The Gradient of Generative AI Release: Methods and Considerations

Irene Solaiman of Hugging Face posted this paper to arXiv (2302.04844) in February 2023. Its argument is that "open or closed" is the wrong question. A release is a set of decisions about which components go out and to whom, and those decisions sit along a gradient. Nathan Lambert lists it on his open-source-ai-reading-list as the case for judging openness by degrees, by license, cost of running, data access and so on. Hugging Face funded the research, and the company has an obvious stake in openness, though the paper is even-handed about the risks.

What gets released

The paper splits a release into three overlapping kinds of component. The model itself means the weights plus the ability to query, adapt or study it. Components for risk analysis include training and fine-tuning data, records of how data was chosen and collected, information about the crowdworkers who did RLHF labeling, and evaluation results. Components for replication include the technical paper, training code, configuration such as batch size, and telemetry such as the loss curve.

The categories overlap on purpose. A model cannot be replicated without its full training data, even though that data is filed under risk analysis, and replication components can themselves be studied for bias. Each can be withheld for a different reason: IP, privacy, consent, competition, or the fear that training code will be repurposed for harm.

What a deployer weighs

Solaiman lists six considerations to settle before choosing a point on the gradient. Concentration of power is the main argument for access. Only a few well-resourced, mostly Western companies can build these systems, they shape the field's direction and narrative, and the people most affected by AI are rarely inside them. Disparate performance and social harm grow when fewer perspectives are involved in building a system. Malicious use and unintentional misuse grow with output quality, and restricting access does not fully prevent them, since a system can be attacked through queries alone. Auditability depends on who can examine a system and with what access, and few tools exist for auditing the huge static datasets these models train on. Accountability for harm is unclear, and more open, widely deployed systems reach more people. And deciding what to filter or gate is a value judgment that shifts with culture and local law.

The central tradeoff falls out of the first and third items. Moving toward openness enables audits and community research and makes risk harder to control.

The gradient

The six levels come from five years (2018-2022) of publicly announced generative systems, each placed by how it was first released. GPT-2, downloadable today, counts as staged because that is how it started.

A fully closed system is known only inside its developer, if it is announced at all. Google's Imagen and DeepMind's Gopher are the examples, and outsiders see only cherry-picked samples. A gradual or staged release opens up over a planned period, with the time between stages used for misuse monitoring and harm research. OpenAI released GPT-2 in four sizes over nine months in 2019. Stability AI began a similar approach with Stable Diffusion, offering hosted access first, and the weights leaked twelve days later.

Hosted access lets users work with a model on the developer's servers through an interface, as with Midjourney through Discord or ChatGPT, and leaves outside researchers little room. Cloud or API access gives more, from query-only access such as the original GPT-3 API to fine-tuning endpoints, while letting the provider track users and rate-limit them. Even an API leaks: EleutherAI's evaluation harness was used to work out GPT-3's parameter counts through OpenAI's API.

Downloadable access releases the weights while holding back components such as the training data. Hardware cost still limits who can run a large model, and safety controls such as content filters become easy to remove. Fully open means every component is released with at least basic documentation. The examples come from organizations founded on openness: EleutherAI's GPT-J, GPT-Neo and the Pile, and BigScience's BLOOM, built in the open by more than 1,000 researchers in over 30 working groups.

Gating cuts across the middle levels. It lets a deployer revoke access to a hosted model, but gating a downloadable model is unreliable, because researchers pass weights and credentials around within their circles. Solaiman still counts it as a real barrier.

Trends through 2022

The timeline figures show that release was mostly open until GPT-2's staged release, after which restricted access became more common, and that the number of systems, and of closed ones, rose sharply after 2021. Language models under about six billion parameters tended to be open, while larger ones from large companies tended to be closed. OpenAI was the most frequent restrict-but-not-close developer; Google and DeepMind were the most frequent fully closed ones. The one large-company exception was Meta's OPT-175B, a downloadable model trained on datasets built by other organizations. Solaiman writes that it was unclear whether open efforts would push closed developers to change.

Later pieces on the reading list answer that question. Meta went much further with Llama, then turned back to closed models by 2026 (open-source-ai-is-the-path-forward, from-open-source-software-to-open-source-strategy), and since about 2024 the leading open models have come from Chinese labs such as deepseek, a shift the 2018-2022 data could not show.

Controls and investments

The second half catalogs safety controls. None of them works alone, the paper stresses, and they work best when shipped with the release rather than added later. Documentation formats (datasheets for datasets, data statements, model cards, system cards) spread across the industry without any enforcement. Technical tools include rate limiting, content filters, detection models, hardcoded responses, watermarking, weight encryption, and fine-tuning or RLHF to change a model's behavior.

Each comes with a caveat. Stable Diffusion's safety filter blocked sexual content but not violence and gore, a normative choice. Filters on sensitive topics can erase whole identity groups, as content moderation on social media already showed. Detection gets harder as outputs improve, and as of 2023 no watermarking scheme had been deployed at scale. Community measures such as bug and bias bounties and platform policies round out the list. Licenses such as the Responsible AI License (RAIL), used by BLOOM and Stable Diffusion, can be enforced in principle but are hard to enforce on downloadable systems.

The paper closes with investments rather than rules. It calls for accessible interfaces and no-code tools so people outside computer science can probe systems; Meta's Galactica demo was pulled within three days once the public found its problems. It also wants public compute to close resource gaps between labs and academia, ethics training for engineers and technical training for social scientists, domain experts brought in while risk is still low, a third-party body to convene discussion, and regulation requiring documentation and audits for high-impact releases.

Reading it in 2026

The framework has aged better than its examples. The six levels still describe how releases are decided, and the split between weights, risk-analysis components and replication components maps onto today's distinction between open-weight models and fully open ones such as olmo. consent-in-crisis-ai-data-commons documents one reason full openness got harder after 2023: training data stopped being freely available.

What the paper did not anticipate is how much commercial strategy, rather than risk assessment, would drive release decisions. That is the subject of the business writing on the same list, from Zuckerberg's letter to Christian Catalini's some-simple-economics-of-open-versus-closed-ai. Its GPT-3 parameter-count example also points toward the 2026 distillation fights (llm-distillation), where API access turned out to leak far more than a model's size.