Open-weight AI safety has been the weakest link in the open model argument for two years, and on Wednesday 17 September 2026 Baseten put a structure around it. The inference company launched a safety infrastructure standard alongside Base Labs, the research arm it spun up earlier this year, and named two partners: Hugging Face, which hosts the models, and Goodfire AI, which specialises in interpreting them.
The number that explains the urgency is public and easy to check. Hugging Face currently lists more than 6,000 abliterated models — open-weight releases whose refusal behaviour has been surgically removed while the rest of the model is left intact. Abliteration is cheap, well documented and requires no retraining from scratch, which is why the count keeps climbing rather than plateauing.
Baseten’s framing is that open-weight AI safety should be a property of how a model is trained and served, not a wrapper applied afterwards by whoever happens to be hosting it. “We believe openness to be an advantage for AI safety,” the company said. This article covers what each partner is contributing, what has and has not been disclosed, why the serving layer is the interesting choice of venue, and what would have to be true for this to become a standard rather than an announcement.
Table of contents
- What Was Announced
- Why Abliteration Forced the Issue
- The Openness Argument Baseten Is Making
- Why the Serving Layer Is an Unusual Venue
- The Money Behind the Open-Weight AI Safety Push
- What a Real Standard Would Need
- How This Fits the Wider Open Model Debate
- What to Watch Next
- Who Is Missing From the Open-Weight AI Safety Partnership
- What This Means If You Deploy Open Weights
- References
What Was Announced
The open-weight AI safety launch has three moving parts, and only one of them is a product.
Base Labs as the research arm
Base Labs is Baseten’s research group, established earlier in 2026. Its role in the open-weight AI safety effort is to develop and publish methods for training and monitoring open models — the methods themselves, not a hosted service built on top of them.
The partnership
Hugging Face and Goodfire AI joined the open-weight AI safety effort as partners. Hugging Face hosts the models; Goodfire contributes interpretability expertise, meaning techniques for explaining how a model arrives at a decision rather than only observing what it outputs.
The framing as a standard
Baseten is describing the work as a “standard” for open models: transparent, and built into how models are trained and deployed rather than bolted on afterward. That word choice sets a high bar for open-weight AI safety, because a standard implies adoption by parties who did not write it.
The open call
Baseten also issued an open invitation to the wider developer ecosystem to contribute to the framework. “Together, we are building an ecosystem of open models that are safe and accessible to all,” the company said — an acknowledgement that three organisations cannot set an open-weight AI safety norm alone.
What was not disclosed
The companies have not said how the partnership will work technically. No specification, no evaluation suite, no timeline and no governance model accompanied the announcement, which is the single largest caveat attached to the open-weight AI safety claim.
| Party | Stated role | What it brings |
|---|---|---|
| Base Labs | Develop and publish training and monitoring methods | Research capacity inside an inference company |
| Baseten | Serve the models and coordinate the effort | The serving layer and customer reach |
| Hugging Face | Host and distribute | The repository where open weights live |
| Goodfire AI | Interpretability | Methods for explaining model decisions |
| The wider ecosystem | Invited to contribute | Adoption, which is what makes a standard |
Why Abliteration Forced the Issue
Open-weight AI safety became urgent because of one technique that turned out to be far easier than anyone building guardrails had assumed.
What abliteration does
Abliteration identifies and removes the internal direction associated with a model’s refusal behaviour. The model keeps its capabilities and loses its ability to decline. It is a targeted edit to the weights rather than a jailbreak prompt, so it survives every downstream deployment and every open-weight AI safety control applied at the surface.
Why it is hard to defend against
Guardrails added after training are the part most easily subtracted after training. Any open-weight AI safety approach that relies on a post-hoc refusal layer is, by construction, removable by whoever holds the weights.
The scale of it today
More than 6,000 abliterated models sit on Hugging Face. That is not a handful of research artefacts; it is an established practice with its own tooling, conventions and audience, and it is the backdrop to every open-weight AI safety claim made this year.
Why the count keeps growing
Abliteration is documented publicly, requires modest compute and does not need the original training data. Every capable open release is therefore an open-weight AI safety candidate, and the gap between release and abliterated variant has been shrinking.
The argument this creates
Critics of open weights use exactly this to argue that open-weight AI safety is a contradiction in terms. Baseten’s response is not to deny the problem but to relocate the solution — into training, and into the layer that serves the model.
The Openness Argument Baseten Is Making
The company’s public position is that openness helps rather than hinders open-weight AI safety, and the reasoning is worth quoting precisely.
The visibility claim
“Openness provides more visibility into the behavior of models,” Baseten said. A closed model can only be probed from the outside; an open one can be inspected at the level of its weights, activations and internal representations, which is the whole basis of the open-weight AI safety argument.
