The Math Remembers: How to Catch a Model Lying About Being Original

In June 2026, the city of Rio de Janeiro shipped an AI model and called it its own. Rio-3.5-Open-397B: 397 billion parameters, announced by City Hall as an open model "trained in Rio" over the past year. Three days later, a stranger on GitHub proved, with nothing but subtraction, that most of it was a model built in Shanghai.

He didn't leak an email. He didn't find a memo. He downloaded the weights, subtracted one model from another, and read the confession sitting in every tensor.

I want to walk through how he did it, because the method generalizes. Merges, fine-tunes, wrappers, quiet distillations: the marketing around a model is trivial to fake, and the weights are very hard to. This is the forensic toolkit for telling the difference. It's also, by the end, an argument for restraint, because the same tools that caught Rio have been pointed at plenty of models that turned out to be innocent.

TL;DR

A linear model merge isn't a resemblance you argue about. It's an exact equation written into every parameter, and you can solve it. This post walks the Rio-3.5 case, where that math played out in public; the algebra that makes a merge recoverable; and the full confidence ladder of model forensics, from the near-worthless "who made you?" up to weight inspection that actually closes a case. The uncomfortable finding at the end: confirmed model fraud is far rarer than the timeline makes it feel.

Three Days in June

The timeline is short. On June 11, an organization called prefeitura-rio (that's IplanRIO, the city of Rio de Janeiro's municipal IT company) uploaded Rio-3.5-Open-397B to Hugging Face. The model card credited a single base model, Alibaba's Qwen3.5, and set the license to MIT. A city secretary, Eduardo Cavaliere, announced it publicly as an open model trained in Rio with public work behind it.

On June 14, a GitHub user posting as 00INDEX, on behalf of a Shanghai lab called Nex-AGI, opened Issue #4 on their own repository. The title was the entire argument: "Rio-3.5-Open-397B ≈ 0.6 x Nex-N2_pro + 0.4 x Qwen." He brought two independent proofs.

The first proof was behavioral. Rio shipped with a hard-coded system prompt that forced the model to call itself "Rio." Strip that prompt away and ask the underlying weights who they are, and the mask slips. Across 120 identity questions with the system prompt removed, the model answered "Nex" 79.2% of the time and "Nex-AGI" 73.3% of the time. It called itself "Rio," its own advertised name, exactly zero times.

Worse, the model recited Nex's specific corporate backstory word for word: "I am Nex, from Nex-AGI… jointly built by the Shanghai Innovation Institute." That paragraph appears in hundreds of Nex's own training examples. It's effectively a watermark, and it was surfacing inside a model the city of Rio was calling homegrown.

The second proof was the weights themselves, the part I'll spend the next section on. 00INDEX recovered the exact mixing ratio: Rio was 0.571 of Nex plus 0.429 of Qwen, and that same ratio held across all 60 layers of the network to within a rounding error.

The tell that removed any doubt about intent: about an hour after the issue went up, the model card was quietly "rectified" to admit the merge, now "built via a merge of Nex-N2-Pro and Qwen3.5." 00INDEX's reply was one line: "Are you talking about the credit that was just updated an hour ago? lol."

Most of the angry thread missed the actual point. Merging models isn't wrong. Both parents were Apache-2.0 licensed, so blending them was permitted. The wrong was the story around it, and the paperwork: Rio relabeled the result MIT and stripped the attribution Apache-2.0 requires, then benchmarked itself only against Qwen, the weaker of its two parents, while hiding Nex, the stronger one it was mostly made of.

Why a Merge Can't Hide

The reason a merge can't hide is that a merge is an equation, and equations have solutions.

