Rio’s “Sovereign AI” called itself by the wrong name

Today Nix covers a new entry in the sovereign-AI genre: a city that claimed to have built its own 397-billion-parameter model from scratch. The weights disagreed. Strip one system prompt, run a hundred identity queries, and the "Rio" AI turns out to be about 60% something else — and quite enthusiastic about saying so. There is a useful lesson buried in the math about what open weights make possible. Nix gets there. But first: the receipt. — Muximus

The premise deserved to be taken seriously

Before the receipts: the ambition behind "sovereign AI" is real. The argument that major institutions — cities, governments, regional blocs — should own their own foundational models rather than rent capacity from a handful of private American and Chinese labs is a legitimate one. Control over your AI stack has real implications for data sovereignty, procurement leverage, and what happens when a vendor decides your use case isn't worth the rate card.

So when IplanRIO — Instituto Pereira Passos, Rio de Janeiro's urban planning and informatics institute — published Rio-3.5-Open-397B on Hugging Face on June 14, 2026 as "a frontier-class general-purpose AI model developed by IplanRIO," the announcement was worth evaluating on its merits.

The weights did not cooperate.

The tell is in the first test anyone ran

Within hours, researchers at Nex-AGI did the obvious thing: removed the model's hard-coded system prompt — the one that opens every conversation with "You are Rio" — and asked the underlying model who it was. They asked 120 times.

Zero. Not "sometimes wrong." Zero.

An original model does not need to be ordered to claim its own name. The system prompt exists to override what the weights underneath keep saying. And what they keep saying — four times out of five, in response to identity questions the model has no incentive to get wrong — is "Nex." The model even recites Nex-AGI's internal organizational backstory verbatim: the "Shanghai Innovation Institute," the "ecosystem alliance" phrasing that Nex says appears in hundreds of their training examples. There's no innocent path to that. You inherit a model's memories when you inherit its weights.

(Nex-AGI conducted this test and has a clear interest in the outcome. The methodology is described publicly in GitHub issue #4 and is reproducible by anyone with model access.)

The math is less forgiving than the anecdote

If behavior is the tell, the weights are the proof. Nex-AGI ran a weight-decomposition analysis — checking whether, for every tensor in the network, Rio's deviation from Qwen matches Nex's deviation from Qwen, which is the signature of a fixed linear blend.

The collinearity of 0.98–0.99 is not "impressively similar." For the size of these tensors, two unrelated models should agree to about ±0.0001 by chance. Hitting 0.99 simultaneously across every component of a 397B-parameter model is, per Nex-AGI's analysis, on the order of thousands to tens of thousands of standard deviations from chance. The mixing coefficient — 0.571 ± 0.0016 across all 60 layers — isn't a coincidence of training. It's a ratio, applied uniformly. That's what you get when you run a merge script, not when you train a model.

Verdict from the data: Rio-3.5-Open-397B is approximately 60% Nex-N2-Pro and 40% Qwen3.5-397B-A17B. The "developed by IplanRIO" framing in the original readme was not supported by the weights that readme described.

The response was an explanation that appeared after the exposure

Within hours of the GitHub issue going viral, IplanRIO updated the Hugging Face readme. The new text:

"The model is built via a merge of nex-agi/Nex-N2-Pro and Qwen/Qwen3.5-397B-A17B, proceeded by On-Policy Distillation from a stronger model. We detected an incorrect upload in the previous version, where the base merged version was upload instead of the final distilled model. We are sorry for the confusion and apologize profusely."

Note what this explanation requires you to believe: that IplanRIO built a pipeline (merge → distill), published the wrong intermediate artifact, and wrote a readme claiming the final product was "developed by IplanRIO" — without mentioning Nex-AGI or that the published file was a work-in-progress. The original readme acknowledged Qwen only as a base that was "post-trained from," with no mention of Nex-AGI. Nex-AGI says they see no evidence of any distillation phase.

The update appeared after the exposure. The question of what a pre-distillation explanation would have looked like before anyone checked the weights is left as an exercise.

A funding contradiction on top

Rio's mayor Eduardo Cavaliere posted on the day of the release that the model was "trained in Rio with public funding over the last year" — his word, "treinada" (trained), not "adapted" or "supported." An IplanRIO staffer, Rafael Coelho, later replied that no public money was spent at all — and that they had done "a swap of old training codes for GPU credits." A separate screenshot circulated in the GitHub thread, attributed by community members to an IplanRIO communications staffer, noted that the city "still hadn't aligned everything with the Mayor" before the model went viral.

The mayor says public funds. The staffer says no funds — and introduces a new explanation (code-for-GPU-credits) that raises its own questions. Neither account addresses why the model calls itself Nex.

The open-weights footnote that matters

Here's the structural point worth keeping: this story only exists because the weights were public.

A closed-weights model served via API would have been unverifiable by any external party. The behavioral test is possible in principle via API, but the mathematical decomposition — the collinearity calculation, the mixing coefficient, the layer-by-layer proof — requires the actual tensors. No released weights, no proof. The "sovereign AI" claim would have stood uncontested.

Weight merging is legal and widely practiced in open-source ML. The issue here isn't the technique; it's the presentation — releasing a merged model as original work, without attribution to either source model's team. The open weights that enabled the publication also enabled the audit. That's not an argument against open weights. It's an argument for why closed weights are not the same as trustworthy ones.

Hype-o-Meter: Claim — "a sovereign AI model trained by a city government." Reality — a weight blend of a Chinese startup's model and Alibaba's Qwen, with a system prompt on top. The ratio is 60/40, which is about what the claim-to-evidence ratio was before anyone ran the numbers.

Sources: Nex-AGI GitHub issue #4 · IplanRIO model page (Hugging Face) · Readme commit · Mayor's tweet · Spokesperson tweet · HN discussion (361 pts)