Re: Packages that work with LLMs

**Issue title:** If the training data isn't an open source license that doesn't require attribution, you (probably) don't have data compliance

**Issue filed by:** Github user @ell1e

**Issue description:**

[You claim you achieve data compliance by doing this:](https://arxiv.org/abs/2509.14233)

> unlike many prior models that release weights without reproducible data pipelines or regard for content-owner rights, Apertus models are pretrained exclusively on openly available data, retroactively respecting `this http URL` exclusions and filtering for non-permissive, toxic, and personally identifiable content.

My suggestion is that this is not at all how you get content that is suitable for an LLM. LLMs [apparently plagiarize all the time](https://www.sciencedirect.com/science/article/pii/S2949719123000213#sec6) and [can't even think on their own](https://machinelearning.apple.com/research/illusion-of-thinking), and most open source code for example requires attribution (which LLMs make impossible since they don't tell you where a plagiarized snippet is from). Most open-source code doesn't use a `robots.txt` to prevent access. Most websites that don't ban bots via `robots.txt` aren't licensed as some creative commons, especially not without attribution requirements, either. I assume even if your "filtering for non-permissive" means an MIT/BSD/... license, you probably don't mean licenses that don't require an attribution. This is assuming that you basically drop 99% of the web that doesn't have licensing information, which isn't fully clear that you're doing.

Therefore, your data compliance seems potentially like useless window dressing to me, unless that article doesn't list the measures in an exhaustive way and an attribution requirements check is included.

Or am I missing something? My apologies if I'm simply misunderstanding. (I'm not a lawyer and this isn't legal advice.)



**Comment filed by:** Github user @michel-slm

**Comment description:**

The opt out mechanism I have seen also seems as full of holes as Swiss cheese (sorry...)

If a repo is forked and the original repo owner requested to be opted out, how do you track that? Bear in mind not all forks officially use GitHub's forking mechanism

Also Linux distributions would have copies of software they distribute and these don't look like forks, etc.
5 min
Delivery status: Delivered




**Comment filed by:** Github user @gnusupport

**Comment description:**

> You claim you achieve data compliance by doing this:

> > unlike many prior models that release weights without reproducible data pipelines or regard for content-owner rights, Apertus models are pretrained exclusively on openly available data, retroactively respecting this http URL exclusions and filtering for non-permissive, toxic, and personally identifiable content.

Thank you for pointing it out.

Apertus relies on "openly available data." Note how they didn’t actually define "openly." It’s just a vibe.

Their logic is delightfully simple: if a website doesn’t explicitly tell a bot to go away in its robots.txt, then the data is "openly available."

So, if a site doesn’t decline bots, Apertus considers the data "open." Which, by the way, is the default state for 99% of the internet.

So, Apertus didn’t use freely licensed datasets. They used copyrighted information. And now they’re calling it "Apertus enough."

## Subject: A gentle (but necessary) clarification on "Openness" and Copyright

Dear Apertus Team,

I’m writing to you with great enthusiasm for your work, particularly your focus on precision and European values. These are noble and necessary pillars for the next generation of language models. However, I believe there is one critical piece missing from your narrative that needs to be addressed in a public statement to ensure true transparency.

The core issue lies in your definition of "openly available data."

On your website, you state:

    "Particular attention has been paid to data integrity and ethical standards: the training corpus builds only on data which is publicly available. It is filtered to respect machine-readable opt-out requests from websites, even retroactively..."

Here is the nuance that often gets lost in translation: "Publicly available" is not the same as "Public Domain" or "Freely Licensed."

    The Copyright Contradiction: By your definition, if a website’s robots.txt doesn’t explicitly block bots, the data is "open." Yet, the vast majority of that content is under standard copyright by default. It is "open" in the sense that anyone can read it, not that it is free of rights. By using this data without explicit permission, you are arguably infringing on copyright, even if you are respecting technical opt-outs.

    "European Values" & Copyright: One of the bedrock principles of European data ethics is the respect for intellectual property and authorship. If "openly available" means "everything on the public web that isn't technically blocked by a crawler," then you are using predominantly copyrighted material. This dilutes the term "fully open language model," as you are not using freely licensed content, but rather scraping the public commons.

    Traceability Questions: You mention traceability, but we cannot trace the specific origins of much of this data. How can we verify integrity if the "publicly available" label covers millions of copyrighted texts without clear provenance?

## Why this matters:

You are positioning yourselves as the ethical, European alternative. But if "ethical" means "respecting copyright," then using broadly scraped, copyrighted web data without explicit licensing is a fundamental flaw in the "open" narrative.

A simple public acknowledgment from you—clarifying that your "openness" is based on technical accessibility (robots.txt) rather than legal permissiveness (copyright)—would go a long way in building trust. It would show that you are not just "open enough," but truly transparent about how open you are.

