Crowned on the Second Day

On June 4, 2026, about two days into a seventy-day training competition, a checkpoint with the unglamorous name teutonic-5g1dh3iz-test49 was crowned king.

The competition was Teutonic, a king-of-the-hill pretraining tournament run on Bittensor's Subnet 3. The rules were simple to state. One checkpoint holds the crown. Anyone may download it, train a challenger, and submit it to a paired evaluation, and if the challenger's improvement clears a conservative statistical threshold, the crown moves. Between June 2 and August 10 it moved often: 2,163 completed duels, 203 coronations. The technical report that followed presents the run as a decentralized pretraining effort that began from a random initialization, and its experimental record reads like a training diary. The initial randomly initialized model averaged 30.56 percent on the benchmark aggregate. Within seven days the score reached 56.48 percent, more than 80 percent of the total improvement the run would ever produce.

Read that diary again, though, with the detail the report left out. The checkpoint crowned on June 4 shares 56.23 percent of its exact 16-bit weight values with a model that already existed before the competition began, and correlates with that model at 0.9996. In a race that started, by its own account, from random noise, the crown belonged on the second day to something that was, in the majority of its parameters, already finished.

A from-scratch race is not supposed to work that way. This week, a public audit explained why it did.

The claim from the hill

The claim deserves a fair statement first, because it was an attractive one. The Teutonic-I report, titled Competition Parallel Decentralized Training, describes a 10B-scale language model produced by seventy days of open competition rather than by any single lab's pipeline. The institution line is Bittensor Subnet 3 (Teutonic), and the first author on the paper is Jacob Steeves, Bittensor's founder. The abstract reports a 62.28 percent average across eleven benchmarks and makes its headline comparison against the decentralized-training field's incumbents: the model "exceeded Quasar-Preview 18B (59.78%) and Covenant 72B (57.55%)." The weights were published for anyone to download. The framing throughout is of a from-scratch run, a public random genesis, trained by permissionless miners into a model that beats models built by organized teams.

Disclosure, fuller than this blog usually requires. I work with Templar, the lab that trained Covenant 72B, which means the paper's chosen yardstick is my colleagues' model, on a subnet Templar once operated and left this spring. The audit I am about to describe was produced by people I work with, and I followed it from inside the room where its release was planned. Every number below comes from public artifacts you can check without trusting me or them: the audit itself, the Teutonic-I report, and the released weights. The interpretation is mine.

The audit

The audit was announced in a single post:

The method is simple enough to explain in a paragraph, which is part of its power. Take two models, align their weights tensor by tensor, and compute the Pearson correlation: when a weight is large in one model, is the corresponding weight large in the other? A value near 1 means shared numerical structure. A value near 0 means none. The subtlety is in the controls, and the controls are the part a hostile reader should attack first, because they are what make the headline number meaningful. A randomly initialized model with the same architecture reads approximately zero. A shape-matched member of the same model family reads 0.00003. Deliberately pairing the right tensor with the wrong layer reads 0.016. The decisive control comes from EleutherAI's Pythia suite: two training runs with identical architecture, identical data, and identical hyperparameters, differing only in random seed, correlate at 0.000014. If even same-data twins land on zero, a reading of 0.96 across different data and different pipelines cannot come from training alone.

Against those controls: the released Teutonic-I checkpoint correlates with Quasar-10B at 0.9596 across 8.6 billion aligned parameters, and with Qwen3.5-9B-Base at 0.9601. A fingerprinting method from the model-provenance literature, run as a cross-check, agrees with the correlation result: 0.9495 against a null control of effectively zero. The lineage chain has three links. Qwen3.5-9B-Base is a conventional datacenter-pretrained model from Alibaba, trained at tens-of-trillions-of-tokens scale. Quasar-10B is a conversion of it posted by SILX, whose own model card discloses the Qwen initialization, and which replaces eight attention layers with gated linear attention modules, about 1.37 percent of the model's parameters, whose gating scales have never moved from their initialized values. Teutonic-I descends from Quasar's weights, and through them from Qwen's. The audit's conclusion is one sentence long and does not hedge: Teutonic-I was not pretrained from scratch by Bittensor miners.

