TLDR: Pirate Face is a permanence layer that archives Hugging Face models as verified BitTorrents. It enables a model’s weights to survive the deletion, the gate, or the license change that removes them from the hub. The difference between it and the ungated mirrors covered yesterday is ownership: a mirror is a copy someone hosts, a swarm is a copy everyone hosts at once.
Eight hours. That is the gap between Meta publishing its identity-gated download page for Muse Spark Open and the same 533 GB checkpoint appearing as a BitTorrent: 128 files, all checksums verified. Pirate Face, the Hugging Face permanence layer behind it, witnessed the revision and listed the magnet before midnight UTC. No gate needed.
The tweet quoting Pliny’s gate reaction has tripled to three thousand likes in a day. The swarm answered within hours.
The mechanics underneath
Tag @thepirateface under any post linking a Hugging Face model. The service streams the model from Hugging Face, checks every file against its published SHA-256, and lists the magnet on a model page of its own. A first-party tracker and DHT discovery give every listing two paths into the swarm. The site states its own limit in plain text: it does not store model weights, a torrent link and a checksum are not copies. What it stores is the proof: source revision, per-file hashes, and a timestamp it calls witnessing.
That proof is what separates an archive from the three ungated mirrors we covered yesterday. A mirror is one host with a copy; take the host down and the mirror is gone. A swarm is many hosts with the same copy, and the magnet resolves as long as any of them seed. Seeding is gamified: points, a leaderboard, an ETH treasury. Whether those incentives hold up over months is an open question, but fifteen models are already through the pipeline.
The rescue ledger
The rescue queue is the part with teeth: tag a model and Pirate Face witnesses its files before anything can happen to them. Fifteen models are listed as rescued. NVIDIA’s Nemotron-3.5-Bolt is one; the Xing4.0-29B GGUF already in our catalog is another.
One provenance entry records the exact failure case the design exists for: a source going unreachable after the checksums were witnessed. A saved checksum set means a community copy can be verified as the same weights, not just some files with the same name.
Every layer of the Muse Spark Open story stacks against Meta’s gate. The company collects legal names, birth dates and organization identifiers to hand out weights whose license grants free copying, modification, distillation and distribution, with only an attribution requirement and a 20 million dollar revenue clause for the serving market in the way. Redistribution is not a hack on that license; it is one of the rights the license explicitly grants, and Pirate Face’s eligible list counts the Muse Model License as archive-worthy for exactly that reason.
The gate cannot protect what the license has already set free. It can only collect identity from whoever downloads through the front door, while the swarm hands the same checksummed bytes to anyone with a torrent client. That is the design constraint every lab writing an open-weights license this year inherits: if your license grants distribution, your download gate is a form, not a control. The weights stay yours to restrict only until a checksum archive exists. Pirate Face shipped its tracker in September, the hub this week, and a 533 GB flagship torrent is the loudest proof yet that the archive layer responds faster than any takedown.
Related on this site: the gate itself is covered piece by piece in yesterday’s article, the weights’ fit math is on the Muse Spark Open model page, and the Xing4.0-29B row is one of the fifteen rescued models now preserved in the swarm.