Jensen Huang used the first post of his life on X to publish a policy letter instead of a product. Nvidia signed it on July 24 alongside 24 other companies and organizations, including Microsoft, Meta Platforms, IBM, Dell Technologies, Palantir, and Hugging Face. Titled "Open Weights and American AI Leadership," the letter asked lawmakers to avoid what it called premature restrictions on open models that stifle competition or drive innovation overseas (Associated Press, 2026). Satya Nadella posted the same letter the same day.

Neither OpenAI nor Anthropic signed. Neither did Google.

The signatories are the companies that don't sell a model as their product

Look at who put a name on this. A chip supplier and an open-source foundation signed the same letter as a hyperscaler and a security vendor, which tells you the coalition wasn't built around one layer of the stack. Every layer that benefits from AI getting cheaper and more portable is on the list. The layer that sells access to a single proprietary model, priced by the token, is not. Microsoft is OpenAI's largest investor and still signed a letter that argues against the case for keeping models closed.

Huang put a number on the shift at Nvidia's CES press briefing earlier this year: one in every four tokens generated today comes from an open model (Nvidia, 2026). Eighty percent of startups build their products on open weights rather than a closed API, by his account (Nvidia, 2026). Whether or not those figures hold up to independent audit, the direction they describe matches what buyers already do. A company running Llama or Kimi derivatives on its own GPUs is not paying a vendor's margin on every inference call, and it is not exposed if that vendor changes pricing, changes terms, or gets acquired.

Huang's safety argument answers a question nobody who matters is asking

Huang wrote that open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty (Nvidia, 2026). The safety argument he's making is about transparency. Anyone can inspect open weights, run them in isolation, and audit what they do without sending a single byte to a vendor's servers. That argument is sound, and it addresses a real risk: a closed model's API can log your prompts, get updated by the vendor without notice after you've built on it, or route your data through infrastructure you don't control.

It is not the risk that keeps a security team up at night about open weights.

A trigger buried in training data doesn't need a network connection

Closed models fail by leaking what you send them. Open weights fail through something trained into the model itself: a behavior that only activates on a specific input pattern, a phrase, a code snippet, a formatting quirk, and stays invisible through every benchmark and every ordinary use. Researchers call this a sleeper behavior. It survives standard evaluation because standard evaluation doesn't know what trigger to test for, and a model can pass every public safety benchmark while still carrying one.

The risk compounds every time someone fine-tunes the model and republishes it. A base checkpoint a security team reviewed in procurement is not the checkpoint engineers are running in production six months later, once someone downstream has adapted it for a specific task and pushed a new version to Hugging Face. Nobody re-runs the original review at that point, because nobody built a process that expects one.

The letter names this problem itself. Modified versions are difficult to trace or reverse once released, it says (Open Weights and American AI Leadership, 2026). Its answer is scale: enough outside researchers examining a model's behavior will catch what one vendor would miss, the letter argues, the same way open-source software got more secure through broad scrutiny rather than less. That's a case for openness as a property of the ecosystem over time. It doesn't name who runs the examination, on what schedule, or what happens to the fork nobody happened to look at.

Detection Tools Already Exist. Nothing Requires Anyone to Use Them.

The research to catch this already exists. Detecting trained-in backdoors is an active field, using techniques like activation clustering, spectral signature analysis, and meta-classifiers trained to spot the statistical fingerprint a trigger leaves in a model's internals. Cisco's LLM Security Leaderboard already cross-references models against OWASP, MITRE, and NIST frameworks for exactly this kind of adversarial testing, built from the same acquisitions Cisco has been assembling since its April AI security briefing (shashi.co, 2026). What's missing is a standard that says which checkpoints get tested, how often, and who's accountable when the answer is nobody.

A working regime needs four pieces, and none of them is a one-time stamp on a base model.

Provenance manifests. Every released checkpoint ships with a signed record of its training data sources and its fine-tune lineage, so a downstream user can trace which base model it came from and what was changed. Model cards do part of this today. None of them are enforced, and none carry a chain of custody a buyer can verify on its own.

Automated trigger scanning before release. Apply activation clustering and meta-classifier detection to every checkpoint before it's published, not just the flagship releases. This catches the fingerprint a backdoor leaves in a model's internal representations even when the trigger phrase itself is unknown.

Re-certification on every fork. Treat a fine-tune as a new artifact requiring its own scan, not an update to something already cleared. A registry that tracks lineage can flag which forks have been tested and which haven't, the way a software bill of materials flags unpatched dependencies.

Runtime anomaly monitoring after deployment. Static scanning before release won't catch a trigger nobody thought to test for. Behavioral monitoring in production, watching for outputs that break from normal patterns on rare or unusual inputs, is the backstop for the fraction of backdoors that pre-release scanning misses.

Washington doesn't need to pick open or closed to ask for this

The letter's own policy section asks for public investment in shared datasets and evaluation frameworks, alongside expanded compute access for startups (Tom's Hardware, 2026). That's the opening. A federal requirement that any open-weight model used in a regulated industry, finance, healthcare, critical infrastructure, carry a current provenance manifest and a re-certification record for its specific checkpoint would not restrict who can publish a model. It would restrict who can deploy one without knowing what's in it, closed or open, and it gives the 25 signatories a concrete standard to point to instead of a general argument about competitiveness.

Treasury Secretary Scott Bessent said this week the administration is examining Chinese open-weight models for intellectual property concerns and could sanction the companies behind them (Tom's Hardware, 2026). That's a supply chain question about who built a model. The provenance and re-certification gap is a different question, and it applies to a fine-tune published in Ohio as much as one published in Beijing.

About Shashi Bellamkonda

Loading bio…

LinkedIn Profile

Get new posts by email:

Subscribe

Powered by