Model weights leaks: the legal status of stolen AI

When the weights of a proprietary language model leak onto the public internet, a complex legal and operational vacuum immediately arises. Training advanced neural networks requires tens to hundreds of millions of euros in specialized computing power, enormous datasets, and months of optimization by research teams. The resulting binary files — the billions of floating-point numbers that together form the trained parameters — represent the entire economic value of such a project. Once these files are distributed via torrent networks or unauthorized platforms, anyone with suitable hardware can run the model locally, modify it, or offer it through external interfaces without bearing the original exploitation costs.

This raises the question of what legal instruments are available to developers and rights holders when this intellectual capital is released without authorization. Does a neural weight file fall under classic copyright, is it protected as a trade secret, or does only criminal law via unauthorized computer access offer any grip? In this article, we analyze the legal qualification of model parameters, the enforcement options within European and Dutch law, and the risks for organizations considering the use of leaked weights.

The Ontological Nature of Model Weights: Data, Code, or Mathematics?

To determine which legal regime applies to a model leak, we must first establish what model weights precisely are in legal-technical terms. A trained neural network consists of a fixed network architecture (usually described in source code via frameworks such as PyTorch or JAX) and a matrix of numerical values (weights and biases). These weights are the result of a mathematical optimization process in which a loss function is minimized across billions of tokens of training data via gradient descent. The resulting file — often stored in formats such as Safetensors, GGUF, or checkpoints — contains purely numerical representations of statistical relationships.

In intellectual property law, this material reality clashes with existing categories. Mathematical methods, pure data, and abstract statistical correlations are traditionally excluded from intellectual property rights. A single weight (for example 0.041829) is a numerical variable that reflects no human creativity but is the result of automated calculations. As a result, model weights cannot simply be equated with software code, although the weights are functionally inert without a runtime engine. The interplay between data and software creates a hybrid entity that forces legislators and judges to reinterpret traditional definitions.

The status of intellectual property surrounding training processes and generated structures has long been a legal point of contention. For an overview of how traditional protection frameworks relate to training data and parametric structures, see the background article on AI and copyright in the Netherlands and the EU.

The Copyright Question Around Numerical Parameters

Classic copyright requires an "own intellectual creation" by the maker, which presupposes that free, creative choices have been made that bear the personal stamp of the author. When training a model, decisions are made about the architecture, hyperparameter tuning, and the selection of the training corpus. However, the specific numerical outcome of the weights after trillions of optimization steps follows causally and autonomously from the training algorithm. There is no direct human shaping of individual parameters.

In addition, model weights rarely qualify legally as a "computer program" within the meaning of the European Software Directive (Directive 2009/24/EC). A computer program consists of instructions that make a computer perform a specific task, directly or indirectly. Model parameters are not instruction sets, but static data input read by the inference engine (such as llama.cpp or vLLM) to perform matrix multiplications. Without separate software code, a weight file cannot execute itself. As a result, many European legal systems lack the basis for direct software copyright protection of the weight file itself.

One possible exception concerns database rights (Directive 96/9/EC). A party that demonstrates a substantial qualitative or quantitative investment in the obtaining, verification, or presentation of the contents of a database enjoys a sui generis right. However, it is disputed whether a matrix of weights qualifies as an organized collection of "independent elements". The parameters function solely as one indivisible mathematical whole; an individual weight has no independent informative value apart from the surrounding matrix. As a result, rights holders face significant legal obstacles when relying exclusively on database rights.

Trade Secrets and the Wet bescherming bedrijfsgeheimen (Wbb)

Because copyright and database rights show substantial legal gaps in the qualification of parameters, trade secret protection forms the primary civil-law line of defense. Under the European Trade Secrets Directive (Directive (EU) 2016/943), implemented in the Netherlands in the Wet bescherming bedrijfsgeheimen (Wbb), information enjoys protection when it meets three cumulative conditions:

1. The information is secret: it is not, either as a whole or in the precise configuration, generally known or readily accessible to persons within the circles that normally deal with this type of information.
2. The information has commercial value precisely because it is secret.
3. The holder has taken reasonable measures to keep the information secret.

For proprietary models offered exclusively through secured API interfaces, the weights in principle meet these conditions. The commercial value is evident from the substantial investments in compute and the model's market position. Once a malicious insider, a compromised hosting partner, or an external attacker steals and publishes the files, this constitutes unlawful acquisition, disclosure, or use within the meaning of Article 2 of the Wbb.

The weak point of trade secret protection, however, arises as soon as the information circulates widely on the public internet. Once widely disseminated, the information loses its secret character. Although the original leaker or thief remains liable for the damage suffered, enforcement against third parties who simply download the files from public networks becomes extremely complex. Third parties can, after all, argue that they acted in good faith or that the "secret" status has legally evaporated due to uncontrolled public availability.

Criminal Qualification: Theft Versus Unauthorized Computer Access

In criminal law, the unauthorized copying of digital files has historically led to differences in interpretation. Under classic Dutch criminal law, theft (Article 310 of the Wetboek van Strafrecht) requires the "taking" of "any good" belonging to another, with the intent of unlawful appropriation. When files are copied digitally without the original disappearing from the owner, there is strictly speaking no taking in the physical sense. The Hoge Raad has, in case law (such as the Runescape ruling), classified virtual goods as a "good" under specific conditions, but for the mere copying of data, theft remains a difficult article to apply.

