For an open model, secrecy is off the table. Integrity, license, and above all custody of everything derived from it are not, and almost no one is building for that yet.
The instinct about open-weight models is that they make the hard problem disappear. The weights are public. There is nothing left to protect. Download them, run them, fine-tune them, and the whole apparatus of secrecy and access control falls away.
That instinct is exactly backwards. Opening a model’s weights does not remove the trust problem. It moves it somewhere almost nobody is looking, and it makes it harder, not easier.
I want to spend this edition naming that problem, because it is arriving now and the field has not built for it. I am not going to walk through the solution today. That comes later. This one is about seeing the problem clearly, because right now most people cannot.
The trust direction just flipped
Start with the part that most confidential-computing work quietly assumes and open weights break.
The tools we built for protecting workloads were built to protect the operator from the code. You run someone’s software in your environment, and the machinery exists to keep that software from harming you or seeing what it should not. The party at risk is the one running the infrastructure.
Now a model builder ships weights into someone else’s infrastructure. Sovereign cloud. On premises. An air-gapped facility. The direction of trust inverts. The party at risk is no longer the operator. It is the builder, whose weights now sit on hardware and under operators it does not control, subject to whatever happens on a machine it will never touch. Almost nothing in the current stack is designed for that direction, and it is exactly the direction that regulated and sovereign deployments are pushing toward.
Open weights take that inverted problem and make it everyone’s problem, because now anyone can be the operator.
What “open” removes, and what it does not
For a closed model, a lot of the work is secrecy. Keep the weights hidden, gate access, and much of the risk is contained by keeping the thing out of reach.
Open the weights and that secrecy becomes theater. There is nothing to hide. But three problems do not go away when the weights go public. They get bigger.
Integrity. When you run an open model, especially on infrastructure you do not fully control, are you running the weights the builder approved, or a tampered copy? Anyone can take an open model, alter it, and re-upload it, and you may be the one who downloads the result. The majority of models on the largest public hub carry no license at all, which tells you how little provenance travels with them today. Verifying that the model in memory is the model that was signed off is not automatic. It has to be built.
License and field-of-use. Open-weight licenses are not blank checks. Llama’s community license requires a separate agreement once you cross seven hundred million monthly active users. Many licenses prohibit using a model’s outputs to train a competitor. Responsible-use licenses restrict harmful applications outright. But today those terms live as text in a file, and a recent legal analysis argues that many of these use restrictions are probably unenforceable as written. The terms exist. The enforcement does not. There is no technical link between what the license says and what the deployment actually does.
Derivative custody. This is the one almost nobody is naming, and it is the one that matters most. The moment someone fine-tunes an open model, a new artifact exists. Who owns it? What is the IP split between the base model and the tuning? Can anyone trace it back to its parent? Right now the honest answer is no. Fine-tuned descendants scatter into the world with no chain of custody, no lineage, no way to prove what they came from or what terms they inherited. For an open ecosystem that is about to produce millions of derivatives, that is a gap the size of the ecosystem.
Secrecy was never the interesting part. Custody is. Custody of the weights, custody of the terms they ship under, and above all custody of everything made from them.
What custody actually means
Let me be precise about the claim, because overpromising is how trust tools lose the trust they are selling. Weight custody is not about making an open model impossible to copy. The base weights are public. That ship has sailed, and pretending otherwise would be exactly the theater I just described.
It is about the things that are actually achievable and that almost nobody is delivering today. Proving the model in use is the one that was approved, not a tampered copy. Turning license and field-of-use terms into a technical condition of running, rather than words in a file no one can check. And giving every derivative a provable line back to its parent, so custody survives fine-tuning instead of dissolving at it.
That is a more grounded claim than the market usually makes, and it is the one worth building on. Integrity, enforceable terms, and lineage are not moonshots. They are missing plumbing.
Why now, and what comes next
Open weights are one of the best things to happen to this field. They democratize access, they let anyone verify and build, and they break the concentration of a few closed labs. I do not want less of that. I want it to be able to grow up without “open” quietly coming to mean “unaccountable.”
That is the problem I have been working on: extending the hardware-rooted trust work behind Confidential MCP and TRACE from agents to model weights themselves. I am not going to lay out the mechanism in this edition. Naming the problem is the work that has to come first, because a solution nobody understands the need for is a solution nobody adopts.
Custody is the word. The weights are open. The question is whether we can keep them open and accountable at the same time, and I think we can. I will show you how soon.
Top comments (0)