Pirate Face reached 531 points on Hacker News with a promise that AI models can live forever. The more revealing number is 24. That was the largest seeder count on its public leaderboard when MrKeyoor checked, attached to a 6.7GB Baidu OCR model. Seven of the ten most-seeded models had between one and eight seeders.
Pirate Face has built a useful index and checksum record, with BitTorrent as the distribution path for permissively licensed models. It has not made storage permanent by declaration. A magnet can survive the company that published it, but the weights survive only while somebody keeps a complete copy online.
What Pirate Face preserves
The service starts with models on Hugging Face carrying Apache 2.0 or MIT licenses. Its technical explainer says each eligible model can receive a BitTorrent v1 magnet tied to a pinned revision. Pirate Face also records SHA-256 checksums for its files. Users can browse and download without an account, while community submissions go through review before their magnets appear.
While an upstream file remains available, Pirate Face says the torrent can use Hugging Face as a web seed. That is a standard BitTorrent mechanism: BEP 19 lets a client obtain pieces from an HTTP or FTP server and share them with peers. The upstream host supplies the first copy efficiently. If that URL later fails, peers holding the same pieces can supply them instead.
The public site separates three records that are easy to blur together. Its catalog advertises more than 669,000 eligible models. Its provenance log reported 6,145 witnessed revisions when checked. A model with a registered torrent still needs reachable peers. Pirate Face says this plainly on saved records: a listing is not a backup, and a magnet does not prove that anyone can download the files.
For researchers, a pinned revision and the hashes in Pirate Face's public provenance record preserve an answer to the question, "Which exact bytes did this model contain?" That can help identify an artifact after a repository changes. It cannot recreate missing bytes.
The archive depends on the last seeder
Pirate Face's leaderboard showed 24 seeders for baidu/Unlimited-OCR, 21 for Qwen/Qwen3.8-27B and 10 for sentence-transformers/all-MiniLM-L6-v2. The latter is only 91MB. Several much larger models, including one listed at 328GB, had eight seeders or fewer. These are snapshots, since peers can appear or disappear at any time.
The magnet for the 91MB MiniLM model, as served by Pirate Face, contained an info hash and Pirate Face's UDP and HTTP tracker addresses when inspected. Pirate Face says the Hugging Face web-seed URL lives in the torrent metadata. Yet BEP 19 places its url-list outside the info dictionary, while BEP 9 says a magnet client obtains only that info dictionary from peers. The public magnet exposed no web-seed URL or direct peer. The project pages reviewed for this article do not explain how a fresh client learns the web seed if no peer can serve metadata.
Once the upstream file is gone, the BEP 19 web seed can no longer provide pieces. The swarm must collectively retain every piece, and at least one reachable peer must provide the metadata to a new magnet user. A checksum can reject a damaged or substituted piece, but it cannot supply a missing one. Pirate Face is an archive only for models that people keep seeding.
A new discovery layer helps those people find one another. On September 20, Pirate Face announced a first-party tracker at udp://tracker.pirateface.co:6969/announce and kept distributed hash table discovery enabled as a second route. The tracker coordinates peer addresses and does not relay model files. DHT reduces dependence on that tracker, though neither system creates a copy where none exists.
The audience is much larger than the active swarm counts suggest. Pirate Face's activity dashboard reported 2,571 accounts, including 1,635 connected to Hugging Face, while the most-seeded individual model had 24 reported seeders. Accounts and seeders measure different behavior, but the difference shows how much of the launch interest still has to become persistent storage.
The project has not yet tied its points system to that scarce resource. Its points rules currently reward an account's first handle, referrals and approved model submissions. Proof of Seed is planned and earns nothing yet. That leaves storage and upload bandwidth to volunteers without an active, attributable seeding reward.
A rescue label is an incident signal
Pirate Face retained a record for unsloth/gemma-4-E4B-it-qat-GGUF after it could not reach the source. The saved record shows revision 8c5a9e4, an Apache 2.0 license, provenance entry 3384 and a reviewed community torrent. It warns that the failure could be temporary or caused by an access restriction. Removal is another possibility.
That warning mattered during reporting. The Hugging Face API for the same model returned HTTP 200 and marked the repository public and ungated, with disabled set to false. It reported the same full revision hash that Pirate Face had saved. The ordinary Hugging Face model page also loaded. Pirate Face noticed an upstream failure and retained enough information to identify the revision. That does not prove Hugging Face deleted the model.
So the word "Rescued" needs care. On Pirate Face, it can describe a fallback-ready saved record, not necessarily a confirmed deletion. A durable archive needs the historical manifest plus a current test of whether the original source and independent peers can serve it.
Checksums solve one part of trust
The public hash chain does a different job. Each provenance entry includes a repository, revision, digest, timestamp and a hash derived from the preceding entry. The site reported a verified chain of 6,145 entries, a signed root and one fork attributed to simultaneous witnesses at sequence 631. Anyone can download the raw log and recompute the links.
That record is tamper-evident when a reader has kept a prior root to compare against. It is not a judgment about what the model does. Pirate Face's seeding guide says a matching digest proves that downloaded bytes match the recorded source. It does not prove the model is safe or accurate, or that it suits a particular use. A malicious original file can have a perfectly valid checksum.
Identity verification has another narrow job. Pirate Face's account rules connect verified handles to a matching Hugging Face account, while unverified names are merely reserved. This can reduce impersonation inside the index. It cannot turn an open-weight file into audited software or settle questions about its training data.
Decentralized files, centralized choices
Pirate Face currently accepts MIT and Apache 2.0 submissions, plus exceptions approved through its form. Submitters must provide a pinned 40-character revision, hashes for every file, license evidence and confirmation that they may redistribute the copy. Its terms place responsibility for redistribution rights and local law on seeders, and allow the service to reject, hide or remove submissions.
The website, moderation queue, provenance API and first-party tracker still have operators. If the site disappears, a copied magnet can continue through DHT only while peers retain its metadata and files. If Pirate Face removes a listing, it can make discovery harder without erasing a magnet already shared elsewhere. The file-transfer layer is distributed. The catalog and policy layer remain a service.
The next useful proof will come from boring measurements. A clean client should be able to fetch a confirmed removal long after Hugging Face returns 404. Seeder counts should stay above one after the launch traffic fades, and the top count should rise beyond 24 without Pirate Face operating the only durable copy. The promised drop-in API and Proof of Seed system are still future work in the project documentation. If those tests hold, "forever" will start to look less like a slogan and more like an observed property of the network.