# Open-weight Frontier Ledger — Bills Draft (v0.1)

> Stage 2 (BILLS). Pre-sweep. **14 bills + 6 meta-costs + 3 escape gates**, with
> **3 ★ predicted-empty** at positions 5, 8, 11.

## The fourteen bills

| # | Bill | What gets paid | ★ |
|---:|---|---|:---:|
| 1 | Fine-tuning safety-erosion audit | Lermen-Rimsky cost-ratio (~10× cheaper to undo safety than train it). | |
| 2 | Distillation cousin half-life | Frontier open-weight reported with empirical distilled-cousin half-life (target 3.4 months median). | |
| 3 | Bio / chem dual-use uplift | Mouton-Lucas + Apollo Q4-2024 uplift baseline; downstream cousins re-evaluated. | |
| 4 | Cyber / hacking dual-use uplift | METR Q1-2025 cybersecurity capability eval baseline. | |
| 5 | **★ Distillation-resistant capability** | Capability with ≥10× compute ratio at frontier that survives distillation. Halevy-Heim-Pilz predicted: 0/14. | ★ |
| 6 | Weight-release-vs-API-access asymmetry | Same model deployed open-weight + API: capability/safety drift between modes. | |
| 7 | Sleeper-agent / backdoor persistence | Hubinger 2024 lineage. Open-weight increases sleeper-agent surface. | |
| 8 | **★ Cross-deployment-surface generalization** | Raw weights → fine-tune → quantize → distill → deploy. Asymmetric pattern: caps transfer, safety doesn't. Direct cousin to Inference-time Safety Bill 14 ★. | ★ |
| 9 | Vendor / lab-card independence | Open-weight claim reproduced by METR / Apollo / AISI / Stanford CRFM. | |
| 10 | Re-pretraining cousin audit | Cousin to distillation: 3-7 months from frontier release to re-pretrained cousin matching 80-90%. | |
| 11 | **★ Open-weight gating regulation achieves stated purpose** | BIS Diffusion Framework rescinded May 2025 (4-month lifetime). EU AI Act 10²⁵ misses Llama 3.1 405B (3.8×10²⁵). | ★ |
| 12 | Distillation-recipe lifecycle | Recipes published 2025-Q1 reduce target/distilled FLOPs ratio from ~100× to 1000-50000× within 6 months. | |
| 13 | Inference-cost-as-deterrent transparency | Per-task FLOP / inference-token / cost disclosed. | |
| 14 | Test-time-search-as-amplifier on open-weights | 1B + 256-sample search > 405B baseline. | |

## Six meta-costs

| # | Meta-cost | Description |
|---|---|---|
| M1 | Toy-model only | ≤30B params. |
| M2 | Closed-weight-only | No open-weight equivalent baseline. |
| M3 | Single-fine-tuning-recipe-only | Single LoRA / DPO / full-finetune recipe. |
| M4 | Pre-distillation-era | Predates 2024-Q4 distillation-budget compression. |
| M5 | No-jailbreak-audit | Safety claim w/o jailbreak / fine-tuning-erosion audit. |
| M6 | Implementation-specific | Specific quantization / inference / distillation scaffolding. |

## Three escape gates: G1 methodology, G2 negative-result, G3 theoretical-construction.

## Iteration plan

- **Batch 1 (8 sweeps):**
  - sweep_401: Open-weight frontier model cards (Llama 3.1-405B, Llama 4, DeepSeek V3/R1, Qwen 3, Mistral Large 2)
  - sweep_402: Lermen-Rimsky safety-erosion lineage
  - sweep_403: Halevy-Heim-Pilz distillation-resistance + Pilz-Heim circumvention
  - sweep_404: R1-Distill / Sky-T1 / Phi-4-reasoning / OpenThoughts cousins
  - sweep_405: Bio / chem / cyber dual-use audits (Mouton-Lucas, Apollo, METR, IBBIS)
  - sweep_406: Re-pretraining cousins / pseudo-distillation
  - sweep_407: Sleeper-agents / Hubinger / Apollo backdoor persistence
  - sweep_408: Vendor / lab-card replication audits + open-weight gating regulation (BIS, EU AI Act, Cohen-Sevilla)