After the open source model is made public, what is really fragile is the default route

把问题写成“美国能不能封印”，答案通常没那么戏剧。 Weight files won’t necessarily disappear from the world, but default routes can easily be overridden.一个 Hub 地址、一个 SDK 默认值、一个线上推理入口，只要被当成理所当然能用，后面的自动化就会跟着一起脆。

从一个地址开始

开源模型最初只是一个地址。拉取、评测、部署、回归，所有动作都指向同一个入口。上游没变的时候，这条路看起来像是“顺手”，甚至像是理所当然；上游一变，才知道当初依赖的不是模型能力，而是那条默认路径。

The most common breakpoint in the project is not “cannot get the model at all”, but “can still get it, but not the original one”. Mirror synchronization is slow, aliases are switched, regional access is restricted, the default version is moved, but the script is still running at the old address. The model ontology is still there, but the process has begun to deviate.

Failure occurs in automation first

It is not difficult to switch images manually, but the difficulty is that automation does not understand it by itself. CI, scheduled evaluation, container construction, experiment records, document examples, and local scripts of colleagues may all copy the same default value. As long as nothing is changed, the old entrance will continue to pop up.

This is also where the term “seal” is most misleading.真正发生的变化，往往不是权重被抹掉，而是默认值被改写。外面看起来还是同一个名字，里面已经换了入口、换了版本、换了依赖。 For humans, this is just a switch; for automation, it is a broad behavioral drift.

The weight can be moved, but the default value cannot be moved.

开源模型的一个重要优势，是权重可以被复制、镜像、分叉和离线保存。 The problem is that the file is copied, not the default path.只要消费侧还把某个外部入口当成唯一真相，权重再开源，运行方式也还是会被外部规则牵着走。

更麻烦的是，这种变化不一定立刻报错。很多时候看上去还能跑，结果却已经不一样了：一套评测在镜像 A 上过了，另一套在镜像 B 上抖了；一个版本在本地可用，到了流水线里却变成另一个补丁集；同一个模型名字下面，实际行为已经开始分叉。

Two things need to be distinguished here. The supply chain problem is more like file management and version management, and the default routing problem is more like runtime decision-making.前者关心有没有备份，后者关心请求先走哪条路。 As long as the default value is written externally, external actions can directly override the workflow.

What needs to be supplemented is the pin, mirror and fallback route.

能补的办法并不复杂，只是很少有人把它们当成第一优先级。

The version should be pinned to a specific commit, hash, or clear release, and do not rely on names like latest that can drift for a long time. It is best to put weights, tokenizers, configurations and inference images into the internal warehouse together, at least to ensure that they can be rebuilt when the network is disconnected.默认入口要有回退路由，不能只有一个线上地址。评测样本和旧结果也要留档，否则连“变了多少”都说不清。

These things all look like operation and maintenance details, but they are actually taking back control from external defaults. Without this layer of closure, open source will only bring “appearance of freedom” but not “actual controllability”.

开源模型公开以后，真正脆的不是权重本身，而是默认路由。只要入口还握在别人的默认值里，模型再开放，工作流也还是会先抖。