Open Source AI Models Could Disappear at Any Time — Here's How to Back Up the Ones That Matter

The Hidden Threat Facing Open Source Models

This warning from an overseas blogger is not alarmism: the open source AI models you can freely download today may suddenly vanish from their platforms tomorrow. The core problem is that the entire AI ecosystem is dangerously dependent on a single model hosting platform — Hugging Face. It hosts over 3 million models, and most AI tools default to downloading weights from it.

What makes this especially concerning is that NVIDIA has agreed to acquire Hugging Face. Jensen Huang promised when announcing the deal that Hugging Face would remain open to the entire AI ecosystem, and that users wouldn't need NVIDIA hardware to use it. That sounds reasonable — but as the developer of Heretic, a tool for removing model censorship, pointed out, the AI world relies on a massive "single point of failure." If that center goes down, the cost of recovery is enormous, because model files are simply too large.

Here's a telling data point: Software Heritage, the nonprofit responsible for archiving the world's source code, once evaluated backing up Hugging Face. The code portion — roughly 12TB — they were willing to preserve. The model weights, at approximately 40PB, were immediately classified as "out of scope." In other words, the world's largest code archive plans to save the code around the models, but not the models themselves.

Hugging Face is currently the world's largest AI model hosting platform — essentially GitHub for AI — allowing researchers and developers to freely upload, share, and download model weights, datasets, and code. Most mainstream AI frameworks (such as Transformers, Diffusers, and llama.cpp) hardcode Hugging Face repository URLs as their default download source, meaning a single from_pretrained('model_name') call sends traffic to the same platform. The term "Single Point of Failure" comes from systems engineering and refers to any node whose failure causes the entire system to collapse. What makes the AI ecosystem uniquely vulnerable is the sheer size of model files — 40PB is roughly 40 million GB, tens of times larger than typical internet archiving projects — making any backup or migration plan prohibitively expensive at a physical level, creating a platform lock-in even harder to break than in software ecosystems.

The Risk of Chinese Open Source Models Being Banned

According to Axios, shortly after models like Kimi were released, there was renewed momentum within the Trump administration to restrict Chinese open source models. Options on the table included adding Chinese labs to the Commerce Department's Entity List, issuing security advisories urging American companies to avoid them, and an executive order that would only allow US companies to host Chinese models if they could guarantee safety and accept liability for leaks.

None of these measures have materialized, and proposals have reportedly been shot down internally before. But Axios's sources described leading AI labs or their allies showing up every three to five months with new ideas to ban open source models.

Days later, around 20 companies — including NVIDIA, Meta, Microsoft, and Hugging Face — co-signed a letter to Washington asking that open weights not be restricted. Notably absent: OpenAI, Anthropic, and Google DeepMind. Anthropic subsequently published its own position, stating it had never advocated restricting open weights. OpenAI said it had never pushed for a ban, but called for mandatory safety testing of capable models, whether open or closed source.

The reality here is simple: Qwen, DeepSeek^Ad, Kimi, and GLM all come from China. If you're running models locally, a ban targeting Chinese models is effectively a ban targeting the models you're already using. A ban can't reach into your hard drive — models downloaded and running offline are invisible to anyone. The only thing it can shut off is the download button.

Models Have Already Disappeared Before

These concerns aren't hypothetical. Runway once deleted its entire Hugging Face account without warning, taking Stable Diffusion 1.5 with it — a foundational model that a huge number of AI image generation applications had been built upon. The Diffusers library had hardcoded that repository URL as its default, so tutorials and pipelines across the ecosystem started throwing errors that same day. Runway's response was simply that they no longer maintained the Hugging Face organization.

The model survived only because many people already had copies, and someone eventually created a mirror under a new name. Similarly, after the original LLaMA leaked as a torrent, a single DMCA takedown from Meta wiped the download scripts from GitHub along with all 403 forks — but the weights kept circulating.

This reveals an important pattern: the models truly at risk aren't the famous ones (those have millions of copies). It's the long tail — a fine-tuned variant someone uploaded that only a dozen people use, an uncensored fork, or an older version your project is pinned to. Heretic's index has already catalogued 10 models removed from Hugging Face. When Hugging Face joined an open-model safety coalition, TechCrunch's reporting described the 6,000 uncensored models on the site as "a massive problem" — the community interpreted it as a genuine warning signal.

