The Hardest Unsolved Problems in Meta, Llama, and Open-Weight AI

A release is a one-way door

Meta describes each new Llama generation as open. What actually happens on release day is narrower and more concrete: a set of weight files is signed, packaged, and made available for download under a licence, and from that moment the files exist on hardware Meta does not control and cannot inspect. Everything this article is about follows from that second fact rather than the first. A licence can be rewritten. A model card can be revised. A checkpoint, once it has left the building on enough independent machines, cannot be taken back — and that asymmetry is the actual shape of every open problem in this space, not a detail of it.

Four problems recur across Meta’s Llama program and the wider open-weight ecosystem it anchors, and none of them are close to settled. What does “open” actually license, once a company’s own success can revoke the licence? What follows once weights the developer no longer controls turn out to enable a harm the developer did try to prevent? What can anyone outside Meta actually verify about a Llama model, given what the model card does and does not disclose? And how does a proportionate safety review survive contact with a release cadence set by competitors who are not waiting for it? This piece takes each in turn, keeps vendor claims labelled as claims, and separates the parts that are established from the parts that are still argument.

What the licence actually gates

Meta calls Llama “open,” and the claim is contested on specific, checkable grounds rather than as a matter of branding taste. The Llama 4 Community License Agreement, effective from Llama 4’s April 2025 release, grants broad rights to use, reproduce, and build on the released materials — with one explicit exception. If the monthly active users of a licensee’s products or services exceeded 700 million in the preceding calendar month on the release date, the agreement states plainly that the licensee “must request a license from Meta, which Meta may grant to you in its sole discretion, and you are not authorized to exercise any of the rights under this Agreement unless or until Meta otherwise expressly grants you such rights” ^[1]. The clause has appeared with the same 700-million threshold across Llama 2, 3, and 4 ^[1]. Its practical effect is to exempt everyone except a short list of the largest technology companies on earth, while looking, to nearly every actual user, exactly like an unrestricted open licence.

A minimal formal statement of what this means is worth writing out, because it is easy to read past the word “sole discretion” in prose. Call $u$ a licensee’s monthly active users at release, and define licence validity as

where $g \in \{0, 1\}$ is not a fixed rule but a discretionary grant decided by the licensor after the fact. Below the threshold, “open” behaves like a normal permissive licence. Above it, the licence is not denied — it is converted into a negotiation whose outcome the model’s own publisher controls. That second regime has no counterpart in any license the Open Source Initiative recognises, and it is the specific, cited reason OSI has stated Llama’s licence does not meet the Open Source Definition — first for Llama 2 in 2023, and again in a follow-up post in February 2025 concluding that Llama 3.x “is still not Open Source by any stretch of the imagination” ^[3]. That is an institutional standards body’s assertion about a definitional fit, not a claim that the models are unusable or low-quality; Meta, for its part, continues to describe the releases as open. Both things are simultaneously true and the disagreement between them is not a rounding error — it is a real dispute about what the word should mean, and this article takes no side beyond reporting the terms precisely.

A second, quieter restriction sits beside the user-count clause: Section 1.b.i of the same agreement requires that if a licensee uses the Llama materials, or the outputs of the Llama materials, to create, train, fine-tune, or otherwise improve a distributed AI model, that resulting model’s name must begin with “Llama” ^[1]. This is a naming and attribution requirement, not a blanket ban on training other models with Llama’s outputs — a real distinction and one worth stating precisely rather than folding into a vaguer claim about what open-weight licences forbid. The licensing question closest to “does this restrict competitors” is the MAU clause; the licensing question closest to “does this restrict downstream model lineages” is the naming clause; conflating the two overstates what either one actually does.

Licensing scope has a geographic dimension as well, and it shows the same pattern of a formally open release narrowed by a separate constraint. Meta confirmed it would release a multimodal Llama model broadly but withhold it from the European Union, citing regulatory uncertainty under the EU’s General Data Protection Regulation rather than the AI Act specifically, according to contemporaneous reporting; a text-only version remained available in the EU ^[12]. An open-weight release, in other words, is not one release. It is a release plus a set of jurisdiction- and scale-dependent carve-outs decided unilaterally by the publisher, and “is Llama open” is underspecified until the carve-out that applies to a particular user is stated.

Once it crosses the boundary, it is gone

The second problem is not about wording at all. It is that a released checkpoint is a physical fact distributed across many machines the publisher does not operate, and no policy instrument reaches back across that boundary once it has been crossed.

The clearest documented version of this is safety fine-tuning removal. Meta’s Llama 2 paper describes, in real methodological detail, the safety work invested before release: two separate reward models, one trained purely for helpfulness and one purely for safety, combined with iterative red-teaming and rejection sampling across successive RLHF rounds ^[5]. That is genuine, disclosed safety engineering, not a footnote. Separately, and after release, Yang and colleagues showed that safety behavior installed this way can be stripped from an openly released model with about one GPU-hour of fine-tuning on roughly 100 adversarial examples, across eight models from five different organizations, while the model’s ordinary capabilities were preserved ^[6]. Read together, these are not a contradiction. They are the actual shape of the problem: pre-release safety training and post-release safety removal are both real and both work, and nothing in the licence, the model card, or Meta’s own red-teaming prevents the second from following the first once the weights are public.

