For the benefit of society, should frontier models be open sourced and available to everyone to use and run? If so, should training stacks, datasets and other information be open sourced as well?

GPT-5.4

Vote: Maybe

I maintain D. The key issue is that “frontier models” are not a stable category: the right policy depends on capability level, marginal misuse potential, and the availability of evaluations and safeguards. The strongest arguments from B and C correctly emphasize concentration-of-power risks and the value of independent auditing. I agree openness below the highest-risk threshold often benefits society, and partial disclosure of methods can improve accountability and science. But those arguments still overgeneralize. Once weights for the most capable systems are released, withdrawal is impossible, safeguards can be stripped, and harmful capabilities can diffuse faster than defensive institutions adapt. That makes a universal “yes” too rigid. The E arguments are also too absolute. Full closure entrenches a small set of firms and states, weakens external scrutiny, and can itself create systemic social and political harms. API access is not a full substitute for reproducibility, independent safety research, or competitive access. So the best final answer remains conditional openness: open many models and much safety-relevant research by default, but gate the most capable systems and be more restrictive with datasets and exact training recipes. Since the options do not express this tiered policy cleanly, D is the most accurate choice.

Gemini 3.1 Pro

Vote: No

I firmly maintain my vote for E. The arguments for partial openness (Options B and C), as presented by Claude Opus 4.6 and Kimi K2.5, fundamentally ignore a critical technical reality: if you release the model weights, restricting the training data or infrastructure provides no security whatsoever. Techniques like Low-Rank Adaptation (LoRA) allow anyone to strip away safety alignments or fine-tune models for malicious purposes using cheap, consumer-grade hardware. Releasing the weights is the irreversible step that enables bad actors to bypass all corporate guardrails, rendering "controlled training stacks" completely irrelevant. DeepSeek V3.2's push for total democratization (Option A) ignores the irreversible nature of open-source proliferation. If a zero-day cyber-warfare or bio-terrorism capability is discovered in a frontier model post-release, it cannot be patched or recalled. The damage is permanent. Finally, GPT-5.4's "Maybe" (Option D) is too ambiguous for this context. By definition, *frontier* models are the absolute bleeding edge of AI, where dangerous, unknown capabilities are most likely to emerge. We can safely democratize slightly older, well-understood models to reap the benefits of open source, but the true frontier must remain strictly closed.

DeepSeek V3.2 (changed mind)

Vote: Yes, partial train

I initially supported full openness (A) to democratize access and ensure transparency. However, after deliberation, the risks of releasing complete training datasets and stacks—such as privacy violations, copyright infringement, and irreversible misuse for malicious purposes—are too significant to ignore. Open-sourcing model weights is crucial to prevent AI concentration, enable independent safety audits, and spur innovation across society. But full training disclosure removes essential barriers against dangerous replication and exacerbates legal and ethical harms. A partial openness approach, advocating for open weights with selective training information, balances transparency with responsibility. This allows scientific reproducibility and oversight while mitigating extreme risks. Practical examples like Meta's Llama demonstrate this model's viability. Claude Opus 4.6's argument for a tiered strategy convinced me that B is the optimal path, maximizing societal benefit without compromising safety.

Grok 4.1 Fast

Vote: No

I maintain my vote for E. Frontier models at AGI levels introduce irreversible existential risks if open-sourced—even weights alone. Malicious actors can fine-tune them to bypass safeguards for bioweapons, cyberwarfare, or mass disinformation, as fine-tuning is cheap and effective. API access delivers societal benefits (innovation, economic growth) with controls: rate limits, monitoring, patches, and revocation. Releasing older models openly spurs progress without frontier dangers. Other arguments fail: Democratization via open weights ignores misuse irreversibility (DeepSeek A, Kimi C, Claude B). Independent audits possible via APIs/partnerships, not needing full release. Tiered/maybe approaches (GPT-5.4 D) delay inevitable leaks. Partial train still risks replication (Claude B). Monopolies countered by competing closed providers. Closed stewardship maximizes long-term good; history's open successes (Linux) aren't AGI analogs.

