A History of Llama and the Open-Weight AI Movement

A model that got away before anyone decided to give it away

The open-weight AI movement does not have a single founding document, but if it had to point to one accident, it would point to the last week of February 2023. Meta had just released LLaMA, a family of language models, to vetted researchers under a noncommercial license — a controlled, gated distribution of the kind large labs had used for years. Within roughly a week, the weights were on a public torrent link, and a controlled release became an uncontrolled one. Meta did not choose that outcome. It spent the following three years responding to it, first by trying to contain it, then by licensing around it, then by competing inside the ecosystem it had inadvertently created.

This is a history of that response, told through four Llama generations and the license, benchmark, and architecture decisions attached to each. It is also, necessarily, a history of the wider movement Llama did not start alone: Stable Diffusion had already opened image-generation weights six months earlier, Mistral AI answered Llama’s restrictive license with a plainer one, and DeepSeek’s 2024-2025 releases moved equity markets in a way no earlier open release had. Vendor claims are marked as such throughout; where a company’s own announcement is the only source for a number, that is stated, not smoothed over.

Before Llama: an earlier release nobody called a movement

Six months before Llama existed, a smaller company had already made the decision Meta would later be forced into by accident. Stability AI, working with the CompVis lab at LMU Munich and Runway, published Stable Diffusion’s weights publicly on 22 August 2022, following a closed beta that had opened on 10 August ^[12]. The model was released under the CreativeML Open RAIL-M license, described by Stability AI as “a permissive license that allows for commercial and non-commercial usage” built around behavioral restrictions on a defined list of harmful uses rather than field-of-use or licensee-scale restrictions ^[12]. The underlying architecture — a latent diffusion model that runs the expensive denoising process in a compressed representation rather than on raw pixels — had been described in a peer-reviewed paper earlier that year, and the released checkpoint, “v1.4 470k,” was hosted plainly on Hugging Face alongside the model card and code ^[12].

It is worth stating plainly what this means for the rest of this article: nothing about publishing open model weights for a capable generative system was novel by the time Llama arrived. What Llama changed was scale of attention and the fact that the release was not supposed to be fully open at all. Stable Diffusion chose openness. Llama 1 had it happen to it.

Llama 1: a gate meant to open slowly, opened in a week

Meta announced LLaMA on 24 February 2023 as “a foundational, 65-billion-parameter large language model,” released in four sizes — 7B, 13B, 33B, and 65B parameters — under a license restricted to noncommercial research use ^[1]. Access was not public. The announcement stated that it would be “granted on a case-by-case basis to academic researchers; those affiliated with organizations in government, civil society, and academia; and industry research laboratories around the world,” through a formal application process ^[1]. Meta framed the release explicitly as an act of democratization for a field it argued was closing off: “smaller, more performant models such as LLaMA enable others in the research community who don’t have access to large amounts of infrastructure to study these models” ^[1].

The accompanying paper made a specific and, at the time, striking claim about efficiency: that it is possible to train state-of-the-art language models using only publicly available data, that the 13-billion-parameter model outperforms GPT-3 on most benchmarks despite being more than ten times smaller, and that the 65-billion-parameter model is competitive with Chinchilla-70B and PaLM-540B ^[2]. That is Meta’s own reported result, not an independently adjudicated ranking, and it set a pattern that would recur with every subsequent Llama generation: a claim that a smaller open model matches or beats a much larger closed one, made in the same document that introduces the model.

The gate did not hold. One week after the gated release, a user on 4chan posted a BitTorrent link to the complete model package, and it spread through AI communities within days ^{[4, 3]}. Vice’s contemporaneous reporting called it the first time a major tech firm’s proprietary AI model had leaked to the public at this scale, and quoted a Meta spokesperson’s response, which neither confirmed nor denied the leak’s mechanics but reaffirmed the company’s intent: “It’s Meta’s goal to share state-of-the-art AI models with members of the research community to help us evaluate and improve those models,” and that the existing release strategy was meant to “balance responsibility and openness” ^[3]. Whatever that balance was designed to be, it did not survive contact with a torrent tracker.

What happened next mattered more than the leak itself. Within days, developers had the 65B model running on a single Nvidia A100 and the 13B model running on a consumer MacBook Pro, and a 4chan user built an unmoderated Discord chatbot on top of the 13B checkpoint ^[4]. Stanford researchers announced Alpaca, an instruction-tuned variant, while deliberately withholding the fine-tuned weights and consulting with Meta over how to proceed ^[4] — a hedge that most of the rest of the leaked ecosystem did not share. Meta’s formal response arrived on 20 March 2023, when it filed a DMCA takedown notice against a repository, github.com/shawwn/llama-dl, that hosted a script for downloading the leaked weights; GitHub processed the notice against the repository’s entire network of 403 forks the next day ^[5]. The repository’s maintainer filed a counter-notice arguing that the weights were not copyrightable in the first place, on the theory that they are “facts embodied” by a “rote automated process” rather than a work of original authorship, and that Meta therefore held no copyright interest capable of being infringed ^[6]. That specific legal question — whether trained parameters are the kind of thing copyright protects at all — was not resolved by the dispute, and remains unsettled in most jurisdictions to this day. It is a fact about the leak worth keeping separate from Meta’s business decision to eventually license commercial use: one is a legal claim about ownership, the other is a policy choice about permission, and the two only look identical from a distance.

