The founding misunderstanding
For three years now, the phrase "open source artificial intelligence" has been thrown around with abandon. Under a single word, objects that nothing really gathers together: models whose weights one can download but whose factory remains closed, datasets whose openness is precarious, training recipes guarded like industrial secrets. In broad strokes, one can distinguish at least three regimes: restrictive licensing with accessible weights (Llama, Mistral), permissive licensing with opaque data (DeepSeek), and the rare reproducible opening where weights, code and corpus are disclosed jointly (Pythia, OLMo, and a handful of others). This typology will not be the subject of the essay, but it provides its matrix: these three regimes coexist under the single label of open source, and it is the singularity of the word, more than the diversity of the practices, that is the problem. The laboratories that release them are not always taken in, mind you. When Meta releases Llama, the company is careful to write at the bottom of the contract "Llama Community License Agreement", not "open source". This licence forbids any company with more than 700 million monthly active users from using the model without a separate authorisation, and excludes, in certain versions, persons established in the European Union. The term "open source" is nevertheless used systematically by the press, and sometimes by Meta itself in its public-facing communications, to describe what this licence covers. There lies the misunderstanding.
The ambiguity is not trivial. In October 2024, the Open Source Initiative, the body that has watched over the canonical definition of free software for nearly thirty years, published the Open Source AI Definition, in short OSAID 1.0. The criterion it sets is demanding: a system of artificial intelligence is called open source only if it grants four freedoms, use for any purpose, study of its workings and inspection of its components, modification, sharing with or without modifications. To these freedoms is added a provenance condition: the model must disclose enough information about its training data for a person to be able, "in substance", to recreate it. At the moment these lines are being written, only a handful of models pass this test: Pythia, OLMo, Amber and CrystalCoder, T5. These are not the names you read every week in the business press. Llama is not there. Mistral is not there. DeepSeek is not there either, despite an MIT licence that looks, at first glance, exemplary.
This last apparent exception deserves to be taken seriously. When DeepSeek released its R1 model in January 2025, the Chinese company placed the entire package, model weights and code in its repository, under the MIT licence, one of the most permissive that exists. No restriction on commercial use. No user threshold beyond which one would have to come back and negotiate. Distillation expressly authorised. In contract terms, this is more open than Llama. And yet R1 does not pass OSAID, for a simple reason: one does not have sufficient information to rigorously reconstruct the corpus on which the model was trained. The weights are free, the recipe is unknown.
The gap between these two examples, Llama and DeepSeek, says the essential thing. When one speaks of openness in artificial intelligence, one is in fact speaking of several distinct openings, which are never granted together. There is the opening of weights, what one downloads in practice on Hugging Face and runs on one's own machine. There is the opening of code, that is to say the training scripts, which is almost never offered. And there is the opening of data, which presupposes that one knows where the input to the machine came from, and which remains, save rare exceptions, a blind spot. Three openings, then, and their entanglement is not neutral: each market actor composes its own mixture according to what it is prepared to concede.
The point here is not to blame these compositions. It is to stop confusing them. When a term accumulates so many distinct meanings that it designates none of them in particular any longer, it is not the language that simplifies itself: it is the debate that closes. And when the word "open" becomes a marketing argument rather than a technical test, those who benefit are, as one might suspect, not the most transparent actors. They are the biggest ones.
First degree: open weights, and what they conceal
Download Llama-3-70B from Hugging Face. You will obtain a file, a few hundred gigabytes of floating-point numbers, arranged in an architecture publicly documented by Meta. These numbers are the "weights" of the model: the parameters that emerged from several months of training on thousands of graphics cards, and that encode, in a totally opaque form, what the model has learned. You can load them into memory, submit a question to them, receive an answer. You can modify them (this is called fine-tuning, and the whole open-source AI ecosystem lives on it). You can redistribute them, within the limits of the clauses we have already seen.
What you do not obtain, by contrast: the procedure that produced them.
This is where the metaphor with traditional free software begins to crack. When Linus Torvalds publishes the Linux kernel under the GPL, he does not merely make available a binary one could execute. He publishes the source code: the human-readable instructions of which the binary is the mechanical translation. The binary alone would be of no interest, one could not audit it, correct it, or develop it in a knowing fashion. The GPL, in the classical software world, guarantees precisely this movement from use to knowledge: to open a program is to make its inspection by other eyes possible.
