burner22

/

numbat

Like 315

I checked this repository through an AI-assisted, reproducible audit and found an exact deterministic generation fingerprint in the published weights.

43 complete tensors — 730,368 BF16 values — can be regenerated bit for bit from their tensor names alone.

Revision examined: 6b7f8fc548cbafe9bec441f03af2d92a55cb4012.

The generation recipe is:

1. Compute SHA256(tensor_name.encode()).
2. Interpret the first eight digest bytes as an unsigned big-endian integer.
3. Use that integer to seed NumPy’s PCG64 generator.
4. Generate standard_normal(shape, dtype=np.float32).
5. Apply:
   • Normalization weights: exp(float32(0.06) * z)
   • Convolution kernels: z * float32(1/6)
6. Convert to BF16 using round-to-nearest, ties-to-even.

After identifying these recipes, predictions were recorded for 21 previously unread tensors, containing 423,168 values. Every predicted value matched the subsequent HTTP Range reads exactly. A separate verification script then fetched all 43 tensors again and confirmed the same byte-for-byte matches.

The checks include early, middle and final normalization layers, plus convolution kernels from layers 0, 1, 2, 112 and 113. Only small byte ranges were downloaded, and no Python code from the model repository was executed.

Here is a minimal standalone reproduction covering both recipes. It requires only numpy and requests, downloads approximately 90 KB, and refuses full-file responses:

import hashlib
import json
import struct

import numpy as np
import requests

REV = "6b7f8fc548cbafe9bec441f03af2d92a55cb4012"
URL = (
    f"https://huggingface.co/burner22/numbat/resolve/{REV}/"
    "model-00001-of-00772.safetensors"
)

def read_range(start, end):
    headers = {
        "Range": f"bytes={start}-{end}",
        "Accept-Encoding": "identity",
    }
    with requests.get(URL, headers=headers, stream=True, timeout=30) as r:
        assert r.status_code == 206, "Refusing a full-file response"
        assert r.headers["Content-Range"].startswith(
            f"bytes {start}-{end}/"
        )
        data = r.raw.read(end - start + 2)
        assert len(data) == end - start + 1
        return data

def bf16_bytes(x):
    bits = x.view(np.uint32)
    return (
        (bits + 0x7fff + ((bits >> 16) & 1)) >> 16
    ).astype("<u2").tobytes()

length = struct.unpack("<Q", read_range(0, 7))[0]
assert length < 1024 * 1024
header = json.loads(read_range(8, 7 + length))

for name, recipe in [
    ("model.layers.0.input_layernorm.weight", "norm"),
    ("model.layers.0.self_attn.k_conv1d.weight", "conv"),
]:
    item = header[name]
    assert item["dtype"] == "BF16"

    seed = int.from_bytes(
        hashlib.sha256(name.encode()).digest()[:8], "big"
    )
    rng = np.random.Generator(np.random.PCG64(seed))
    z = rng.standard_normal(item["shape"], dtype=np.float32)

    x = (
        np.exp(np.float32(0.06) * z)
        if recipe == "norm"
        else z * np.float32(1.0 / 6.0)
    )
    predicted = bf16_bytes(x)

    start, end = item["data_offsets"]
    assert end - start == len(predicted) < 1024 * 1024
    actual = read_range(
        8 + length + start,
        8 + length + end - 1,
    )

    assert predicted == actual, f"Mismatch: {name}"
    print(
        name,
        len(predicted) // 2,
        "EXACT",
        hashlib.sha256(actual).hexdigest(),
    )

Expected output:

model.layers.0.input_layernorm.weight 12288 EXACT 13bd9e147c4d37548617a04661ca24f2975667e811331aecd21713c1ba5c78e0
model.layers.0.self_attn.k_conv1d.weight 24576 EXACT d0f5f7ad83727da9d1e9242bce76f3ff853e049bf14196ad5f707bbb21a2d79d

What this establishes: the tested tensors are exactly reproducible deterministic synthetic arrays, including both normalization parameters and convolution kernels.

What it does not establish: I have not checked every tensor or reproduced full-model inference. These matches alone cannot logically exclude a training setup that deliberately kept all these parameters frozen. They also do not authenticate the claimed Anthropic origin.

Could the uploader explain these exact matches and provide the training configuration showing whether these parameters were intentionally frozen? Without that explanation, this is strong, directly reproducible evidence against treating the repository as an authentic trained checkpoint.