Modelswarm is an idea for a hub of open-weight AI models that nobody owns. The name means models distributed by a swarm of peers, as in a BitTorrent swarm, so no company has to host them. Publishers sign their releases from their own Bitsocial profile, and every piece of every file is checked against the signed release as it downloads. No company decides which models are listed, which stay available or what can be said about them.
Status: idea stage. This repository reserves the name and collects the design. Nothing here is built; roadmap.md tracks what comes next and what each step waits on. It fits Phase 5 of the Bitsocial master plan, the long tail of Bitsocial clients. Most of it needs only what Bitsocial and BitTorrent already ship, so the first milestones are not blocked by earlier phases.
Credit. Modelswarm builds on HuggingSocial (huggingsocial.co), the original design by Bitsocial developer Rinse12. Most of the architecture comes from it: Bitsocial for releases and discussion, BitTorrent and HTTP mirrors for the weights, signed manifests checked on the reader's machine, hubs, indexers, the command line and the local Hugging Face endpoint. Modelswarm changes where releases live, how downloads are verified, how formats that can run code are handled and how models that are only on Hugging Face are covered; see Prior Art.
Hugging Face hosts over 3 million models, by Nvidia's count. On 2 September 2026 Nvidia agreed to buy it for $12.9 billion, a deal the US Department of Justice has since asked questions about. Whoever owns it, one company holds the files, the list of what exists and the place where each model is discussed.
That company can remove a model, and others can make it do so:
- Hugging Face restricted access to GPT-4chan in 2022.
- Meta's DMCA notice of March 2023 had GitHub take down repositories for downloading the leaked LLaMA weights.
Torrents already solve the storage half. Academic Torrents and Pirate Face publish models as magnet links, and a file with seeders cannot be deleted by any host. The list of magnets and the discussion around them still sit on one website each, and a magnet link says nothing about who published the file.
Modelswarm splits the hub into parts that no single party holds:
| Hugging Face | Pirate Face | Modelswarm | |
|---|---|---|---|
| Where the files are | Hugging Face's servers | Seeders, with Hugging Face as a web seed | Seeders, plus any HTTP mirror, including Hugging Face |
| Who can delist a model | Hugging Face | Pirate Face, which runs the list | Nobody across the network. A hub can drop a release from its own board, not from the publisher's profile |
| Who published this file | A Hugging Face account | A Pirate Face handle, verified through the matching Hugging Face account | A signing key, the same across every release by that publisher |
| When a corrupted or swapped file is caught | The host is trusted | After each file downloads, against Hugging Face's SHA-256 | During the download, piece by piece |
| Where discussion happens | Hugging Face | On Pirate Face | Peer-to-peer communities, each with its own rules |
| Works with existing tools | Yes | Yes, through its pirateface pip package for Python tools |
Yes, through a local endpoint that speaks the Hugging Face API |
Pirate Face as described on pirateface.co in November 2026.
A checksum of a whole file can only be compared when the download is finished. For a 40 GB model that means finding out at the end.
Modelswarm releases carry what BitTorrent v2 calls a pieces root for each file: the root of a SHA-256 hash tree built over 16 KiB blocks of that file. The root is inside the signed release, so:
- every piece is verified when it arrives, and a bad one is thrown away and fetched again from another source;
- the check is the same whether the piece came from a torrent peer or an HTTP mirror, so Hugging Face or any other mirror can serve the bytes without being trusted;
- the same file always has the same root, in any torrent and any release, so identical files share seeders.
See how-it-could-work.md.
A signature proves who published a file and that it arrived unchanged. It does not prove the file is harmless. Model files in pickle-based formats can run code when they are loaded, which is why Hugging Face scans for them. Modelswarm has no central scanner, so the defaults carry the weight:
- formats that hold tensors and metadata, such as safetensors and GGUF, download normally;
- pickle-based files and repositories that ship code to execute are flagged and need an explicit confirmation;
- a hub can refuse them as a posting rule;
- scanners are replaceable services that publish signed results, the way indexers are replaceable.
See how-it-could-work.md.
A catalogue the size of Hugging Face cannot live in one Bitsocial community, and it does not have to. A release lives in its publisher's own profile, which holds only that publisher's models. Hubs are ordinary communities that curate: they carry crossposts of releases and the discussion about them. The catalogue is the sum of many small communities, and an indexer makes it searchable.
Models that exist only on Hugging Face need no listing at all to be downloaded: the client can read Hugging Face's own metadata. A record is published the first time someone seeds such a model, so the peer-to-peer index grows with what people actually use. See how-it-could-work.md.
The planned client would use Forge RPC by default for its Bitsocial connection. Forge RPC is optional: users can switch to another compatible provider or self-host a node, and publishers keep their own keys. Modelswarm remains decentralized; model files travel over BitTorrent and HTTP mirrors, not through the RPC.
RPC revenue from Modelswarm is speculative, not a strong monetization pitch. RPC hosts release metadata and discussion, not the model weights, so metadata hosting alone may offer little reason to pay. Publisher willingness to pay is unvalidated. Reliable weight seeding, managed distribution or enterprise support could be separate paid services, but they go beyond RPC and are not committed features. The repository keeps its GPL-3.0-or-later license.
- Not a host. The project would publish a client and tooling. It would run no hub, no index and no seedbox that others depend on.
- Not a tracker site. There is no website whose removal takes the list of models with it.
- Not a replacement for Hugging Face's compute. No hosted inference, no Spaces.
- Not a blockchain. Releases and discussion are signed Bitsocial records; files are torrents. Bitsocial Chain would only be used for
.bsopublisher names and tips.
- HuggingSocial, by Bitsocial developer Rinse12, is the design Modelswarm builds on, and the source of most of its architecture (see its DESIGN.md). Modelswarm differs in four ways: releases live in each publisher's own profile and hubs carry crossposts, so no hub can delist a release; every piece is verified during the download against a BitTorrent v2 pieces root, instead of whole files afterwards; formats that can run code are flagged and left out of default downloads; and mirror records are created when someone seeds a model, instead of mirroring Hugging Face in bulk.
- Pirate Face lists models as magnet links with Hugging Face web seeds, checks files against Hugging Face's SHA-256 and offers a drop-in
pippackage for Python tools. It still relies on Hugging Face for its source records and runs the list on its own website. Academic Torrents indexes models as torrents on its own website.
- how-it-could-work.md: publishers, releases, the manifest, verification, safety, hubs, downloading, the Hugging Face endpoint and search
- open-questions.md: design decisions not yet made
- roadmap.md: what is next and what each step waits on
- src/: the page for modelswarm.org, a React and Vite app on the stack of 5chan and WeTube. The app, Vite config, Node tooling and tests use strict TypeScript;
corepack yarn type-checkchecks both the app and scripts. Use Node 22.18+ (22.x) or 24+. Runcorepack yarn install, thencorepack yarn startto open it athttps://modelswarm.localhost;corepack yarn buildwrites static files tobuild/, and Vercel deploys every push tomaster
GPL-3.0-or-later for this repository. Models keep whatever license their publisher gave them; see open-questions.md.
- Bitsocial protocol docs: https://bitsocial.net
- Bitsocial Improvement Proposals:
bitsocialnet/BSIPsand https://bsips.bitsocial.net - Indexer:
bitsocialnet/bitsocial-indexer - Bitsocial Chain (names, payments):
bitsocialnet/bitsocial-chainand https://chain.bitsocial.net - Sibling idea-stage repos: WeTube (YouTube alternative), GitCommons (GitHub alternative), Infinipedia (encyclopedia), Hopium (social trading)