Now the weights of a large language model are not a source code. They are, structurally, the analogue of a binary, with the qualification that no readable "source code" corresponds to them. The analogy is not perfect: a classical program is compiled from human instructions, its weights are not, and there is a real philosophical difference between a learned model and a deterministic program written and then translated. It is useful, more modestly, to convey the sense that one receives an executable artefact without access to the full chain of its fabrication. A weight is a number. Several billion weights form an opaque matrix that no one, not even the engineers who trained them, knows how to interpret line by line. When you download a model, you retrieve the frozen result of a learning process, without the data that fed it or the sequence of operations that made it converge. You cannot know, by reading the weights, why the model settles on this answer rather than that one. You cannot, strictly speaking, debug it.
This asymmetry has a name in the technical community: people speak of open weights to designate it. The term is recent, less than five years old, and its very appearance is revealing. Before Llama 2, released in the summer of 2023, there was still some hesitation to concede that a model could be "open" with respect to its weights without being so with respect to its factory. Today the distinction has entered the vocabulary of the laboratories, but it has not entirely won over that of the media. As Anastasia Stasenko, who co-directs the French research laboratory Pleias, regularly stresses in her public interventions, the act of placing weights online has progressively been recast as openness, even though what really defines a generative AI model, according to her, is less the final object than the training corpus that produced it. It is on this last point that the important distinctions are lodged.
What Stasenko is pointing to is the gap between two openings that continue to be conflated. For a model to be truly reproducible, for an independent team to be able, from the elements furnished, to remake the same model or to make a variant with full knowledge of what they are doing, one would need three things: the weights, the code of the training scripts, and the training data. The first ingredient is often supplied. The second rarely is, and always partially. The third is almost always absent, hidden behind the smokescreen of "data from the internet and licensed sources".
The absence of the third element is the most important, and the least discussed. Without the training data, one cannot know whether a model has been fed on quality scientific texts or on shopping-site cookies. One cannot know whether it has seen, in proportion, more English-language Wikipedia or Russian-language forums. One cannot know which voices were oversampled and which others were erased. All one can do is interrogate it after the fact, by building batteries of tests that probe its behaviour. It is the equivalent of examining a patient without access to their medical history: possible, but limited, and always in the dark.
This partial opacity is more or less openly acknowledged depending on the laboratory. When the French company Mistral releases its small models, it communicates on their Apache 2.0 licence, one of the most liberal in the software world, without saying a word, or almost, about the data on which these models were trained. When Meta releases Llama, it mentions "trillions of tokens" without specifying their composition. When DeepSeek releases R1, the silence is almost total. The inference code and the weights are distributed under MIT, which is generous. What the model learned on remains a proprietary know-how.
The term "open weights" is what the profession has found to describe this state of affairs honestly. It describes what is open, and only that. The term "open source", when substituted for it, carries with it a whole inheritance from free software, the promise of reproducibility, of transparency, of community, that open-weight models do not honour. It is a category of thought that does not fit, applied to a product that is not designed to satisfy it. The confusion serves, as always, the actors who have the least to show.
Second degree: open source put to the test of artificial intelligence
Let us grant the preceding observation: open-weight models are not, strictly speaking, open source. The temptation, then, is to imagine that there must exist, in parallel, a genuine open-source tradition for AI, where datasets would be open as code has been for thirty years. This is what small laboratories have actually set out to build, and the recent history is worth telling, because it reveals a structural problem that no one knew how to formulate before it arose.
