# Our position on open-weights models
- Transcript ID: `80d8760fd0f40ab2`
- Source tier: `official_authored_text`
- Original language: `en_or_source_language_unlabeled`
- Translation status: `agent_translated_reviewed` (18/18 chunks)
- Original source: https://www.anthropic.com/news/position-open-weights-models
- Raw evidence: `data/transcripts/web/anthropic-dario-open-weights-2026-07-27.json`
> 中文是派生翻译，英文是留存的源文本。中文未复核时，以英文和原始音视频为准。
## paragraph 1
**中文**
Anthropic 首席执行官 Dario Amodei 撰文
**English / Original**
A post by Dario Amodei, Anthropic CEO
## paragraph 2
**中文**
过去几天，围绕开放权重模型——尤其是来自中国的开放权重模型——出现了大量讨论。据报道，一些美国官员正在考虑禁止美国公司使用中国的开放权重模型。作为回应，许多科技公司签署了一封支持开放权重模型的公开信；还有人指责 Anthropic 为了保护自身业务，企图推动禁止开放权重模型。读过我过去文章的人应该知道，我并不认为这类禁令是有效措施。不过，为免留下任何疑问，我在此明确说明：Anthropic 从未主张禁止开放权重模型。
**English / Original**
Over the last few days there has been a lot of discussion about open-weights models, especially those from China. Reports suggest that some US officials are considering banning the use of Chinese open-weights models by US companies. In response, many tech companies have signed a letter supporting open-weights models, and some people have even accused Anthropic of wanting to ban open-weights models as a means of protecting our business. Anyone who has read my past writing should know that I don’t regard such bans as a useful measure, but let me state it clearly so that there is no doubt: Anthropic has never advocated for a ban on open-weights models.
## paragraph 3
**中文**
不具备危险能力的开放权重模型是一种公共产品：除运行模型所需的算力外，使用它们无需支付其他成本，而且它们能够为企业、开发者和研究人员创造价值。
**English / Original**
Open-weights models that don’t have dangerous capabilities are a public good: they don’t cost anything besides the compute needed to run them, and they provide value to businesses, developers, and researchers.
## paragraph 4
**中文**
保护主义式的禁令无法解决我最严重的国家安全忧虑。具体而言，我担心两种噩梦般的情景。六个月前，我在《技术的青春期》一文中阐述了这两种情景；多年来，我一直坚持这些立场：
**English / Original**
Protectionist bans would not address my most serious national security concerns. Specifically, I am worried about two nightmare scenarios. I laid these out in my essay The Adolescence of Technology six months ago1, and have held these positions consistently for many years:
## paragraph 5
**中文**
我最主要的担忧是：威权政府——并非只有中国共产党，但中国共产党显然是其中能力最强的威胁——可能构建出比美国模型更强大的 AI 模型，并利用它们取得永久性的军事优势，或者对本国人民实施极其严酷的压制。美国政府内部广泛存在这一忧虑：副总统 Vance 去年在巴黎警告说，‘威权政权已经窃取并利用 AI 来增强其军事、情报和监控能力’；美国情报界《2026 年度威胁评估》则认为，‘其他全球大国在 AI 领域的强劲进展，正在挑战美国的经济竞争力和国家安全优势。’这些模型是否以开放权重方式发布，乃至是否被美国企业使用，都与这一风险无关。事实上，最危险的模型可能是在秘密状态下训练，只交给中国人民解放军用于无人机，并交给国家安全部门用于监控和压制的模型。
**English / Original**
My primary concern is the risk that authoritarian governments—not solely the Chinese Communist Party (CCP), although the CCP is clearly the most capable threat—build AI models that are more powerful than those built by the US, and use them to achieve permanent military superiority or perpetrate incredibly deep repression of their own people. This concern is widely shared within the US government: Vice President Vance warned in Paris last year that “authoritarian regimes have stolen and used AI to strengthen their military, intelligence, and surveillance capabilities,” and the Intelligence Community’s 2026 Annual Threat Assessment found that “other global powers’ robust progress in AI is challenging US economic competitiveness and national security advantages.” It is irrelevant whether these models are released with open weights, and certainly irrelevant whether they are used by US businesses. In fact, the most dangerous model may be one that is trained in secret and handed only to the People’s Liberation Army for use in drones and the Ministry of State Security for surveillance and repression.
