Nathan Lambert on Open Language Models: History, Competition and Risk

This introduction brings together the issues shaping open language models, drawing on a lecture I gave in Harvard's AI safety course. Although attention often goes to OpenAI and Anthropic, open models influence the frontier, spread technology through the economy, and shape who gets to control and govern it.

An open-weight model lets someone download the trained weights and use them in their own system. Examples include Meta's Llama and Muse, Moonshot's Kimi, Zhipu's GLM, Alibaba's Qwen and DeepSeek. This differs from access solely through an API.

I distinguish these from open-source models that also release training code, recipes and data. Olmo, Hugging Face's models, Marin, Open Athena and EleutherAI's Pythia are examples in that research tradition. Such releases are more useful for studying and modifying training, though I think their leading examples lag leading open-weight models in performance.

Meta's Llama became an important research platform in February 2023, though the original weights were hard to obtain and redistribution of fine-tunes was restricted. People distributed weight differences and reconstructed models locally. Mistral's smaller dense models also gained popularity later that year.

Llama 3 and 3.1 marked a high point for Meta in 2024. DeepSeek's mixture-of-experts research and V3 release at the end of that year preceded R1, which drew an enormous market reaction. In 2025, releases from MiniMax, Moonshot, Qwen, Baidu and others made Chinese labs much more prominent.

By 2026, models such as GLM 5 and Kimi K3 had become strong at agentic tasks. Separately, research-oriented efforts include BLOOM, Pythia, Olmo and Tülu, whose data and technical reports help researchers understand how models are built and how training changes over time.

Most research nevertheless uses open-weight families offered in many sizes, from small models to tens of billions of parameters. Llama has given way to Qwen as a common foundation. Its dominance is useful, but I worry that findings presented as general AI methods may sometimes depend on the particular Qwen models researchers use.

Licenses define terms between a model maker and a user. MIT and Apache 2 are permissive software licenses frequently applied to model releases; the Linux Foundation's OpenMDW adapts the Apache approach to model weights and data. Leading releases are increasingly using customized terms instead of purely permissive licenses.

One approach is a revenue threshold: Lambert cites terms for Kimi K3 and U Spark Open requiring certain large inference providers to negotiate a separate agreement. Model builders want a share of downstream revenue because inference companies also earn money from their work. The unresolved challenge is getting enough money back to fund the next models.

Other licenses add branding requirements or restrict particular uses. I have not seen branding provisions consistently enforced, but use restrictions are in tension with the freedoms associated with open-source software. Downloadable weights and a genuinely open-source license are not the same thing.

The free-software tradition began as an ethical stance: freedom to run a program for any purpose, study and change it, redistribute it, and distribute modifications. Copyleft licenses use sharing obligations to preserve freedoms in distributed derivatives. Open-source advocacy also developed a pragmatic emphasis on software development and adoption, including permissive licenses that allow proprietary forks.

Support for open models comes from different motivations. Companies may open a technology strategically to weaken a rival and protect a complementary business. Investors have their own incentives. My motivation as a nonprofit researcher is that openness enables scientific progress and understanding, safety research and wider participation in technological change.

Others emphasize freedom and resistance to concentrated power: if AI is consequential, a few companies should not determine everything people can do with it. The transformer paper illustrates the value of research sharing: I believe Google's publication enabled years of subsequent competition and innovation, benefiting society over long horizons.

Meta's writing on open AI described developer freedom, cost, safety and innovation, alongside the strategy of commoditizing complements. Google used open-source strategically through projects such as Android and Kubernetes. This business history matters because it shows that not every open-model release is driven by ideology.

A company behind the frontier has incentives to release openly: it can gain adoption, attention and talent while weakening a leading competitor. Some companies may also believe in broad access, but strategy explains much of the ecosystem. These incentives were familiar in earlier open-source software markets.

For customers, ownership and control may matter more than price alone. Small closed models can also be cheap, whereas open weights allow an organization to adapt a model with its own data and retain control of the result. Harvey's reported work fine-tuning Kimi K3 for legal tasks illustrates the potential for specialized accuracy at lower cost.

During visits to Chinese labs, I saw how releasing weights could help new entrants such as Moonshot gain adoption and feedback. DeepSeek helped establish that pattern. Companies including Ant Group, Meituan and Xiaomi also build internal technology and can gain attention and outside feedback by releasing models they already have reason to develop.

How competitive are these models? Individual benchmarks need nuance, but Artificial Analysis estimated an open-weight lag of roughly three months, while Epoch AI's index suggested around five months at the time of the lecture. It is striking that labs with fewer resources can remain so close on these measures.

SemiAnalysis' analysis matches my experience that the gap narrowed as the industry matured. GPT-4 and ChatGPT were much more polished than early open models such as Llama 2. Open-weight developers have since become more professional, and their practical performance has improved alongside measured scores.

Benchmark scores are not the whole story. Labs have incentives to optimize for public tests, particularly when financial markets reward signs of progress. I think some open models may be somewhat benchmark-focused, and their performance can be uneven across tasks even when scores look strong.

Closed models can be robust across varied uses; some Chinese open models have been slower on multimodality and can be hit-or-miss outside their strengths. Yet GLM, Kimi K3 and DeepSeek's Flash model are viable coding agents. Their opportunity is to compete in valuable domains with more control and potentially lower task-specific costs.

The data I showed places leading US open-weight models another three to five months behind leading Chinese open models. That produces a difficult tradeoff for American organizations choosing between frontier performance and a model from a provider they trust. The United States has fewer builders at the top end, though the situation is improving.

