Systems Research系统研究Nov 4, 20262026年11月4日Note短评

Open weights are a release you can't take back.开源权重是一次收不回的发布：治理只能管部署，管不了权重本身。

A lone figure seen from behind stands in the open doorway of a concrete vault built into a sunny green hillside, releasing a stream of colorful paper airplanes that scatter away over a bright city below and can't be gathered back. White headline reads 'Open weights never come back' with a Chinese line below: 开源权重，发出去就收不回.一个背对镜头的人站在嵌入阳光绿色山坡的混凝土库门口，放出一串彩色纸飞机飞散到下方明亮的城市上空，再也收不回来。白色英文标题写着 'Open weights never come back'，下面一行中文：开源权重，发出去就收不回。Image: WAKENEX图片：WAKENEX

On Nov 4, 2026, at the World Internet Conference Wuzhen Summit, DeepSeek, Alibaba's Qwen and MiniMax shared a stage under the theme of openness. The line to notice came from DeepSeek researcher Chen Deli: AI is a "great aid" today, but within 10 to 20 years it could take over most human work and "tech companies will need to act as defenders." Even the DeepSeek-R1 safety report concedes open-sourcing "introduces potential risks of misuse."

Reason it through. Once weights are public they can't be recalled or patched, and no kill-switch reaches copies already downloaded. So governance can only sit on the deployment layer: hosting, APIs, licenses. That is exactly the layer open weights let everyone bypass. Safety at the weight level is physically out of reach.

The incentive is plain. The lab keeps distribution and mindshare, while the costs land downstream: misuse, guardrails fine-tuned off, vulnerable code in whoever deploys it. Whoever opens fastest wins the ecosystem, so the externality compounds. That is why even DeepSeek urges "a more cautious approach."

The strongest counter holds too. Open weights also distribute the defense: more auditors, no single-vendor chokepoint, while closed models just hide the same risks behind an API. But it doesn't rescue weight-level governance: openness amplifies attack and defense alike, only the lab keeps the upside, and the irreversible part is shared by everyone.

For you: if you build on an open-weight model, treat it as infrastructure you can't un-adopt, and spend your safety budget on the layer you control. Evaluations, sandboxing, checking the code it writes, because no upstream patch is coming.

What would change this: a lab shipping an enforceable mechanism that constrains already-released weights at scale, or audits showing open deployments are no more misused than closed ones.

11 月 4 日，世界互联网大会乌镇峰会，DeepSeek、通义千问、MiniMax 三家中国开源大模型罕见同台，主题正是『开放』。但真正该留意的一句来自 DeepSeek 研究员陈德立：今天 AI 是『得力助手』，可未来 10 到 20 年它可能接管人类大部分工作，『届时科技公司需要充当防御者』。连放出权重的人都在提醒下行；DeepSeek-R1 安全报告也承认，开源『带来潜在的误用风险』。

拆到底：权重一旦公开就无法召回、无法打补丁，没有任何关停开关能触达已经下载的副本。于是所谓『治理』只能落在部署层：托管、接口、许可。而这恰好是开源权重让所有人绕开的那一层。权重层面的安全，物理上就够不着。

激励很清楚：实验室拿走分发、生态和话语权，而误用、被微调掉护栏、生成更脆弱代码这些代价，落在下游部署者身上。谁开得更快谁先占住生态，外部性越滚越大。这正是连 DeepSeek 都在呼吁『更谨慎』的原因。

最强的反方也成立：开源同时分发了防御，更多人审计、不绑定单一厂商、可复现，闭源只是把同样的风险藏在接口后面。但这救不了权重层治理：开放对攻防两边都放大，上行只归实验室，不可逆的部分由所有人分担。

对你的含义：如果你基于开源模型搭东西，就把它当成一旦采用就撤不回的基础设施，把安全预算放在你能控制的部署层。评测、沙箱、核查它写出的代码，因为上游不会有补丁发下来。

会推翻这个判断的是：某家实验室真拿出一套能约束『已放出去的权重』、且被大规模采用的机制；或独立审计显示开源部署并不比闭源更容易被误用。

Built on the WAKENEX concept:所用的 WAKENEX 概念： From possibility to trade-off从可能到取舍

Sources来源

Primary source: pandaily.com/deepseek-qwen-minimax-wuzhen-dialogue-open-source-mode…原始来源：pandaily.com/deepseek-qwen-minimax-wuzhen-dialogue-open-source-mode…pandaily.com ↗

WAKENEX / NOTESWAKENEX / 短评

Add WAKENEX as a preferred source on Google在 Google 把 WAKENEX 设为首选来源

Sources来源

READ NEXT接着读

Owning the model lets the labs take the layer above it. The thin reseller stuck in the middle gets squeezed out.握住模型，实验室就能吃掉它上面的应用层。 夹在中间、只负责转卖的那一薄层被挤了出去。

Legal stock perps change the venue, not the leverage risk you carry.个股永续合约合法了，换的是场地，不是你承担的杠杆风险。

Reserved blockspace with a zero penalty is a promise, not a guarantee.预订的区块空间，只要违约不用付代价，就只是承诺，不是保证。而这正是 ETHGas 眼下在以太坊上向华尔街兜售的东西。

Owning the model lets the labs take the layer above it. The thin reseller stuck in the middle gets squeezed out.握住模型，实验室就能吃掉它上面的应用层。夹在中间、只负责转卖的那一薄层被挤了出去。