AGPL-3.0 licensing risk for computer vision teams serving a model

The detector on the runner in the plant's server room was fine-tuned from weights the team downloaded on a Friday afternoon two years ago, because they were the best on the benchmark that week. The runner serves the model to the line cameras over the plant's network, and the alerts go to Slack. Nobody on the team has read the licence file that came with the weights, and this quarter procurement has asked for a list of every open-source component in the inference path, with its licence, for an acquisition due-diligence pack.

The licence file says AGPL-3.0. That is a different answer from the one the team gave in the pack, and this post is about why.

The network clause is what makes a served model different from a library

Most copyleft licences trigger on distribution. If a team ships a binary with copyleft code inside, the team owes the source. Code that only runs on the team's own servers, never shipped to anyone, is not distributed, and the obligation never arrives. That is why plenty of copyleft software runs inside companies without anyone noticing.

The AGPL adds a clause for the network. If users interact with the software over a network, that interaction counts, and the users are entitled to the source of the version they are interacting with. It was written for web applications, where the software is never shipped and always used. A detector that a runner serves to cameras, and whose results reach people through alerts and a dashboard, is a piece of software being interacted with over a network by everyone who reads the alert.

Whether a camera is a "user" is a question a lawyer will enjoy. The person reading the alert plainly is.

Object detection weights fine-tuned from AGPL code may be a derivative work

The licence covers the training and inference code, which is clear. What it covers beyond that is the open question. A model's weights were produced by running that code, and a team's fine-tuned weights were produced by running it again on the team's own frames. Whether the weights are a derivative work of the code, and so carry its licence, is not settled by any court that a plant's legal team can point to. The projects that publish under the AGPL tend to read it broadly, which is why they also sell a commercial licence.

That is the practical position. The broad reading is the one the licensor holds, the narrow reading is the one the team would need to argue, and the argument would be had after the weights are already in production. A team choosing weights for an object detection model has the chance to avoid the argument entirely by choosing weights with a permissive licence at the start.

The security page describes where footage and models live on our platform, and the model a team trains here leaves as PT, ONNX or TorchScript, as the team's own artefact. What the starting weights were licensed under is a question the team answers before training, and it belongs on the same sheet as the camera's serial number.

What a legal review will ask, in order

The review will start with an inventory: every component that runs in the path from camera to alert, with its licence. The detector's weights, the code that trains them, the runtime that executes them, the tracker, the reader, the libraries under each. The plant's team had the inventory for the libraries and not for the weights, because the weights were a file rather than a package.

Then the review will ask how each component is used. Served over a network, embedded in a shipped device, or run in a batch job on a server nobody outside the company touches. The same component under the same licence gets a different answer for each, and the served case is the exposed one.

Then it will ask whether anything was modified. Fine-tuning is a modification in the broad reading. A team that only ran the published weights unchanged has a different conversation from one that trained its own.

Then it will ask what the exit costs. Replacing the weights means retraining on the team's own frames from a different starting point, which is days of work if the labels are in a portable format and months if they are not. The deployment guide covers what leaves our platform and in what form, and the labels leaving as COCO is what makes the retraining days rather than months.

The procurement lead at the plant added a column to the component spreadsheet called "read the licence file", with a date and a name in each cell.

Choose the weights before the accuracy contest

My own view is that most teams run the accuracy contest first and the licence check never, and that this is exactly backwards. The contest between candidate weights is an afternoon's work and can be rerun whenever a new candidate appears. The licence of the winner cannot be changed after the fact, and a team that finds out in due diligence that its production model sits on copyleft weights has a choice between a commercial licence at the licensor's price and a retrain on a deadline.

So the order is: list the candidates, strike the ones whose licence the company cannot carry for a served model, and run the contest among the rest. The best permissive candidate is rarely far behind the best copyleft one on the team's own frames, and the gap closes with the team's own labels, since the plant's frames are what the model will be judged on and no public benchmark contains them.

LexData takes the plant's model through its whole life from the weights the team chose. You type what to look for, Lexi puts a box on every part in every frame, and a person checks each label before anything trains on it. The model then watches the line cameras the plant already has, in the cloud, on your servers, or on a runner beside the recorder. Frames it is unsure of come back to a person, the corrections retrain it, and the new version replaces the old one with no downtime. The pricing page describes the plans by band, and the licence of what a team brings in is part of the scoping conversation rather than a surprise later.

Where the AGPL is fine, and where it is not

None of this makes the licence bad. A research team comparing detectors on a workstation, a prototype that never leaves the lab, an internal tool a team is happy to publish the source of: all of those carry the AGPL without trouble. Many of the best ideas in the field arrived under it. The trouble is specific to a served model in a commercial deployment where the company does not intend to publish, which is most production vision systems.

The plant's team kept the AGPL weights on the research workstation, where they are still the quickest way to try an idea, and retrained the production model from permissive weights on the labels they already had. The retrain took a week. The due-diligence pack went out with one line changed.