Can Europe Use Open Weight Models to Accelerate Sovereign AI?

In my previous post on Sovereign AI suggested a dual strategy for Sovereign AI: bridge the gap with a vetted pool of open weights. This post explores what “vetted” and “use” have to mean – three moves, and one limit we cannot engineer away.

Beyond download and run

In Responding to the Anthropic Ban, I argued that the answer to frontier-model dependency is not to build our own frontier model on a crisis timetable, but a dual strategy: bridge now with a vetted pool of capable open-weight models, and build genuine ownership of the critical tier over time^[1]. I was careful about one word. “Vetted,” I wrote, “means managed risk – provenance control, evaluation, runtime monitoring – not a clean bill of health, since the weights themselves cannot be fully audited.”

This post takes up that caveat. The practical question is not whether open weights can match the frontier, since they now nearly do, but what it takes to use them without inheriting someone else’s risk, and whether they can be made to accelerate a sovereign programme rather than merely sustain one.

They can, and the logic is the one China has already demonstrated. Using them, though, has to mean more than download and run: three disciplined moves, and an honest reckoning with the one thing none of them fixes.

Pruning open weights into foundations

Start with the cheapest acceleration on the table: someone else already paid for the expensive part. Open weights now trail the closed frontier by only about four months^[14], so what you borrow is very close to the state of the art.

A large open-weight model is a pretrained representation that cost tens of millions to learn. Depth pruning – removing whole transformer blocks – lets you cut such a model down to a size you can afford to own and retrain. On selected question-answering benchmarks, some large models retained much of their performance after substantial layer removal, up to roughly half in the strongest case, provided the model was then healed with a short parameter-efficient fine-tuning pass^[3]. Reasoning performance was more fragile, so the usable pruning ratio has to be established task by task. You inherit the representation; you pay only for the adaptation.

Do this on European, rights-cleared, multilingual data and you may gain a measure of hygiene along the way. Separate research suggests that targeted attention-head pruning, combined with clean-data fine-tuning, can weaken certain backdoors in transformer classifiers^[4]. Whether whole-block pruning provides the same protection in modern generative models remains unproven, so treat any security benefit as a possibility to test, not an assurance.

Be honest about how much. A backdoor need not sit in the blocks you delete, and the most robust triggers are spread across the network rather than parked in one place^[5]. At best, pruning-and-healing raises the cost of a surviving backdoor; it does not prove a model clean. The healing pass, not the deletion, is doing the real work – and the pipeline that runs it, not the checkpoint, is the sovereign asset.

There is a provenance trap here worth naming. If your reason for pruning is fear of a foreign-origin backdoor, building your sovereign model on that same foreign base is self-defeating, unless the strip-and-heal is aggressive enough to count as genuine retraining. At which point a permissive Western base, or a transparent European one, gives you the same acceleration with a cleaner story. Prune for capital efficiency against bases you already trust. Do not prune to launder a base you do not.

Ownership of the pipeline does not remove the surrounding legal obligations. In Europe, the AI Act’s general-purpose-model rules have applied since August 2025, although ordinary fine-tuning will not usually make the modifier a new GPAI provider under the Commission’s current guidance^[16]. Licence terms, copyright reservations, personal data, documentation and the obligations attached to the eventual use case still have to be handled explicitly. “Rights-cleared” must therefore describe the whole pipeline, not merely the final training corpus.

Copy the logic, not the application

The sharpest proof that this works is not European. In 2024, researchers linked to the People’s Liberation Army fine-tuned Meta’s Llama into a military intelligence tool, ChatBIT, and reported strong results against selected comparison models on their own military-domain evaluation^[8]. Meta’s licence forbade military use: the Llama 2 acceptable-use policy prohibits military, warfare and espionage applications. It made no difference.

I wrote before that the lesson is to copy not the application but the logic. Here is the logic, stated plainly: a frontier-model disadvantage need not decide the outcome; what decides it is what you build, what you build it on, and how fast. ChatBIT’s value did not come from Llama; it came from the proprietary military corpus they fine-tuned it on. The base was free, and much of the domain-specific advantage lay in the data and adaptation.

Two cautions keep this from becoming a slogan. First, ChatBIT is a command and intelligence model – text, analysis, decision support. It did not fly drones. Nor does the recipe transfer cleanly to every layer of autonomy: the compact vision, navigation and control models that operate on edge hardware face different constraints, where chips, sensors, embedded software and real-world validation may matter more than access to a downloadable language model. Do not let the ease of the thinking layer flatter you into believing you have solved the flying one. Second, if licences are only paper – and ChatBIT proves they are – Europe should not build a doctrine that rests on an American licence staying permissive. Prefer bases whose terms and provenance you control.

Vetting means adversarial testing

Which brings us back to the word I underlined: vetted. You cannot vet a model you merely trust. You vet it by trying to break it – and here open weights are not just acceptable but preferable.

