Comment by MLCommons

You can’t patch a released, open-weight model. This is the property that breaks the assumptions of the prior model of responsible disclosure. Open-source software can be patched in place; a deployer updates and the hazard closes. An open-weight model cannot. A new version is a new artifact, not an update. Every copy of the prior weights stays operational, unmodified, and in the hands of anyone who retained them – indefinitely.