Immutable Architecture: Why the Future of AI Models Demands Permanent Storage

Signup Write New Story Immutable Architecture: Why the Future of AI Models Demands Permanent Storage by vishwa vimukthi gammuduwaththage by vishwa vimukthi gammuduwaththage | @ vishwagw Founder at Falcon Eye AI INC AI researcher & Entrepreneur, focusing on computer vision, autonomous unmanned systems and Artificial intelligence

AI researcher & Entrepreneur, focusing on computer vision, autonomous unmanned systems and Artificial intelligence

I ship software that depends on model weights. When I pin a version of a library, I expect the same bytes tomorrow. I want the same from a model, because a perception model that behaves a little differently next month is a different product.

This article is about who holds the files, and what happens when the holder changes its mind.

The open-model ecosystem has one main shelf. Hugging Face reports about 18 million users, and for most open models it is the default and sometimes the only public download location.

On September 3, 2026, NVIDIA announced an agreement to buy Hugging Face for about $12.9 billion. Jensen Huang said it "will remain an open platform." I have no evidence that this promise will be broken. But the main distribution point for open weights is now set to belong to the company that sells most of the chips those weights run on. That is a lot of trust in one place.

Models do disappear, and not always for bad reasons:

You can agree with one of those decisions, both, or neither. The structural point is the same. As one recent analysis put it, permission to use a model and dependable access to it are separate properties. A license covers the first. Nothing covers the second.

The second problem is quieter. A model can stay available under the same name and stop being the same model.

The best-known measurement is from Chen, Zaharia, and Zou at Stanford and Berkeley. They ran the same prompts against GPT-4 in March and June 2023. On a task asking whether a number is prime, accuracy fell from 84 percent to 51 percent. The model name was unchanged. People debated why the numbers moved, but nobody disputed that behavior shifted under a stable label.

It keeps happening in different forms. In August 2025, OpenAI removed GPT-4o from ChatGPT when it launched GPT-5, then brought it back after users objected. In September 2025, Anthropic published a postmortem saying that infrastructure bugs, not deliberate changes, had degraded some Claude responses for weeks.

That last case is worth noting. Drift is not always a decision. Sometimes it is a routing bug or a hardware change. From the user's side, it looks identical: yesterday's output is gone, and nobody told you.

Open weights should be immune to this, and mostly they are. But a repository is mutable. Its owner can push new files to the same branch, and anyone who downloads by name instead of by commit gets whatever is there today.

A URL tells you where a file is. It says nothing about what the file is. Whoever controls the server controls the answer.

Content addressing reverses this. The address is a cryptographic hash of the file. Change one byte and the address changes. You can fetch the file from anyone, including someone you do not trust, and check it yourself.

You can get the core of this today with no blockchain at all:

import hashlib def sha256_of(path, chunk=1 << 20): h = hashlib.sha256() with open(path, "rb") as f: while block:= f.read(chunk): h.update(block) return h.hexdigest() EXPECTED = "paste the published hash here" assert sha256_of("model.safetensors") == EXPECTED, "weights do not match"

And pin the exact revision when you download, never a branch name:

from huggingface_hub import snapshot_download snapshot_download( repo_id="org/model", revision="full 40-character commit hash", )

These two habits remove most silent-update risk for weights you run yourself. What they do not solve is availability. A hash is useless if no one still has the file.

This is where decentralized storage comes in, and the three names in the usual pitch are not interchangeable.

IPFS is a protocol for content addressing and peer-to-peer transfer. It is not a storage guarantee. A file stays available only while at least one node chooses to keep it. If everyone stops, the address still exists and points to nothing.

Filecoin adds a market on top. You pay storage providers for a fixed term, and they must post cryptographic proofs that they still hold your data. This is verifiable, paid storage with an end date. Deals have to be renewed. Its newer Onchain Cloud launched on mainnet in January 2026, with early usage reported at around 49 terabytes. That source is promotional, so treat the figure as a claim.

Arweave makes the boldest promise. You pay once, and part of the fee goes into an endowment meant to fund storage for at least 200 years, on the assumption that storage keeps getting cheaper. "Permanent" here is an economic forecast. It depends on that cost trend and on miners staying interested for centuries.

Size is a practical issue. A 70-billion-parameter model at 16-bit precision is about 140 GB. Paying a one-time permanence fee per gigabyte for every checkpoint, quantization, and fine-tune gets expensive fast. Prices move with the token, so check a live calculator before you plan around any number.

Git solved this for code. Each commit is a hash that includes its parent's hash, so history cannot be rewritten without everyone noticing. Model hubs borrow the idea, but the history lives on the hub's servers.

A decentralized version needs two small pieces:

The log is tiny, a few hundred bytes per release. It can live on Arweave or any public chain for almost nothing. The blobs are large and can live anywhere: Filecoin, a torrent swarm, a university mirror, your own disk.

This split is the main thing I took from the research. The record of what a model is can be permanent and cheap. The copies only need to be numerous.

I think the arguments against this idea are stronger than its supporters usually admit.

It does not touch closed models. The worst silent updates happen behind APIs from OpenAI, Anthropic, and Google. You cannot hash weights you cannot download. Permanent storage only helps with open models, which are already the easier case.

It cannot verify remote inference. Most people do not run open models themselves. They call a hosted endpoint. A hash on Arweave says nothing about which weights that server loaded, or whether it quietly swapped in a cheaper quantization. Proving that needs hardware attestation or verifiable inference, and neither is mature at large-model scale.

Immutable means you cannot take it back. In December 2023, the LAION-5B dataset was pulled after researchers found links to child abuse material in it. That removal was right, and it was possible because the data sat on servers someone controlled. The same applies to a model with a planted backdoor, leaked proprietary weights, or a model trained on personal data that a court orders deleted. A network that cannot delete also cannot fix mistakes.

"Permanent" is a bet. Arweave's endowment rests on assumptions about hardware costs across two centuries. Filecoin deals lapse if nobody renews them. IPFS content vanishes when the last node drops it. Each one is a different kind of promise from an economic system that is under ten years old.

The simpler tools mostly work. Pin your revisions, verify hashes, keep your own copies, and seed a torrent. Community projects already index Hugging Face models with their hashes and magnet links. That gets a careful team most of the benefit with no token involved.

A matching hash is not safety. It proves the file is the one that was published. It does not prove the published file is harmless. Old pickle-based checkpoints can run arbitrary code when loaded.

I do not think every checkpoint should be written to a permanent ledger. That would be expensive, and it would preserve our mistakes along with our work.

A narrower version holds up. Foundational open models are becoming shared infrastructure, like compilers and kernels. For those, three things seem worth doing:

Permanent storage is one way to get the second point. It is not the only way, and it is not the most important of the three. The hash is.

Open Inference Networks: Democratic Access to Intelligence