AI How language models work, from tokens to reasoning
Open weight AI models: what open really means here
Open weights versus open source versus closed models, what the licenses permit, and the practical trade offs if you run a downloadable model yourself.
The short answer
- An open weight model is one whose trained numbers you can download and run yourself, which is not the same thing as open source software.
- Most releases publish the weights only, keeping the training data, the training code and the exact recipe private, so nobody outside can reproduce or fully audit the model.
- Several popular model licenses carry conditions that classic open source licenses forbid, such as user count thresholds, acceptable use rules and naming requirements.
- What open weights genuinely buy you is control: nothing leaves your machine, no per token bill, and a version that cannot be changed or withdrawn underneath you.
- What you take on is hardware, updates, security and safety, because a downloaded model comes with no support desk and no one else patching it.
An open weight model is one where the company publishes the trained numbers, so you can download the file and run the model on your own computer or server. That is all the term promises. It does not mean you can see the training data, it does not mean you can reproduce the model, and it does not reliably mean the license meets the classic definition of open source. The word "open" is doing a lot of quiet work in these announcements, and the gap between what people hear and what is actually released is where the trouble starts.
The three things that could be released, and usually are not
A modern model has several separable parts, and calling something open tells you nothing about which ones you get.
- The weights: the billions of learned numbers that are the model. Almost always included in an open release.
- The architecture and inference code: how the numbers are wired together and run. Usually published, often in a research paper plus a small code repository.
- The training data: the actual text collection. Essentially never published, partly because of copyright exposure and partly because it is a competitive asset.
- The training recipe: the data mix, the ordering, the filtering, the reinforcement stages. Described in general terms at best.
Without the last two, nobody outside the company can rebuild the model or audit what went into it. That is why careful people say open weight rather than open source. The Open Source Initiative's long standing definition requires the freedom to use the software for any purpose, with no restriction on fields of use, and it assumes you can inspect and rebuild what you received. Several widely used model licenses fail that test on both counts. Anyone who already thinks in open source terms from ordinary software should expect the analogy to break here.
Three tiers, and what you can actually do
| Closed API model | Open weight model | Genuinely open source model | |
|---|---|---|---|
| Get the file | No | Yes | Yes |
| Run offline | No | Yes | Yes |
| See the training data | No | Rarely | Yes, that is the point |
| License conditions | Terms of service | Often custom, sometimes restrictive | Standard permissive license |
| Version stays put | No, it updates | Yes, your copy is frozen | Yes |
| Someone else patches it | Yes | No, you do | Community |
The third column is thinly populated. A handful of research projects publish weights, data and code together under a permissive license, and they tend to be smaller and less capable than the well known downloadable models.
What the licenses actually say
Read the license file, not the blog post. The conditions that appear in practice fall into a few families.
Standard permissive licenses such as Apache 2.0 or MIT attach almost nothing: use it, modify it, sell products built on it, keep the notice. Custom community licenses are the awkward category. Common clauses include a monthly active user threshold above which you must negotiate separately, an acceptable use policy incorporated by reference that can be updated later, a requirement to display the model family name in your product, restrictions on using outputs to train competing models, and a rule that anything you distribute downstream carries the same terms. Research only licenses go further and bar commercial use altogether.
None of these are outrageous, and most small users will never hit a threshold. The problem is discovering one after you have built a product on it.
What running your own model genuinely buys
Four things, and they are real.
Nothing leaves the machine. For confidential documents, client files or health information, this removes an entire category of question about retention, subprocessors and jurisdiction. The questions raised in where your prompts are processed stop applying when the answer is "this laptop".
No per token bill. At steady volume, a fixed server beats metered API pricing. The crossover depends on utilization: a machine busy eight hours a day pays for itself far faster than one answering a dozen queries.
A version that cannot move. Hosted models are updated and retired on the provider's schedule, which can change your output overnight. A downloaded file behaves the same in two years, which matters if you have validated a workflow against it.
Freedom to inspect and adapt. You can run the same test 500 times, probe its behavior, fine tune it on your own material, strip it back for speed, or run it inside a network with no internet access at all.
What you take on instead
Hardware is the first wall. Roughly, a small model of a few billion parameters runs on a recent laptop with 16 GB of memory; a mid sized one wants a dedicated GPU or a machine with unified memory in the 32 to 64 GB range; the largest open releases need server hardware most people will rent rather than buy. Quantization, which stores the weights at reduced precision, cuts memory use substantially for a modest quality loss and is what makes desktop use practical at all. The relationship between size and quality is not linear, and model size explained is worth reading before you buy anything.
After hardware comes everything a provider used to do: updating the serving software when a vulnerability is published, monitoring for abuse if you expose it to others, logging, rate limiting and deciding what the model should refuse. Safety tuning ships inside the weights, but it is not enforced from outside, and a determined user with their own copy can fine tune it away. If your model is internal, that is a manageable risk. If it faces the public, it is your responsibility, not the publisher's.
There is also no support. When output quality degrades, no one is investigating on your behalf.
How to check a model before you rely on it
- Open the license file in the repository and search for "commercial", "users", "distribute" and "acceptable use".
- Check whether the acceptable use policy is a separate live web page. Archive it with the date.
- Confirm the parameter count and the quantized file sizes against the memory you actually have, with room for the context window on top.
- Run your own 20 question test set, not a public benchmark, since benchmark scores are routinely contaminated by test data appearing in training.
- Decide who patches the serving software, and put a name against it.
- Price a year of hardware and electricity against a year of API calls at your real volume.
Where to start
If you are curious rather than committed, install a small model on the computer you already own and use it for a week on real work. It costs nothing and it calibrates you faster than any comparison chart: you will discover very quickly whether the quality gap matters for your tasks or not. The practical setup steps, memory requirements and realistic use cases are in running AI on your own device. Only after that week is the license question worth your lawyer's time.
Common questions
Is an open weight model free?
The download usually is, but running it is not. You pay in hardware, electricity and staff time instead of per token fees, which works out cheaper only at steady, reasonably high usage.
Can I use one commercially?
Often yes, but read the license rather than assuming. Some are standard permissive licenses with almost no conditions, while others add restrictions on scale, on use cases, or on training other models with the output.
Are open weight models less safe?
They ship with safety training, but anyone can fine tune that training away on their own copy. For your own use the practical question is different: you own the filtering, logging and misuse controls that a hosted provider would otherwise run.
Can I see what a model was trained on if the weights are open?
Almost never. Weights are billions of numbers with no readable record of their sources, and most releases do not publish the data list, so open weights improve testability rather than transparency.