EleutherAI is, in several respects, the moral heir of free software in the field of artificial intelligence. The group was born on a Discord server on 7 July 2020, at the initiative of Connor Leahy, Leo Gao and Sid Black, in the form of a collective of volunteer researchers and engineers. Its ambition could be summed up in a single sentence: to demonstrate that AI research could be conducted outside the large proprietary laboratories, on condition that the essential ingredients (code, models, data) were published as the work progressed. On 31 December 2020, barely six months after its founding, EleutherAI put online The Pile, a training dataset of 825 gigabytes aggregating twenty-two distinct sources: articles from arXiv, public repositories from GitHub, medical texts from PubMed, YouTube subtitles, patents, posts from specialised forums. At the time, this was the largest open corpus published for training a large language model, and within a few months it became the reference material for a good part of academic research. Three months later, on 21 March 2021, the collective released GPT-Neo, a family of models trained on The Pile and calibrated on the architecture of GPT-3, in sizes ranging from 125 million to 2.7 billion parameters. At that moment, this was the most credible open alternative to OpenAI's models.
Three years later, the picture had flipped. In the wake of a wave of lawsuits brought by publishers and authors against the major AI laboratories, foremost among them Sarah Silverman and several writers suing Meta, it became apparent that The Pile contained problematic components. One subset in particular, named Books3, comprises the full texts of 196,640 books for the most part still under copyright, aggregated from Bibliotik, a clandestine library well known to download enthusiasts. Books3 became evidence in several disputes. In the summer of 2023, after a DMCA notification from the Danish anti-piracy group Rights Alliance, the public mirror of the dataset was taken down. In August 2023, EleutherAI itself stopped communicating publicly around The Pile, and the original version of the dataset disappeared from Hugging Face. What had been open for three years was open no longer.
This episode is generally told as a setback for EleutherAI. It is more instructive to read it as the revelation of a contradiction. In the tradition of free software, the openness of a program is, by construction, durable: one can redistribute indefinitely, fork, archive, bring abandoned code back to life. No one can retroactively "remove" the GPL from a released version. This stability rests on one thing: the source code of a classical program belongs, as a general rule, to its author, who chooses its licence themselves. With training datasets for AI, this is almost never the case. A modern dataset aggregates texts, images, and code drawn from thousands, sometimes millions, of distinct sources, each with its own rules, its own rights holders, its own possibilities of legal action. The aggregate is open so long as none of its constituents speaks up. It ceases to be so as soon as one of them does.
The lesson is unambiguous: an "open" dataset in artificial intelligence is, by construction, fragile. Its durability depends on the inertia or the indifference of the rights holders it has quietly absorbed. This precariousness is the exact inverse of what the open-source label promises in classical software: a common library on which one can build without fear that someone will come along and remove the stones.
There is an answer to this problem, and EleutherAI provided it itself in June 2025, in partnership with the Library of Congress, Hugging Face and several other actors, in the form of Common Pile v0.1. The logic has changed. One no longer takes what one finds in order to remove it if a complaint is made. One takes only what the licence conditions explicitly allow to be used for training. Public domain, compatible Creative Commons licences, open-access scientific articles, code under permissive licences, sources with explicit authorisation. The result is larger than the original, around eight terabytes against the 825 gigabytes of the initial Pile, and it has been used to train two seven-billion-parameter models that hold their own honourably against the first Llamas. But more importantly, it is open in the strong sense: its composition is known, its sources are traceable, its permanence depends on no one's indulgence.
The contrast between these two generations of datasets says, once again, the essential thing. The first applied to data the grammar that worked for code: scrape widely, document, publish, hope it passes. The second admits that data is not code, and that its openness, to be real, must be built at another level of demand: at the level of provenance. The movement is slow. It is also solitary: very few actors in generative AI have committed to it. Most continue to fabricate their corpora in opacity, persuaded that the question is not one of their method but of their scale.
Third degree: the fiction of open data
The dream of a truly open training dataset, as we have seen, runs up against a structural contradiction: one does not control the rights on what one has harvested. The solution seems obvious: harvest only what one has the right to harvest. It seems obvious until one tries to apply it. And it is here that the third illusion appears, the most tenacious: the one that consists in believing that open data would be, if not available in abundance, at least accessible to whoever takes the trouble.
Anastasia Stasenko has a phrase for this illusion. She co-directs Pleias, a small Franco-German research laboratory which has set itself the mission of fabricating models trained on sources whose provenance is entirely documented. When she is asked about her method, she refuses, according to paraphrases of her public interventions, the usual idea of cleaning up a large corpus, recovering the web and eliminating what is problematic. Her logic is exactly the inverse, and rests on a simple opposition: it is a matter not of excluding from an undifferentiated magma, but of including, one by one, sources whose provenance is documented. One builds from the void, source by source, discriminating at the entry rather than at the exit. It is this difference of gesture, more than any other technical element, that separates a dataset open in the strong sense from a dataset open by default of objection.