The actionability claim
The company continued: openness gives “greater means of turning safety research into actionable and transparent controls than closed-source.” This is the sharper half of the open-weight AI safety argument — that a finding about a model’s internals is only useful if someone can act on it in the weights.
Goodfire’s version
Goodfire replied to Baseten’s post with a compressed statement of the same idea: “Safety must be built into open models and provided by those who serve them.” The second clause is the novel part, and it assigns open-weight AI safety responsibility to inference providers.
Why interpretability is the bridge
Goodfire’s work opens what the industry calls the black box: identifying the features and circuits a model uses. If refusal behaviour can be located precisely, it can in principle be entangled with capability rather than isolated in a removable direction — which is the only structural answer to abliteration anyone has proposed.
The honest limit
None of this has been demonstrated as a shipped technique. The openness argument is a hypothesis about where open-weight AI safety research should be done, and the partnership is the vehicle for testing it.
Why the Serving Layer Is an Unusual Venue
Most open-weight AI safety proposals target either the model developer or the regulator. This one targets neither.
Who normally carries the obligation
Open-weight AI safety commitments have historically attached to the lab that trains the model. That works for closed providers, who control deployment, and fails for open weights, where the developer loses control at the moment of release.
What the serving layer can see
An inference provider sees the traffic: which prompts arrive, which models answer, what patterns recur across customers. That vantage point supports open-weight AI safety monitoring in a way a static weight file never can.
What the serving layer can do
It can refuse to host a model, instrument it, apply controls at request time, or publish what it observes. Goodfire’s phrase — “provided by those who serve them” — is a claim that this is the right place for the obligation to sit.
The commercial logic
Baseten sells inference. A credible open-weight AI safety story is a direct sales asset with enterprise buyers who currently default to closed providers on risk grounds. The incentive and the mission point the same way, which is a strength and a reason for scrutiny.
The obvious gap
A provider can only govern what runs on its own infrastructure. Weights downloaded from Hugging Face and run elsewhere are outside any serving-layer control, and that is the majority of open-weight usage by volume.
| Layer | What it controls | Why it is insufficient alone |
|---|---|---|
| Model developer | Training data and objectives | Loses control at release |
| Repository host | What is listed and how it is labelled | Cannot see how weights are used |
| Inference provider | Requests, monitoring, request-time controls | Blind to self-hosted deployments |
| Interpretability research | Understanding of internal behaviour | Needs someone to act on findings |
| Regulator | Obligations and penalties | Slower than the release cycle |
The Money Behind the Open-Weight AI Safety Push
Both companies are unusually well funded, which shapes how seriously the open-weight AI safety commitment should be read.
Baseten’s position
Baseten raised a 1.5 billion dollar Series F in June 2026, taking its valuation to 13 billion dollars. That is a scale at which funding a research arm is a rounding error rather than a stretch, and it removes the usual excuse for under-investing in open-weight AI safety work.
Goodfire’s position
Goodfire raised a 150 million dollar Series B led by B Capital earlier in 2026 to advance its interpretability platform. Interpretability has moved from an academic subfield to a funded product category in roughly two years.
What the capital implies
Neither partner needs this announcement for credibility with investors. The more plausible reading is commercial: enterprise buyers are the constituency that cares most about open-weight AI safety, and both companies sell to them.
The arithmetic of the round
Baseten’s 1.5 billion dollar raise against a 13 billion dollar valuation means the round represents roughly 11.5 percent of the company’s post-money value, which is a substantial dilution and a signal of how fast the inference market is being contested.
What a Real Standard Would Need
Calling something a standard is a claim about other people’s behaviour, so it is worth setting the open-weight AI safety bar explicitly.
A published specification
An open-weight AI safety standard needs something implementable by a party that was not in the room. Methods “developed and published” by Base Labs is a promise of that; it is not yet that.
An evaluation anyone can run
Open-weight AI safety claims need a test. Without a public benchmark that measures how resistant a model’s safeguards are to removal, there is no way to distinguish a compliant release from a badge.
Governance that is not one company
A standard authored and controlled by the vendor who benefits from it is a product specification. Broadening it to the ecosystem is exactly what the open call invites, and exactly what has not happened yet.
Adoption by model developers
The partnership covers a researcher, a host and a server. It does not yet include the organisations that actually train and release open weights, and their participation is what would make open-weight AI safety intrinsic rather than applied.
A response to the removal problem
Any credible open-weight AI safety standard must say something specific about abliteration. Entangling refusal with capability, so that removing one degrades the other, is the direction the interpretability work points — but nobody has shown it working at frontier scale.
How This Fits the Wider Open Model Debate
The open-weight AI safety announcement lands in the middle of an argument that has been running since open weights became competitive.
The regulatory backdrop
Open weights sit awkwardly in most AI regulation, which assumes an identifiable deployer. An industry-led open-weight AI safety standard is partly an attempt to answer that question before a legislature answers it less helpfully.