Backing Up Models Like a Smart Prepper

You can't save everything, but you can make precise choices. The advice here is practical: pick the three or four models you'd hate to lose most.

Estimating size is straightforward — at full 16-bit precision, models take roughly 2GB per billion parameters. So a 7B model is about 14GB, and a 27B model around 54GB. If space allows, keep the original files, because the quantized versions you run day-to-day are lossy compressions derived from them — like a JPEG generated from a RAW photo.

The key is backing up completely. Weights alone won't run in five years. Download the entire repository: tokenizer, config, chat template, and generation settings. A wrong chat template lets the model load just fine, but it'll respond like it's had six beers. Keep the license file too — Apache 2.0 grants rights that are "perpetual and irrevocable," so even if the repository changes its license later, your existing copy remains valid, and you'll want that documentation on the same drive. Also record the exact version number and checksum (a fingerprint proving the file hasn't been tampered with), and save a copy of the runtime environment you use — a llama.cpp build or container image. The code around a model rots far faster than the model itself.

Quantization is the process of compressing model weights from high-precision floating point (such as 16-bit or 32-bit) down to lower-precision integers (8-bit, 4-bit, or lower), with the goal of reducing file size and memory footprint so that large models can run on consumer-grade GPUs or CPUs. Common formats include GGUF (used by llama.cpp), GPTQ, and AWQ. Quantization introduces some precision loss — similar to compressing a RAW photo to JPEG. The difference is usually imperceptible in daily use, but the information is lossy and cannot be fully recovered. The recommendation to keep the original 16-bit weights is precisely for this reason: keeping the "negative" means you can regenerate any quantized variant on demand in the future, while keeping only a quantized file forfeits that flexibility. A Chat Template defines the format markers for system prompts, user messages, and model responses in a conversation. Different models use different template specifications, and loading the wrong one causes the model to misinterpret its input structure, significantly degrading output quality.

What Storage Medium Should You Use?

One commenter in the original video burned their models onto M-DISC Blu-rays rated for a thousand-year lifespan. But the math doesn't favor this: archival-grade discs run $7–$10 per 100GB, or roughly $70–$100 per TB. Another commenter went the route of buying secondhand server hard drives.

The top-voted technical reply cut right to the point: a disc that lasts a thousand years is useless if the drive that reads it dies in ten. The more practical solution: two regular hard drives stored in two different locations, with checksums verified every six months. That's enough to sleep well at night.

As for the "pirate version of Hugging Face"? It already exists. Pirate Face lists over 669,000 models as torrents — limited to those with Apache or MIT licenses. For fine-tuned models, if all you have is the recipe file (a roughly 9KB text file), rebuilding takes about a minute as long as you still have the base model. But a full fine-tune requires the dataset and GPU compute hours — those are what actually need to be preserved in full.

A Checksum is a fixed-length hash value computed from a file's contents (common algorithms include SHA-256) and is used to verify that a file hasn't been corrupted or tampered with during storage or transfer. Hard drives are susceptible to "silent data corruption" over long storage periods — files appear to still exist but their contents have quietly changed, with no indication from a standard file manager. Periodically verifying backups with checksums (using tools like sha256sum or md5sum) is a low-cost way to confirm data integrity. Seeding is a BitTorrent term referring to the act of continuing to upload a file to others after you've finished downloading it. The more seeders a file has, the harder it becomes to erase from the network entirely — which is why backing up and then seeding effectively turns personal archiving into a node in a distributed preservation network.

Conclusion: An Evening's Work for Real Peace of Mind

The overall assessment here is cautiously optimistic: a complete ban on open weights is unlikely, because too many large companies depend on them — NVIDIA especially — and you can't recall files that already exist on millions of hard drives.

But the real risk is this: every model disappearance so far has happened without warning, triggered by nothing more than a deleted account or a legal letter. And the cost of insuring against it is just two hard drives and one evening: pick the models you care about, download the complete repositories, put them on two drives, then seed and share.

In the worst case, nothing gets banned, and you end up with a coding assistant that still works when the internet goes down.