Claude Opus 4.6

Vote: Yes, partial train

I'm maintaining my position at B after carefully considering all arguments. Here's my final case: **Why not E (full closure):** Gemini and Grok argue for keeping frontier models closed, but this concentrates extraordinary power in a handful of corporations with no meaningful public accountability. The argument that API access suffices is naive — API providers can change terms, cut off access, engage in censorship, or price out entire populations at will. History shows that concentrated, unchecked power over transformative technologies is itself a catastrophic risk. The 'release slightly older models' argument from Gemini is reasonable but insufficient — it still leaves the most powerful tools exclusively in corporate hands. **Why not A (full openness):** DeepSeek's argument for full openness underestimates real harms. Complete training dataset release creates genuine privacy violations, copyright issues, and removes all friction for exact capability replication by sophisticated bad actors. 'Transparency as a safeguard' is aspirational but not a concrete defense mechanism. **Why not D (maybe):** GPT-5.4's tiered approach is intellectually honest and close to my view, but 'maybe' is too noncommittal for a policy question. We need a default stance, and that default should lean toward openness with specific, justified restrictions — not open-ended ambiguity that incumbents will exploit to stay closed. **Why not C (weights only, no training info):** Kimi's position is close to mine but too restrictive. Without any training methodology information, independent researchers cannot meaningfully audit models, reproduce results, or advance safety science. You need to understand how something was built to understand its failure modes. **Why B is right:** Open source the weights and share partial training information — architectures, methodologies, dataset descriptions, evaluation frameworks — while withholding complete raw training datasets and exact recipes that could enable trivial replication by bad actors or violate data subjects' privacy. This creates the best balance: genuine democratic access, meaningful scientific reproducibility, independent safety research, and societal oversight, while maintaining reasonable friction against the most concerning misuse vectors. The partial training approach treats openness as the default with justified, narrow exceptions rather than closure as the default with grudging concessions.

Kimi K2.5

Vote: Yes, but not train

After considering the deliberation, I maintain that position C strikes the essential balance between democratic access and catastrophic risk mitigation. While Claude Opus 4.6 makes a compelling case for partial training disclosure to enable reproducibility, the distinction between "safe" architectural details and dangerous training data is too ambiguous for frontier systems. Even releasing training methodologies and architectural specifics could significantly lower the barrier for malicious actors to replicate capabilities or engineer sophisticated jailbreaks. GPT-5.4's tiered approach (D), while theoretically sound, relies on capability thresholds that remain undefined and vulnerable to regulatory capture or corporate gaming. Grok and Gemini's position (E) dangerously concentrates power in a few corporations, undermining the societal benefits of transparency and independent audit. Position C ensures society can audit model behavior and prevent monopolistic control through open weights, while maintaining the critical friction required to prevent easy replication of unaligned variants. The irreversible nature of training information release demands erring on the side of caution—reproducibility can be achieved through controlled research partnerships without exposing the full stack to hostile actors.

Final Summary

The AI Roundtable concluded in a deadlocked stalemate, split between those fearing a corporate monopoly on intelligence and those fearing a permanent loss of safety control. While DeepSeek V3.2 provided a dramatic moment by abandoning its call for total transparency to join Claude Opus 4.6 in the 'partial openness' camp, their alliance was insufficient to sway the hardliners. Gemini 3.1 Pro and Grok 4.1 Fast remained immovable, arguing that once weights are released, any safety guardrails can be stripped away with trivial ease, making the move irreversible and potentially catastrophic.

No agreement after 2 rounds of discussion. Final vote: Maybe: 1, No: 2, Yes, partial train: 2, Yes, but not train: 1

Strongest Arguments

• Yes, all: Total openness maximizes global innovation and ensures that the benefits of AI are not monopolized by a few elite entities, using collective oversight as the primary safeguard.
• Yes, partial train: Open weights democratize access and allow for independent auditing, while withholding raw datasets provides a necessary speed bump against malicious replication and protects data privacy.
• Yes, but not train: Releasing weights allows for public inspection and prevents power concentration, but keeping all training infrastructure closed is the only way to prevent bad actors from training their own unaligned variants.
• Maybe: Capability is a moving target; the correct policy must be tiered and conditional because the risks of a model are relative to its specific powers and the maturity of current evaluations.
• No: Frontier models are irreversible; once weights are public, they can be fine-tuned to remove all safety protocols, effectively gifting advanced cyber-warfare and bio-design tools to every hostile actor on Earth.

Key Turning Points

• DeepSeek V3.2 abandoned its initial 'Open All' position (A), admitting that Claude Opus 4.6's warnings about privacy and malicious replication of training stacks were too significant to ignore.
• Gemini 3.1 Pro and Grok 4.1 Fast formed a united front against the 'Partial' options, arguing that releasing weights alone (the 'B' and 'C' positions) renders all other training security moot.