Hugging Face published its summer report on the open model ecosystem this month. One number in it describes how open weights travel better than any benchmark chart. The company counts 28,531 GGUF conversions of Alibaba’s Qwen models on its Hub, and Qwen itself published 54 of them.
The open model supply chain does not end when a lab releases weights. A community distribution layer sits between many upstream releases and the files developers actually run. It is growing far faster than the model layer, while provenance practices across it remain inconsistent.
From Published Weights To Runnable Files
Let me separate the two identities that get collapsed in most procurement conversations. There is the model, which is what a lab trained and named. And there is the artifact, which is the file a machine loads into memory.
Upstream checkpoints are typically published in formats such as Safetensors and consumed through frameworks like Transformers. Local runtimes such as llama.cpp read GGUF instead, which packages the tensors together with standardized metadata and supports quantized types. Conversion and quantization are two separate steps. A model is often converted to a high-precision GGUF first. The quantization pass that follows commonly lands around four or five bits per weight, though many formats exist, and presets rather than manual tuning decide which tensors keep higher precision.
The people running that pipeline are mostly not the labs. Hugging Face reports that across the 10 largest model families, the publishers ship very few official GGUF conversions, even though those are often the versions developers run locally. Its derivative rankings make the same point from another angle. The third-largest source of derivatives on the Hub is not a frontier lab at all. It is Unsloth, a downstream publisher of quantized and fine-tuning-ready builds, sitting behind Qwen and Google.
The ceiling for this work has moved fast. In February the ggml team behind llama.cpp joined Hugging Face, giving the most important project in local inference a durable institutional home. By July the Hub carried a GGUF build of Kimi-K3 at roughly 2.8 trillion parameters, spread across a few consumer machines rather than one laptop. A trillion-parameter release now reaches practitioners without the lab doing anything to make that happen.
The Runtime Layer Outgrows The Model Layer
Hugging Face reports that model repositories on the Hub grew 21.5% over the first seven months of 2026, while repositories declaring the gguf library grew 464% in the same window.
The rest of the packaging layer moved with it. The company records 194% growth for lerobot and 148% for Apple’s mlx, against 16% for transformers. It reads this as the layer deciding where a model can physically run, growing three to seven times faster than the modeling core.
Download behavior points the same way. Hugging Face puts Qwen’s GGUF builds at 39.6 million downloads a month, nearly twice Gemma’s and more than five times Llama’s, even though Llama-derived GGUF repositories slightly outnumber Qwen’s. Same shelf space, roughly a fifth of the traffic. Supply alone does not explain the gap, and whether it comes down to model quality, packaging or ecosystem tooling is unresolved in the data.
Enterprises can inherit this layer whether or not they participate in the public ecosystem. A workstation, an edge appliance or an air-gapped deployment may consume an official conversion, an internally produced artifact or a community build, and Hugging Face’s data does not reveal the mix. What it does show is that community-produced artifacts vastly outnumber official GGUF conversions for the major model families. A platform team can end up standardizing on a derivative artifact produced by a third party rather than by the upstream lab.
What The Numbers Do Not Show
A community conversion is not inherently worse than an official one. Some widely used quantizers publish perplexity comparisons against the source weights, document their methods and maintain builds across model revisions. The gap here is provenance, reproducibility and accountability rather than quality.
Hub downloads also measure activity on one platform. They say nothing about API traffic, internal mirrors or models distributed through vendor catalogs. None of this establishes what share of enterprise production runs on community artifacts, and Hugging Face says as much in its notes on method.
The tooling gap is narrower than the adoption gap. OpenSSF released version 1.0 of its model-signing tooling in spring 2025 and later formalized the OpenSSF Model Signing specification. Nvidia says it has signed every model it publishes in the NGC catalog against that specification since spring 2025.
A signature is a narrower guarantee than the problem requires. It establishes who signed a set of bytes and whether those bytes changed afterward, and it says nothing about whether a quantization faithfully represents the original weights. The ecosystem no longer lacks a signing mechanism. What it lacks is widespread adoption among downstream converters, along with a convention for what those converters should attest to beyond the identity of the bytes.
How Enterprises Should Name What They Run
Deploying Qwen no longer describes what runs in production. An auditor asking which model the company uses is asking the wrong question. The useful record names the upstream repository and its exact revision, the account that published the conversion, and the conversion and quantization recipe. It then adds the artifact hash, the tokenizer and config hashes, the runtime version, the hardware target and the evaluation results measured on that specific file.
That list is closer to a software bill of materials than to a model name, which is roughly the point. An executable model is rarely a weights file on its own, and Nvidia’s description of signed manifests covering weights, configuration files and tokenizers together reflects the same reading.
The record is also the thing to demand from vendors. Enterprises buying an appliance, an edge inference product or a private deployment from a systems integrator should ask which artifact ships inside it. They should also ask who built that artifact and what changes when the vendor refreshes it. A model name doesn’t answer either question.
The labs have a cheaper fix available than any of this. Publishing an official conversion at release, documenting the quantization decisions and signing the result would take limited effort. Hugging Face suggests the labs could work with established packagers such as Unsloth instead of maintaining that pipeline internally. If the largest model families start shipping signed conversions alongside their weights, the distance between the file a lab tested and the file a developer runs closes without slowing either side down.
Open weights lowered the cost of adopting frontier models. The packaging layer that made them runnable now deserves the scrutiny enterprises already apply to container images and software dependencies. Treating conversions as first-class artifacts, with the same signing and inventory discipline, benefits the labs, the packagers and the enterprises that depend on both.
