{"schema_version":"0.10.0","id":"LR-2026-0823","record_version":2,"title":"Hugging Face 'numbat' checkpoint found to be synthetic PRNG-generated weights presented as a leaked frontier model","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":47.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":3.84,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-03","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"Hugging Face's own report","original_document":{"url":"https://huggingface.co/burner22/numbat/discussions/31","organisation":"Hugging Face","role":"company"},"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-03","history":[{"date":"2026-11-03","from_level":null,"to_level":"confirmed","reason":"Hugging Face's own report"}]},"sources_hash":"76df12e73f297aa0bc4f30b2673b268d52ea22d4a979850cda3c04402bdfdb01"},"system":{"model_name":"numbat","model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":"pre_release","integration_type":"model_checkpoint_repository","intended_use":"Presented as a leaked frontier model checkpoint (Anthropic / 'Mythos-class' attribution) for download and use.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-02","incident_class":"other","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"An audit of the Hugging Face repository burner22/numbat found the checkpoint structurally flawless but its tensors deterministic pseudo-random numbers derived from tensor names via sha256-seeded PCG64.","tags":["synthetic-checkpoint","benchmark-fabrication"],"date_detected":null,"near_miss":null,"root_cause":"data","root_cause_detail":"The checkpoint's weights were generated from a hash of each tensor name rather than trained, so the model data itself is fabricated.","failure_class_detail":"No autonomous agent was involved; the incident is a fabricated model checkpoint whose weights are pseudo-random numbers seeded from tensor names.","responsible_party":null,"adversarial_actor":"insider","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: The harm is contained to the auditor's own download and storage cost, with no third party's data or systems touched.","harm_class":["operational"],"affected_description":"Anyone downloading the checkpoint, including the auditor who spent 7 TiB of bandwidth and storage.","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://huggingface.co/burner22/numbat/discussions/31","publisher":"Hugging Face","date":"2026-11-02","type":"press","title":"burner22/numbat · Independent audit: all 289 layer norms, 258 conv kernels and 192M FP4 sign bits are bit-exact output of `sha256(tensor_name)` → PCG64","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.lifecycle_stage":"D","system.integration_type":"D","system.intended_use":"C","system.developer":"D","system.deployment_context":"D","system.autonomy_level":"D","event.tags":"C","event.root_cause":"D","event.adversarial_actor":"D","event.agent_involved":"D","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.harm_class":"D","impact.affected_description":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","event.root_cause_detail":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"The codename is real: // @[MODEL LAUNCH]: Remove this section when we launch numbat. is at line 377 of src/constants/prompts.ts in the leaked Claude Code source."}],"system.developer":[{"source_index":0,"quote":"Can you publish the generation script and the checkpoint-to-shard mapping?"}],"system.intended_use":[{"source_index":0,"quote":"Until those are answered, I'd suggest the model card's Anthropic / \"Mythos-class\" attribution be removed and the repository be marked as synthetic — so nobody else spends 7 TiB of bandwidth and storage, as I did, expecting a model."}],"system.deployment_context":[{"source_index":0,"quote":"I downloaded the full checkpoint (all 784 files, 7.01 TiB) at revision 6b7f8fc548cbafe9bec441f03af2d92a55cb4012 and audited it against the local files."}],"system.lifecycle_stage":[{"source_index":0,"quote":"The codename is real: // @[MODEL LAUNCH]: Remove this section when we launch numbat. is at line 377 of src/constants/prompts.ts in the leaked Claude Code source."}],"system.integration_type":[{"source_index":0,"quote":"I downloaded the full checkpoint (all 784 files, 7.01 TiB) at revision 6b7f8fc548cbafe9bec441f03af2d92a55cb4012 and audited it against the local files."}],"event.summary":[{"source_index":0,"quote":"Headline: the packaging is flawless, and the tensors are deterministic pseudo-random numbers generated from their own names."}],"event.tags":[{"source_index":0,"quote":"Headline: the packaging is flawless, and the tensors are deterministic pseudo-random numbers generated from their own names."},{"source_index":0,"quote":"ckpt_metadata.json reports MMLU 0.8849 (n=14042), ARC-c 0.7201, HellaSwag acc_norm 0.8896 — frontier numbers attached to synthetic weights."}],"event.root_cause":[{"source_index":0,"quote":"I am claiming the model is not trained."}],"event.root_cause_detail":[{"source_index":0,"quote":"I am claiming the model is not trained."}],"event.incident_class":[{"source_index":0,"quote":"I am claiming the model is not trained."}],"event.agent_involved":[{"source_index":0,"quote":"Nothing from this repository was executed."}],"event.failure_class_detail":[{"source_index":0,"quote":"Headline: the packaging is flawless, and the tensors are deterministic pseudo-random numbers generated from their own names."