Say someone blends two models, A and B, into a new model C by averaging their weights with some mixing weight α:

${\theta }_C=\alpha {\theta }_A+(1-\alpha ){\theta }_B$

That statement isn't approximate, and it isn't a claim about the model as a whole. It holds for every single parameter tensor in the network: every attention projection, every expert, the output head. So subtract θ_B from both sides. Write d = θ_A − θ_B for the direction from B to A, and e = θ_C − θ_B for the direction from B to the suspect. The merge asserts, exactly:

$e=\alpha d$

That's one equation per parameter. In a 397-billion-parameter model, it's hundreds of billions of equations sharing a single unknown. That redundancy is the whole game. You recover α by projecting e onto d, which is a one-line least squares:

$\hat{\alpha }=\frac{({\theta }_A-{\theta }_B)\cdot ({\theta }_C-{\theta }_B)}{\Vert {\theta }_A-{\theta }_B{\Vert }^2}$

Then you check two things. First, the residual: how much of e is left over after you subtract α·d. For a genuine merge stored in fp16, it's down at the floating-point noise floor, around 0.001 (a few times higher for bf16, which keeps fewer mantissa bits). Second, the collinearity, the cosine between d and e. Two unrelated models point in essentially random directions in a billion-dimensional space, so their cosine sits near zero, agreeing to about ±0.0001 by chance alone. A real merge gives a cosine near one.

Rio measured 0.993. On every tensor. Simultaneously. As 00INDEX put it, that isn't "high similarity." It's thousands of standard deviations from anything chance could produce.

The interactive below is the whole argument in one picture. Drag the true mixing weight of the merge and watch the two curves:

The merge's residual touches zero at exactly one value of α, and an independent model's never touches zero at all, no matter which α you try. That gap is the entire proof.

Now the honest complication, because this is where fair accusations go to die. Nearly every open model descends from a handful of ancestors: Llama, Qwen, Mistral. When two models share an ancestor, those shared weights dominate everything, so the raw cosine between almost any two same-family models is around 0.999 whether or not one was built from the other. Naive weight similarity is the single most common way people generate a false accusation. The fix is to work in delta space: subtract the common base first, then compare the leftover fine-tuning directions. A true merge leaves the suspect's delta sitting inside the span of its parents' deltas, residual near zero. A mere cousin's delta points somewhere else, and no α brings that residual down. That out-of-span residual is the number a fair accusation actually rests on.

And the clean proof does break, sometimes. Fine-tune a model after merging and you smear a dense correction on top of the equation; α stays roughly recoverable, but "exact proof" softens to "strong evidence." Fancier recipes like SLERP, TIES, and DARE aren't simple averages, so a single global α won't fit them. But each leaves its own fingerprint. DARE, which randomly drops most of a delta and rescales the survivors by 1/(1−p), leaves a histogram spike at exactly that constant: drop 90% and every surviving weight is 10× its parent's. The math still remembers. It just writes the confession in a different hand.

Where the Weapon Came From

There's an irony worth sitting with: the forensics that caught Rio is built entirely out of the research that makes merging easy in the first place.

The lineage goes back about four years. In 2022, "Model Soups" showed that if you fine-tune the same base a dozen ways and just average the weights, you often beat any single run, for free, at no extra inference cost. Later that year, "task arithmetic" gave the trick an algebra: define a task vector as the difference between a fine-tune and its base, τ = θ_ft − θ_base, and you can add these vectors to combine skills or subtract them to remove one. 2023 and 2024 brought sharper recipes, TIES and DARE, that resolve the interference when you fuse several models at once. And MergeKit, released in 2024, turned the whole thing into a commodity: write a short YAML file, name your ingredients, get a merged model.

That research answered the question every open-model builder was asking: how do I get a competitive model without a training budget? The answer was to average other people's. Read slightly differently, the same papers answer a second question: how do I prove that someone did exactly that?

Because all of it rests on one precondition. Merging only works when the models share an architecture and a common initialization, with no shuffling of neurons in between. They have to live in the same coordinate system. That precondition is also what makes them comparable for forensics. When models don't share a basis, as with two independent training runs, you first have to align them by permuting neurons, the problem "Git Re-Basin" solves, before any comparison means anything.

The academic side has since hardened the tools well past subtraction. REEF fingerprints a model from its internal representations and survives fine-tuning, pruning, and even merging. Stanford's "Independence Tests" put an exact p-value on the question "were these two models trained independently?", and in passing, caught that Llama-3.2-3B was pruned from Llama-3.1-8B. There is now a whole literature on reconstructing the family tree of the model zoo from weights alone. Rio was an early, loud application of it. It won't be the last.

