Claude hand-wrote the weights of a 397,250-parameter citation checker. The 97.8% is not in the repo

On 3 November the CTO of a legal-AI company posted two sentences and a four-column table. "Got fable to hand-write weights of a 100k param model to recognize real versus fake legal citations," Jacob Lauritzen of Legora wrote. "Basically one-shotted a full NN that's better than training it." The table lists hand-written weights at zero labels seen, 3,793 non-zero parameters and 97.8% test accuracy, against 94.6% for a trained model given 8,192 labels, and the framing that travelled was self-improvement by another name.

This one can be checked. The artifacts are on Hugging Face: a 397,250-parameter Core ML network, the Python that generated its weights, the evaluation logs, and a demo. I cloned it. What is there is more interesting and much narrower than the table.

The release is four times the size of the claim

The repo was created on 4 November under an Apache-2.0 licence, and has a single commit. Its logs give parameter counts. The first blind version, v1.0, is 190,664 parameters with 7,901 non-zero. The version now on the Hub, v1.5, is 397,250 with 13,871 non-zero. Neither is the figure in the tweet: 3,793 non-zero weights and "100k param" match no released checkpoint. The network people are arguing about is four times larger and 3.7 times denser than the one described in the post that made it famous. That is drift rather than fraud — it was rebuilt afterwards — but anyone quoting 3,793 is describing a model that was never published.

What the model wrote was a compiler

Claude did not emit 397,250 floating point numbers. It wrote citenet/spec.py and citenet/net.py, about 750 lines, and net.py compiles the tables in spec.py into weight tensors at build time. The spec is a citation rulebook: 204 reporter abbreviations with the courts each one prints, 12 families of impossible reporter series, 77 court detectors, approximate volume-to-year timelines.

A reporter template becomes a convolution filter that fires only when the characters spell <digit> F.3d<space>. Digits get decoders with weight k·10^i on digit k, and rules are gates of the form relu(8·[federal appellate reporter] + [state court] − 8). The network sees 64 characters per citation and nothing else: no case name, no holding, no page.

Every non-zero weight has a name, which is unusually legible and the strongest argument for the project. It also relocates the achievement: the model authored a rulebook and a compiler that implements it, so the capability is spec-writing inside a fixed architecture, not an intuition for 397,000 numbers. Sean Goedecke made the same point about the MIT experiments: turning a simple program into a network is a known trick, and "the best way to work with binaries is still to write source code and compile it."

The eval, down to the last citation

LePhantomCite is a real artifact: 1,300 brief excerpts, 390 in the eval split, 1,109 injected hallucinations across five types. Only 158 are non-existent citations, the one type a string-only model can catch.

The repo evaluates at citation level. The eval split holds 1,290 citations: 983 genuine, 276 carrying other hallucination types, 31 phantom. v1.0, logged as the "first and only blind run", caught 31 of 31 phantoms and flagged 3 of 983 real citations. v1.5 caught 31 of 31 and flagged one, for precision 0.969. The flagged citation is 652 A.2d 634 (D.C. Cir. 1995), which the author argues is an error in the source brief itself.

Now look for 97.8%. It is not in the repository: a grep across every script, log, card and HTML file returns nothing, and no published split yields it. On the released eval split, 31 phantoms caught and one genuine citation flagged is 1,287 correct out of 1,290, or 99.8% accuracy — a different number from a different arithmetic. The 97.8% exists only inside a screenshot, which a reader cannot check.

The "zero labels" column has the same problem. The tweet says zero; the card says the network "was designed using only the aux_train split", while spec.py insists nothing in it is learned. Those are compatible only if "seen" means "received a gradient", and the card does not reconcile them.

The trained baseline tied, and the control did better

The 94.6% belongs to a 107,745-parameter network trained on 8,192 labels. Those numbers come from the same screenshot, and that model is not in the repo.

The one in the repo is more damaging. results/train_baseline_v1.1.txt runs the same architecture, initialised at random and trained with Adam on aux_train, three seeds. All three catch 31 of 31 phantoms with zero false flags out of 983; the hand-written net flags one. The card says it plainly: "trained from scratch, the same architecture (v1.1) ties on this benchmark, with 0/983 false flags." On this split, gradient descent is marginally better on the only metric that matters to a lawyer: how often you are told a real citation is fake.

Where hand-writing wins is five fakes the author planted in a demo brief, of kinds the training split never contains. The hand-written net caught 5 of 5; the trained one caught 1. The author calls that set "tiny and I wrote it, so treat it as illustrative", and he is right. It is the honest core of the result: a compiled rulebook generalises to violations it was never shown, because it was never shown anything. The weights also resist the obvious next step. Fine-tuning from them destroyed the model — 30 of 31 phantoms, 118 of 983 false flags. These weights are a brittle program, and SGD smears them.

A party trick with a real use

The performance claims, unlike the accuracy claims, hold up in the logs. On an M5 Pro:

Build	Latency	Throughput
1 citation	~50 µs	19.5k/s
8,192, GPU	6.16 ms	1.33M/s
Neural Engine plus GPU	—	1.82M/s

End to end, the author reports 3.30 GB of US court opinions in 2.3 seconds: 1.44 GB/s and roughly 1.68 million citations a second on a laptop. That is a real result regardless of how the weights were made.

It is also, by the author's own admission, a spell-checker. "A string-only network can tell that a citation could exist, not that it does." The six citations ChatGPT invented in Mata v. Avianca, including 925 F.3d 1339 (11th Cir. 2019), are structurally valid and pass. Of the 276 eval citations carrying mismatched case names, wrong pincites, misquotes or misrepresented holdings, the net flags two.

The benchmark's published best system, GPT-5 in an agentic loop, reaches 84.4% recall at 55.0 F1 with access to case law. CiteNet attempts one type with 64 characters and no retrieval. Its 97.8% and the paper's 55.0 F1 describe different tasks, and putting them in one sentence is how a good filter gets mistaken for a solution.

What the claim cannot carry

A 397,250-parameter network is about one twenty-thousandth the size of an 8B model and was compiled from a rulebook a law student could read. Nothing here is recursive, and nothing improved itself: v1.0 to v1.5 was a human-directed revision using 5,062 labels, after the blind run. Calling this self-improving AI is a category error, and it is the same drift that turned a loop repair on Qwen into a sixfold maths gain — a narrow, real result that the framing outran.

Paul Calcraft, who replicated the result, put the objection more bluntly: Fable "can only write a fake legal citation detector net when there is a ruleset it can follow", and at this complexity "the problem is harder to solve via gradient descent than a hand-written program." The task was chosen because a program solves it.

What would move this from demo to finding is a preregistered eval across all 390 excerpts, a trained baseline at matched size and matched labels, a task with no rulebook to transcribe, and an independent rebuild from spec.py. The defensible sentence is short. A frontier model wrote a compiler that emits a working 397,000-parameter citation filter, with no gradient step, and it runs in 50 microseconds. Everything past that is unpublished, contradicted by the author's own logs, or true only on a five-item test he wrote himself.