## paragraph 6
**中文**
我的第二项担忧是，强大的 AI 模型可能被滥用于发动网络攻击或生物攻击，也可能存在严重的对齐问题。无论来自中国还是其他地方，开放权重模型的潜在风险确实高于闭源模型，因为很难对其施加安全护栏或监控其用途，而且权重一经发布便无法收回。但是，禁止美国企业使用这些模型无助于缓解这一风险，因为恶意行为者本来就不太可能是守法经营的美国企业。这种禁令会保护美国 AI 公司免受竞争，但这从来不是我的目标。
**English / Original**
My secondary concern is the risk that powerful AI models may be misused to carry out cyberattacks or biological attacks, and may have serious alignment problems. Open-weights models—it does not matter whether they come from China or anywhere else—do potentially present a higher risk than closed models, because it is very difficult to apply guardrails to them or monitor their usage, and once weights are released they cannot be withdrawn2. But banning the use of these models by US businesses does nothing to address this risk, because bad actors are unlikely to be legitimate US businesses. It would protect US AI companies from competition, but that has never been my goal.
## paragraph 7
**中文**
为了应对上述忧虑，我确实支持以下三项措施；我本人和 Anthropic 一直都在倡导这些措施：
**English / Original**
To address these concerns, I do support the following three measures, which I and Anthropic have consistently advocated for:
## paragraph 8
**中文**
我们不应向中国出售高性能芯片或芯片制造设备；同时，应严厉打击猖獗的走私活动以及为获得此类芯片而采用的规避手段。中国国内的芯片生产能力有限，因此受 Scaling Laws（规模扩展规律）制约，如果没有美国芯片，就无法构建出比美国更强大的模型。这是阻止第一类威胁最高效、最直接的方式；与此同时，通过阻碍那些处于美国法律管辖范围之外的模型训练，也能间接缓解第二类威胁。
**English / Original**
We should not sell powerful chips or chipmaking equipment to China, and we should crack down on the rampant smuggling3 and workarounds used to obtain access to such chips. China has limited domestic production capacity, and therefore, due to the scaling laws, cannot build more powerful models than the US without US chips. This is the most efficient and direct way to block threat #1, and by hampering the training of models that are out of reach of US law, it also indirectly helps with threat #2.
## paragraph 9
**中文**
我们应当打击工业规模的模型蒸馏活动。与从零开始训练模型相比，蒸馏对算力的利用效率高得多。它能让中国用既有芯片构建出远超正常情况下所能达到水平的模型，从而在一定程度上绕过芯片禁令。蒸馏并不能让中国共产党获得与美国相当或超过美国的 AI 能力，但可以把中国的前沿水平拉近到仅落后美国数月。确实，实施这些活动的许多公司会发布开放权重模型；然而，与这些行动得到一个试图在 AI 前沿超越美国的威权国家支持这一事实相比，模型是否开放权重远没有那么重要。我们应通过政策干预来遏制这种行为。全面禁止开放权重模型既不是正确的补救办法，也从来不是我们所主张的措施。
**English / Original**
We should crack down on industrial-scale distillation operations. Distillation is a much more compute-efficient process than training models from scratch. It allows China to build much better models than its number of chips would ordinarily enable, and thus partially evade chip bans. Distillation does not allow the CCP to obtain equivalent or superior AI capabilities to the US, but it can bring the Chinese frontier to within a few months of the US frontier. It is true that many of the companies carrying out these operations release open-weights models—but the open weights are far less relevant than the fact that the operations are backed by an authoritarian state seeking to overtake the US at the frontier. We should have policy interventions to deter this behavior. A blanket ban on open-weights models is neither the correct remedy nor something we have called for4.
