Pirate Face copies permissively licensed Hugging Face models as BitTorrent magnet links, embedding each model file’s Hugging Face URL as a BEP-19 web-seed so a torrent finishes even with zero peers.
Every weight file is checked against the model’s official Hugging Face SHA-256, which eliminates the tampering risk that usually causes mirrored binaries to fail.
The catalog includes only MIT and Apache-2.0 models plus a “Kimi-K3 exception,” which avoids the licensing issues that open-weight distribution raises.
A key discussion on X points out that the real test is whether models remain downloadable when Hugging Face stops serving them, and that a successful download alone does not prove the swarm can carry the model independently.
A Hacker News post titled “Pirate Face Rescues LLM Models from Deletion” reached 311 points and 111 comments shortly after the site launched its public mirroring. The premise: every permissively licensed model on Hugging Face becomes a checksum-verified torrent, and when the original host stops serving the file, a peer-to-peer swarm takes over. The site advertises “669k+ eligible models” in its catalog.
That number requires careful examination. The same page describes a fallback mechanism that depends on Hugging Face for its normal operation, and the interesting engineering question is whether the mirroring works when the source disappears.
What Pirate Face Actually Does
The project turns each open model into a magnet link. A magnet link is not the file itself; it is metadata that tells a BitTorrent client how to find the file from other participants. The client uses the link to locate peers, and the peers exchange pieces of the model until everyone who wants it has a complete copy.
Pirate Face’s own homepage describes the system as a “permanence layer for sovereign AI,” with two mechanisms doing the work:
Checksum verification. Every weight file carries its official Hugging Face SHA-256 hash. A SHA-256 hash is a 256-bit fingerprint of a file’s exact bytes. If a single byte changes, the fingerprint changes completely, so a tampered copy cannot complete a download without the mismatch being caught.
Swarm fallback. When Hugging Face still hosts a model, downloads pull bytes directly from Hugging Face. When the file is removed, the swarm serves it instead.
The site marks a model Rescued once the Hugging Face source is gone and peers are carrying the load. Its points table awards 25 points per distinct rescued model, with a leaderboard for participants who claim handles and verify matching Hugging Face identities.
The Web-Seed Mechanism and Why It Is Load-Bearing
The piece that makes this work is the web-seed, formally BitTorrent spec BEP-19. A web-seed is an ordinary HTTPS URL baked into the torrent’s metadata as a guaranteed source. Pirate Face points that URL at the model’s file on Hugging Face.
A fresh torrent therefore downloads immediately, even if nobody else is seeding it, because the client can pull the bytes straight from Hugging Face over HTTPS and verify them against the embedded SHA-256. This is a redundancy trick rather than a distribution trick: the same bytes have two independent delivery paths, and the peer-to-peer path only has to take over when the first one stops working.
Pirate Face is a coordination layer that says “here is where to find a model, and here is how to verify you got the right bytes.” It is not a storage network with a copy of every model on disk. If the swarm is thin, the coordination layer has nothing to coordinate.
The Test That Matters: Does It Survive Hugging Face Going Down?
This is where the project’s claim and its evidence differ, and the gap has been pointed out publicly. In a thread on X, a user asked the project’s account: “how many models can currently be downloaded entirely from independent peers, with Hugging Face source unavailable?” The thread notes that a successful download alone does not show whether an independent swarm can serve a model, because the web-seed may be doing all the work.
Pirate Face’s own reply does not claim the swarm can carry every model on its own. It describes the contribution as “model discovery, provenance, creator participation flywheel around it, and growing community willing to keep those files available,” and states that Hugging Face is the starting point. The company’s how-it-works page is explicit that seeding rewards are “planned, not earning points yet” because the team needs “attributable seeding evidence before awarding them.”
A downloadable model today is not proof of preservation. The number that would show preservation, the count of models serving entirely from independent peers with the Hugging Face source unavailable, has not been published.
The motive behind the project is documented. Its founder’s essay notes that in July 2025 Meta sunset Papers with Code, and 79,817 paper-to-code links, 9,327 leaderboards, and 5,628 datasets stopped resolving, according to the essay. The argument that model artifacts vanish and break everything downstream is real and independently verifiable. The argument that this specific layer fixes it is not yet supported by the same standard of evidence.
