K-文化的一切——从回归到 K-美妆，发送到您的邮箱订阅邮件

METAL MEDIA

Position: Current Model Cards Are Insufficient for Downstream Governance of Open-Weight Foundation Models

arXiv:2608.180862026-08-20

抽查Hugging Face上500个热门模型发现,光靠模型卡片管不住开放权重AI的安全风险

论文分析了Hugging Face上下载量最高的500个开放权重基础模型(OWFM)的模型卡片、可接受使用政策(AUP)和许可证。几乎所有模型都有模型卡片,但安全相关内容很薄弱,只有21.2%的模型明确标注了AUP,而且不少许可证本身与这些使用限制相冲突。作者提出了信息、规范、法律三层结合的治理框架,包括安全卡片、标准化AUP和为开放权重模型量身定制的许可证。

METAL MEDIA 解读图

抽查Hugging Face上500个热门模型发现,光靠模型卡片管不住开放权重AI的安全风险

  1. 01依据NIST生成式AI风险管理框架的安全关键词分类,对Hugging Face下载量前500的开放权重基础模型的模型卡片、AUP和许可证进行了系统调查
  2. 0299.6%的模型提供了模型卡片,但只有75.2%包含安全相关字段,只有21.2%的模型卡片中明确引用了AUP
  3. 03文档详尽程度与模型下载量几乎无关(多种回归模型的解释力R²均小于0.01),反而更取决于开发商是谁——Meta和Google披露密度较高,Qwen较低
  4. 04指出Apache 2.0、MIT等常见开源许可证在结构上无法容纳基于用途的限制条款,这会削弱甚至覆盖同时存在的AUP的法律效力
  5. 05提出了标准化的安全卡片模板,强调模型血统(上游模型、数据、AI反馈来源)和可操作的安全评测,并设计了将AUP作为附件纳入法律条款的开放权重专用许可证方案
这是 METAL MEDIA 制作的解读图，并非论文作者提供的原图。

他们做了什么

  1. 依据NIST生成式AI风险管理框架的安全关键词分类,对Hugging Face下载量前500的开放权重基础模型的模型卡片、AUP和许可证进行了系统调查
  2. 99.6%的模型提供了模型卡片,但只有75.2%包含安全相关字段,只有21.2%的模型卡片中明确引用了AUP
  3. 文档详尽程度与模型下载量几乎无关(多种回归模型的解释力R²均小于0.01),反而更取决于开发商是谁——Meta和Google披露密度较高,Qwen较低
  4. 指出Apache 2.0、MIT等常见开源许可证在结构上无法容纳基于用途的限制条款,这会削弱甚至覆盖同时存在的AUP的法律效力
  5. 提出了标准化的安全卡片模板,强调模型血统(上游模型、数据、AI反馈来源)和可操作的安全评测,并设计了将AUP作为附件纳入法律条款的开放权重专用许可证方案
Table 1: Governance artifact presence in top 500 OWFMs.
Artifact TypeCountPercentage
Model card (any form)49899.6%
Safety-specific fields37675.2%
AUPs10621.2%
Explicit license42585.0%
Table 2: Comparison of Major AUPs
ModelsStructureRestricted UsesViolation triggers
Infringement / HarmBreach of lawDeceit / MisinformationOthers
Llama 4AUP (part of community license)✓✓✓Failure to disclose; interaction with third-party toolsTermination
GemmaProhibited Use Policy (part of Terms of Use)✓✓✓Sexually explicitRestricting usage
DeepSeekUse Restrictions (part of DeepSeek license agreement)✓✓✓Military; inappropriate; personal data; automated; discriminating; exploitativeRestricting usage
QwenUsage Policy (not referenced in model cards) + Apache 2.0✓✓✓High-risk use cases; platform abuse; minor protectionWarnings, removal, etc.
Stable DiffusionCreativeML Open RAIL-M✓✓✓Personal data; automated; exploitative; discriminating; medical; legalRestricting usage
Table 3: Comparison of Widely Used OSLs
PermissiveCopyleft
ApacheMITAFLGPL-3GPL-2
Copy / Modify / Redistribute / Commercial✓✓✓✓✓
Retain notice✓✓✓✓✓
Explicit patent license✓✗✓✓✗
Patent retaliation✓✗✓✓✗
Source codes✗✗✗✓✓
Copyleft✗✗✗✓✓
Disclaimer / limitation✓✓✓✓✓

