Gemma's terms of use: open weights with a leash

What shipped

On 21 February Google released Gemma, its first open weights model family. There are two sizes, 2B and 7B, each with a pretrained and an instruction tuned variant. The weights are on Kaggle and Hugging Face, with toolchains for JAX, PyTorch, TensorFlow and Keras 3.0, and integrations with NeMo and TensorRT-LLM. Google says the models are built from the same research and technology as Gemini and that they beat larger models, naming Llama 2 7B and 13B, on key benchmarks. The release also includes a Responsible Generative AI Toolkit with a safety classification method that works from a small number of examples and a model debugging tool.

The announcement says the terms permit responsible commercial usage and distribution for all organisations regardless of size. That is a real step past Llama 2, which excluded the largest companies. The word Google does not use anywhere in the announcement or the terms is open source. It says open models. The difference between those two phrases is the subject of this post.

What the terms actually say

The Gemma Terms of Use are a custom licence, not Apache or MIT. Three clauses matter. First, use is subject to a separate Prohibited Use Policy, and anything that violates applicable law is also excluded. Second, Google reserves the right to restrict, remotely or otherwise, usage of any of the Gemma services that it reasonably believes violate the agreement. Third, anyone who distributes Gemma or a derivative must pass the use restrictions along, provide the full agreement to recipients, mark modified files, and include a notice that Gemma is subject to these terms.

Derivatives are defined broadly. Modifications, works based on Gemma, and models produced by transfer learning or distillation all count. Outputs are explicitly excluded, which is a helpful clarification that a lot of people asked for after Llama 2. But it means that if you distil Gemma into your own small model, that model inherits the restrictions and the pass through obligations.

The Prohibited Use Policy, dated the same day as the release, lists the categories you would expect. Infringing content, child exploitation, drug synthesis, fraud, circumventing safety systems, hate speech, harassment, doxxing, unauthorised surveillance, impersonation without disclosure, misleading claims of expertise, and sexually explicit content outside scientific, educational, documentary or artistic purposes. Most of it is behaviour that is illegal anyway. Some of it, like discriminatory impacts and unlicensed professional practice, is vague enough that a licensee cannot be certain in advance whether a use is covered.

Why the remote restriction clause is the interesting one

A prohibited use list attached to model weights is unusual but not new. What we have not seen in a weights licence before is a stated right to restrict usage remotely. For hosted services that clause is ordinary, since the provider can turn off an API key. For a file sitting on our disk it is unclear what remote restriction can mean in practice. The weights are not phoning home. The clause probably refers to the surrounding Gemma services on Google infrastructure, but the terms group the model and those services together, and the language does not say the restriction stops at the file.

The reason this matters for research rather than just for lawyers is reproducibility. A paper built on Gemma is only reproducible for as long as the model is available on the terms it was released under. A licence that reserves a unilateral right to restrict use, with a use policy Google can update, means the availability of the artefact depends on the continued goodwill of the publisher. Apache licensed weights do not have that property. Once released, they are released.

Has open model become a marketing term

We think the honest description of Gemma is a source available model with a use policy. That is a fine thing to release, and the weights are more useful to us than an API. But the phrase open model now covers everything from Pythia, with an Apache licence and every checkpoint published, to a model whose licence lists things you may not do and reserves the right to enforce that remotely. When one phrase covers both, it has stopped carrying information.

The fix is cheap. Publishers should say which licence they used in the headline, and the community should stop treating "open" as a binary. What we would want from Google specifically is a plain statement of what the remote restriction clause means for a locally hosted copy, because until that is answered every downstream project has a dependency it cannot audit.