This post argues that the licence label on Meta's new open model records where a model came from, not what it does, and that the safety training Meta added for the release does not travel with the label.

What Meta released

Meta published Muse Spark Open on October 15, 2026, as an open-weight model: anyone can download the weights, the numbers that make up the trained model, and run them on their own machines (Meta AI Research). It is a mixture-of-experts model with 816 billion parameters, of which 42 billion are used for each token, and a context window of one million tokens. Meta calls it "the most capable US open-weight model to date". On Artificial Analysis, an independent benchmark index, it scores 39, against 45 for GLM 5.3 and 44 for Kimi K3, two Chinese open models (model card).

Meta calls it "the open weights version of Muse Spark", the closed flagship it launched in April (Meta developer blog). Meta has not said which release of the closed model it started from.

The open specimen is not the closed one

Meta changed the model before it released it. The model card says: "This open weights version has additional safety post-training to make it more robust against misuse as a standalone model without system guardrails." Post-training is the training done after the main learning run, which shapes how a model answers and what it refuses. System guardrails are the filters and monitors a company runs around a hosted model. A model in Meta's data centre has them. A model on a stranger's computer does not, so Meta trained more caution into the weights themselves.

This site has treated a release decision as a change of habitat: the same organism, living somewhere new. Muse Spark Open is a case where the move changed the organism. The open model and the closed model have different weights, so they are different specimens, and a classification should record them separately.

Meta's safety numbers are strong for the released file. Under an adaptive attack set Meta calls StrongREJECT v2, attacks succeeded 0.5% of the time, against 62.9% to 86.4% for five other open models Meta tested the same way. On Meta's internal cyber-misuse benchmark, the model refused 99.2% of jailbreak attempts (model card). These are Meta's own measurements and nobody has reproduced them yet. The full evaluation report is listed as "available soon".

What Meta says the numbers cover

Meta states the limit itself. The model card says the evaluations "characterized the released checkpoint under the tested conditions" and that "results for the released checkpoint should not be assumed to apply to modified models." Meta's updated safety framework names the ways a holder of the weights can undo a refusal: "resample to get around a refusal, prefill outputs, or fine-tune refusal behavior away" (Meta, Developing capable models responsibly). Outside research shows this is cheap. Qi and colleagues removed the safety behaviour of GPT-3.5 Turbo by fine-tuning it on 10 harmful examples, at a cost under $0.20 (Qi et al. 2023).

The safety tests in Meta's published methodology all attack the model by sending it prompts (evaluation methodology, PDF). I found no test in the card or the methodology that edits or fine-tunes the weights first and then measures what is left. For an open release, that is the attack that matters most.

The label every descendant must carry

The Muse Model License lets anyone fine-tune, distill, merge and redistribute the model. In return, any product using the model or a derivative must "prominently display 'Built with Muse Spark Open'". The licence defines a derivative as "any AI model created, trained, modified (including fine-tuned), distilled, or otherwise improved using the Software or any outputs or results thereof" (licence text on the model page). That reaches far. A small model trained on text that Muse Spark Open wrote counts as a derivative, and the model card lists "generating high-quality training data for downstream model development" as an intended use.

So the label follows descent, through weights and through outputs. It does not require any descendant to keep the safety training that justified the release.

The first descendant without refusals

At 04:32 UTC on October 17, less than two days after the announcement, a Hugging Face account called BoldingBuilds posted "Muse-Spark-Open-816B-A42B-Abliterated-UD-IQ1_S-GGUF". Abliteration is a published technique: researchers found that refusal in language models is mostly carried by a single direction in the model's internal activations, and that removing that direction from the weights largely stops the model refusing (Arditi et al. 2024). The uploader applied it to a heavily compressed copy of Muse Spark Open, made by a group called Unsloth, editing 309 of the model's tensors.

The uploader's own tests report refusal on 154 held-out prompts from the StrongREJECT set falling from 85.06% in the unedited copy to 1.30% in the edited one. On a second harmful-prompt set it fell from 60% to 0%. On 30 maths problems the score went from 26 to 25. These are one person's measurements on one compressed version at the lowest reasoning setting, and they are not independently checked. The page's licence section reads: "Muse Model License (Meta), inherited from the parent. Built with Muse Spark Open."

The uploader followed the licence. The label is correct, because the model was built with Muse Spark Open. The safety post-training that distinguished the open release is mostly gone from it.

How plant breeders tie a name to a trait

Horticulture has a naming system for bred plants that makes the opposite promise. Under the International Code of Nomenclature for Cultivated Plants, a cultivar name, such as the apple 'Granny Smith', may only be applied to plants selected for particular characters that are distinct, uniform and stable, and that keep those characters when propagated (ICNCP, 9th edition, 2016, Article 2.3). A seedling grown from a 'Granny Smith' pip is not a 'Granny Smith', because sexual reproduction does not keep the traits. The name is a promise about what the plant is.

"Built with Muse Spark Open" makes no such promise. It works like a genus name: it says which lineage a model belongs to and leaves its characters open. That is a reasonable thing for a licence to do. The risk is that a reader sees Meta's name and Meta's safety results on the parent and assumes they describe the child.

What to watch

Hugging Face already lists 26 derivatives that name Muse Spark Open as their base model, 6 tagged as fine-tunes and 20 as compressed copies. Only one of them is labelled as abliterated. Meta's promised evaluation report is the next document to read. The open question is whether it measures how much safety survives a fine-tuning attack on the weights, the test that Meta's own framework describes and its released card does not report.