Examples
Examples from published documents
- Anthropic: "Egress bandwidth controls: Network-level restrictions that limit data transfer rates out of sensitive environments, making large-scale exfiltration of multi-terabyte model weights more time-consuming and detectable." (Anthropic Risk Report, August 2026, §6.4.2)
- The EU Code of Practice exempts a model from its security commitment "if the model's capabilities are inferior to the capabilities of at least one model for which the parameters are publicly available for download." (EU GPAI Code of Practice, Safety and Security Chapter, Commitment 6)
Counter-examples
Not to be confused with
- Protecting the model's outputs from misuse by legitimate users (for example with classifiers) is a deployment safeguard, not weight security.
Related terms
Related AI safety terms
Terms defined under this element that are not NIKOLAI elements themselves, each as the cited document uses it. Every term is also listed in the AI safety glossary.
- Model weights
- Model weights are the learnable parameters of an AI model, including the weights and biases learned during training, that determine what it can do. RAND singles them out because they embody the compute, data and research invested in training.
- Source: RAND, Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (Nevo et al., 2024, RR-A2849-1)
- Weight exfiltration
- Weight exfiltration, or weight theft, is the unauthorised copying of a model's weights out of the developer's control. Google DeepMind notes that release of weights may enable the removal of any safeguards trained into or deployed with the model.
- Source: Google DeepMind Frontier Safety Framework v3.1
- Insider threat
- An insider threat is a hostile operation by people or AI systems with access to sensitive organisational resources, such as staff, contractors, infiltrated spies or a self-exfiltrating model. The EU GPAI Code of Practice also counts accidental model leakage.
- Source: EU GPAI Code of Practice, Safety and Security Chapter
- Distillation attack
- A distillation attack is the large-scale extraction of a model's outputs, such as its reasoning traces, to train a copy cheaply without access to the weights. xAI's framework describes security measures against the extraction and distillation of reasoning traces.
- Source: xAI Frontier AI Framework, 30 Jun 2026
Source of record
Where this definition comes from
RAND, Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (Nevo et al., 2024, RR-A2849-1), Chapter 2, Scope
“We further focus exclusively on the risk from theft, copying, or mimicry of the weights of frontier AI models.”
https://www.rand.org/pubs/research_reports/RRA2849-1.htmlGoogle DeepMind Frontier Safety Framework v3.1, §2.1.1
“This is because the release or unauthorized modification of model weights may enable the removal of any safeguards trained into or deployed with the model, and hence access (including by threat actors) to any critical capabilities.”
https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf
Crosswalk
How named organisations use this concept
Every row below is a shadow mapping. A shadow row is CASRAI's own reading of a published document. No lab, evaluator or regulator named on a shadow row has declared, endorsed, or been consulted on it. That changes only when an organisation files its own Mapping Declaration.
| Organisation | Their term, as published | Match & verification | Source |
|---|---|---|---|
| RAND CorporationShadow mapping RAND, Securing AI Model Weights (RR-A2849-1, 2024) | “"We further focus exclusively on the risk from theft, copying, or mimicry of the weights of frontier AI models."; recommendations include "Centralize all copies of weights to a limited number of access-controlled and monitored systems." and "Reduce the number of people authorized to access the weights."” Verified against the full report PDF fetched 13 Nov 2026. | exactEQ confidence: high | RAND, Securing AI Model Weights: Preventing Theft and Misuse of Frontier Models (Nevo et al., 2024, RR-A2849-1) |
| AnthropicShadow mapping Anthropic Risk Report, August 2026 | “§6.4 "Model weight security": "Anthropic has developed a security program to protect ASL-3 model weights against most non-state attackers, including cybercriminal groups, hacktivists, and corporate espionage actors."” | exactEQ confidence: high | Anthropic Risk Report, August 2026 |
| Google DeepMindShadow mapping Frontier Safety Framework v3.1 | “"Security Mitigations: are safety measures we implement which are intended to prevent the unauthorized modification or exfiltration of model weights by unauthorized actors."; "Security mitigations also protect against the risk of the model exfiltrating itself."” | exactEQ confidence: high | Google DeepMind Frontier Safety Framework v3.1 |
| METRShadow mapping METR (common-elements) | “"Model Weight Security": "Information security measures that will be taken to prevent model weight access by unauthorized actors."” | exactEQ confidence: high | METR (common-elements) |
| EUShadow mapping EU GPAI Code of Practice, Safety and Security Chapter | “Appendix 4.2 "Protection of unreleased model parameters" and Appendix 4.4 "Insider threats", including "reduction of the risk of model self-exfiltration, through (a) sandboxes around models, such as virtual machines and code execution isolation"” The Code says "model parameters" rather than "weights". | closeCL confidence: high | EU GPAI Code of Practice, Safety and Security Chapter |
| OpenAIShadow mapping OpenAI Frontier Governance Framework | “"Protection of unreleased model weights": "Model weights are protected through encryption (at rest and in transit), continuous monitoring, and access controls (e.g., multi-factor authentication, multi-party approval, and detailed logging)."” | closeCL confidence: high | OpenAI Frontier Governance Framework |
| AmazonShadow mapping Amazon's Frontier Model Safety Framework | “"Security Measures": "designed to prevent unauthorized access to model weights or guardrails implemented as part of the Safety Measures, which could enable a malicious actor to remove or bypass existing guardrails to exceed Critical Capability Thresholds."” | closeCL confidence: medium | Amazon's Frontier Model Safety Framework |
| MetaShadow mapping Meta Advanced AI Scaling Framework v2 | “High threshold security: "Initiate protocols for heightened access controls to model weights and security protections to prevent their tampering or exfiltration."” | closeCL confidence: medium | Meta Advanced AI Scaling Framework v2 |
| California SB 53Shadow mapping California SB 53 | “Framework topic "(7) Cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties."” | closeCL confidence: high | California SB 53 |
What do these codes mean?
- exact
- The source term is equivalent to this element
- close
- The source term is close but not equivalent to this element
- broad
- The source term is broader than this element
- narrow
- The source term is narrower than this element
- none
- No mapping claim — used for false-friend and declared-but-undefined rows
- EQ
- Equivalent
- CL
- Close
- BR
- Source is broader than the element
- NR
- Source is narrower than the element
- FF
- False friend — same or similar label, different meaning
- DU
- Declared but undefined by the source
- UV
- Unverified
Related, not mapped
Pointers that are not crosswalk claims
These sources mention this concept but do not define or map it clearly enough to count as a crosswalk row — noted here so the research is visible without overstating it as a mapping.
- xAI
Security measures against "the large-scale extraction and distillation of reasoning traces" (anti-distillation), protecting model capabilities through ordinary use rather than weight access. Related, not a mapping.
xAI Frontier AI Framework, 30 Jun 2026
Gap
Weight theft as an event (for example an exfiltration incident) belongs to the incident track; this element covers the protective objective only.
