Model Weights Are the New Cryptography: A Beginner’s Guide

A short essay is doing laps on Hacker News right now with a very specific claim: model weights are the new cryptography. The argument is simple. In the 1990s, publishing strong encryption from the United States could get your code classified as a weapon. Today, publishing frontier model weights can trigger export licensing under a brand-new control category. Same fight, different math.

The essay isn’t wrong. But almost every response to it stays in the policy lane – think pieces about the Bureau of Industry and Security, quotes from lawyers, historical asides about OpenBSD. That’s fine reading. It’s also useless if you actually build things with these models. This piece takes the opposite approach: if weights really are the next cryptography, the sensible move is to download the ones you care about now, keep local copies, and learn to run them. That’s the tutorial.

Two ways to read this moment (one is clearly better)

Reading A: “This is a policy problem. Wait for the courts / the next administration / the trade lawyers.” This was the exact posture crypto users took in 1996. It cost the field five years.

Reading B: “Weights that already exist on my SSD are outside the regime. Everything else is subject to change by letter.” This is the OpenBSD posture – do the thing while doing the thing is still legal, and keep the artifact.

Reading B is better for one specific reason: the current U.S. rule has an explicit carve-out. Per BIS’s January 2025 announcement, models with widely available weights are not subject to controls. Once you have the file, the licensing regime doesn’t reach it. That’s not a loophole – it’s the actual text.

Why the analogy holds (and where it doesn’t)

The historical parallel comes from a widely-shared essay that recounts how OpenBSD shipped its Blowfish implementation on a T-shirt with the source code printed down the back – code that, if written inside the United States, would have been classified as a weapon. The workaround was jurisdictional: write it in Germany, build it in Sweden, distribute from Canada.

The weights version of this is already happening. Mistral, DeepSeek, and Zhipu publish weights that, once downloaded, no export letter can recall. The June 12, 2026 U.S. directive that accomplished the same outcome as the rescinded Diffusion Rule through a letter only works on closed models. Export controls on closed-weight frontier models are enforceable precisely because the models are closed – pull the API, and the model is gone. Open weights don’t have this vulnerability.

Where the analogy strains: crypto was a small math object. A 70B-parameter model is 40+ GB after quantization. You need storage, VRAM, and a plan. The rest of this guide is that plan.

For the technically curious: The academic framing predates the policy. A 2020 paper by Carlini et al. – Cryptanalytic Extraction of Neural Network Models – framed model extraction as a chosen-plaintext attack on a nontraditional “encryption” function. The weights-as-cryptography metaphor isn’t marketing; it’s how researchers already think about it.

The recommended setup: Ollama + three specific pulls

You want a tool that (a) is a single install, (b) manages disk and GPU for you, and (c) speaks the OpenAI API so your existing code works. That’s Ollama. It wraps llama.cpp with a single-command interface for model management, provides an OpenAI-compatible REST API out of the box on localhost:11434, and handles GPU offloading automatically.

Step 1 – Install

Go to ollama.com and grab the installer for your OS. On Linux, the install script also registers a systemd unit so the server survives reboots. Verify with:

ollama --version
ollama serve # starts the local API on http://localhost:11434

Step 2 – Pull three models that matter, right now

Pick based on your hardware. Sizes below are Q4 quantized (disk footprint roughly equals VRAM needed).

Model choices are current as of July 2026 and will drift – Qwen3 quietly became the answer to “what should I run locally?” for most developers this year, but that consensus turns over fast. Pull now, evaluate later.

Step 3 – Confirm the GPU is actually being used

This is the step that gets skipped, and it’s the one that quietly ruins the experience on Windows. If no supported GPU is found, or if the model doesn’t fit in VRAM, Ollama falls back to CPU – output is correct either way, but on a 7B model, CPU inference runs 10-30x slower: a 30-second response instead of under 2. Run:

ollama run qwen3:8b "Say hello"
ollama ps # in another terminal

The ps output shows a PROCESSOR column. If it says 100% CPU and you own a GPU, your drivers are the problem – not Ollama. Update NVIDIA drivers, then reinstall.

A real workflow: keeping your copy from being overwritten

Here’s a gotcha nobody flags. ollama pull qwen3:8b re-fetches the latest tag every time you run it. If the upstream repo gets pulled from Hugging Face – which has happened to several models in the wake of the June 2026 letter – running pull again on a machine with an internet connection will attempt to overwrite your working copy. There’s no confirmation prompt.

The fix is to pin the digest and back up the blob:

# find the digest of the version you're happy with
ollama show qwen3:8b --modelfile

# back up the actual weight blobs (Linux/macOS default path)
cp -r ~/.ollama/models ~/backups/ollama-models-$(date +%F)

# on Windows: %USERPROFILE%.ollamamodels

The blob store is content-addressed. If you keep the files, you keep the model – even if it disappears from every registry tomorrow. This is the modern equivalent of the OpenBSD CD.

Four things you learn the hard way

• Context windows lie. Llama 4 Scout advertises 10M tokens. Long-context inference is memory-hungry: on consumer hardware, you will hit VRAM limits well before the theoretical maximum. Test with your actual longest input before designing a workflow around the marketing number.
• Point your existing OpenAI code at Ollama. Set the base URL in your framework to http://localhost:11434/v1 and use any model name you have pulled. LangChain, LlamaIndex, the OpenAI Python SDK – all of them work with no other code changes.
• Disk fills faster than you expect. Large models (30-70B at Q4) can require 20-40 GB. Three of those and you’ve eaten a hundred gigs. Use ollama rm aggressively.
• The rule doesn’t cover outputs, yet. Legal analysts tracking the BIS framework have flagged model outputs as the next likely target for export controls – worth watching, not worth panicking about.

What China’s parallel move means for you (short answer: mirror early)

In July 2026, China’s Ministry of Commerce began consulting Alibaba, ByteDance, and Z.ai on export controls covering the country’s most advanced AI model weights, training data, and semiconductor designs – a decisive policy reversal, first reported by the Financial Times on July 21, 2026 and confirmed by Reuters the same day. Qwen and DeepSeek weights are currently open. That status is not guaranteed to persist.

Which raises a question the docs don’t answer: if both the U.S. and China start restricting frontier weights simultaneously, what happens to the models trained in one jurisdiction and hosted on servers in the other? Nobody knows yet. But every day the answer is unknown is a day you can still ollama pull.

FAQ

Is downloading open-weight models from China legally risky for a U.S. user?

Not under current U.S. export controls (as of July 2026). The BIS rule regulates exporting controlled weights, not importing open ones. Sanctions law is a separate question – but for the models named above, there’s no restriction on pulling them to your machine.

What if I already use ChatGPT or Claude – why bother with local models?

The reason only becomes clear the first time an API gets revoked or deprecated. A local model doesn’t get taken down by a policy letter – your gpt-oss:20b will run identically five years from now if the file still exists on disk. There’s also the prompt privacy angle: a hospital, law firm, or journalist working with a source has legitimate reasons to avoid sending queries to a third-party server. That said, if neither scenario applies to you, hosted models are genuinely easier. This is a hedge, not a religion.

Do I need a fancy GPU?

No. An 8 GB laptop runs llama3.2:1b or qwen3:1.7b fine for chat.

Do this now

Install Ollama, pull one model from the table above, then copy your ~/.ollama/models folder to an external drive. That’s the whole action. If the analogy holds, in five years the copy on that drive will feel exactly like the OpenBSD CD does now – a small artifact from a fight you didn’t quite realize you were part of.