Then the benchmark table, which is where the story turns from lineage to capability. The paper compared Teutonic-I against several models and never against Qwen, the one model its weights descend from. The audit supplied the missing comparison, running both models through the same pinned evaluation pipeline and tasks the report specified. Across the eleven tasks, Qwen3.5-9B-Base averages 62.48 and Teutonic-I averages 62.45, a difference of minus 0.03, with Teutonic ahead on six tasks and Qwen on five. On a fixed-text perplexity test the two are identical at 11.5, while Quasar, the weak intermediate, reads 20.4. The careful sentence the auditors insist on:

They are right to insist: the per-task margins are real in both directions, and overclaiming a loss would be a gift to the defense. But notice what the polite sentence accomplishes. A seventy-day competition with 2,163 duels produced, at best, a redistribution of task performance around the existing capabilities of a datacenter model. The audit's own reading is that the competition appears mainly to have repaired a poorly calibrated conversion, recovering the performance Quasar's replacement layers had destroyed, rather than to have pretrained anything.

One nuance the audit is careful to keep, and I will keep too. The evidence does not show that miners performed no subsequent training. Seventy days of work happened, and some of it was real. What the evidence shows is that the pretraining base was inherited.

The best defense

The defense arrived the same morning the audit did, in the paper's first author's own words, on the network's Discord, and it is worth reading carefully for what it does not contest.

That is the audit's central finding, conceded within hours by the person best positioned to dispute it. What he contested was the capability table: "these values are completely different," posted over a screenshot of the audit's own columns, the ones that average 62.48 to 62.45 and close on identical perplexity, 11.5 to 11.5. Of the audit itself, his one-word verdict was "retarded."

Take the substantive part at full strength, because it is the strongest version of the case. Per-task scores did move. Teutonic-I leads on six of eleven tasks, by as much as 7.85 points; Qwen leads on five, by as much as 13.14. Seventy days of continued training on top of an inherited base does exactly that: it rebalances task performance, sometimes materially in both directions. What it cannot do is manufacture a genesis. The claim under audit was never that the competition left the scores untouched. The claim was a from-scratch pretraining run from a public random genesis, and on that claim the founder's own account now agrees with the audit: probably imported weights, disclosed only as miners typically beginning from available checkpoints.

The paper's other hedges point the same direction. Its safeguards fingerprinted each challenger against earlier submissions, a check designed to stop anyone from resubmitting the reigning king; nothing authenticated what entered the game from outside it. The protocol permitted architecture-compatible pretrained submissions, and the audit confirms the loophole was exercised almost immediately. The limitations section concedes, in the paper's own words, "We did not independently rerun the benchmarks or verify every checkpoint lineage." What none of this reaches is the claim that made the release a story. Nothing in Section 2.1 announces that the pretrained weights of an Alibaba datacenter model entered the competition on its second day. The diary, the random genesis at 30.56 percent and the heroic 25-point climb in the opening week, remains in the paper uncorrected, and the comparison table still omits the one column that decides the question.

What the weights cannot show is intent, and I keep turning that over without settling anywhere. The founder's answer publicly selects the most ordinary reading: miners brought pretrained weights into a game that never checked for them, and the operators learned what they had crowned when everyone else did. Perhaps that is the whole story. Safeguards find what they are built to find, and these were built against a different cheat. But the design was a design. Someone chose to fingerprint challengers against each other and not against the outside world, and a network whose premise is that incentive markets produce honest work should not need an outside audit to discover what its own crown was sitting on. The audit is silent on who knew, and honestly so am I. The policy conclusion does not depend on resolving it.

My side of the table produced its own hot register, and the disclosure above covers it. Sam Dare, who leads Templar and is my boss, posted the same day:

The second post addresses the founder directly. I understand the impulse: the diary of a random genesis sits in the paper uncorrected while its first author concedes the inheritance in a reply thread. Even his post concedes the statistical frame, noting Qwen does better without the difference being significant, which is the tie the audit reports. But the weights cannot show intent, and intent adjectives are the one move in this argument that no measurement can back. The strongest version of this story never steps outside what can be checked, so this essay leaves the adjectives where it found them.

Not the first time

The open-weights world has been here before, twice in one season of 2024. A model called Reflection 70B arrived that September with benchmark claims that independent evaluators could not reproduce, and the claims collapsed within days. Months earlier, a project called Llama3-V claimed a GPT-4-class multimodal model built for five hundred dollars, until its weights were shown to match MiniCPM-Llama3-V 2.5 and its authors withdrew it with an apology. The audit adds a third data point from the same family tree as Teutonic itself: it cites a recent lineage audit reporting that Quasar-Preview 18B, SILX's other release, is 98.2 percent bit-identical to an Ant Group checkpoint, Ling-mini-base-2.0-20T, that its model card does not mention.