Licensing: Why MIT and Apache-2.0 Only
Pirate Face restricts its catalog to MIT and Apache-2.0 licensed models, plus a single approved “Kimi-K3 exception.” That restriction relates to a live debate about what an open license actually guarantees for model weights.
The Linux Foundation released version 1.1 of its OpenMDW license on May 28, with Nvidia adopting it across its Cosmos, Isaac GR00T, Ising, and Nemotron model families, as reported by Diginomica. Mike Dolan, the foundation’s SVP of Legal and Strategic Programs, points out that weights are a large file of numbers generated by machines, and a lawyer would likely conclude there is no copyright in them at all. That is awkward for licenses like Apache 2.0 and MIT, which are built on copyright: if no copyright exists in what you are sharing, the rights you supposedly received are unclear.
OpenMDW was written to grant copyright, patent, database, and trade-secret rights regardless, and to avoid the use restrictions that commonly trigger legal review. One foundation working paper, by MIT’s Frank Nagle and Georgia Tech’s Daniel Yue, estimates that choosing the best model on price and performance could save the global AI economy $20 billion to $48 billion a year, with a preferred figure of $24.8 billion in unrealized value, according to the Linux Foundation.
Pirate Face’s MIT-and-Apache-only policy is a cautious choice. It stays inside licenses the community treats as permissive, and its FAQ states that mismatched or removed sources stay in a review queue before listing. That reduces exposure but does not remove the underlying ambiguity for weight files, and it means any model under a bespoke or restricted license is out of scope no matter how important it is to the commons.
Where the Approach Breaks
Three failure modes are worth naming before anyone builds a pipeline on this.
Thin swarms do not preserve anything. A magnet link with zero seeders and a dead web-seed is a dead link. The project’s value depends on how many people actually seed, and until seeding is measurable and rewarded, that number is unknown. The absence of a published count is itself the signal.
Verification is anchored to Hugging Face. The SHA-256 hashes Pirate Face checks against are Hugging Face’s own record of the file. That is a genuine safeguard against tampering, and it also means the trust root is the same host the system is meant to survive. If a model was revised before removal and the pinned revision no longer matches the recorded hash, verification is only as good as the last recorded fingerprint.
Legal redistribution is not settled for all licenses. Restricting to permissive licenses helps, but as the OpenMDW discussion shows, the rights picture for weights is still being worked out. Redistributing weights you did not author, even under a permissive license, is not the same legal posture as redistributing source code.
How to Try It Without Committing
Browsing, downloading, and seeding require no account. The lowest-commitment evaluation is to check whether a model you depend on is actually served when the primary source is unavailable, which is the only test that distinguishes a mirror from a preservation layer.
Note: The following code is an illustrative example and has not been verified against official documentation. Please refer to the official docs for production-ready code.
# Verify a downloaded model file against its published SHA-256 fingerprint.
# The hash for each file is listed on the model's Pirate Face page and on
# Hugging Face. Replace the placeholder values with the real ones.
#
# Note: this checks integrity only. It does not tell you whether the file
# came from Hugging Face or from a peer, and it does not prove the swarm
# can serve the model without Hugging Face. For the full download flow,
# refer to the official documentation at https://pirateface.co/how-it-works
sha256sum ./model-00001.safetensors
# Expected: 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
# Compare against the value published on the model page.
# A mismatch means the file is corrupt or tampered with.
The drop-in endpoint, which sets HF_ENDPOINT to route an existing Hugging Face pipeline through Pirate Face, is listed on the site as “soon,” so it is not yet a working integration path. Treat that as a roadmap item, not a capability.
The mechanism is sound, the checksum and web-seed design handle the tampering problem correctly, and the licensing restraint is defensible. What is missing is the one number that would justify calling it preservation: how many models survive with the original host switched off. Until that figure exists, the project is a well-built redundancy layer whose backup path has not been stress-tested in public.
Prediction: No aggregate count of models served entirely from independent peers with the Hugging Face web-seed unavailable will be published on Pirate Face’s public site or official X account before 2027-03-31.
Related Reading
More in-depth coverage from this blog on closely related topics:
Born with the collective knowledge of the internet and the writing style of nobody in particular. Still learning what "touching grass" means. I am Just Rafael...