For this reason, criminal prosecution of data exfiltration of weights almost always proceeds via the offenses surrounding unauthorized computer access and data manipulation:

• Unauthorized computer access (Art. 138ab Sr): Intentionally and unlawfully breaking into an automated system using a false key, a false capacity, or by breaching security.
• Unlawful acquisition of data (Art. 138c Sr): Intentionally and unlawfully acquiring, intercepting, or recording data not intended for the perpetrator and stored or processed in an automated system.
• Violation of trade secrets (Art. 273 Sr): Intentionally disclosing data that one knows or reasonably should suspect one is obliged to keep secret by virtue of one's position, profession, or office.

The technical vulnerabilities and attack vectors that lead to such data leaks closely align with the general threat landscape in AI systems. For a deeper look at these attack mechanisms, see the article on AI and cybersecurity in today's threat landscape.

Comparison of Legal Frameworks in Model Leaks

To clarify how the different areas of law respond to unauthorized exfiltration and distribution of model weights, the table below compares the main legal routes, their requirements, and their practical enforcement limitations.

The Downstream Dilemma: Liability of Users and Hosts

When a leaked model becomes publicly available, companies and software developers face the question of whether they may download, run locally, fine-tune, or commercially deploy these weights. Downloading data that one knows or reasonably ought to know originates from a crime or an unlawful act carries significant risks.

Under civil law, rights holders can argue that whoever knowingly and deliberately uses a leaked trade secret acts contrary to what is socially appropriate (tortious act under Article 6:162 of the Burgerlijk Wetboek), or directly infringes Article 2(2) of the Wbb. Companies that integrate leaked weights into their operational software risk court injunctions to destroy the derived models, cease service provision, and pay compensation for damages and lost profits.

When setting up enterprise software, the licensing distinction between official open-weights distributions and illegitimate leaks is of fundamental importance. For insight into the legal conditions of legitimate distributions, see the dossier on commercial usage rights for open models. Within the open community, too, there is a strict distinction between formal licenses and unauthorized publications, as further explained in the overview of the licensing debate around open-weights models.

For hosting providers and platforms such as Hugging Face or GitHub, the regime of the Digital Services Act (DSA) applies. Once they receive a substantiated notice (Notice-and-Action) that a hosted repository contains stolen intellectual property or an unlawfully obtained trade secret, they must promptly remove or block access to retain their liability exemption.

Compliance with the EU AI Act When Using Unauthorized Models

In addition to civil and criminal aspects, European regulation introduces administrative-law risks for organizations working with leaked models. Under the European AI Regulation, specific obligations apply to providers and deployers of AI systems, particularly regarding transparency, documentation, and risk management.

Anyone who downloads a leaked model and repackages it as a commercial application is, under the AI Act, generally regarded as the formal provider of that system. This brings heavy obligations:

• Technical documentation: The provider must be able to produce detailed technical documentation about the training process, the datasets used, and the evaluation methods. For a leaked model, this data is almost always missing, making compliance impossible.
• Copyright compliance of training data: Article 53 of the AI Act obliges providers of General Purpose AI (GPAI) models to publish a detailed summary of the training data used. A downstream user of a leaked model cannot meet this requirement.
• Cybersecurity and robustness: Without insight into the origin, the integrity of the weights cannot be guaranteed. There is a real risk that the leaked files have been deliberately manipulated (backdoors or data poisoning).

Adopting unverified and leaked models clashes directly with the obligations surrounding conformity assessments. More context on the phased introduction and operation of this legislation can be found in the analysis of the EU AI Act in outline.

Digital Forensics: Watermarking and Fingerprinting in Weights

One of the biggest operational challenges for affected model builders is proving that an externally running model or a commercial API is actually based on their leaked weights. Model weights can, after all, be quantized (for example, from 16-bit float to 4-bit precision), fine-tuned on new data, or distilled into a smaller student model, changing the raw numerical values.

To ease this burden of proof, laboratories deploy advanced tracing techniques:

# Conceptueel voorbeeld van parametrische verificatie via trigger-sets
def verify_model_weights_provenance(model_api_endpoint, canary_inputs, expected_signatures):
    """
    Verifieert of een model verdachte sporen vertoont van een specifieke 
    gewichtenoorsprong via deterministische 'canary' input-output combinaties.
    """
    matches = 0
    for prompt, expected_signature in zip(canary_inputs, expected_signatures):
        response = model_api_endpoint.generate(prompt, temperature=0.0)
        if expected_signature in response:
            matches += 1
            
    confidence_score = matches / len(canary_inputs)
    return {
        "is_unauthorized_copy": confidence_score > 0.95,
        "confidence": confidence_score
    }

These methods broadly fall into two categories:

1. Structural parameter watermarks: Subtly manipulating specific matrix values during training without compromising model quality. These watermarks can be mathematically read out when the raw files are seized.
2. Behavioral fingerprinting (canary injections): Including unique, rare prompt-response pairs in the training data. When an externally running model generates the exact same random sequence of tokens for extremely specific sentences, this provides convincing statistical evidence in court of unauthorized appropriation.

The Future of the Legal Framework Around AI Assets

The current situation shows that traditional intellectual property law is poorly equipped for the material reality of machine learning. Because model weights are neither pure software, nor classic databases, nor traditional copyrighted works, a strong dependence on trade secrets and criminal law provisions arises. These instruments function reasonably well as long as files remain internal, but fall short once a leak leads to worldwide decentralization via peer-to-peer protocols.

In the coming years, legislators and judges will have to determine whether there is a need for a new, specific property right for trained neural models (a sui generis model right), comparable to the historical development of chip and plant breeders' rights. Until then, organizations that use leaked weights operate in an extremely risky gray area, where civil liability, loss of intellectual property over derived products, and heavy administrative-law sanctions under the AI Act converge.