## paragraph 10
**中文**
所有能力足够强的模型，无论开放还是封闭，都应接受强制性安全测试。应对第二类威胁的最佳方式，就是在模型发布前直接测试其网络、生物和对齐风险。我认为，这一主张实际上已经接近共识：近几个月 Trump 政府开始朝这个方向行动，令我感到鼓舞；近期也有行业提案主张，对能力最强的模型实施这类测试，而不区分其原产国，也不区分开放还是封闭，同时完全豁免能力较弱的模型，例如初创企业和学术界的模型。开放模型是否会增加风险，以及这种风险能否缓解，应当由测试得出结论，而不是预先决定。改善开放权重模型安全性也可能存在有前景的方法，包括 AE Studio 与 Anthropic 最近关于模块化训练策略的联合研究。需要注意的是，要让测试真正有效，它必须在全球范围内实施，这意味着连中国共产党也需要参与。我认为这实际上有可能实现：正如我在《技术的青春期》中所写，围绕防止 AI 生物武器开展有限合作或许是可行的，因为这同样符合中国的利益。
**English / Original**
All sufficiently capable models, open and closed, should go through mandatory safety testing. The best way to address threat #2 is to just directly test models for cyber, biological, and alignment risks before release. I think this idea is actually close to a consensus: I have been heartened both that the Trump administration has moved in this direction in recent months, and by recent industry proposals that would apply such testing to the most capable models regardless of their country of origin or whether they are open or closed (while exempting less capable models, such as those from startups and academia, entirely). Whether open models do or don’t pose an increased risk, and whether that risk can be mitigated, is something that should emerge from testing, rather than be decided in advance—and there may be promising methods for improving the safety of open-weights models, including recent research from AE Studio and Anthropic on modular training strategies. Note that to be effective, testing would need to be global, which means even the CCP would need to be on board. I think this may actually be possible: as I wrote in The Adolescence of Technology, limited cooperation around preventing AI biological weapons may be possible because it is in China’s interest too.
## paragraph 11
**中文**
这就说到了那封公开信。我赞同其中许多观点：开放权重扩大了参与 AI 经济的机会，至少在部分应用中增强了竞争，也赋予客户更大的控制权。对模型蒸馏的忧虑，应通过有针对性的法律和商业框架来处理，也就是我上面介绍的措施。但我不同意公开信的两项断言：开放权重模型未必会让安全防护措施更容易开发；让更多人获得模型能力，也未必会让防守方比攻击方获益更多。在我看来，相反情况至少同样可能发生。例如，我担心生物领域存在明显的攻防不对称：能力足够强的模型可能利用广泛可得的材料，迅速把能够引发大流行的病毒武器化；而即使在最理想的情况下，对此类病原体建立防御也是一项历时多年的实际工程——‘曲速行动’已经说明了这一点。此类问题应通过严格的发布前测试，以实证方式回答，而不能预先假定答案。
**English / Original**
This brings me to the open letter. I agree with much of it: open weights expand access to the AI economy, they strengthen competition at least for some use cases, and they give customers greater control. Concerns about distillation should be addressed through targeted legal and commercial frameworks—the same measure I described above. But I don’t agree with the letter’s assertions that open-weights models necessarily make it easier to develop safeguards or that broad access to capabilities necessarily helps defenders more than attackers. It seems at least as likely to me that the opposite will be true. For example, I worry that biology will have a strong attacker-defender asymmetry, where sufficiently capable models may be able to quickly weaponize pandemic-level viruses with widely available materials, whereas defense against these agents is a multi-year operational task in the best case (as we saw with Operation Warp Speed)5. Questions like this should be empirically answered by rigorous pre-release testing, not assumed in advance.
## paragraph 12
**中文**
概括我本人和 Anthropic 的立场：我们过去没有、现在也没有主张把开放权重模型作为一个类别全面禁止。相反，我们应聚焦于阻止高性能芯片落入威权政权之手、制止工业规模的模型蒸馏，并要求所有能力足够强的模型——无论开放还是封闭——接受安全测试。
**English / Original**
To summarize my and Anthropic’s position, we have not and are not advocating for a ban on open-weights models as a category. We should instead focus on keeping powerful chips out of authoritarian hands, stopping industrial-scale distillation, and requiring safety testing of all sufficiently capable models, open and closed.
