibaba do not report details of any pre- or post-mitigation safety evaluations for their DeepSeek and Qwen models respectively." You can read the full FMTI company report if you want the scoring detail.

Price is what moved the market, not policy. Roughly 14 cents per million input tokens against five dollars for a US frontier alternative is a 36 to 1 spread, and teams route accordingly.

A rule written in Washington binds the labs behind the minority share and does not reach the developers behind the majority at all, which is a strange outcome for a safety measure. Procurement bansprocurement banA rule barring government agencies or contractors from buying or using products built on specific models or vendors, used as an enforcement lever when direct regulation cannot reach.See also chip export controls and audits are the levers left, and neither one is a pre-release test.

If you run models on your own hardware, notice which side of that split your stack sits on. The weights on your drive were not covered by any of this when you pulled them, and no proposal on the table changes that retroactively.

Europe already picked a number#

One jurisdiction stopped arguing and wrote it down. The EU AI ActEU AI ActEuropean Union legislation imposing obligations on general-purpose AI models, including documentation, copyright, and safety testing duties that scale with a model's assessed risk.See also general-purpose AI model, systemic risk threshold's general-purpose AI obligations have been enforceable for new models since 2 August 2025, with existing models given until 2 August 2027.

The open-source exemption in there is real and broader than most coverage suggests. Here is what it does and does not cover.

• Release under a free licence with public weights and you skip the technical documentation duty owed to downstream providers.
• A copyright policy still applies, exemption or not.
• So does a public summary of the training data.
• Above the systemic-risk threshold the exemption disappears entirely.

Then it stops. Article 51(2) presumes systemic risksystemic risk thresholdA cumulative training compute cutoff in the EU AI Act above which a general-purpose model is presumed to pose systemic risk and loses any open-source exemption.See also EU AI Act, FLOP, general-purpose AI model once cumulative training compute passes 10^25 FLOP, and past that line the exemption is gone and the full Article 55 obligations land, adversarial testing and incident reporting included. As the legal summary puts it, "This exemption does not apply to GPAIgeneral-purpose AI modelThe EU AI Act's regulatory category for a model flexible enough to serve many downstream uses, the trigger for the Act's transparency and safety obligations.See also EU AI Act, systemic risk threshold models with systemic risks."

Note what Europe did not write, having sat with this longer than anyone. The obligations all land on the developer before and around release, never on the copies afterwards.

What actually decides this#

The question is not whether open weights get regulated. Europe already did it and the sky stayed up. The question is whether a proposal acts before the download or after, and only one of those answers describes something a person can comply with.

Judge every future proposal on that basis. A pre-release testing requirement with a published threshold is a real rule, arguable on its merits, and it will bind the labs inside whichever jurisdiction writes it. Anything that assumes a released model can be watched, patched, or taken back is asking for a world where the last three years of downloads did not happen.

Anthropic's paper knows this, which is why it asks for chips, courts and a pre-release test rather than a recall. The one ask that reaches past release, stopping distillation, only works against operations big enough to leave a model behind. Everything smaller runs on hardware nobody can see.

The reachable levers are chips, courts, and the moment before release. Everything after that is weather.