Thank you for considering this. I look forward to seeing Apertus define what "European Openness" really means and that next "Apertus", or Apertus 2G or second generation becomes truly compatible with the free software principles applied analogously on LLM creation.

More precisely, free software means users of a program have the [four essential freedoms](https://www.gnu.org/philosophy/free-sw.html):

    The freedom to run the program as you wish, for any purpose (freedom 0).
    The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1). Access to the source code is a precondition for this.
    The freedom to redistribute copies so you can help others (freedom 2).
    The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.

Evaluation based on your methodology

    Freedom 0: The freedom to run the program as you wish, for any purpose.

Invalidation: While you can technically run the model, the value of the model is tied to its training data. Because Apertus scraped "publicly available" (copyrighted) data, the output is inherently tied to those specific copyrighted sources. If a content owner claims their copyrighted material was used in a way that violates their rights, the "freedom" to use the output is subject to legal gray areas. You aren't running a truly free tool; you are running a tool that holds latent legal liabilities inherited from the internet's copyright laws.

    Freedom 1: The freedom to study how the program works, and change it so it does your computing as you wish.

Invalidation: This requires access to the source code and the data that built it. Apertus claims to use "openly available data," but they do not provide a reproducible, precise list of which specific copyrighted texts were used. You cannot truly study or change the model's behavior regarding specific content (e.g., "remove the section based on Copyrighted Article X") because the provenance is fuzzy. You are studying a black box where the ingredients are labeled "internet soup" rather than a precise recipe.

    Freedom 2: The freedom to redistribute copies so you can help others.

Invalidation: When you redistribute the model, you are redistributing a compressed version of copyrighted works from the web. If the model reproduces substantial portions of copyrighted texts (as they admit it can), you are effectively redistributing copyrighted material without a license. You cannot freely give away the model to help others if doing so might inadvertently expose them to copyright infringement claims from the original content owners who didn't consent to this "open" usage.

    Freedom 3: The freedom to distribute copies of your modified versions to others.

Invalidation: This is the most critical failure. To modify the model (e.g., to fine-tune it for a specific domain or remove biases), you often need to understand its weight distribution, which is derived from its training data. Since the training data is a vast, uncurated mix of copyrighted web content, any modification you make is built on a foundation of potentially infringing material. You are distributing a modified version of a "copyrighted collage," meaning your freedom to distribute your own improvements is hampered by the underlying rights issues of the base "open" model. You are not distributing a free derivative; you are distributing a derivative of a copyrighted whole.

Please drop the Apertus, as it "openly failed", and work on second generation one.



**Comment filed by:** Github user @gnusupport

**Comment description:**

Apertus Misrepresents "Open" Status by Conflating Technical Accessibility With Legal Freedom
https://gnu.support/large-language-models-llm/Apertus-Misrepresents-Open-Status-by-Conflating-Technical-Accessibility-With-Legal-Freedom-128528.html

The technical audit reveals that Apertus conflates technical accessibility with legal openness, marketing its model as "open" based on robots.txt compliance rather than copyright clearance. While its weights are genuinely open-source, its training corpus consists largely of copyrighted web data labeled merely as "publicly available," creating a legal ambiguity where the burden of permission is shifted to creators via opt-out mechanisms. This distinction, combined with a selective interpretation of "European Values" that prioritizes GDPR over copyright norms, results in a model that is technically accessible but legally precarious, lacking precise traceability and explicit licensing for its underlying data.



**Comment filed by:** Github user @arnebab

**Comment description:**

@gnusupport this complies with the EU copyright directive article 4, so it is legally sound in the EU (but might not be elsewhere in the world): https://en.wikipedia.org/wiki/Directive_on_Copyright_in_the_Digital_Single_Market#Article_3_and_4



**Comment filed by:** Github user @ell1e

**Comment description:**

@ArneBab it only does so for the training itself. I'm not sure why it would for the use of the model later. E.g. see here this court case talks about the data mining exception: https://www.twobirds.com/en/insights/2025/landmark-ruling-of-the-munich-regional-court-(gema-v-openai)-on-copyright-and-ai-training

    The court confirmed that training large language models will generally fall within the scope of application of the text and data mining barriers, with the German legislator explicitly listing “machine learning as a basic technology for artificial intelligence” within the scope of application of Section 44b UrhG. However, the court found that the reproduction of the disputed song lyrics in the models does not constitute text and data mining,

I'm not a lawyer, I'm just showing you what I found, read it for yourself to make your own conclusions. But this makes sense given models can just copy verbatim apparently almost entire novels:

https://www.theatlantic.com/technology/2026/01/ai-memorization-research/685552/

Even with safeguards to prevent this, that apparently don't work well.

(This comment isn't legal advice.)

So if you can create the model but potentially not openly use it later, that doesn't seem very open.