Open-weight models

Models whose trained weights are downloadable (run them yourself) — distinct from "fully open source" (weights + training code + data, which is rare). The defining 2026 movement in the llm-provider landscape open-source-llms-2026.

State of play (2026)

Open-weight is now "good enough for serious production," not just a cheap alternative. Leaders: deepseek V4 Pro/R1, Meta Llama 4, Alibaba Qwen3, google gemma-4, Moonshot Kimi K2.6, Z.ai GLM-5.2 (MIT; the #1 open-weight model on artificial-analysis as of 2026-06), Mistral Large 3/Small 4, Microsoft Phi-4, and — from 2026-07 — Thinking Machines Lab's Inkling (Apache-2.0, 975B/41B, multimodal).

The open field is not all Chinese. Inkling's arrival prompted Willison to count the US open-weight roster as Inkling, NVIDIA Nemotron, and Gemma 4 — three inkling-willison-review. Against qwen, deepseek, z-ai and Kimi, that's a thin bench, and two of the three come from companies whose real business is elsewhere (chips, ads). Inkling is the outlier: a startup whose open weights are the strategy, monetized one layer up at Tinker.

Three structural trends

• MoE dominance — almost every flagship is a sparse Mixture-of-Experts: large total params, small active set (Gemma 4 25.2B/3.8B; Llama 4 Maverick 400B/17B; DeepSeek R1 671B/37B). The mechanism is a gating/router that picks the top-k experts per token (usually k=1 or k=2) and sums only those, so most of the network stays idle — conditional computation that can use less inference compute than a dense model despite carrying far more total parameters moe-architecture. That total-vs-active split is exactly why open-weight flagships get frontier capability at practical serving cost (cf. llm-inference, kv-cache). DeepSeek's variant adds shared experts that always activate alongside the routed ones moe-architecture.

• Context explosion — 256K → 1M → 10M (Llama 4 Scout).

• Licensing clarity — Apache-2.0 won the permissive race (Qwen3, Gemma 4, Mistral Large 3); MIT for Phi-4 and DeepSeek R1. Meta's Llama "Community" license is more restrictive; "read the terms" applies (Kimi's Modified MIT). A third shape, and the terms tightening as the capability closes (2026-07-28, kimi-k3). Moonshot dropped Modified MIT for a bespoke Kimi K3 License: MIT-shaped for use, modification, distribution and sale, with one carve-out — run a Model-as-a-Service business above US$20M revenue over any consecutive 12 months and you need a separate commercial agreement. Embedding the model in an end-user product, or relaying to someone else's hosting, is explicitly outside the definition. So the axis now holds three shapes: truly permissive (Apache-2.0/MIT — Qwen, GLM, Inkling), user-threshold (Llama's 700M-MAU clause), and revenue-threshold on serving (Kimi K3). Qwen moved out of the first bucket, at least for its newest checkpoint (found 2026-08-30). qwen38-flash-next ships under qwen-community-1.0, not Apache-2.0: running the weights commercially as a hosted inference service, or inside an AI work-assistant product, needs a separate agreement with Qwen. That is the Kimi shape without the revenue threshold — a flat carve-out on serving. Both claims are kept: Qwen's earlier releases genuinely are Apache-2.0 (qwen), and the flagship of the next generation is not, which means "Qwen is permissive" is now a statement about a checkpoint rather than about a vendor. The direction is consistent with the pattern this section already names — terms tighten as capability closes on the frontier — and it now has three independent instances (Llama, Kimi, Qwen) rather than two. The pattern in the last two is the same: free for everyone except the clouds and API resellers who would monetize serving it. Worth holding beside the capability story — K3 is the strongest open-weight challenge to the closed frontier this spoke has recorded, and it arrived on the least permissive licence Moonshot has used.

• Multimodality reaches the open/local tier — open weights are no longer text-only: gemma-4 12B ships encoder-free vision + native audio (raw audio projected straight into the token space), runnable on 16GB VRAM/unified memory gemma-4-12b-announcement. Memory footprint, not just licensing, is becoming the open-weight battleground. Inkling shows how wide that battleground is: also encoder-free vision + audio, also Apache-2.0 — but 2TB+ of aggregated VRAM in BF16, ~600GB quantized to NVFP4 inkling-announcement. "Downloadable weights" spans a 16GB laptop and a 16×H200 cluster; the license tells you nothing about who can actually run it.

• The behaviour is editable, not just the deployment (added 2026-07-26). A permissive license on downloadable weights also licenses modifying them, safety posture included. gemma-4-31b-it-scotoma is Gemma 4 31B-it with its refusal direction thinned across layers 7–41 and republished under Google's own Apache-2.0 (abliteration). Licensing clarity has been read here as permission to run; it is equally permission to rewrite and redistribute. Nothing in Apache-2.0 distinguishes the two. And the rewrite is now a commodity (2026-08-22). heretic does the refusal edit automatically — pip install, one command, 20–30 minutes on a 4B model on a consumer GPU, no understanding of transformer internals required — and its README claims well over 5,000 models on Hugging Face built with it. The mechanism it automates was published in 2024 (arditi-refusal-direction): refusal sits in a one-dimensional subspace, and safety fine-tuning does nothing to hide it. Editing the safety posture out of an open-weight model is not a research capability any more. It is a build step.

Why it matters

Open weights enable local/private deployment (Ollama, vLLM, llama.cpp) and break the pricing floor — the competitive pressure that makes deepseek's low llm-api-pricing possible and forces proprietary labs to justify their premium on llm-benchmarks.

Open weights are not a text-only story, and the image side shows the pattern in a harsher form. mage-flow-turbo is Microsoft's MIT-licensed 4B text-to-image model, claiming to match open systems five to eight times its size while rendering 1024² in 0.59s. Every one of those numbers is from the model card. There is no artificial-analysis equivalent for image models in this corpus, so where an open-weight LLM's claims get re-run by somebody neutral, an open-weight image model's simply stand — the licence is open and the evaluation is not.

Publication is irreversible, and that is a separate axis (2026-09-04)

Every licence distinction above governs what you may do next. uncensored-ai-rekhi names the thing none of them touches: a published checkpoint cannot be withdrawn. "Once Meta publishes Llama, those weights exist forever. And whatever capabilities researchers discover in those weights later, whatever new attacks become possible, everyone who ever downloaded the model has access to them."

That is true by construction rather than by evidence, and it changes the licence table's meaning rather than adding a row to it. Apache-2.0, the Llama MAU clause, the Kimi K3 revenue threshold and qwen-community-1.0 all constrain the serving of weights by parties who can be identified and sued. None of them reaches a copy already on a disk, and the abliteration point above — that the safety posture is an uninstaller, not a property — is the same observation from the model's side. The practical consequence the essay draws is a timing one: because the edit is a commodity, the lag between a frontier open release and its decensored derivative is days, so safety work done before publication is the only kind that binds.

A second-hand market has grown on top of that, and the spoke now pages it as dark-llm-services — rented uncensored inference at $30–$200/month, per security reporting the corpus has not read directly. Treat the numbers as leads; the structure is the part that follows from what is already here.

Related

open-source-llms-2026 · heretic · abliteration · mage-flow-turbo · moe-architecture · deepseek · kimi-k3 · llama · llm-provider · llm-benchmarks · llm-inference · uncensored-ai-rekhi · dark-llm-services