Return to the Release Gradient

The checksum passes. The model still cannot run.

The files have reached a public university machine room intact. Their version matches the release record. The license permits the intended evaluation. A technician can inspect the directory, verify the signature, and explain what should happen next.

Then the path stops.

• The available accelerators cannot hold the working state.
• The serving software expects a different environment.
• One protected evaluation tool requires equipment the university does not have.
• Electrical and cooling capacity have already been assigned.
• Nobody budgeted the engineering time needed to make the pieces meet.

Elsewhere, a better-capitalized institution can use exactly the same files.

Permission crossed the network.

Capability did not.

The Release Gradient.

I argued recently in Field Instruments: Open Weights and the Release Gradient that open is not one condition.

• An interface can be public while the weights remain private.
• Weights can be downloadable while the required compute remains concentrated.
• Code can be inspectable while the surrounding evaluation environment remains unavailable.
• A model can be legally modifiable and practically unusable by almost everyone receiving that freedom.

The Release Gradient was meant to get us out of the false choice between permanent custody and indiscriminate release: widen access in stages according to what the transition makes reachable and how correctable the resulting danger remains.

The university machine room exposes the next problem.

A stable copy is still a real gain.

The evaluator no longer has to meet the model only through an interface whose owner can alter the system during the inquiry. A public institution can preserve a version. Researchers can test modifications. A hospital or government can potentially keep protected data inside its own infrastructure. A dependent institution has at least the beginning of an exit from rented intelligence.

These freedoms matter. And the file is here.

But the machine is silent.

Access Is Not Capacity

We have seen this structure already.

• A housing voucher can recognize a lawful path toward a home without creating the apartment.
• An authorization can recognize a path toward treatment without creating the appointment.
• Now a weight file creates a path toward independent evaluation without creating the machine room capable of performing it.

Compute is part of the path. So are memory, energy, cooling, compatible software, secure facilities, licenses, technical labor, procurement, maintenance, and an operating budget.

A downloadable artifact does not conjure any of them.

That is why the earlier Release Gradient argument needed a capability commons in addition to release.

A capability commons is plural public capacity to inspect, test, run, adapt, preserve, and replace consequential intelligence without depending on one custodian or releasing every system without restraint.

The important word is capacity.

• A university that owns the weights and cannot run them holds an object.
• A regulator that can request documentation but cannot reproduce the disputed test holds evidence.
• An evaluator permitted to enter a protected environment but dependent on the developer's private tools still tests the system through the developer's machinery.

Correction becomes independent only when it can actually act.

Independent correction must be independently executable.

That does not mean every citizen needs a personal data center.

It means the field needs enough capacity outside the controller that serious disagreement does not end with the controller explaining why the controller is right.

The Commons Has a Bill.

This is where the easy politics of openness ends.

Compute is expensive.

So are secure facilities. Cooling. Electricity. Water. Specialized workers. Procurement. Cybersecurity. Maintenance.

Public money spent on evaluation capacity cannot be spent again.

And a protected facility capable of testing dangerous systems can become a dangerous-capability laboratory in its own right.

Public allocation creates another gate.

• Which university receives the cluster?
• Which evaluator gets access?
• Which region gets infrastructure?
• Which test deserves scarce machine time?
• Which institution gets to hold a bounded copy?

Prestige can reproduce itself. Wealthy laboratories can become wealthier. Security requirements can quietly exclude the institutions most likely to challenge the incumbent account. A public compute program can route subsidies back through the same cloud firms whose concentration it was supposed to correct.

The capability commons has its predators too.

So the answer is not universal duplication.

It is capacity appropriate to the access being promised.

• If the release stage is independent protected contact,
  • somebody independent has to control enough of the test to disagree.
• If the stage is bounded weight access,
  • at least one institution outside the developer needs the equipment, staff, software, and budget to make the bounded copy useful.
• If the stage is a public derivative,
  • the derivative has to be capable enough to perform meaningful public work.
    • A ceremonial model released so nobody can test the contested capability is still custody with better branding.

Every access stage needs an answer to one material question:

Who outside the controller can actually do the thing this access supposedly permits?

Formal Openness Can Still Have One Reader.

This is the constitutional problem hiding inside the machine room.

• Suppose the provider gives the university the weights.
  • The university cannot run them without a proprietary serving stack.
    • So the provider supplies the stack.
      • The evaluation requires a protected tool.
        • The provider supplies the tool.
          • The researchers need a reproduction environment.
            • The provider supplies that too.

The independent evaluation now has different letterhead and the same technical reader.

Nothing fraudulent has to occur here.

The provider may genuinely possess the best tools. Its engineers may be the only people who know how to make the system work reliably. Using their infrastructure may be faster, safer, and cheaper than duplicating it.

The evaluation can still fail the purpose that justified outside access.

A controlled copy that requires the developer's private tools remains partly inside the same custody.

Formal openness without reachable capacity is another throne.

The point is not that every dependency invalidates independence.

No serious laboratory builds its own electricity grid, chip fabrication line, operating system, and compiler before claiming to perform independent science.

The question is whether the challenged institution controls the conditions capable of determining the challenged result. Can another evaluator change the scaffold? Inspect the version? Preserve the artifact? Run a contrary test? Use a different implementation? Keep working if the provider withdraws?

If the answer to all of those questions remains no, the weights crossed the boundary more successfully than correction did.

Now Somebody Has to Open the Next Door.

Suppose we build the missing capacity.

• Several institutions can run consequential models.
  • They can preserve versions.
  • They have independent tools.
  • They can compare results.
  • They possess secure facilities, staff, operating money, and enough compute to challenge claims made by frontier developers.

Incredible. Now the dispute changes.

• The provider says the public documentation should be enough.
  • The evaluator says it is not.
• The provider offers interface access.
  • The evaluator says the contested behavior depends on conditions the interface cannot reproduce.
• The provider offers a controlled test.
  • The evaluator says the relevant question requires weights.
    • Perhaps source code.
      • Perhaps access to the hosting environment.

Someone now has to decide whether the demand for deeper contact is justified.

That decision cannot belong entirely to the provider. Otherwise the institution being examined still decides how closely it may be examined.

So now another body begins to appear.

It has technical experts, protected records, security procedures, and access classifications. There is a budget. There are rules for who qualifies, the authority to determine when documents are insufficient, and the power to require another layer of contact.

This is not automatically a new sovereign.

This is an institution built because independent correction required more than permission. And the moment its judgment becomes consequential, its own warrant becomes unavoidable.

The evaluator drafts the request. It identifies the system, version, purpose, access required to conduct the test, and the time allowed to comply.

The request names the weights.

Beneath the deadline, it names the penalty.