The reinforcement learning question
Safety behaviour in current models is largely instilled through reinforcement learning from human feedback, and that is precisely the layer abliteration targets. Any durable fix has to change how that training is represented internally, not just how much of it is applied.
The competitive framing
Open-weight releases are increasingly positioned against closed frontier models on cost and control. Open-weight AI safety has been the strongest remaining objection, which makes a credible answer commercially valuable to everyone shipping open weights.
The hosting responsibility question
Hugging Face lists the abliterated models alongside everything else. Its participation raises, without answering, what a repository owes the ecosystem when a hosted artefact exists specifically to defeat a safeguard.
Why the ecosystem call matters most
The open invitation is the part that determines the outcome. If model developers and other inference providers sign on, this becomes infrastructure. If they do not, it remains three companies publishing papers, which is useful but not a standard.
What to Watch Next
A few concrete signals will show whether the open-weight AI safety work is real, and each is observable from outside the partnership.
The first published method
The first technical publication from Base Labs is the open-weight AI safety test. Look for whether it defines a measurable property, and whether the measurement is reproducible by someone outside the partnership.
Whether a model developer joins
The most meaningful next signature is a lab that releases open weights. Until one adopts the methods at training time, the safeguards remain applied rather than intrinsic.
Whether Hugging Face changes anything
A labelling change, a policy on abliterated variants, or a safety metadata field on model cards would each be evidence that the partnership reaches the repository layer.
Whether the evaluation is public
A private benchmark is a marketing asset. A public one is infrastructure. Which of the two appears will say more than any further announcement.
Whether anyone measures removal resistance
The honest metric for open-weight AI safety is how much work it takes to strip the safeguards and how much capability is lost in doing it. If that number gets published and tracked, the field has a scoreboard. Teams weighing open models for production should read the eventual specification against their own AI strategy rather than against the press release, and the broader landscape is covered in our AI models and tools hub.
Who Is Missing From the Open-Weight AI Safety Partnership
The absences are as informative as the participants, and three categories of organisation are not on the list.
The model developers
Nobody who trains and releases open weights has signed on. That is the gap that matters most, because “built into how models are trained” is a description of work only a trainer can do. Until a developer adopts the methods, the open-weight AI safety story stops at the serving layer.
The other inference providers
Baseten is one of several companies serving open weights commercially. A standard adopted by one provider is a differentiator; a standard adopted by several is infrastructure. The open call is aimed squarely at this group.
The independent evaluators
No third-party evaluation organisation is named. Safety claims measured by the same parties who make them have a well-understood credibility problem, and the open-weight AI safety field has no shortage of groups doing independent testing.
The hyperscalers
The large providers also host open weights at scale. Their absence is unsurprising at week one and would be significant at month six, because their distribution is what would make an open-weight AI safety norm unavoidable.
Why the absences are not fatal yet
Every standard starts with a small group. The question is whether the open call converts absences into signatures within a few months, or whether the partnership settles into a well-funded research collaboration that other companies cite politely and ignore operationally.
| Signal | What it would prove | Status at launch |
|---|---|---|
| Published specification | Others can implement it | Promised, not published |
| Public evaluation suite | Claims are testable | Not announced |
| A model developer adopting it | Safeguards are intrinsic | None named |
| Repository policy change | It reaches distribution | Not announced |
| Independent evaluator involved | Results are credible | None named |
| Second inference provider | It is a norm, not a feature | None named |
What This Means If You Deploy Open Weights
For organisations already running open models in production, the announcement changes the roadmap rather than today’s controls.
Nothing changes this quarter
No specification exists yet, so there is nothing to implement. Existing controls — request logging, output filtering, scoped credentials, human review on consequential actions — remain the whole of your open-weight AI safety posture for now.
Check the provenance of your weights
The 6,000-plus abliterated models on Hugging Face are not always obviously labelled, and a fine-tuned derivative may inherit an abliterated base. Knowing the ancestry of every model you serve is the cheapest control available and the one most often skipped.
Treat refusal behaviour as a property to test
If safeguards can be removed from a model, they can be absent from a model you assumed was safe. Running your own refusal tests against every deployed checkpoint turns an assumption into a measurement.
Watch the serving layer question
The Goodfire claim that safety should be “provided by those who serve them” has a direct consequence for buyers: it implies your inference provider is part of your control surface. That is a question to put to any vendor, including Baseten.
Plan for a specification you have not seen
When the Base Labs methods appear, the useful response is to evaluate them against your own risk model rather than adopt them because they are the only open-weight AI safety standard on offer.
References
More AI coverage: explore Progressive Robot's AI Models, Tools & Releases hub — hands-on reviews, setup guides and benchmarks in one place.