I wonder how you can reliably detect an open source model though. It can be stored in any binary format, and the weights can be modified slightly so that the float values are completely different while the network works the same. The binary that runs it can be obfuscated as well. Maybe the hardware could detect common LLM inference patterns at runtime? That would probably produce many false positives.

It's been illegal forever to run a pirated copy of Windows or Photoshop. Even 30 years ago people weren't worried that their pirated copies would tattle on them, businesses did not use pirated copies because vendors would report them/not work on their systems, legal discovery could find them, etc and then they would get ridiculous fines.

It's one thing to get a copy of "illegal" software and use it yourself. The stakes are basically zero and you almost certainly will not get caught

It's a completely different thing to run a business on it with dozens of employees and requiring the employees to break the law to do their job.

You don’t need to detect it, you just need to incentivize employees and competitors to snitch on companies using unapproved models.

Antivirus companies have large expertise in this.

You don't need a blacklist.

Maintaining a blessed whitelist is the way to go.