The result of this discipline has a name: Common Corpus. Published on 15 November 2024 on Hugging Face, in partnership with the AI Alliance initiative and with Mozilla, it is, to date, the largest multilingual corpus released under a permissive licence: 2.27 trillion words, to be set against what the major laboratories estimate is necessary to train a contemporary foundation model. The corpus covers more than thirty languages, with eight representations above ten billion words, and it has the particularity, almost unique in the current landscape, that each document composing it is associated with metadata specifying its original licence. You can audit Common Corpus. You can remove a source from it if you discover a flaw. You can fork it. In a field where such gestures are almost unthinkable, this is a considerable achievement.
What is remarkable in Pleias's approach is less the raw result than the work it took to obtain it. The European public digital libraries, foremost among them the Bibliothèque nationale de France, but also those of the Netherlands, of Italy, of Germany, have spent two decades digitising and OCRing millions of pages fallen into the public domain. This treasure exists, but it is not, by default, accessible to the automatic harvesters of generative AI: it is hosted on specialised platforms, with interfaces designed for humanities researchers, and to retrieve it in practice one must know the libraries, the archivists, and the formats at once. Stasenko and her co-founder, Pierre-Carl Langlais, trained at the Sorbonne in information and communication sciences, have spent a considerable amount of time walking this geography. This is not engineering work in the sense the large laboratories understand it. It is archive work, network work, work of patience.
This discipline leads to a second, and more unexpected, result: one can train compact models which, according to performance figures announced by their authors, hold their own honestly against the large ones. In the autumn of 2025, Pleias released Baguettotron, a 321-million-parameter model, that is to say several hundred times smaller than the reference models of the American laboratories, trained not on trillions of words harvested blindly, but on two hundred billion synthetic words generated from about fifty thousand well-chosen Wikipedia articles. This architecture, which Pleias classes in the category of small reasoning models, attains, according to the benchmarks published by the laboratory itself, performances superior to those of models from Google or Alibaba of comparable size. These results are, at this stage, self-declared and have not, to my knowledge, been the subject of systematic independent replication. They are coherent with the laboratory's research trajectory, but it is on that footing, and not as raw independent fact, that they should be received. Baguettotron furthermore has the particularity of having eighty deep layers, which makes it, according to Pleias's announcements, the deepest model in its size category. Its very name is a joke on its Frenchness and on its strange architecture.
What this model suggests, if one accepts these announcements, is not that small is superior to large. It is that the relationship between the size of the dataset, the quality of its composition and the final performance is less linear than has long been believed. With a discriminated corpus and synthetic data of good craftsmanship, one might reach levels of reasoning comparable to models trained on volumes one hundred times greater. The sine qua non is precisely what no major laboratory consents to give: transparency on the composition of the material.
It remains to understand why this work is so rare. The answer can be put in few words: it is not profitable in the sense the major actors understand profitability. Building Common Corpus takes years and mobilises competences, philology, law, archivistics, that are not found in abundance in Silicon Valley. Pleias is a start-up with a modest valuation that has not, so far, raised funds comparable to those of the major laboratories. Open data in the strong sense is not an object that the market produces spontaneously. It is a common good that demands a patient will, and resists the logics of scale that dominate elsewhere.
Why fuzziness benefits the biggest
If "open source" in artificial intelligence is almost never what it claims to be, one is entitled to ask whom this imprecision serves. At least three mechanisms point toward an answer.
The first is competitive. When DeepSeek released R1 in January 2025 under MIT licence, the effect on the American actors was immediate. Nearly all the West Coast laboratories accelerated their own announcements of "open" models. OpenAI, which had defended an entirely closed model for several years, began to evoke publicly the release of variants with accessible weights. Meta released Llama 4 in the months that followed. More broadly, the success of DeepSeek reinforced the competitive pressure in favour of models with accessible weights, without thereby bringing more transparency about the data. In none of these cases did the opening of weights come with the opening of the training dataset. Competitive pressure forced a marginal concession, the giving of weights, while yielding nothing of what constitutes the real manufacturing advantage, namely the composition of the corpus. The fuzziness around the word open makes it possible to call "opening" what is only a sharing of the finished object, and to present this sharing as an ethical gesture.