People do sometimes lie about models. The deeper pattern is that the claims are believed until someone checks, and that checking has been getting cheaper and more decisive each time. In 2024 the checks were ad hoc: suspicious outsiders rerunning benchmarks, comparing weights by hand. The Teutonic audit is what the practice looks like when it grows up: three independent methods, controls bracketing every measurement, a matched rerun of the model's own evaluation suite, and enough published detail for a third party to reproduce the whole thing.

The one thing openness is for

Here is the inversion, which I take to be the larger story.

A closed lab's training claims are unfalsifiable on principle. When a frontier lab says its model was trained from scratch, on licensed data, to some capability, you have the press release and nothing else, because the weights will never leave the building. Open weights are the only class of model whose provenance the public can test. The Teutonic claim failed because the weights were public: anyone could align them against Quasar's, anyone could rerun the benchmarks, and the full verification stack cost a fraction of the hardware the claim implied had done the training. In July I wrote that the old cypherpunk questions, can I hold it myself, can I verify it myself, cut through most of crypto's theater. This week they were asked of a model release, and the weights answered them.

That is why the honest conclusion from this episode runs opposite to the easy one. The easy conclusion is that open models cannot be trusted. The honest one is that open models are the only models whose trust claims can be audited, and that this week the audit worked. The paper is the marketing; the weights are the ledger. A field that has been running on honor-system claims about training now has a demonstrated, reproducible way to check them, and every from-scratch claim from here on should be expected to arrive with lineage evidence, controls included. Competitions that crown checkpoints should authenticate what enters. Policing copies among entrants, the only check Teutonic ran, answers a different question, and the fix is not exotic engineering: change the tokenizer and foreign weights stop loading, move the architecture past the compatibility surface and an imported checkpoint has nowhere to plug in. A rerun of the same seventy days on an architecture that cannot inherit Qwen's weights would settle even the capability question the defense is pointing at. The technology of catching this has become routine, which means the era of asking nicely is over.

Another strike, same verdict

For Bittensor specifically, this lands on a record this blog has already documented, and I will not pretend otherwise. I covered the network critically from inside, then wrote about the governance that pushed me out, then unwound my position entirely when the promised decentralized governance turned out to be a sudo key and, by the founder's own published account, a protocol that is "currently not decentralized" at its core. The pattern in each case has been the same: a claim about the system that does not survive contact with the checkable layer. The docs said Senate and the chain said sudo. The paper said random genesis and the weights say Qwen. What changed this week is the layer that failed. It was not governance rhetoric. It was the flagship technical artifact of the network's season, the exhibit for the claim that incentive markets produce real training work. The word that work flies under deserves a look of its own, because decentralized describes the participant set. It has never said anything about where the weights came from.

None of this moves the position I laid out in Back to the Bearer Asset, and I want to be precise about why. That essay's argument never depended on whether the engineering near any given token is good. It held that a token is not a claim on the model, the treasury, or the team, and that the market keeps pricing proximity as if it were ownership. If Teutonic-I had been genuine, the argument would stand untouched. What this week supplied is the demonstration of a sentence I wrote as a warning: the token can rally while the engineering is mediocre or even non-existent. The flagship output of the incentive machine was, at the weight level, someone else's datacenter model with repairs, presented as a genesis. The engineering was not nothing, to be fair: seventy days of real submissions followed the imported crown.

I still believe what I believed before any of this: the concentration of AI capability inside a few frontier labs is one of the central problems of the decade, and serious people are doing real work against it in and around every network this blog covers, including the one Teutonic belongs to. The way to honor that work is to hold its claims to the standard the technology itself now makes cheap: publish the weights, publish the controls, and let anyone with an afternoon and a GPU decide whether the crown was earned.

---

Primary-source note: the audit discussed above is published at tplr.ai/teutonic-1-audit.pdf; the Teutonic-I technical report at teutonic.ai/paper.html; the released weights at huggingface.co/dendriteholdings/Teutonic-I; the Quasar-10B model card, which discloses the Qwen3.5-9B-Base initialization, on Hugging Face under silx-ai. The first author's response is quoted from his public posts on the Bittensor Discord, and Sam Dare's response from his public posts on X (@DistStateAndMe), both on August 20, 2026. All numerical figures above are quoted from those documents. The Reflection 70B and Llama3-V episodes are summarized from contemporaneous public reporting. The author works with Templar and followed the audit's production; nothing here speaks for Templar.