Open Language Models

• Who should control the world’s most dynamic technology, which could become the most powerful tool humanity has ever built?
• What patterns of development should we control and encourage?
• Are open technology platforms controllable?

An unorganized list of supporters:

1. Capitalism (e/acc, Meta): Investors may want to protect their portfolio companies and big companies want to commoditize their complements.
2. Scientific progress / understanding (me, LeCun, others): Open-source is the foundation of education and scientific progress (which helps long-term innovation and safety)
3. Anti-concentration of power: How can we trust one group to govern this technology safely? How can we maintain existing social structures with powerful AI systems in the hands of few?
4. Freedom (an older open-source value): “Why should anyone get to control the world’s most powerful technologies?”

It’s a regular discussion on if open models are more benchmaxxed.

1. Benchmaxxing slightly: Yes, Chinese labs likely care about public benchmarks slightly more – their culture and economic value is built around the narrative of keeping up
2. Long-tail weaknesses: Yes, the American models often feel a bit more well rounded, have more capabilities (e.g. GLM is not multimodal), and work better in the long-tail of domains.
3. Usable in core domains: Still, the Chinese models are very impressive and at times genuinely go toe-to-toe with the best closed models.

I spent a long time in the last 6 months looking for analyses that show these leading open weight models have clear flaws, but they don’t really exist – at least for the absolute cutting edge (Kimi, GLM, and DeepSeek).

Distillation generally comes from the technical line of work on teacher-student knowledge distillation, a loss function that learns the shape of a distribution rather than just if the next token prediction was correct (Hinton et al., 2015).

Distillation in post-training became to be known as the set of tools for using the outputs of any model to train a downstream model (ie. most synthetic data) (Tunstall et al., 2023).

Distillation today refers to using reasoning traces from the latest models (which is hidden in APIs) to train a competitive model. A better term for this is adversarial distillation or jailbreaking reasoning APIs as it is more about illicit access than the above technical methods.

More on the history of distillation is here in my book.

• Scale: Anthropic has detailed very wide-scale usage of their models by Chinese AI labs, which as captured sensitive Chinese government data getting routed to their services (Anthropic, 2026)
• Sophistication: Many actors in the Chinese AI ecosystem have dedicated teams to circumvent the intended use of the API, extracting reasoning tokens (e.g. methods from the paper on previous slides)
• Private / classified briefings: As with cyber risks (more on this later), there are regular classified briefings on AI matters relevant to national security

• Labs are associating volume as a signal for importance, but the community hasn’t independently shown the impact of distillation on frontier post-training.
• Many, but likely not everyone, in Western AI circles under-estimates China’s ability in building models, as distillation has been raised as a central issue in the discourse

A fun project to analyze all the arXiv papers in the 5 most popular ML categories (cs.AI, cs.CL, cs.CV, cs.LG, stat.ML) and their plain-text mentions of various model families.

I’ve scanned 370K papers so far, now I scrape every new paper on arXiv in these categories.

The stacked bar plots coming up are in perfect – they’re stacked to show more time, but they’re percentage hit rates per model family, so can be above 100% in total.

1. Performance
2. Web adoption (downloads)
3. Research adoption

… and most of the inference/post-training market is them too!

A “ban” of open models would likely come from regulatory uncertainty over the use of certain models, especially those from China. In the case of a regulatory ban, bad actors trying to use the powerful open models will almost certainly still have access. The likelihood of the US instituting a “great firewall” against the import of open weight models effectively is 0.

At the same time, there are many labs making models within ~1 year of the frontier of progress (10+) and the cost is still in the hundreds of millions of dollars, creeping towards billions, so many sovereigns – governments or large companies – can still build and release these models.

Recent events have shown open models to be crucial for cyber defense (HuggingFace, OpenCode incidents), as trusted access programs run by companies cannot easily scale to the entire economy.

Closed models have been used in numerous cyber attacks, and there is no research showing that their safeguards are on track to become steadfast.

As it stands, the balance is more that both open and closed models are increasing risk, but bottlenecks exist and cyber is a complex process to diffuse. Erring on the side of helping the defender is my bet (but go read more experts on cyber).

Thanks for listening!

Slides: https://natolambert.com/slides/2026/harvard/lecture.html

Newsletter: interconnects.ai

Data: dashboard.interconnects.ai/

Contact: @natolambert / nathan@natolambert.com