The second mechanism is legal and geopolitical. When one downloads the weights of a DeepSeek model and runs it on one's own servers, one does not expose one's data. But when one uses the company's online services, the API or the consumer application, one transmits this data to a company whose head office is in China, and which in that capacity falls under Chinese laws on national security and on data protection. These laws, as several legal analyses noted in 2025, grant the Chinese government a power of access to data held by Chinese companies without direct equivalent in European or American law. It is this difference that led several Western governments to ban DeepSeek on the devices of their public servants in the weeks that followed the launch. The lesson is subtle: a model can be "open" as a downloadable product, and nonetheless constitute, as a service, an instrument of data capture. The distinction between the object and the service is precisely what the term "open source" tends to erase.
The third mechanism is more discreet, and is perhaps the most worrying. Genuine open data exists: Wikipedia, the digitised archives of public libraries, the Common Crawl corpora, the European public databases. They are, by construction, free of charge and permanent. But they are today being plundered at a scale that weakens them. The Wikimedia Foundation published a communiqué in April 2025 detailing the pressure that the harvesters of generative AI exerted on its infrastructure: bandwidth consumption for the downloading of multimedia content from Wikimedia Commons had increased by fifty per cent since the beginning of 2024, the bulk of this progression being the work of automatic retrieval robots. Sixty-five per cent of the most expensive traffic for the foundation's datacentres came from bots, even though bots represent only a third of the pages effectively consulted. The laboratories that exploit these resources almost never contribute to their financial upkeep. They capture their value, consume their bandwidth, and leave in return only a slow degradation of their availability. The result is a textbook case: genuine openness is subsidising, at a loss, the opacity of its competitors.
These three mechanisms converge. They describe a system in which mis-named openness, open weights presented as open source, download presented as liberation, extraction presented as contribution, always plays in favour of the actors who have the most means at their disposal. The word "open" has become a status marker whose beneficiaries are those who can use it without its content being verified.
Stepping out of the three illusions
How, in this landscape, can one separate genuine openness from rhetorical openness? Three criteria, corresponding to the three degrees we have traversed, can help.
The first is that of reproducibility. An openness which does not allow one, in theory, to remake the model from the elements furnished is not an opening in the strong sense. This criterion eliminates from the start everything that exposes only the weights and asks the reader to take on faith the description that the developers give of their training procedure. It does not demand economic reproducibility (building a foundation model remains reserved to those who have the servers to do it), but epistemic reproducibility: that one can, in theory, verify that the declared ingredients are those that were used.
The second is that of durability. An opening that does not commit its author to maintaining it, or that can disappear under pressure from a single rights holder, is not a commons but a precarious concession. This criterion favours datasets whose composition is controlled from the outset, Common Pile, Common Corpus, and the small number of their equivalents, to the detriment of those which rely on indiscriminate harvests. It invites one to ask, before each promise of openness, a simple question: how long can this opening hold up without a court getting involved?
The third is that of the traceability of the chain. An opening only has meaning if, for a given model, one can follow the entire set of artefacts that contributed to its fabrication: the data sources, the training scripts, the filtering choices, the steps of fine-tuning and alignment. Very few models satisfy this criterion today. It is not absurd to believe that this will be the frontier on which the evaluation of AI will be played out in the years to come, the one that separates the models one can, in honesty, qualify as a common good, from those that are merely a commercial product cleverly presented.
These three criteria do not amount to a political programme. They are a grid for reading. They do not say that one must renounce open-weight models (these models have their utility, they allow researchers to work, they allow modest companies to build without paying everything to OpenAI or to Anthropic). They simply say that one must stop calling them by a name that carries promises they do not honour. The phrase open source, in artificial intelligence, is not an empty label. It is a hijacked label. To set it right is to return to the word its function as a test, and to the reader, the possibility of judging on its merits what is presented as open.