AI / ML topic How Do You Protect a Model's Weights?

Meta trained Llama 3.1 405B on H100 GPUs for 30.84 million GPU hours. All of that data, electricity and months of engineering ends up as 405 billion weights. At 16 bits apiece, that’s about 810 GB. It fits on a single 1 TB consumer SSD.

That’s the security problem: a model’s weights are the product. Whoever holds them can run it, sell it, or use fine-tuning to strip its safety training back out. And unlike a factory, you can copy them in an afternoon. Mark Zuckerberg made the point himself in 2024: “stealing models that fit on a thumb drive is relatively easy”.

How weights get out

It’s already happened. In February 2023, Meta shared its first LLaMA with approved researchers only. Within about a week, someone posted it as a torrent on 4chan. Meta sent takedown notices, but couldn’t un-leak it.

In January 2026, a jury convicted a former Google engineer of economic espionage and theft of trade secrets. Over about a year, he’d uploaded more than 2,000 pages about Google’s AI supercomputers, including its TPU chips, to his personal cloud account. That wasn’t weights, but it’s the textbook insider threat: legitimate access, used discreetly for a long time.

A thorough map of the problem is RAND’s 2024 report, Securing AI Model Weights. It counts 38 distinct ways to steal them. RAND groups them into nine families, and most are ones any ops person knows: malicious code on a server, stolen credentials, a supply-chain attack, insiders and bribes, and physical access to the hardware.

The controls you already know

Reassuringly, almost every defence is one you’ve configured before. When Anthropic raised its security bar in May 2025, it said its approach uses more than 100 controls. Among them:

• Two-person access: no single employee can touch the weights alone. That’s two-party authorization, the rule for nuclear launch keys and bank vaults.
• Software allowlisting: only approved programs run on the machines near the weights.
• Bandwidth caps: egress from the secure environment is rate-limited. Weights are huge, so a cap that barely touches normal work turns a quick copy into a slow, visible one.

Add the usual suspects: hardware security keys against phishing, and logs that someone reads.

What’s new about guarding a model

Anthropic singled out those bandwidth caps as the control most specific to weights. The other new piece is hardware. Confidential computing walls data off inside the hardware, even while a chip is working on it, and encrypts whatever leaves. The H100 was the first GPU to support it; with it switched on, whoever runs the host machine can’t simply read the weights out of GPU memory.

The downloaded-model problem has a boring fix too. In 2024, JFrog found about 100 malicious models on Hugging Face that ran code the moment they were loaded, mostly through the old Python “pickle” format, which can carry programs. Safetensors files hold only numbers and a short header describing them, so loading one can’t run code.

Try closing the paths yourself:

Notice that no single control closes everything, and logging closes nothing. It only tells you what’s happening. RAND’s version of that lesson: security “cannot be ensured by implementing a small number of ‘silver bullet’ security measures.”

How much is enough?

RAND sorts defences into five levels by the attacker they can stop, from SL1 (“hobbyist hackers”) through SL3 (cybercrime gangs and insiders) to SL5 (“top-priority operations conducted by the world’s most capable nation-states”). The labs RAND consulted estimated that, if they made it a priority, reaching SL3 would take about a year, SL4 two to three, and SL5 at least five, with help from the national security community. RAND’s own verdict on SL5: it “is currently not possible.”

The law has started asking too. California’s SB 53, signed in September 2025, requires the largest frontier developers to publish a framework that covers “cybersecurity practices to secure unreleased model weights from unauthorized modification or transfer by internal or external parties.”

The other side: give them away

Not everyone thinks locking weights up is the goal. As of September 2026, Mistral, DeepSeek and Meta all publish open-weights models on purpose, though Meta launched its April 2026 flagship, Muse Spark, closed. Zuckerberg’s 2024 argument was that secrecy mostly fails anyway, and openness lets everyone study, fix and build on the models. In July 2024, the US Commerce Department’s NTIA reviewed the question and recommended that the government “actively monitor” the risks rather than restrict open weights for now.

The two positions conflict less than they seem to. Publishing a model you’ve decided is safe to share is a choice; having an unreleased one taken from you isn’t. The security work in this post is about keeping the release the lab’s decision.

So how do you protect the weights?

The same way you’d protect any crown-jewel system: few people with access and never one alone, nothing runs that you didn’t approve, nothing leaves faster than you can notice, and logs that someone reads. What’s different is the file. It’s 810 GB, it cost a fortune, and one copy is enough to lose it for good.

References & further reading

The incidents, then the frameworks, then the open-weights side.