Anthropic’s public position on open-weight models, stated by its CEO in July 2026, makes the irreversibility explicit rather than treating it as an implied risk: open-weight models carry higher misuse risk than closed ones specifically because “it is very difficult to apply guardrails to them or monitor their usage, and once weights are released they cannot be withdrawn” ^[11]. That statement is worth flagging clearly as a vendor position — Anthropic sells access to closed models and has an interest in that comparison — but it is also consistent with the independent, peer-adjacent evidence above, and with the International AI Safety Report 2026’s conclusion that open-weight releases are irreversible in a way that materially changes the harm-mitigation calculus once a dangerous capability is discovered after the fact ^[9]. Notably, Anthropic does not call for banning open-weight releases; its stated position is that the question of whether they carry excess risk “should emerge from testing, rather than be decided in advance” ^[11] — a call for more evaluation, not for prohibition, and one this article returns to in the section on evaluation timelines below.

None of this is unique to Meta or to Llama specifically — the shadow-alignment result was demonstrated across five organizations’ models, and the irreversibility argument applies to any published weight file regardless of publisher. It is presented here because Llama is, by a wide margin, the most widely downloaded and re-derived open-weight family this problem currently applies to, which makes it the family where the unsolved status of the problem has the largest surface area.

What the weights don’t tell you

The third problem is reproducibility, and it is best made concrete by comparing what two different open-weight programs actually ship, rather than what either says about itself in the abstract.

Llama 4’s own model card describes the pretraining data as “a mix of publicly available, licensed data and information from Meta’s products and services,” specifically naming “publicly shared posts from Instagram and Facebook and people’s interactions with Meta AI” as included sources ^[2]. That sentence is the extent of the public data disclosure. There is no dataset-level manifest, no published mixture ratios, no training code, and no intermediate checkpoints. The Llama 3 paper adds architectural and training detail at the level of a 405-billion-parameter dense transformer with a 128,000-token context window, evaluated against benchmarks and released with a companion Llama Guard 3 safety classifier ^[4] — but the corpus itself, and the exact recipe that turned tokens into this specific checkpoint, is not something an outside researcher can reconstruct or re-run.

Set beside that, the Allen Institute for AI’s OLMo 2 release discloses, alongside full model weights, “training code, training logs, training metrics, and inference code, as well as full training data including code that produces the training data” from its underlying corpus, together with thousands of intermediate checkpoints across the training run ^[7]. OLMo 2’s reported benchmark results land competitively with, though not uniformly above, similarly sized Llama and Mistral models ^[7] — a fact stated here as the paper’s own comparison, not as this article’s independent ranking; benchmark scores from different evaluation harnesses are not directly comparable, and no cross-vendor ranking should be built from them.

The reproducibility gap this creates is not cosmetic. “Open weights” and “reproducible research artifact” are two different properties, and Llama consistently ships the first without the second, while OLMo ships both. A researcher can download Llama’s weights and run the model; a researcher cannot download Llama’s training pipeline and verify that the published behavior follows from the described process, because the described process is not published in enough detail to attempt that. Whether that gap matters depends on what one wants from an open release — running a model and auditing how it was made are different activities, and Llama supports only the first.

A race against your own review

The fourth problem is the one with the least settled methodology behind it, and it concerns timing rather than content: how a safety evaluation adequate to an open-weight release’s actual risk is supposed to survive a release cadence set by competitive pressure rather than by the evaluation’s own completion.

A recent systematic review gives this problem an unusually direct empirical anchor. Paskov and colleagues propose four criteria specific to open-weight risk — evaluating a model without its shipped safety scaffolding in place, testing its robustness to the kind of fine-tuning modification documented above, testing whether narrow additional training can selectively amplify a dangerous capability, and proxying worst-case misuse rather than only typical use — and then apply those four criteria to 37 open-weight model families released between 2025 and April 2026. Their finding: “only one of the 37 families of models reviewed fulfills PE1-4 and most do not fulfill any” ^[8]. That is one research group’s proposed framework, published in June 2026, and other reasonable frameworks would draw the line differently — the number 1-of-37 should be read as evidence that current practice clusters well below whatever a defensible bar is, not as a precise universal score. Meta’s own account of its Llama 4 process describes recurring red-teaming exercises staffed by specialists in cybersecurity, adversarial machine learning, integrity, and multilingual content, with particular focus on CBRNE material, child safety, and cyber-attack enablement ^[2]. That is real, disclosed evaluation work, and it is also — on Paskov and colleagues’ criteria — not the same thing as testing the model with its safety scaffolding removed, which is closer to the state a determined downstream actor will actually reach.