Open weights are not necessarily much cheaper on a general cost-versus-intelligence frontier: small closed models can be highly cost-effective too. Competition may reduce open-model prices, but I expect control, ownership and specialization to matter more than a blanket price claim. Chinese companies also account for many of the strongest models, not merely one or two.

Distillation has become a charged term in discussions of how these models are built. A rough training sequence is pretraining, mid-training and supervised fine-tuning, then reinforcement learning. Pretraining creates the base model; later stages can teach reasoning and help models perform longer tasks more reliably and efficiently.

Model-generated data can enter the middle stages: one model's output becomes training data for another. Historically, knowledge distillation meant training a student on a teacher's output distribution. In language models the term broadened to cover synthetic outputs, and it is now often used for training on reasoning traces from an API model.

I use the term adversarial distillation for attempts to extract reasoning that an API normally hides. I believe some Chinese labs have developed methods resembling published security research on extracting those traces. This is a specific claim about a narrow capability, not proof that every use of a closed model's API is training data extraction.

Anthropic and other labs have described large-scale use of their APIs by Chinese labs. Some may involve reasoning extraction, while other usage includes routing user requests to closed models. The scale and sophistication attract attention, but I do not think those facts alone establish the size of the resulting training advantage.

I have not attended private or classified briefings and cannot evaluate information that has not been made public. Some people making claims also have financial interests in frontier labs. My interpretation is that obtaining data can be easier than acquiring more compute, and that China's own model-building abilities are often underestimated.

Distillation can be useful in mid-training and supervised fine-tuning, but much recent post-training progress concerns reinforcement learning and other later techniques. I do not see public evidence establishing how much of the overall gain comes from distillation. That uncertainty makes it hard to justify treating one technique as the whole explanation.

I am skeptical that banning Chinese models would stop the activity or prevent people from using open weights. Broad software restrictions could reduce US innovation and global exchange. I worry that policies designed around this debate could produce short-term advantages for particular labs at the expense of long-term dynamism.

Frontier labs should also improve their own defenses. I welcome Anthropic's reported work making API distillation harder and want to see what follows before drawing stronger conclusions. Fast-following can be more compute-efficient than making a frontier breakthrough, but that does not mean the followers are incapable of difficult engineering.

Not all API use is for training. Reporting on token resellers suggests that some users in China access otherwise unavailable models through intermediaries, sometimes with user data becoming part of the transaction. I do not think the business reasons behind all this traffic are fully understood.

Xiaomi's public stream of metrics from a week-long reinforcement-learning run is one example of Chinese labs showing their training expertise. I see it partly as a response to the distillation narrative and a valuable public resource on large-scale RL. Such work requires significant effort and compute in its own right.

Estimates from Epoch AI and SemiAnalysis suggest large compute disparities. ByteDance has more compute than other Chinese labs in the comparison, while the others have substantially less than US frontier labs. If the difference carries through to training, efficiency and a narrower focus become especially important.

To measure adoption, I collect public data in the Interconnects dashboard. Inference companies occasionally disclose token volumes, while OpenRouter publishes data that can be filtered to open models. On a logarithmic plot these indicators show rapid growth; Google API volumes offer a rough comparison, although the figures do not capture all usage.

Downloads are another imperfect proxy. Qwen dominates many download charts, and Gemma has also grown, but raw totals favor small models and ecosystem activity. Strong frontier models can look minor on the same scale. Automated traffic can inflate counts, and local use after download is largely invisible.

In the download data I call July 2025 the flip, when Chinese models overtook earlier US and European leadership. Hugging Face activity has grown, but platform traffic is only a proxy for adoption. Download trends can still be informative for narrower categories, such as local models designed to run on a laptop or quantized hardware.

I also searched hundreds of thousands of arXiv papers in popular machine-learning categories for model names. Llama was initially dominant, while Qwen has grown rapidly as research infrastructure. In my sample Qwen appears in roughly 60% of papers mentioning an LLM; because papers can mention several models, category percentages can sum above 100%.

Qwen is now mentioned in a similar number of papers to OpenAI's GPT models in this text search. This is an imperfect measure: a mention does not prove how a model was used, and some references may be missed. Still, the trend illustrates both Qwen's growth and the increasing centrality of language models in machine-learning research.

Looking ahead, cyber risk is real. A disclosed vulnerability is different from an actual attack, and closed models have also been used in attacks. I do not believe banning open weights would eliminate the risk: malicious actors may retain access while legitimate companies face uncertainty, and many labs can build models near the frontier.

Past risk discussions have included claims about misinformation, and some feared outcomes have not materialized as predicted. Other harms, including non-consensual deepfakes, are real. We should measure risks rather than oscillate between treating every possibility as certain and dismissing dangers when one forecast fails.

A few months' lead for closed frontier models can give researchers time to study emerging risks before open weights reach similar capabilities, but that window is short. Labs need to communicate clearly with governments and society. I expect a transition lasting years, with new risks that require coordination and practical responses.

I view Moonshot's reported decision to reduce some cyber capabilities in Kimi K3.1 as a useful example of considering marginal risk when releasing weights. Different labs have different risk postures. Chinese labs operate in a distinct political and economic context; we should understand their incentives instead of assuming every release is reckless.

Open models can also support cyber defense, while closed systems can enable attacks. The ecosystem has a backlog of vulnerabilities and uncertainty about attackers' behavior, so we should not assume a ban immediately makes everything safe. Biological risks have different physical bottlenecks; I need to learn more about them rather than treating them as identical to cyber risks.

Ultimately, I see open models as a way to diffuse technology, limit concentration and enable safety research and scientific inquiry. We should be cautious about retreating from openness because of fear alone, and instead judge the risks we can actually measure.