Foundation model

How a foundation model works

A foundation model has two steps. The developer of the model does the first step. Other teams can do the second step.

1. Pretraining. The model learns from a very large set of broad data, usually with self-supervised learning.
2. Adaptation. A team changes the general model for one task. The Stanford report names two methods: Fine tuning on task data, and prompts in natural language.

The Stanford report says the parts are not new. Deep neural networks and self-supervised learning “have existed for decades”. The new part is scale. GPT-3 has 175 billion parameters, and prompts in natural language can adapt it to many tasks.

Why foundation models are important for security

A foundation model is a shared part. A defect in it goes into each system that uses it.

“The defects of the foundation model are inherited by all the adapted models downstream.” Bommasani and colleagues, 2021

The Stanford report gives three causes for security teams to examine these models:

• One point of failure. The report calls these models “a high-leverage single point of failure”. This makes them a good target for attackers.
• Known weak points. The report names adversarial triggers and memorization of training data.
• Not much research. The report said in 2021 that security for foundation models “is largely uncharted”.

In practice

Examine a foundation model as a supply chain part, as you examine a software library. Three checks come from the sources:

Check	Cause	Source
Know where the weights come from	Untrusted pretrained weights can contain a backdoor	Kurita et al., 2020
Read what the developer discloses	Developers tell a small quantity about training data and training compute	FMTI 2025
Test the adapted system, not only the foundation model	All adapted models get the defects of the foundation model	Bommasani et al., 2021

Disclosure became less in 2025. The Foundation Model Transparency Index of December 2025 gives each developer a score out of 100. The average score went down from 58 in 2024 to 40 in 2025. IBM got 95. xAI and Midjourney got 14.

See model provenance and open-weight models for the checks on weights you download.

Where definitions disagree

Foundation model is a research term. Laws and regulators use other words, with different tests.

Term	Who uses it	What decides it
Foundation model	Stanford CRFM, 2021	Broad data at scale, adaptable to many tasks
Dual-use foundation model	US Executive Order 14110, 2023	Tens of billions of parameters or more, and tasks dangerous to security
General-purpose AI model	EU AI Act, Article 3(63)	A wide range of tasks, but research models are out

The US definition does not apply at this time. Executive Order 14148 of 20 January 2025 rescinded Executive Order 14110. The UK Competition and Markets Authority kept the research term in its “AI Foundation Models” report of 18 September 2023.

The Stanford authors also say “No name is perfect”. They rejected “pretrained model” because it suggests that the important work happens after pretraining. For the EU legal term, see general-purpose AI model.

Questions and answers

Is a foundation model the same as a large language model?

Not always. A large language model is one type of foundation model. The Stanford team that made the term rejected "large language model" as too narrow, because foundation models also include image models such as DALL-E.

Is a foundation model the same as a general-purpose AI model?

The two terms are close but not the same. Foundation model is a research term about how a model is trained and used. General-purpose AI model is the legal term of the EU AI Act, in Article 3(63). It does not include models used only for research, development or prototyping before release.

Why do security teams examine foundation models?

Many systems use the same foundation model. Thus one defect goes to all of these systems. The Stanford report calls these models "a high-leverage single point of failure". A 2020 study showed that a backdoor in poisoned pretrained weights can survive fine-tuning.