## paragraph 13
**中文**
2026 年 7 月 28 日编辑说明：已更新有关模块化训练策略研究的表述，注明该研究由 Anthropic 与 AE Studio 合作完成。
**English / Original**
*Edit 28 July: Updated to note that the cited research on modular training strategies was a collaboration between Anthropic and AE Studio.
## paragraph 14
**中文**
关于利用 AI 夺取权力和生物风险的讨论，请分别参见该文第 3 节和第 2 节。
**English / Original**
See Sections 3 and 2 of that essay for discussion of misuse for seizing power and discussion of biological risks, respectively.
## paragraph 15
**中文**
另请参阅英国 AI 安全研究所的这份报告，尤其是以下论述：‘支撑上述益处的开放性，也排除了许多闭源模型开发者可以采用的安全措施，例如发现并阻止滥用、在漏洞出现后持续改进防护措施、控制用户访问以及撤回模型。开放权重模型一经发布，这些手段便永久失效：安全护栏可以被移除，模型副本可以被下载、再次分发，并在无法监控的私人系统上运行。因此，对于具备危险能力的模型——包括网络攻击能力很强的模型——开放权重发布会造成持续且不可逆的滥用风险。’
**English / Original**
See this report from the UK AI Security Institute, specifically: “The same openness underpinning these benefits precludes many of the safety measures that closed model developers can use to detect and disrupt misuse, iterate on safeguards as vulnerabilities emerge, control user access and withdraw models. Once open-weight models are released, these options are lost permanently: safeguards can be removed, and copies can be downloaded, redistributed, and run on private systems beyond monitoring. For models with dangerous capabilities – including highly cyber-capable models – open weight release therefore creates a persistent and irreversible risk of misuse.”
## paragraph 16
**中文**
另请参阅此处、此处和此处所列的美国司法部其他报告。
**English / Original**
See also here, here, and here for more reports from the US Department of Justice.
## paragraph 17
**中文**
Anthropic 致力于通过自身实践打击工业规模的模型蒸馏，包括识别并封禁以这种方式使用我们模型的账户。但这项工作很困难。例如，相关账户往往要等到大量蒸馏已经发生后才能被识别；蒸馏活动还经常创建大量虚假账户，导致识别目标不断变化。任何单一公司的措施都无法彻底解决这一问题，因此我们才呼吁针对该问题制定政策。
**English / Original**
At Anthropic we’re committed to cracking down on industrial-scale distillation through our own practices, including identifying and banning accounts that use our models in this way. This is challenging—for instance, the relevant accounts can often only be identified after substantial distillation has occurred, and distillation often involves creating large numbers of fake accounts that form a moving target. The practices of any individual company cannot entirely solve the problem, which is why we have called for policy on this issue.
## paragraph 18
**中文**
关于生物威胁和攻防平衡的更详细讨论，请参见《技术的青春期》第 2 节。简而言之，我认为当前保障生物安全的关键，并不是所谓的‘防守方’，甚至也不是材料是否容易获得，而是智力能力与实施灾难性伤害的意愿之间存在负相关。互联网搜索乃至 DNA 合成等以往技术，能力都远不足以打破这种相关性；但我担心，按照目前的进步速度，AI 很快就会将其打破。换一种说法：能力足够强大的技术会消除所有门槛，从而暴露攻击方或防守方是否拥有内在的结构性优势；而我担心，在生物领域，占据这种优势的是攻击方。
**English / Original**
See Section 2 of The Adolescence of Technology for a more detailed discussion of biological threats and the offense-defense balance. To summarize, what I believe currently keeps us safe in biology is not “defenders”, or even the availability of materials, but a negative correlation between intellectual capability and desire to commit catastrophic harm. Previous technologies like internet search or even DNA synthesis were nowhere near powerful enough to break this correlation, but I worry that at its current rate of progress, AI will do so very soon. Another way to say it is that a sufficiently powerful technology removes all barriers and exposes whether the attacker or defender has an inherent structural advantage, and I worry in biology it is the attacker.