Cas (Stephen Casper)

Open-weight model safety is AI safety in hard mode. Anyone can modify every parameter. @scasper.bsky.social: Open-weight models are only months behind closed models, which are reaching dangerous capability thresholds. 2026 will be critical.👇

This is not a new report (it's from last summer). But it's now finally available on SSRN, more accessibly than before. Great working with Claire Short on this.

papers.ssrn.com/sol3/papers....

I made a fully-open, living document with notes and concrete project ideas about tamper-resistance and open-weight model safety research.

You, yes you 🫵, should feel free to look, comment, or message me about it.

docs.google.com/document/d/1...

I would love to see the draft. scasper@mit.edu

"Policy levers to mitigate AI-facilitated terrorism"

"The biggest AI incidents of 2026, and how they could have been prevented"

"Technocrats always win: Against 'pluralistic' algorithms and pluralism-washing"

“Is your Machine Unlearning Algorithm Better than a Bag-of-Words Classifier? (No)”

"Don’t overthink it: extremely dumb solutions that improve tamper-resistant unlearning in LLMs"

...

Here are some miscellaneous title ideas for papers that I'm not currently working on, but sometimes daydream about. Let me know if you are thinking about anything related.

Research on tamper-resistant machine unlearning is funny.

The SOTA, according to papers proposing techniques, is resistance to tens of thousands of adversarial fine-tuning steps.

But according to papers that do second-party red-teaming, the SOTA is just a couple hundred steps.

To people working on adversarial vulnerabilities for safeguards against AI deepfake porn, I'm glad you're doing what you're doing. But don't forget that mitigations matter, & we're not always up against sophisticated attacks. Half the time, the perpetrators are literal teenagers.

And we also have to remember that in this domain, like half of the perpetrators are literal teenagers.

But mitigations matter. There is evidence from other fields like digital piracy that reducing the accessibility of illicit things drives up sanctioned uses, even when perfect prevention isn’t possible…

Probably by restricting their distribution on platforms like civitai under the same kind of law.

Sometimes people tell me, “that kind of stuff is not gonna work because models will still be accessible on the Internet.”…

Finally, this seems like the right thing to do anyway. It would be a strong protection against training data depicting non-consenting people or minors. And many people might reasonably consent to their NSFW likeness to be online in general without consenting to AI training.

This kind of approach would make the creation of NCII-capable AI models/apps very onerous. Meanwhile, Congress probably would not run into 1st Amendment issues with this type of modification to fair use law.

Or B: The developer could alternatively attest/verify that they developed the system using an externally sourced dataset known to satisfy A1-A3 for their usage.

A3: Third, the developer would be required for a period (e.g. 10 years) to preserve a record of the unredacted list, all contracts signed by subjects, and their contact information.

A2: Second, the declaration must attest that all subjects provided affirmative, informed consent for their NSFW likeness to be used to develop this technology.

A1: First, the declaration needs to present a redacted list (unless subjects consented to non-redaction) of all individuals whose likeness was involved in developing the technology -- i.e. all humans whose likeness is depicted in pornographic training data.

In practice, we could prohibit NCII-capable models/applications unless they are hosted/released alongside a declaration under penalty of perjury from the developer, with a few requirements: Either (A1, A2, A3) or B.

Instead, I think there is a viable alternative that doesn't categorically restrict NSFW AI capabilities. Instead, we could simply require that anyone whose NSFW likeness is used in training a model or developing software offer affirmative and informed consent.

Arguing for categorical prohibitions of realistic NCII-capable technology grounds that there is no alternative might work. Both of the above decisions cited viable, narrower alternative restrictions. But I wouldn't hold my breath.

This poses First Amendment challenges in the USA.

1. Reno v. ACLU (1997) prohibits categorical restrictions on internet porn.

2. Ashcroft v Free Speech Coalition (2002) protects legal "child porn" as long as no actual child's likeness is involved.

The technical reality: If we want open-weight AI models that are even slightly difficult to use/adapt for making non-consensual personalized deepfake porn, it is overwhelmingly clear from a technical perspective that we will have to limit models' overall NSFW capabilities.

First, see this thread for some extra context.

x.com/StephenLCas...

🧵 Non-consensual AI deepfakes are out of control. But the 1st Amendment will likely prevent the US from directly prohibiting models/apps that make producing personalized NCII trivial.

In this thread, I'll explain the problem and a 1st Amendment-compatible solution (I think).

One example of how easily harmful derivatives of open-weight models proliferate can be found on Hugging Face. Search "uncensored" or "abliterated" in the model search bar. You'll find some 7k models fine-tuned specifically to remove safeguards.

Legal Alignment for Safe and Ethical AI Alignment of artificial intelligence (AI) encompasses the normative problem of specifying how AI systems should act and the technical problem of ensuring AI systems comply with those specifications. T...

Sorry I forgot the link.

www.arxiv.org/abs/2601.04175

Thanks + props to the paper's leaders and other coauthors.

1. Studying the extent to which production agentic AI systems do or do not follow the law.
2. Studying the legal alignment of deployed AI systems “in the wild.”
3. Using legal frameworks to navigate challenges with pluralism in AI.

There's a lot of good stuff in the paper, but I'll highlight a few of the directions I'm most interested in here...