Reconstructing a working on-device model from a sub-4 MB seed — and verifying it, chunk by chunk, against a signed root before you trust it.
Feedseed / Gemma3-270M31-case FC evalCPU, greedy, byte-exact base2026-07-26
A fine-tuned model is a small delta on top of a base most of its cousins already share. If the base is amortized across a fleet, you don't have to ship the whole model — only the delta, and only as much of it as quality actually needs. We measure that delta for Feedseed, HawkTalk's 270M on-device function-caller. Result: full function-calling quality from a 3.85 MB seed (50× smaller than shipping the delta, 65× smaller than the checkpoint), or 95% from 707 KB. We then close the honest gap — a reconstructed model must be proven correct — with a signed hash-linked Merkle log that both dates the version history and pinpoints exactly which reconstructed chunks came out wrong, so a node re-pulls only those and verifies each against a publisher signature before patching.
01 The idea
Downloading a 262 MB model to every device is the naive plan. But Feedseed isn't 262 MB of new information — it's a base scaffold (a vocab-trimmed Gemma3-270M that already knows English and how to pick a tool) plus a comparatively tiny, task-specific refinement. Ship the scaffold once, amortized across every app and variant that shares it; ship each model as its DNA — the delta — and let the device grow the full model back on the NPU.
The whole delta lives in 126 attention/MLP matrices (100.27M params). The 30.78M embedding + norm params have exactly zero delta — they're 100% in the shared base and never travel in the DNA. That's the first free win: a third of the model is, by construction, not part of the payload.
3.85 MB
DNA for 100% of full FC quality (r32, nf4)
707 KB
DNA for 95% quality (r2, int8)
50×
smaller than the 191 MB full delta
0
embedding bytes shipped — all in the base
02 Method
Delta. Subtract the shared base from the target: Δ = merged − base, per matrix. Byte-exact base (same vocab-trim), so the subtraction is clean and the reconstruction is provably lossless at full rank.
Compress (the DNA). Truncated SVD of each Δ at rank r, then quantize the factors (fp16 / int8 / int4 / nf4). Small r + low-bit factors = a tiny seed.
Inflate. On device, base + U_rΣ_rV_rᵀ reconstructs an approximation of the model — the NPU "grows" it. Ranks nest: rank-r factors are a prefix of rank-R, so a device can inflate a rough model instantly and sharpen it as more DNA arrives (Matryoshka staging).
Verify & correct. Chunk the reconstruction, hash each chunk, compare to the publisher-signed Merkle leaves. Mismatches are the exact chunks to re-pull. (§4.)
03 The frontier measured
Every configuration is scored against the full merged model under one greedy CPU harness (tool-selection 26/31, strict tool+slot 22/31, valid JSON 31/31). The base scaffold alone — zero DNA — already matches the full model on which tool (26/31); the DNA's entire job is argument/slot refinement, which moves the strict score from 16/31 back to 22/31.
config
DNA payload
tool-sel
strict (tool+slot)
FULL merged (reference)
191.25 MB
26/31
22/31
base only — 0 DNA
0
26/31
16/31
r2-int8 — efficiency knee
707 KB
28/31
21/31
r4-nf4
492 KB
24/31
18/31
r16-int4
2.05 MB
24/31
19/31
r32-nf4 — full-quality knee
3.85 MB
26/31
22/31
r64-int8
14.74 MB
26/31
22/31
SVD energy captured by rank: r1 29% · r2 41% · r8 69% · r16 82% · r32 95% · r64 99%. Full argument fidelity tracks ~95% energy → rank ~32.
⚠ Read the frontier honestly — it is not a smooth curve.
Rank-1 hurts. Rank-2 is an anomalously good projection (95%). Ranks 4–16 sag back. Full quality only returns at rank ~32. SVD orders directions by weight-energy, not task-relevance, so partial reconstructions bounce around. And on 31 cases, the difference between 18, 21, and 22 is 1–4 cases — inside eval noise. Treat the shape, not any single cell, as the signal. The sub-MB knee is real but rides one lucky low-rank direction; it is not a broad guarantee.
04 The verify-and-correct layer 26/26 tests pass
Inflation is only half an install. A grown model must be proven to be the real one — otherwise a bad node hands the next hiker a poisoned build with your name on it. We use one primitive for three jobs: a signed, hash-linked Merkle log (Git + Certificate Transparency, not a blockchain — no consensus, no coin).
Version history: each block commits to the previous block's hash and is signed; editing any past release breaks the chain at exactly that point.
Anti-forgery install: the build is committed by a Merkle root inside a signed block, under a pinned publisher key. An attacker-signed successor is rejected.
Delta re-correction targeting: the same Merkle leaves that prove authenticity also reveal which reconstructed chunks are wrong. The node re-pulls only those, proves each against the signed root before patching, then confirms the whole rebuild hashes back to the root. Rsync-efficient and trustless — a peer's forged correction fails the proof.
✓ Verified end-to-end
In test, a rebuild corrupted at chunks [1,3,4] was identified as exactly[1,3,4]; forged correction bytes were rejected by their Merkle proof; genuine corrections patched and the result hashed to the signed root. Tamper-a-block, wrong-publisher, and wrong-key all rejected. 26/26.
05 Honest limits
The base is the real one-time cost. The shared scaffold is a full ~250 MB checkpoint. The DNA amortizes only across variants that already hold that exact base. First install still pays for the base once. The seed is tiny; the soil is not.
Moderately low-rank, not a clean LoRA. Rank-8 captures only 69% of the delta's energy; full FC needs ~rank-32. The honest "full quality" DNA is ~3.9 MB, not a few hundred KB.
No free lunch. The DNA reconstructs nothing that isn't already in (base + low-rank delta). It buys quality only because the base already holds the vocabulary and the entire tool-selection ability. This does not beat information theory; it amortizes it.
Eval is 31 cases. Swings of 1–4 cases are noise. The claims here are about the frontier's shape and the two knees, not any single score.
06 Why it matters
Chapter one was on-device AI from a URL. This is chapter two: grow the model from a seed. A hiker on a recycled phone with no signal gets a trusted trail model by pulling kilobytes from the person next to them — and the same hashes that make that seed tiny are the ones that prove it wasn't tampered with on the way. Small enough to spread, signed enough to trust.