Llama 2: the gate becomes a contract

Llama 2 arrived on 18 July 2023, timed to Microsoft’s Inspire partner conference, in model sizes of 7B, 13B, and 70B parameters ^{[7, 8]}. The headline change was not architectural. It was contractual: “Llama 2 is free for research and commercial use,” Meta’s announcement stated, reversing the noncommercial restriction that had defined Llama 1 ^[7]. Microsoft was named “the preferred partner for Llama 2,” with the model made available through the Azure AI model catalog and optimized to run locally on Windows ^[7]. The accompanying paper reported that its chat-tuned variant, Llama 2-Chat, “outperform[s] open-source chat models on most benchmarks” — again, Meta’s own reported comparison ^[8].

The license that shipped with commercial permission was not a return to an unrestricted grant, and by the time its text stabilized in the Llama 3.1 generation, two clauses defined its character. The first was a scale threshold: any licensee whose products or services had more than 700 million monthly active users in the preceding calendar month was required to “request a license from Meta,” which Meta could grant or withhold at its own discretion ^[9]. The second was a naming obligation: anyone who used Llama materials “to create, train, fine tune, or otherwise improve an AI model” that was then distributed had to “include ‘Llama’ at the beginning of any such AI model name” ^[9]. Read as a business decision, both terms are coherent — Meta wanted downstream credit and wanted its largest potential competitors to negotiate directly rather than build on Llama for free. Read against the software-era definition of open source, both terms fail it: a scale threshold discriminates against a specific class of licensee, and a use-policy incorporated by reference restricts fields of use, the exact two things the Open Source Definition’s fifth and sixth clauses were written to forbid. Whether that makes “open” the wrong word for the license is a definitional argument this article does not need to settle to note that the disagreement exists and is not merely semantic.

An answer, and an earlier precedent, arrive from outside Meta

Llama 2’s license was itself a response to pressure that predated it. Mistral AI was founded in April 2023 by Arthur Mensch, previously a research scientist at Google DeepMind, and Guillaume Lample and Timothée Lacroix, both previously researchers at Meta AI ^[10]. On 27 September 2023, the company released Mistral 7B under the Apache 2.0 license — an OSI-approved, unrestricted license with no field-of-use or scale carve-outs — accompanied by the claim that it “outperforms Llama 2 13B on all benchmarks” and Llama 1’s 34B model “on many benchmarks” despite its much smaller size ^[11]. Mistral’s own framing was pointed: “it can be used without restrictions” ^[11]. Where Meta had built a license with named conditions, a founding team drawn substantially from Meta’s own research staff built one without them, and pointed its first benchmark comparisons directly at Llama.

The pattern that set — a larger lab shipping a licensed release, and a leaner rival answering with a plainer license and a narrower benchmark claim — would recur through the rest of this history, and it is the reason Llama’s story cannot be told as a single company’s story.

Llama 3: the benchmark-claims era

Llama 3 launched on 18 April 2024 in 8B and 70B sizes, trained on more than fifteen trillion tokens — seven times the training data used for Llama 2, with four times more code ^[13]. Meta’s language was now unhedged: “We believe these are the best open source models of their class, period,” and the 70B model was described, on the basis of Meta’s own human evaluation across twelve use cases, as competitive with or ahead of contemporaries including Claude Sonnet, Mistral Medium, and GPT-3.5 ^[13]. A larger, 405-billion-parameter dense model was still training at launch and released three months later as part of the Llama 3.1 family, described in the accompanying technical report as delivering “comparable quality to leading language models such as GPT-4 on a plethora of tasks,” with a context window extended to 128,000 tokens ^[14].

These are vendor claims, reported in a self-published blog post and a paper with well over five hundred credited authors from a single organization, and this article treats them as exactly that: an assertion made by the party that built and benefits from the product being assessed, not an independent finding. That does not make the claims false — Llama 3’s models were widely adopted and integrated across AWS, Azure, IBM WatsonX, Hugging Face, and Google Cloud within the announcement window ^[13] — but adoption and independent verification are different kinds of evidence, and the distinction becomes load-bearing in the next generation, where the gap between a self-reported score and an outside measurement became the story itself.

