CrowdGPT v2.6 repairs the hole that let any client poison the shared model

A week after r/LocalLLaMA first saw CrowdGPT, a project training a 1B-parameter model on volunteers' GPUs, its author posted v2.6 on 31 October. The headline number is throughput: 4.5B new tokens in six days. The substance is a repair job. The previous version let clients fake their work, poison the training data, and, through the auto-updater, run code on contributors' machines.

The protocol was the vulnerability

An earlier client could submit fake contributions with no server-side checks, and bogus updates every millisecond were enough to take the server down. The consequence he states plainly: it "could very easily train the model to contain malicious backdoors". The update path was worse: auto-update pulled whatever was published to GitHub, so stolen credentials meant code execution on every contributor's machine.

v2.6 answers both. Client releases are now signed with a key that exists only on his device, and contributions are checked server-side and cross-checked between clients. The price sits in the changelog's mechanics: three clients train on exactly the same data, and their results are compared before anything is accepted.

Trust bought with throughput

The throughput claim needs company. The author says the breaking changes left some contributions stale, yet the network still trained on 4.5B new tokens in six days, roughly what he managed in two months on his personal GPU. A total produced while per-update compute tripled is not a cheaper schedule; it shows the volunteer pool is deep enough to absorb the tax.

His bound on the remaining risk is the more useful number: a malicious client can now train on only 2-3% malicious data per round before being banned, against 100% before. He scopes it himself: "I am not claiming that this creates a 100% perfect Federated learning framework, but that makes malicious contributions way harder."

Twelve percent of the slogan

The project dashboard corrects the marketing. At research time: 2,616 contributions from 19 active GPUs, 12.0B tokens against a 100B-token goal, 297 optimizer steps, a latest aggregated loss of 3.0209, 70 names on the leaderboard. The model is 1B parameters, 24 layers, grouped-query attention, a Qwen3 tokenizer and BF16 weights, with global updates pushed to Hugging Face every ten hours. So "AI owned by everyone" still runs through a central coordinator and a borrowed weight bus; the repo, created in August, has 158 stars.

Also shipped: CrowdBench, an early collaborative benchmark where anyone can add questions with deterministic answers. The reason to watch the project is narrower than its tagline: a single human-readable Python client can be audited by outsiders, and symmetric redundancy is real design work. A 1B model is a fair proof of concept, not a claim about frontier capability, and 12% is the honest measure of how far the crowd has come.