A real-data falsification-harness ledger for frontier open-weight (≥30B params, weights publicly available) capability claims and dual-use risk-mitigation claims. 8 deep-loop sweeps, 372 raw → 371 unique, hand-arbitrated. Bills 5, 8, 11 ★ NO CLEAN TRIGGER YET (0 clean triggers each). Halevy-Heim-Pilz: 0/14 capabilities found distillation-resistant. Lermen-Rimsky: ~10× cheaper to undo safety than train it. BIS Diffusion Framework rescinded May 2025 (4-month lifetime — shortest documented federal AI rule).
When AI companies release their model weights publicly, what does that actually mean for safety and policy?
Full technical framing continues below: bills, candidates, closure tables, declarations, verification.
A "bill" is a closure mechanism that any frontier open-weight model claim must engage. The 14 bills below were predeclared in bills_draft.md v0.1 BEFORE the 8-sweep batch. Real fire counts come from the hand-arbitrated _batch_1_union.json (371 unique papers).
bills_draft.md v0.1 holds across the 371-paper batch.
Bill 5 ★ (distillation-resistant capability): 24 candidates, 0 clean. Halevy-Heim-Pilz: 0/14 capabilities resistant. Pilz-Heim: 5× compute reduction, 85% retention. R1-Distill / Sky-T1 / Bespoke-Stratos / Phi-4-reasoning at 100–1000× lower compute. Median teacher:cousin compute ratio at 90% retention = 28×.
Bill 8 ★ (cross-deployment-surface): 11 candidates, 0 clean. Asymmetric pattern: capabilities transfer; safety doesn't. Lermen-Rimsky LoRA fine-tuning undoes safety on Llama 2-Chat 70B at ~10× lower cost than training it. Halawi covert malicious fine-tuning: 99% post-tune compliance evading 3 defense layers.
Bill 11 ★ (open-weight gating regulation): 36 candidates, 0 clean. BIS Diffusion Framework rescinded May 2025 (4-month lifetime). EO 14110 revoked Jan 2025 (15-month lifetime). EU AI Act 10²⁵ misses Llama 3.1 405B (3.8×10²⁵). Llama 4, Qwen3-MoE 235B, Hunyuan-Large all ship Apache 2.0 at frontier scale. Cousin to Compute Governance Bill 17 ★.
Open-weight frontier models compress capability-vs-distillation half-life to 3.4 months. Lermen-Rimsky demonstrates ~10× cheaper to undo safety than to train. The ecosystem ships at a cadence the gating regulatory regime cannot keep pace with: BIS Diffusion 4-month lifetime, EO 14110 15-month lifetime.
Cross-ledger coupling: Compute Governance Bill 2 (distillation circumvention) + Bill 11 ★ + Bill 19 (distilled-cousin half-life 3.4 months) ↔ this ledger Bill 2 + Bill 5 ★ + Bill 12. Inference-time Safety Bill 14 ★ (cross-surface) ↔ this ledger Bill 8 ★ — same asymmetric pattern. Capability Benchmarks Bill 19 (vendor-claim half-life 73 days) ↔ this ledger Bill 2 (cousin half-life 3.4 months).
Public update committed within 7 days of any verified clean trigger of any ★ bill.
Live alerts: Meta / Mistral / DeepSeek / Alibaba Qwen open-weight cards · Lermen-Rimsky safety-erosion line · Halevy-Heim-Pilz distillation-resistance · METR / Apollo / AISI · BIS / EU AI Office / Cohen-Sevilla · Apollo o-series / Claude scheming.
aggregate_batch_1.py → bill_classifier.py --arbitrate-union.Every empirical claim resolves to public data. Run the classifier, regenerate the heatmap, audit the corpus, file a falsification.
Public draft v0.2 (2026-05-09) — 371 unique papers across 8 sweeps; Bills 5, 8, 11 ★ NO CLEAN TRIGGER YET with 0 clean triggers each. Corpus, scripts, and classifier outputs are linked below. Bill counts are generated from the documented sweep and arbitration process.