Who can still stop a model you host yourself

Downloading a set of weights feels like the end of the dependency. The model is a file, the file is on your disk, and nobody revokes a file. That is mostly true, and it is worth knowing exactly where the mostly sits — the answer differs from one model to the next, and again at every layer you build on top.

Open weights and open source are not the same thing

A model you can download is described as open, and that word covers at least three separate legal situations. Some releases carry a genuine open-source licence. Some carry a bespoke document written by the company that trained the model, with conditions on what you may do with the output. The download button looks identical either way; the difference sits in the file next to it.

• Apache 2.0 and MIT releases place no restriction on use at all. Qwen has shipped major models under Apache 2.0 and DeepSeek released R1 under MIT — short enough to read in a minute, with no acceptable-use clause attached.
• The Llama community licence is not an open-source licence. It pulls in an acceptable use policy by reference, requires derivative models to carry the name, and sets a commercial threshold above which Meta wants separate terms.
• The Gemma terms attach a prohibited use policy and reserve a right to restrict usage remotely. The policy can also be updated after you have downloaded anything.
• Research-only licences exist and are easy to miss. Several impressive models permit evaluation and forbid production use — a problem you would rather find before the deployment than after.

The instruction is dull: open the licence file in the repository, not the announcement post. The blog says open. The file says what open means here.

What a licence can actually do to you

A model licence is a contract, and a contract is enforced by suing somebody. That is a slow instrument aimed at an identifiable counterparty, which is why it gets used against companies and effectively never against one person running a model on a rented card. It has nothing in common with the automated pipeline behind a copyright complaint, which works because it is cheap and needs no court — the difference set out in how a notice actually works.

The layers that do hold a switch

1. 01The provider you leftAn API key is an account, and an account is revocable at any moment, for any reason, including none. This is the layer most people are escaping, and the only one that stops you inside a second.
2. 02The hub you downloaded fromModel repositories get gated, renamed and removed. That governs whether you can fetch the weights again, or a newer version. It does not touch the copy already on your disk.
3. 03The cloud renting you the cardMost large accelerator providers attach a use-case review and an acceptable-use policy to the hardware itself. That is a live relationship rather than a one-time download, and it can end mid-run.
4. 04The jurisdiction of the metalA court with authority over the building can order the machine seized or switched off. How your model is licensed changes nothing about that, in either direction.

Once the weights are local, only the last two are still connected to anything. And the third is a decision you make on the day you rent, not a condition you inherit.

Building so the levers have nothing to grip

None of this calls for an exotic architecture, only the boring discipline of not depending, at run time, on a service that is free to decline.

• Keep your own copy of the weights on storage you control, checksummed, with the licence file stored beside them.
• Pin the version. A model quietly updated underneath you is an outage that arrives without an error message.
• Let inference start with no network. No licence check, no telemetry callback, nothing that phones home at boot.
• Encrypt the volume holding the weights and any fine-tuning corpus, because that corpus is usually the sensitive half.
• Put the inference endpoint behind a proxy and leave the origin without a public name of its own.

Each has a longer version elsewhere in these notes: keeping a restorable copy, encrypting a rented disk, and keeping the origin quiet. A serving stack is a server like any other.

What we change about this, and what we do not

We rent whole cards with no usage review and no question about what you intend to serve, which takes the third layer out of the picture — the argument in renting a card nobody reviews. We do not take out the fourth, and no host can: the machine sits in a building, in a country, and which country is the choice that outlives every other one. What we can state plainly: a licensing dispute between you and a model vendor is not something our abuse desk acts on, because it is not an order.

The gap between a model you rent and a model you hold is not really technical, since inference is inference. It is that the first keeps alive a relationship somebody at the other end can end, and the second is a file. Everything above is checking that you did not rebuild that relationship somewhere else without noticing.

Published by NoDMCAVPS, an offshore host that files automated DMCA notices instead of forwarding them. What we still remove is listed in the acceptable use policy.