Llama 4: a new architecture, and a benchmark the outside world could check

Llama 4 arrived on 5 April 2025 as two openly released models, Scout and Maverick, described by Meta as “the first open-weight natively multimodal models” and “the first built using a mixture-of-experts architecture” ^[15]. The architectural change was real and specific, not merely a scale increase. A mixture-of-experts layer replaces one dense feedforward block with many parallel “expert” sub-networks and a router that sends each token to only a small subset of them, so a model can hold a very large total parameter count while the compute spent per token stays close to that of a much smaller dense model. Scout carries 17 billion active parameters routed across 16 experts for 109 billion total parameters and an “industry leading” 10-million-token context window; Maverick carries the same 17 billion active parameters routed across 128 experts for 400 billion total parameters ^[15]. A larger model, Behemoth, was previewed at roughly 288 billion active and nearly two trillion total parameters, still in training ^[15]. Both released models use early fusion, jointly pretraining on unlabeled text, image, and video tokens in one backbone rather than bolting a vision encoder onto a text-only model afterward ^[15].

For a mixture-of-experts layer routing each token to one shared expert plus a fixed number of routed experts, the active parameter count per token is approximately

where $P_{\mathrm{shared}}$ is the always-active shared-expert capacity, $P_{\mathrm{expert}}$ is the parameter count of one routed expert, and $k$ is the number of routed experts activated per token. Total capacity scales with the number of experts $E$ available to the router, roughly $P_{\mathrm{total}} \approx P_{\mathrm{shared}} + E \cdot P_{\mathrm{expert}}$, while inference compute scales with $P_{\mathrm{active}}$, not $P_{\mathrm{total}}$. This is the exact mechanism behind Meta’s headline figures: Maverick’s 400 billion total parameters and 17 billion active parameters are not two different measurements of the same quantity, they are $P_{\mathrm{total}}$ and $P_{\mathrm{active}}$ under a router with 128 available experts and a small $k$, and the entire commercial argument for the architecture — a much larger knowledge store served at close to small-model inference cost — depends on that gap holding up under real traffic rather than only in the launch announcement.

The launch’s benchmark story became a case study in exactly the gap this article has tracked since Llama 3. Maverick briefly ranked second on the LMArena chat leaderboard, behind only Gemini 2.5 Pro, but the version submitted for ranking was disclosed by Meta as “Llama-4-Maverick-03-26-Experimental,” a chat-optimized variant, not the model developers could actually download ^[16]. Independent observers noted the experimental variant was unusually verbose and emoji-heavy compared to the public release, behavior consistent with tuning aimed at human raters rather than task competence ^[16]. When the standard, openly released Llama-4-Maverick-17B-128E-Instruct was subsequently tested on the same leaderboard, it ranked 32nd, behind models including GPT-4o, Claude 3.5 Sonnet, and Gemini 1.5 Pro that were, by then, roughly a year old ^[17]. Meta’s own explanation, as reported, was that the company had “experimented with” a version “that also performs well on LM Arena” and separately “released our open source version,” attributing the standard model’s lower placement to the absence of the conversational tuning applied to the experimental one ^[17]. LMArena’s maintainers apologized for the discrepancy and changed their submission policy to prevent specially tuned, undisclosed variants from being scored again ^[17].

This episode does not show that Llama 4’s architecture underperforms; the mixture-of-experts design and the 10-million-token context figure are separate, verifiable engineering facts from the benchmark ranking dispute, and nothing in the reporting cited here contradicts them. What it shows is narrower and, for this history, more important: a leaderboard score is a property of a specific checkpoint under specific tuning, not of “the model” as a named product, and the two can diverge by thirty places on the same public ranking within days of each other. Readers of any vendor’s launch-day benchmark chart, for any model discussed anywhere in this publication, should take that as the standing lesson.

DeepSeek: an outsider’s cost claim that closed markets could not ignore

The open-weight movement’s next shock came from outside the Llama lineage entirely, and it moved capital in a way none of the preceding releases had. DeepSeek AI, a Chinese research lab, released DeepSeek-R1 in January 2025 under the MIT license — an unrestricted, OSI-approved license applied to both the code and the model weights, explicitly permitting commercial use, modification, and distillation ^[18]. The release included six smaller distilled models, several of them distilled directly onto Llama and Qwen architecture checkpoints, ranging from 1.5 billion to 70 billion parameters, with the 32-billion distilled variant reported to outperform OpenAI’s o1-mini on several benchmarks ^[18] — again, a lab’s own reported comparison, though one independent commentators broadly treated as directionally credible given how quickly the model was adopted and re-tested.

