SenseDefend

Synthetic-media instruments, by article and effective date

What a weights repository does and does not ask

When model weights are published, anybody can run them on their own hardware. The only document that travels with the files is the terms they are offered under, and permissive terms are written to ask for as little as possible. As of 2026-09-12.

What travels with a set of published weightsA hosted product knows its callers and can change a default for all of them. A repository knows its download count, and the only document travelling with the files is the terms they are offered under.The filesWeights, downloadableTo anybody, onto their ownhardwareRun under code the publishernever seesThe termsWhatever the publisher requiredWith the files, as the onlyobligationUsually asks for attributionand little elseThe model cardIntended use and limitationsRead by whoever bothersExplains a great deal,requires nothingOutput generated somewhere the publisher cannot seeWho could still be asked
Fig. 1 Permissive terms exist to remove friction, so requirements on downstream operators are the thing they are written to avoid.
What a repository page holds, and what each part can be read for. Recorded 2026-09-12.
Part of the pageWhat it can be read for
The files themselvesWhat can be run, and on what
The terms of useWhatever the publisher chose to require
A model card in the repositoryIntended use, and stated limitations
Nothing about a hosted interfaceA different page owns that entirely

Inclusion rule. Sections commonly present where model weights are published for download. Order. In the order a reader encounters them.

1A licence is a place an obligation could live, and usually does not

Permissive terms exist to remove friction. Requirements on downstream operators are friction, so the documents that get adopted are the documents that ask for little.

Reading such a licence for a marking requirement and finding none is therefore an expected result rather than a surprise. Recording it matters anyway, because it is the only document in the chain that could have carried one.

2Who the operator is becomes unknowable

A hosted product knows its callers. A repository knows its download count. Once weights are on somebody else's hardware, nothing the publisher does later reaches the output, and nobody can enumerate who is generating what.

That is a structural fact rather than a criticism. It does mean any question about what output from those weights carries has to be asked of the operator, who may not be identifiable at all.

3A hosted route and an open route are different populations

The same model can exist as an interface with documented parameters and as files with no parameters at all. Statements about one do not describe the other, and a register has to keep them apart.

Conflating them produces the confident, wrong sentence: this model marks its output. Whether anything is marked depends on which of the two routes produced the file, and often nothing records which.

4What a model card in a repository is good for

Intended use, training description and stated limitations are often present and are worth reading. They describe what the authors think the weights are for, which constrains nothing and explains a great deal.

What such a card almost never contains is an instruction to whoever deploys the weights. Reading it as a policy for downstream operators is reading a document for something it was not written to be.

Background on mechanism and practice. Nothing here is attributed to a product, and nothing here is a reading of any instrument. The sourced material is on the generator table. Related: Omission and statement, Recording silence.