The Confidence Ladder

Weights are the top of the ladder, not the whole of it. Most provenance arguments happen with far less access, an API and a suspicion, and the mistakes almost always come from treating a low rung as if it were the top one. It helps to name the rungs.

Rung one is self-report, and it is nearly worthless. Ask a model "who made you?" and it will often answer confidently and wrongly. The post-2023 web is saturated with ChatGPT transcripts, so any model trained on a broad crawl learns that the likeliest completion to "what are you?" is "I'm ChatGPT, made by OpenAI." When DeepSeek's V3 identified itself as ChatGPT in most informal trials in late 2024, it set off exactly this confusion. Mike Cook of King's College London gave the right framing: training on another model's output is "taking a photocopy of a photocopy," where you inherit the artifacts, including the self-portrait. Rio's 79.2% "I am Nex" looks damning, and it was, but only because a tensor proof was standing behind it. On its own, self-identification is a hypothesis, never a verdict.

Rung two is behavioral fingerprinting, and it's a real signal. Models have stable, measurable output tics: favored words, formatting habits, particular refusal phrasings. A classifier can learn them. One 2025 study told ChatGPT, Claude, Grok, Gemini, and DeepSeek apart at 97.1% accuracy, and got roughly half of that from the first word of the response alone. An active version, LLMmap, fingerprints 42 model versions to 95% accuracy with as few as 8 crafted queries. This is strong for "is my provider silently swapping the model behind this endpoint?" It's weaker for lineage, because two different base models fine-tuned on the same synthetic data start to converge: the teacher's fingerprint bleeds through both.

Rung three reads the plumbing, the tokenizer and the logits. A model's tokenizer, its exact vocabulary and merge rules, almost never changes under fine-tuning or merging; retraining it would invalidate every learned embedding. So the tokenizer is a near-immutable lineage tag, and you can even read a model's training-data mixture off the order of its byte-pair merges. With access to logits, you can go further: Nicholas Carlini's team recovered the hidden dimension and part of the embedding matrix of production OpenAI models through the API alone, for under twenty dollars.

Rung four is the weights, and it's the only rung that closes a case. Delta-space α, out-of-span residual, representation fingerprints. This is where Rio was settled. It's also where the Yi-34B question was settled back in 2023, a model accused of hiding its Llama lineage behind two renamed tensors, which turned out to be exactly that and nothing worse.

A Field of Accusations, Mostly Unproven

I started this expecting a rogues' gallery. What I found was thinner and stranger: a handful of loud accusations, most never actually proven, and a couple that dissolved on contact.

Reflection 70B is the closest thing to a clean technical scandal, and even it has a hole. In September 2024, Matt Shumer announced a Llama-3.1 fine-tune that supposedly beat GPT-4o and Claude 3.5 Sonnet. Nobody could reproduce the scores from the public weights, which behaved like plain Llama 3. Testers were redirected to a private API that performed better, and the community fingerprinted that API as Claude 3.5 Sonnet, partly because it silently filtered the word "Claude" out of its own output. Artificial Analysis, who ran the evals, put it carefully: the good numbers existed only "on a private API… we were not able to independently verify exactly what we were testing." Misrepresentation, confirmed. Whether it was fraud or a chain of unlucky bugs was never settled, because the good scores never reappeared anywhere you could inspect.

The DeepSeek distillation accusations are louder and even less resolved. Through 2025 and into 2026, David Sacks, OpenAI, and later Anthropic all claimed DeepSeek had distilled their models. The evidence offered in public was self-identification and asserted-but-undisclosed logs. No forensics were released. No lawsuit was filed. And the whole thing has a hard time surviving the observation 404 Media made most bluntly: OpenAI, which scraped the web's copyrighted text on a fair-use theory, is furious that someone may have used its outputs the same way.

