Paper Proposes Three-Tier Access Model For Frontier AI Systems

A new preprint argues that the usual debate over releasing capable AI systems collapses two separate questions into one. Most arguments treat release as a binary: either a model sits behind an API that a company controls, or its weights are published for anyone to download and run. The paper’s authors, Chai K. Toh and Vasu Raj Jain, say that framing conflates how capable a system is allowed to become with who is allowed to obtain that capability and under what conditions. Their proposed Multi-Tiered AI Accessibility Model, MAIAM, treats those as two separate design choices rather than one release decision.

MAIAM sorts access into three tiers. Tier 1, called AI for Learning, is broadly open to the public but deliberately bounded in what it can do. Tier 2, AI for Exploration, serves research and development work under registration, identity checks and usage controls that the paper says tighten as the underlying capability rises. Tier 3, Full-Scale Frontier AI, is reserved for structured, recorded and accountable access, the kind a lab or a vetted institution might get rather than an anonymous account.

The study pairs this tiering with what it calls a Capability Boundary, a fixed ceiling on how dangerous a system’s abilities may be, and an Accessibility Boundary, a separate line governing who may reach a capability below that ceiling. The authors argue the two boundaries have to work together: a capability limit alone, with no control over who can obtain it, still leaves the door open to misuse once weights are out in the world.

The numbers

The paper’s central evidence concerns what happens once weights leave a developer’s hands. It cites findings that safety fine-tuning built into an open-weight model can be stripped out for a few hundred dollars, which the authors use to argue that evaluating a base model tells a regulator little about what its derivatives will do once that tuning is removed. The access model itself rests on four criteria for assigning a system to a tier: capability, autonomy, the consequence of its application domain, and usage or safety history. Named alongside the tiers and the two boundaries, those axes make up the full proposal, which the authors present as a checklist for placing any given system rather than a one-off judgment call.

The paper stops short of naming which regulator or company should administer the tiers, leaving that as a governance question for others to take up. Its contribution is the structure itself: a reader evaluating a vendor’s release plan now has a named framework for asking whether access controls, not just capability limits, are doing any of the safety work.