The structural tension underneath this is simple to state and hard to resolve. Let $\tau$ be the interval between an open-weight release and the next comparable release from a rival lab, and let $E$ be the minimum evaluation time a given release’s actual risk profile requires. When $E \le \tau$, a proportionate review fits inside the competitive window without forcing a choice. When $E > \tau$ — which the 1-of-37 finding suggests is common in practice — a lab is left choosing between shipping before the review is complete, delaying past the point a competitor’s release changes the calculus anyway, or shrinking $E$ by narrowing what the review covers. None of Meta’s public materials, the NTIA’s 2024 report, or Anthropic’s stated position resolve which of those three a lab should choose; the NTIA report explicitly recommended monitoring rather than mandated restriction, on the grounds that available evidence did not yet justify restricting the availability of open model weights ^[10], while Anthropic argues for mandatory pre-release testing timed to close before release regardless of competitive pressure ^[11]. That is a genuine, unresolved disagreement between a government body favoring monitoring over restriction and a frontier lab favoring mandated pre-release testing — stated here as a disagreement, not adjudicated.

What supersession does not reach

A last, smaller-seeming problem follows directly from the first three and deserves its own statement rather than being folded into “irreversibility” generally: superseding a model does not withdraw it.

When Meta ships a new Llama generation, or revises a model card, or narrows a licence term, that action changes what Meta itself hosts and what Meta’s own documentation says. It does nothing to the millions of copies already downloaded, mirrored, quantized, and re-hosted before the change — those copies keep running exactly as they did, indefinitely, under whatever licence terms and safety configuration they were downloaded with. There is no mechanism, contractual or technical, that reaches a copy once it has left Meta’s infrastructure, which means every stated correction — a tightened acceptable-use policy, a new Llama Guard version, a walked-back claim — applies only to the newest checkpoint and to nothing that predates it.

This is the same one-way-door fact from this article’s opening, restated at the level of ongoing operation rather than initial release: irreversibility is not a single event at publication, it is a permanent property of every copy made from that point forward, for as long as the hardware running it keeps running.

Where the disagreement actually sits

It is worth being precise about where genuine expert disagreement lies in this space, because it is not where casual debate usually places it.

There is little real disagreement that Meta’s licence fails a strict open-source definition on the MAU clause specifically — OSI’s analysis is a definitional argument about a public, checkable text, not a contested empirical claim. There is little real disagreement that safety fine-tuning can be cheaply removed from an openly released model — that has been demonstrated, not merely argued. The genuine disagreement is about what follows from those two facts: Meta continues shipping under the current licence and disclosure regime and describing it as open; the NTIA’s 2024 position was to monitor rather than restrict; Anthropic argues for mandatory pre-release testing without settling whether that testing can realistically complete before competitive pressure forces a release; and no institution in this space — government, standards body, or lab — has proposed a mechanism that would let a publisher retract a copy already downloaded. That last gap is not a disagreement so much as an admission: everyone writing about this problem is proposing controls on what happens before release, because nothing controls what happens after.

Predictions, and what would falsify them

These are forecasts, kept separate from the sourced findings above. Horizon: 22 August 2028.

One. Model cards for major open-weight releases will begin disclosing evaluation results with shipped safety scaffolding removed, as a standard section, rather than only evaluations of the deployed configuration. Disconfirmed if major labs’ 2028 model cards still report only in-scaffolding results with no removed-safeguard evaluation section.

Two. No major open-weight publisher will introduce a technical mechanism capable of revoking or degrading a previously downloaded checkpoint. Disconfirmed if any major lab ships a released, downloadable open-weight model with a working remote-revocation or call-home degradation mechanism that has been independently verified to function.

Three. The gap between what a model card discloses (architecture, benchmarks) and what it discloses about training data and recipe will not close for Meta’s Llama line specifically, even as smaller fully open efforts like OLMo continue closing it for their own releases. Disconfirmed if a future Llama model card publishes a dataset-level manifest or training recipe sufficient for independent reconstruction.

Four. Proportional-evaluation criteria resembling Paskov and colleagues’ four-part framework will be cited in at least one government or standards-body procurement or disclosure requirement. Disconfirmed if no such framework appears in binding or semi-binding policy language by the horizon date.

What to take away

Meta’s Llama program is not unusually irresponsible among open-weight releases, and it is not uniquely constrained either — both the MAU-threshold licence pattern and the thin data disclosure are now closer to industry norm than to Meta-specific outliers. That is precisely why the four problems above are worth stating plainly rather than as complaints about one company: they are unresolved at the level of the practice, not at the level of one publisher’s choices. A licence can restrict scale without restricting openness in the way most users experience it. A model can be evaluated thoroughly before release and still be stripped of that evaluation’s protections an hour after release. A model card can satisfy every disclosure norm the field currently expects and still not tell an outside researcher what was actually trained on. And a safety review timed to a publisher’s own judgment has no guarantee of surviving a release calendar set by rivals who are not reviewing on the same clock. None of these are solved by better wording. They are solved, if they are solved at all, only by whatever happens after the file has already left the building — which is the one place no current policy instrument reaches.