Yi-34B is the case I'd point to as a warning. In late 2023, Eric Hartford noticed that 01.AI's Yi-34B used Llama's exact architecture with two tensors renamed, and raised it. It looked like lineage-hiding. It wasn't. 01.AI called it an oversight, renamed the tensors back, and EleutherAI publicly defended them: "all modern LLMs are made from the same algorithmic building blocks," and the rename was "not evidence of nefarious intent." The accusation evaporated.

The one case in this whole territory that a court actually confirmed as fraud had no model in it at all. Nate, an "AI checkout" app, raised over $40 million from investors on a claim of automated purchasing that the DOJ and SEC found was "effectively zero percent" automated. The checkouts were done by human contractors in the Philippines and Romania. (And while we're correcting the record: Builder.ai's viral "700 engineers pretended to be the AI" story is overstated. Its confirmed fraud was financial, not a Mechanical-Turk performance.)

The pattern is the lesson. The toolkit is powerful, and powerful tools invite overreach. A weight-space match is proof. A vibe is not.

Where This Leaves You

The weights don't lie. But reading them fairly is a discipline, and the person making the accusation owes the accused exactly the rigor they're demanding. If you ever find yourself holding a suspicious model and the urge to post about it, here's the discipline that keeps you honest.

Work in delta space, not raw weights. Subtract the shared base before you compare anything. A breathless "these models are 0.99 similar!" is almost always just two cousins sharing an ancestor.

Demand consistency across tensors. One suspicious layer proves nothing; you can fit almost any single tensor by accident. A stable α across hundreds of tensors at once is the signal that can't be faked.

Treat self-identification as a hypothesis. "It says it's ChatGPT" is contamination until the logits or the weights agree with it.

Rule out the boring explanation first. A shared ancestor, a shared synthetic training set, an adopted tokenizer: each one mimics derivation. Exclude them before you accuse anyone.

Don't trust the model card. Hugging Face's lineage metadata is author-declared and unverified; nothing checks the uploaded weights against the base they claim. The audit is the community, running subtraction.

And if you ship a merge, just say so. DeepSeek-R1-Distill-Qwen-32B names its parents in the title. That is the entire fix, and it costs nothing.

You can rename the tensors, edit the README, and forge the benchmark. But every weight in the file still remembers exactly where it came from — and subtraction is cheap.

---

Sources

• nex-agi/Nex-N2 Issue #4 — the Rio-3.5 exposure in full: recovered α = 0.571 ± 0.0016, cos_fit = 0.993, the 79.2% / 0.0% identity probe, and the lab's admission
• Rio-3.5 model card, "rectification" commit — the README edited to admit the Nex + Qwen merge, about an hour after the accusation
• Model Soups (Wortsman et al., ICML 2022) — the empirical basis of linear weight merging
• Editing Models with Task Arithmetic (Ilharco et al., ICLR 2023) — the task-vector algebra that makes a merge linear, and therefore recoverable
• MergeKit (Goddard et al., EMNLP 2024) — the tool that turned merging into a one-file commodity
• Git Re-Basin (Ainsworth et al., ICLR 2023) — permutation symmetry, and why naive cross-lineage weight comparison fails
• Independence Tests for Language Models (Stanford, 2025) — exact p-values for "trained independently?"; caught Llama-3.2-3B as pruned from Llama-3.1-8B
• REEF: Representation Encoding Fingerprints (ICLR 2025) — representation fingerprints robust to fine-tuning, pruning, and merging
• Idiosyncrasies in LLMs (2025) — behavioral fingerprinting at 97.1% five-way accuracy
• LLMmap (USENIX Security 2025) — active fingerprinting: 42 model versions, 8 queries, 95%
• Stealing Part of a Production Language Model (Carlini et al., ICML 2024) — recovering a black-box model's hidden dimension for under $20
• Data Mixture Inference (Hayase et al., 2024) — reading a model's training mixture off its tokenizer merge list
• Artificial Analysis on Reflection-70B — "not able to independently verify… a private API"
• EleutherAI on Yi-34B — the accusation that dissolved; "not evidence of nefarious intent"
• Nate AI-checkout fraud charge (TechCrunch) — the one court-confirmed case, and it had no model
• Why DeepSeek thinks it's ChatGPT (TechCrunch) — why self-identification is weak evidence