为什么重要

这项研究用数据证明,当前的模型卡片不足以支撑下游开发者对开放权重模型做出可靠的安全判断。它为部署、审计开放权重模型的从业者和政策制定者提供了具体可行的治理设计方向。

本文术语

  • 开放权重基础模型(OWFM) · 只公开模型权重、不公开训练代码和数据的AI模型
  • 模型卡片 · 描述模型能力、局限和风险的标准文档
  • AUP(可接受使用政策) · 规定模型禁止或限制用途的规范性文件
  • 开源许可证(OSL) · Apache 2.0、MIT等最初为软件代码设计的著作权许可规则
  • NIST生成式AI风险管理框架 · 美国国家标准与技术研究院制定的生成式AI风险分类标准

无法转载的图表

  • Figure 1: A Three-Layered Approach to Downstream Governance of Open-Weight Foundation Models. (Left) AS-IS: The current fragmented system, where model cards focus on performance rather than safety, AUPs are often missing or non-binding, and model licenses frequently conflict with stated usage restrictions. (Right) TO-BE: The proposed unified framework integrating three complementary layers for more resilient downstream safety control: informational (safety cards), normative (standardized AUPs), and legal (OWFM-tailored licenses).
  • Figure 2: Prevalence of Safety-Related Keywords Across the Top 500 Downloaded Models. Each bar represents the number of models whose documentation contains at least one keyword from the corresponding safety category, based on the NIST GenAI Risk Management Framework taxonomy.
  • Figure 3: Safety-Related Keyword Coverage by Vendor (Top 12 by Model Count). Stacked bars show the number of models in each keyword-count range (0, 1–5, 6–10, 11–20, 21+). Vendors such as meta (including Llama and facebook OPT models) and google exhibit higher keyword density, while Qwen models are concentrated in lower-frequency ranges, highlighting systematic differences in disclosure practices.
  • Figure 4: Vendor-Level Clustering of Model Card Embeddings. Each point represents a model, positioned using PCA on sentence embeddings of model card text. Colors indicate developer affiliation, and point size reflects total governance-related keyword counts. k-means clustering yields several distinct developer-level documentation patterns, while a heterogeneous set of other developers remains broadly dispersed across the embedding space.
  • Figure 5: Relationship Between Model Popularity and Governance Documentation Depth. Each point represents a model, with total downloads (millions) on the x-axis and governance-related keyword counts on the y-axis. Regression lines across multiple functional forms are not explanatory (R2<0.01), hinting that ecosystem utility does not predict documentation quality.
  • Figure 6: Governance Artifact Flows Across the Top 500 OWFMs. The Sankey diagram traces each model across download rank, safety-keyword coverage, developer, license, and AUP status. Flow widths indicate model counts, showing that permissive OSLs, notably Apache 2.0 and MIT, lead to "no AUP", while custom licenses such as Llama and Gemma are associated with AUP presence.
在原文中查看图表 →

论文原文摘要（英文）

The growth of open-weight foundation models (OWFMs) has prompted the AI community to re-evaluate strategies for effective downstream governance. Although model cards have been widely adopted as transparency artifacts in model repositories, existing frameworks often fail to adequately inform downstream developers and users about the distinct safety challenges posed by OWFMs. This position paper analyzes 500 model cards hosted on Hugging Face and argues that effective governance of OWFMs requires a multi-layered approach integrating three complementary components: (i) model cards, (ii) acceptable use policies (AUPs), and (iii) licenses. To motivate this claim, we identify a safety gap left by existing regulatory approaches, including model heritage, alignment provenance, and empirically observed behaviors, through an analysis of model cards with safety-critical information. We further argue that standard open-source licenses (OSLs) are not well suited for OWFMs and may weaken the enforceability of AUPs. Building on these observations, we outline directions for evolving model cards, AUPs, and licenses into integrated safety artifacts to enable a more comprehensive governance framework that coherently integrates informational, normative, and legal dimensions.

作者 · Sungwon Chae, Keonwoo Kim, Hoki Kim, Jaeyeon Ju, Sangchul Park

在 arXiv 阅读

最新论文

全部论文 →

METAL MEDIA 最新报道