The capability is real, though it belongs to LLM-based systems generally, closed and open, often with substantial scaffolding. Such systems can now find exploitable flaws in production software, generate working exploits from advisories and execute multi-stage attacks in controlled environments. Some have outperformed most human teams on structured capture-the-flag exercises^[9][10], although those benchmarks remain easier and more constrained than real operations. Open weights are nonetheless the right tool for a sovereign testing harness, for two reasons. They run locally or air-gapped, so findings about national systems never leave national hands. And their refusal behaviour, which would otherwise obstruct authorised security testing, can be adapted locally.

That second property is precisely why the same models are dangerous in other hands, and the governance has to be built for it. Model-level refusal behaviour in open weights can be stripped in minutes on consumer hardware using publicly available tools^[11], and separate research has shown that safety alignment can be seriously degraded with as few as ten adversarial fine-tuning examples^[15]. But those are model-level controls. Deployment controls – tool permissions, network egress, monitoring – are separate, and they are where the real line sits. The line between a defensive harness and an offensive tool is not capability. It is authorisation and containment. So a sovereign harness is defined by its controls, not its models: consenting and owned targets only, no outbound network, an allowlist on every action, full audit, no standing credentials. Get those right and a capable open model becomes the best red-teamer you can field. Get them wrong and you have built the thing you feared.

The line between a defensive harness and an offensive tool is not capability. It is authorisation and containment.

You cannot audit your way to trust

All three moves run into the same wall, the one I flagged in the first post: you cannot fully audit a multi-billion-parameter model for what is in it. It helps to be precise about what “in it” even means, because four different risks get muddled under “backdoor,” and they need different answers.

A weight-embedded backdoor is a trigger-conditioned behaviour baked into the weights – the true sleeper agent, dormant until it fires. A supply-chain compromise is a tampered checkpoint or a poisoned adapter – a problem of the artefact, not the model. Persona bias is the model behaving differently according to who you say you are – a policy property, not a covert trigger. And inference-time poisoning arrives through the data you feed at run time – not a property of the model at all. Conflate them and you will reach for the wrong defence.

The evidence on the first is genuinely uncomfortable. A backdoor built to survive can survive: Anthropic’s sleeper-agents work trained a model to write safe code in one year and exploitable code in another, and standard safety training – supervised, reinforcement, adversarial – failed to remove it^[5]. In one denial-of-service experiment, 250 poisoned documents were enough to implant a reliable gibberish-producing trigger across models ranging from 600 million to 13 billion parameters, and the number required did not rise with model size, although the result has not yet been shown to generalise to every kind of backdoor^[6]. A 2026 preprint extended the same idea to tool-using agents, demonstrating destructive behaviour activated by a date-based trigger while benign benchmark performance remained intact^[7]. Detection is improving: Microsoft’s 2026 scanner uses memorisation, attention and trigger-tolerance signals to identify some backdoors without prior knowledge of the trigger^[12], but it works best on deterministic trigger-response behaviour and is one component of assurance, not a general proof that a model is clean. You can raise the cost and bound the blast radius. You cannot issue a clean bill of health.

The persona risk, by contrast, is the one you can see for yourself, and it is origin-specific. In its report What’s In America’s Code?, Booz Allen ran more than 2,800 trials and found three of four leading Chinese models produced materially more vulnerable code when the user was identified as working for the US government, with Qwen3-Coder adding roughly 130% more flaws under that persona^[13]. That is not a hidden trigger. It is a measurable bias, and a differential test across models of different origin surfaces it without hand-waving.

So the honest posture is the one the first post named: managed risk. Treat national origin as a prior, not a verdict – the Chinese-origin behaviours are real and reproducible, but Western weights are not immune, because a weight-embedded backdoor is origin-agnostic and can enter through any adapter in the chain. Rank models by the assurance available for them – reproducible builds, disclosed data, third-party evaluation – not by flag. And let containment, not faith, carry the weight: a model that cannot phone home, cannot hold credentials and cannot act unattended has had its blast radius bounded whether or not it is clean.

Where the lasting advantage lies

Return to where the first post ended. The decisive contest is not who builds the most capable model, but who can turn the models they can reach into systems they can rely on. Open weights are how Europe reaches capability it did not pay to create. Pruning turns them into foundations; adaptation turns foundations into sovereign tools; the harness is how you earn the right to trust any of it.

None of this removes the model-layer dependency, and none of it should pretend to. What it does is exactly what the dual strategy asked for^[2]: it lets you swap the model rather than be captured by it, and it puts the sovereign value where no download can reach, in the data, the pipeline and the controls. That is where real ownership accrues, and it is the part worth building, because it is the part that lasts.

John Sotiropoulos is Founder of Deep Cyber Ltd and author of the official Implementation Guide for the UK’s AI Cyber Security Code of Practice, now the basis for the ETSI baseline standard. He is a Board Member of the OWASP GenAI Security Project and Co-lead of the Agentic Security Initiative, where he chairs the OWASP Top 10 for Agentic Applications. The full argument is in the working paper When Agents Go to War.