Open-weight models: What you get when an AI model can be downloaded but not rebuilt

An open-weight model is an AI model whose trained parameters, the “weights,” are published for anyone to download. With the weights and suitable hardware, you can run the model yourself, without asking its maker for permission each time. That is different from “open source,” which asks for much more.

The idea is back in the news because of DeepSeek, whose models are released this way. Reuters reported that the US Homeland Security Department is ordering civilian agencies to remove DeepSeek products and third-party services built on the model.

A finished cake you can take home, but not the recipe

Think of a bakery. A closed model is a cake you can only eat inside the shop. An open-weight model is the finished cake, boxed to take home: you can slice it, add frosting, or sell slices. An open-source model would also hand you the recipe, the ingredient list and the kitchen notes, so you could bake it again from scratch.

Weights are the finished cake. They are billions of numbers a model learned during training. They encode what the model knows, but they do not show what data it learned from or how the training was run.

What a download actually contains

DeepSeek’s R1 release shows the typical package. According to the project’s Hugging Face and GitHub pages, DeepSeek published the weights of DeepSeek-R1 and DeepSeek-R1-Zero, each with 671 billion total parameters, of which 37 billion are active for any one token. It also published six smaller “distilled” models, from 1.5 billion to 70 billion parameters, built on Qwen2.5 and Llama 3 models.

The smaller ones can be served with common tools. The project page gives an example using vllm serve with the 32-billion-parameter distilled model. Once downloaded, the model runs on hardware its user controls. The maker does not host it and does not see each request.

The GitHub page does not say that the training data or the training scripts were released. It says the distilled models were fine-tuned on about 800,000 samples curated with R1, but it does not point to that dataset.

Open weights, open source and the license in between

Two separate questions decide how “open” a model is. The first is what is released: weights only, or also code and data details. The second is the license, meaning what you are allowed to do with it.

DeepSeek’s page says the R1 code and weights use the MIT License, a short permissive license. The page says this permits commercial use, modification, derivative works and distillation, which means training other models on the model’s outputs. The distilled versions keep the licenses of their base models: Apache 2.0 for the Qwen-based ones, and the Llama 3.1 and 3.3 licenses for the Llama-based ones.

Other labs attach conditions. Reports on Meta’s Llama say its license restricts some uses, such as using it to improve other large language models, and that Meta has not fully disclosed its training data. Meta describes Llama as open, though reports say it has also used phrases like “openly available.”

Where the term comes from and who defines it

Open-weight models grew out of a long habit in AI research of sharing trained models. Meta’s Llama family popularized it for large language models. Chinese labs such as DeepSeek and Alibaba’s Qwen team followed. DeepSeek-AI posted the R1 paper, “DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learning,” to arXiv on January 22, 2025. It was later published in Nature.

The Open Source Initiative (OSI), the nonprofit that maintains the Open Source Definition for software, published version 1.0 of its Open Source AI Definition in late October 2024. It asks for three things in the form used to modify a system:

• Data information: enough detail about the training data for a skilled person to build a substantially equivalent system.
• Code: the full source code used to train and run the system.
• Parameters: the weights, under OSI-approved terms.

By that yardstick, a release of weights alone is open-weight, not open source. Press coverage at the time reported that Llama did not meet the definition. Not every lab accepts this framing, and Meta has said there is no single definition of open source AI.

Why a download is hard to take back, and what that means for policy

The practical difference is control. A hosted model, such as a chatbot behind a company’s servers, can be switched off, filtered or monitored by its operator. A downloaded model cannot. Copies spread, anyone can fine-tune them, and companies can build them into products under their own names.

That is why the DHS order, as Reuters described it, covers not only DeepSeek’s own products but also third-party services developed using DeepSeek. When weights are free to reuse, a model can sit inside software that never mentions its origin. Finding it means tracing vendor stacks. Reuters’ account, as we reported, does not say how agencies are expected to do that.

The same openness has benefits. Researchers can inspect behavior and test safety claims. Companies can run a model on their own servers, which can keep data in-house. Smaller teams can adapt a model without paying per request. Running a model locally does not by itself guarantee that nothing leaves the system, because that depends on the software around it.

Limits, open questions and what to watch

Open weights are not full transparency. Without data information, outsiders cannot easily check what a model was trained on, whether it contains copyrighted material, or why it behaves as it does. Weights also cannot prove the absence of flaws. DHS, per Reuters, said the models might contain malware or other vulnerabilities. The report describes no specific incident.

Three things are worth watching:

• Labeling. Whether regulators and buyers adopt the OSI’s definition, or keep using “open source” loosely for any downloadable model.
• Provenance rules. Whether buyers such as governments start asking vendors to list which models sit inside their products.
• License terms. Whether labs keep releasing under permissive licenses like MIT, or add more conditions as models grow more capable.

For now, the term “open-weight” is a useful warning label: the model can be run, copied and adapted, but how it was made may stay out of view.