{"schemaVersion":"nuwa-current-record-1","version":"2026-10-29.1","publication":"published","work":{"id":"open-weight-risk-management","title":"Open technical problems in open-weight AI model risk management","aliases":[],"authors":[],"primaryFunction":"governance","secondaryFunctions":[],"kind":"technical-report","sourceId":"open-weight-risk-management-publication","attributionSourceId":"open-weight-risk-management-publication","originalUrl":"https://www.aisi.gov.uk/research/open-technical-problems-in-open-weight-ai-model-risk-management","publicationDate":"2025-10-26","updatedOn":"2026-10-25","areas":[],"scopeNote":{"en":"Relevance is assigned to the research question and stated conditions of the work. A topic tag is not a risk rating.","zh":"风险关联依据研究问题及明确条件建立，主题标签不代表风险评级。"},"protocolIds":[],"contributions":[{"organizationId":"aisi","role":"publisher","sourceId":"open-weight-risk-management-publication","locator":"Official publication masthead and article byline"}],"summary":{"en":"Identifies technical research gaps in managing risks from modifiable, redistributable open-weight models.","zh":"梳理可修改、可再分发的开放权重模型在风险管理中的技术研究缺口。"},"note":{"question":null,"method":null,"finding":null,"supports":null,"limits":null,"connections":null},"resources":[],"noteStatus":{"question":"limited","method":"limited","finding":"limited","supports":"limited","limits":"limited","connections":"limited"},"noteAvailability":{"en":"A substantive NUWA research note is not yet available. The repeated draft sections were removed pending review of the original methods, findings and limitations; use the original publication for the research account.","zh":"实质性的 NUWA 研究笔记尚未完成。重复草稿章节已移除，待核查原始方法、发现与限制；研究内容请以原始出版物为准。"},"noteSourceLocator":"No complete section-level method/results/limitations review completed for this note; cached original page and any chart audit retained as discovery evidence.","tags":[]},"reading":{"id":"open-weight-risk-management","title":"Open technical problems in open-weight AI model risk management","en":{"takeaway":"The agenda treats tampering, release strategy and provenance as distinct open technical problems.","question":"Which risk-management tools need different assumptions when users can modify and redistribute weights?","design":"The authors organize a technical research agenda around curation, tamper resistance, tampering evaluations, staged deployment and model forensics, while explicitly excluding broader nontechnical governance.","findings":["Ordinary black-box tests do not cover the range of modifications possible after open-weight release.","Heritage inference faces mixed-lineage, cross-architecture and ecosystem-scale obstacles, so weight availability alone does not ensure provenance transparency."],"interpretation":"NUWA interpretation: openness of weights and openness of methods/evaluations are separate properties, with different implications for assurance.","limits":"This is a research agenda, not evidence that each proposed safeguard works or that one release model has a known net risk advantage.","connections":["NUWA connection: Deep Ignorance instantiates one curation approach; agentic-self-modification makes update authority and artifact lineage concrete operational questions."],"decisionRelevance":"NUWA recommendation: define threat access and modification budgets in evaluation records, and document release-stage reversibility and lineage coverage."},"zh":{"takeaway":"该议程将篡改、发布策略与来源谱系视为不同开放技术问题。","question":"用户可以修改和再分发权重时，哪些风险管理工具需要不同假设？","design":"作者围绕数据整理、抗篡改、篡改评测、分阶段部署及模型取证组织技术议程，明确排除更广的非技术治理。","findings":["普通黑盒测试不能覆盖开放权重发布后的各种修改。","谱系推断面临混合来源、跨架构和生态规模障碍，因此权重可得不等于来源透明。"],"interpretation":"NUWA 解读：权重开放和方法、评测开放是不同属性，对保证有不同影响。","limits":"这是研究议程，不证明各提议防护有效，也未确立某发布模式的净风险优势。","connections":["NUWA 关联：Deep Ignorance 实现一种数据整理方法；智能体自修改将更新权限与产物谱系变成具体操作问题。"],"decisionRelevance":"NUWA 建议：评测记录定义对手访问及修改预算，并披露发布阶段的可逆性和谱系覆盖。"},"sourceRefs":[{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"2 Why is open-weight model risk management challenging?","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"},{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"3.2 What this Paper Does Not Cover","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"},{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"4.1 Training Data Curation","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"},{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"4.3 Model Tampering Evaluations","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"},{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"4.4 Staged Deployment Strategies","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"},{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"4.5 Model Provenance and Forensics","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"},{"sourceId":"open-weight-risk-management-publication","url":"https://arxiv.org/html/2608.07514","locator":"6 Discussion","version":"Selected original resource https://arxiv.org/html/2608.07514; sha256:5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f; archived source capture; exact capture time not independently established","artifactSha256":"5661ec88023099737d450a4d67ea8cb8aaf48dd43ffc34a0b0657b194209ef5f"}],"publication":{"state":"published","publishedOn":"2026-10-29","authorizationReference":"user-authorized-global-index-publication-2026-10-29","reviewedCandidateId":"local-6efe31bc4a0c0f37"},"review":{"state":"published-note","sourceScope":"full-text","availableScope":null,"readingCoverage":"selected substantive sections of the full source body","completePaperAudit":false,"independentEvidenceReview":"pending-human-review","bilingualEditorialReview":"pending-human-review","authorship":"model-assisted-research-note","preparedFingerprint":"98f41b9450eea0f24ed45b632d756a0f28308ccf9ceb4318f92d36189328de0e"}},"sources":[{"id":"open-weight-risk-management-publication","title":"Open technical problems in open-weight AI model risk management","url":"https://www.aisi.gov.uk/research/open-technical-problems-in-open-weight-ai-model-risk-management","version":"Source capture 2026-10-25","publicationDate":"2025-10-26","datePrecision":"day","type":"research-publication","verifiedOn":"2026-10-25","documentId":"https://www.aisi.gov.uk/research/open-technical-problems-in-open-weight-ai-model-risk-management"}]}