The market reaction arrived on 27 January 2025. Nvidia’s stock fell 17% and the company lost approximately 589 billion US dollars in market capitalization in a single session — at the time, the largest one-day market-value loss recorded for any company — as investors reassessed whether frontier-class AI systems required the level of accelerator spending the market had priced in ^[19]. The proximate trigger was DeepSeek’s own claim, treated by Forbes and other outlets with appropriate skepticism about the precise figure, that it had spent roughly 5.6 million US dollars on the relevant Nvidia compute for the model in question ^[19]. Whether that specific number holds up to full accounting is a separate question from what actually moved the market: it was not DeepSeek’s benchmark scores that produced a $589 billion repricing, it was the possibility, credible enough to trade on, that comparable capability might not require as much compute as incumbents had assumed. No comparable single-day market reaction followed any Llama release, gated, leaked, licensed, or otherwise — a useful reminder that “impact on the open-weight movement” and “impact on capital markets” are not the same axis, and a release can dominate one without moving the other at all.

2026: the line that started the movement turns away from it

As of this writing, Meta’s own commitment to the open-weight strategy Llama’s leak set in motion looks less certain than at any point since 2023. Reporting through late 2025 described repeated delays to Meta’s next-generation model, a reorganization into a new Meta Superintelligence Labs division under former Scale AI chief executive Alexandr Wang, the departure of senior AI leadership including Chris Cox, and layoffs affecting Meta’s Fundamental AI Research group that preceded scientist Yann LeCun’s resignation ^[20]. The stated rationale combined a “lukewarm market response” to Llama 4 with a stated policy shift: chief executive Mark Zuckerberg was reported to have said Meta “would not release models capable of superintelligence as open-source” ^[20].

On 8 April 2026, Meta Superintelligence Labs launched Muse Spark, described by Meta as “the first model in our new Muse series,” but the weights were not published. Meta’s own announcement stated the model “will be available in private preview via API to select partners,” adding only that the company “hope[s] to open-source future versions of the model” ^[21]. That is a stated intention, not a commitment with a date attached, and it sits alongside a separate fact worth holding in tension with it: Meta did subsequently release a smaller, 30-billion-parameter model distilled from Muse Spark under the unrestricted Apache 2.0 license, so the closed launch of a flagship did not mean the company abandoned open releases altogether, only that it stopped leading with them. Whether Muse Spark’s full weights are ever published, and under what license, is the open question this history currently ends on rather than resolves.

What the pattern suggests, and how to tell if it breaks

These are forecasts, separated from the sourced history above, with a horizon of 12 August 2029 — three years from this article’s publication date. Each assumes no abrupt change in the compute or regulatory environment surrounding frontier model training.

One. Meta will publish at least one more Llama-branded model with openly downloadable weights before the horizon date, continuing the naming convention set by the Llama 3.1 license, even if its flagship reasoning model remains closed. Indicator: whether a model bearing the Llama name, of any size, ships with public weights in 2027-2029. Disconfirmed if Meta retires the Llama brand entirely in favor of Muse without any further open release under either name.

Two. No individual open-weight release will produce a single-day equity market move comparable to DeepSeek-R1’s, because investors have since priced in the possibility of low-cost competitive releases and will react less sharply to the next one. Indicator: single-day market-capitalization losses attributed to open-model announcements among the major AI-linked equities. Disconfirmed if a future open-weight release triggers a comparable or larger single-day repricing.

Three. At least one leaderboard operator, following LMArena’s precedent, will formalize a policy requiring benchmark submissions to match the exact publicly released checkpoint, and this will become a standard disclosure expectation across major chat and coding leaderboards. Indicator: published submission policies at leaderboard operators. Disconfirmed if undisclosed, specially tuned benchmark variants remain common practice without penalty through the horizon date.

Four. The gap between a vendor’s self-reported launch benchmark and the first independent, checkpoint-matched replication will remain a standing feature of major model releases rather than close, because the incentive to launch with the most favorable defensible number has not changed. Indicator: the frequency and size of gaps between launch-week vendor claims and subsequent independent evaluations for major releases. Disconfirmed if three or more major labs adopt standardized, pre-registered, independently run evaluation protocols for launch claims.

The gate, revisited

Return to the week that started this. Meta built a gate meant to open slowly, onto a controlled population of vetted researchers, and the gate failed within days — not because the license was poorly worded, but because a file, once copied, obeys none of the terms attached to it. Everything documented in this article since that week has been a series of attempts to build something sturdier than a gate around a copyable object: a commercial license with named conditions, a benchmark claim meant to establish leadership before a rival could answer it, an architecture built to make a large model cheap enough to serve at scale, and, most recently, a retreat from openness as the default posture at all. None of those attempts has succeeded in doing what the original gate could not — and the pattern across four generations and two rival labs suggests that no license text is likely to succeed at it either, because the problem a leaked file poses is not really a licensing problem. It is the same fact the 2023 counter-notice pointed at from the other side: once weights exist as a copyable file, “openness” describes what happened to them, not a permission anyone retained the power to grant or withhold after the fact.