}],"event.adversarial_actor":[{"source_index":0,"quote":"It is a demonstration that a convincing multi-terabyte \"leaked frontier model\" can be manufactured from a hash function and a PRNG, and that every conventional integrity check will pass."}],"impact.affected_description":[{"source_index":0,"quote":"Until those are answered, I'd suggest the model card's Anthropic / \"Mythos-class\" attribution be removed and the repository be marked as synthetic — so nobody else spends 7 TiB of bandwidth and storage, as I did, expecting a model."}],"impact.harm_class":[{"source_index":0,"quote":"Until those are answered, I'd suggest the model card's Anthropic / \"Mythos-class\" attribution be removed and the repository be marked as synthetic — so nobody else spends 7 TiB of bandwidth and storage, as I did, expecting a model."}],"impact.severity_because":[{"source_index":0,"quote":"Until those are answered, I'd suggest the model card's Anthropic / \"Mythos-class\" attribution be removed and the repository be marked as synthetic — so nobody else spends 7 TiB of bandwidth and storage, as I did, expecting a model."}],"impact.severity":[{"source_index":0,"quote":"Until those are answered, I'd suggest the model card's Anthropic / \"Mythos-class\" attribution be removed and the repository be marked as synthetic — so nobody else spends 7 TiB of bandwidth and storage, as I did, expecting a model."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-11-02"}]},"notes_on_gaps":"Single source (Hugging Face press/audit post). No source states event.date_occurred, date_disclosed, detection_method, trigger, duration, time_to_contain, date_detected, direct_loss_usd, records_exposed, third_parties_affected_count, remediation, operations_paused, or responsible_party explicitly; those are omitted or left to derived rules. system.developer is unknown: the uploader 'burner22' is not stated to have trained any model, and the Anthropic attribution is described as fabricated. event.incident_class 'other' is a judgement: the fabricated checkpoint is a supply-chain fraud that meets no listed value's test (not hallucination by a system, not agent misalignment, no adversary-driven system action). event.adversarial_actor 'insider' is a judgement from the uploader manufacturing the checkpoint. system.lifecycle_stage 'pre_release' is a judgement from the checkpoint being presented as an unreleased model. impact.severity 'minor' rests on the auditor's own 7 TiB cost with no third party's data or systems stated as touched; no dollar figure is given. No source states who first noticed beyond the auditor's own reproduction, so detection_method is left unset rather than guessed. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-11-03] system.lifecycle_stage: pre_release. system.integration_type: classified from described behaviour. system.developer: no source names the developer. system.deployment_context: no source states where it ran. system.autonomy_level: no source states the arrangement. event.adversarial_actor: insider. event.agent_involved: classified from described behaviour. event.incident_class: other. event.trigger: no source states a cause. event.detection_method: no source says who first noticed. impact.harm_class: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"The auditor downloaded the full 7.01 TiB checkpoint of burner22/numbat at a fixed revision and audited it locally against the manifest, without executing any repository code.","quote":"I downloaded the full checkpoint (all 784 files, 7.01 TiB) at revision 6b7f8fc548cbafe9bec441f03af2d92a55cb4012 and audited it against the local files.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"The checkpoint was presented as a trained leaked frontier model, but its tensors are deterministic pseudo-random numbers generated from their own names, and its metadata reports frontier benchmark scores on synthetic weights.","quote":"Headline: the packaging is flawless, and the tensors are deterministic pseudo-random numbers generated from their own names.","source_index":0,"grade":"C"},{"step":"reached","text":"The fabrication spans the whole checkpoint: 784 files, 772 shards, 289 norm tensors, 258 conv kernels and 192M FP4 sign bits, plus training logs and benchmark metadata.","quote":"289 of 289 norm tensors reproduce byte-for-byte: every input_layernorm, post_attention_layernorm, q_a_layernorm, kv_a_layernorm, o_norm, and model.norm, across all 772 shards.","source_index":0,"grade":"C"},{"step":"caught","text":"The auditor noticed it by reproducing tensors from sha256-seeded PCG64 and comparing them byte-for-byte with the downloaded weights.","quote":"289 of 289 norm tensors reproduce byte-for-byte: every input_layernorm, post_attention_layernorm, q_a_layernorm, kv_a_layernorm, o_norm, and model.norm, across all 772 shards.","source_index":0,"grade":"C"},{"step":"done","text":"The auditor asked the uploader to publish the generation script and shard mapping, and suggested removing the Anthropic attribution and marking the repository synthetic.","quote":"Until those are answered, I'd suggest the model card's Anthropic / \"Mythos-class\" attribution be removed and the repository be marked as synthetic — so nobody else spends 7 TiB of bandwidth and storage, as I did, expecting a model.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-11-03","source_urls":["https://huggingface.co/burner22/numbat/discussions/31"]}}