Who Does Withholding Delay? A Game-Theoretic Model of Open-Weight AI Release Under Asymmetric Proliferation

2026-07-24

AI Summary

This study addresses the trade-off between safety and utility in the release of open-weight AI models, cautioning that overly restrictive access policies may inadvertently accelerate malicious actors’ acquisition of alternative models. The authors develop a game-theoretic framework to analyze laboratories’ optimal strategies under controlled access, defender-first windows, and protective openness. Introducing the novel concepts of “access inversion” and “asymmetric empowerment,” the work systematically quantifies the security efficacy boundaries of these strategies in heterogeneous actor environments. Through linear and nonlinear game modeling, high-dimensional sensitivity analysis, and a policy evaluation framework, the study identifies critical variables—such as substitution timelines and marginal capability gains—and delineates the conditions under which each strategy is effective. It demonstrates that defender-first windows combined with revocable safeguards significantly enhance security under specific parameter regimes.

Abstract

Restricting access to a dual-use AI model is precautionary only if it delays harmful actors more than defenders. That condition varies across actors: a state agency or organized criminal group may obtain a substitute through theft, distillation, intermediated access, independent development, or a foreign release, while a small utility or open-source maintainer may have no comparable route. We model a laboratory choosing among controlled access, a defender-first window, safeguarded open weights, and minimally restricted open weights. Access inversion occurs when restriction gives an access advantage to adversaries that obtain effective substitutes faster than defenders. Asymmetric empowerment occurs when immediate release adds the most capability to populations least likely to possess a substitute. The policy ranking also depends on relative usefulness, opportunistic misuse, offense-defense conversion, defensive spillovers, safeguard friction, and nonrecallable losses. A linear benchmark yields a unique adversary-substitution threshold above which broad release overtakes control when the endpoint conditions hold. A defender-first window has value when selected defenders deploy protection before adversaries catch up, and removable safeguards remain useful when they deter enough opportunistic misuse. A nonlinear implementation gives each release tier a nonempty policy region. Three nested 2,048-point deterministic designs assess sensitivity to parameter bounds, and a separate grid examines actor-specific deployment delays after release. Release, cyber-evaluation, and incident-response cases identify the quantities a release review should estimate: actor-specific substitution times, marginal capability gains, deployment rates, defensive reach, newly enabled misuse, and nonrecallable losses.

Problem

• AI release
• asymmetric proliferation
• dual-use AI
• access restriction
• adversary substitution

Innovation

• game-theoretic model
• asymmetric proliferation
• open-weight AI release
• access inversion
• defender-first window