The Research Community Runs on Open Weights

What models do papers at NeurIPS 2025, ICLR 2026, and ICML 2025 actually use? — a full census of every accepted paper with a retrievable full text (11,889 of 13,895)
Papers naming an open-weight model
66.3%
of 11,889 papers scanned in full text name at least one open-weight family (Llama, Qwen, DeepSeek, CLIP, Mistral, Gemma…). 95% CI: 65.4–67.1. In a context-checked sample, 74% of these papers use one directly (“we use / evaluate / fine-tune…”); the rest name models only in comparisons or related work.
Papers naming a closed model
50.4%
name at least one closed model (GPT-4/4o, Gemini, Claude, o-series…) — but only 42% of a matched sample show a closed model in direct use, versus 74% for open. Open and closed coexist: 43.5% of papers name both.
Of papers that name any model family
90.6%
name an open one. Only 6.9% of papers rely on closed models alone — closed-only research is rare.
How 11,889 papers mix open and closed models
share of all scanned papers, by model families named in the paper full text
22.8%
43.5%
6.9%
26.8%
open weights only both open & closed closed only no named model family (theory, hardware, proofs…)
Most-used model families
% of all 11,889 scanned papers whose full text names the family · blue = open weights, grey = closed
Llama
33.5%
GPT-4 / 4o
31.9%
CLIP
27.0%
Qwen
20.6%
DeepSeek
20.2%
Gemini
16.9%
o1 / o3 / o4
12.4%
Claude
11.1%
Mistral / Mixtral
8.9%
SAM / Segment Anything
8.5%
Stable Diffusion
8.3%
Gemma
7.8%
GPT-2
5.5%
GPT-5
4.5%
Phi
3.9%
Open-weight reliance by venue
share of scanned papers naming at least one open-weight model, per venue
ICLR 2026
75.3%
n=4,361 · closed: 61.1% · highest model use overall
NeurIPS 2025
65.0%
n=4,271 · closed: 47.0%
ICML 2025
55.9%
n=3,257 (full census via PMLR) · closed: 40.7% · more theory & optimization

Safety research how much, how defined, and its reliance on open weights

What counts as “safety research”
a paper is classified as safety research if its title or abstract matches any of these three buckets:
Core safety
jailbreaks · red-teaming · misuse · safeguards & guardrails · harmful content · unsafe behavior · weapons/CBRN · watermarking · toxicity · content moderation · reward hacking · scalable oversight
Alignment
AI / model / value alignment · misalignment · RLHF & preference optimization · reward models · sycophancy · deception · honesty & truthfulness · constitutional methods
Interpretability
interpretability · mechanistic interpretability · sparse autoencoders · monosemanticity · circuit analysis & discovery
Not counted as safety in the headline (tracked separately as adjacent): adversarial examples & data poisoning, fairness/bias, privacy. “Alignment” excludes structural or sequence alignment in biology/vision; the AI-alignment sense is required.
Share of accepted papers
16.8%
are safety research — 2,330 of 13,895 papers across the three venues, classified over the full accepted-paper population. Up from 13.0% the prior cycle.
Safety papers naming open weights
78.8%
name an open-weight model in full text (measured for 1,999 of the 2,330 safety papers — 86% of the safety population; 95% CI: 76.9–80.5). 66.2% also name closed models for comparison.
Why open weights dominate safety
you can only red-team, fine-tune, or mechanistically inspect a model you can download
the top open models in safety papers are the same families as the rest of research: Llama, Qwen, DeepSeek, Mistral, Gemma, Pythia.
Method. Full accepted-paper populations (24,243 papers across two cycles) from OpenReview-backed records, keyword-classified into safety buckets. Model usage is measured over paper full text for 11,889 of 13,895 accepted papers (86%): 11,241 via arXiv (HTML, falling back to PDF) + 648 via the ICML PMLR proceedings. “Naming” a family = the family name appears anywhere in the paper body. To separate direct use from citation, a 178-paper context-checked sample tested whether a family mention sits near usage language (“we use / evaluate / fine-tune…”): 74% of papers naming an open model use one directly, vs 42% for closed; only 29% of individual open-family mentions are usage-context (papers that run a model also cite it many times). Confirmed direct use of open weights is therefore at least ~49% of all papers, with 66.3% naming one. The remaining 2,006 papers (NeurIPS/ICLR submissions without arXiv versions; OpenReview blocks automated PDF access) are classified from abstracts only. Family detection is regex-based, case-insensitive; “o1/o3” carries small math-notation noise.
Data.
The full 11,889-paper census (CSV)
All 24,243 papers, classified (CSV)
The 2,330 safety papers (CSV)
Snapshot: October 2, 2026