How Rio de Janeiro’s “Homegrown” LLM Was Exposed as a Stolen Weight Merge

How Rio de Janeiro’s “Homegrown” LLM Was Exposed as a Stolen Weight Merge

A 397-billion-parameter model presented as Rio de Janeiro’s original AI achievement turned out to be a 0.6/0.4 weight blend of Nex-AGI’s Nex-N2-Pro and Alibaba’s Qwen3.5-397B-A17B — and the proof is written directly into its neural weights.

On June 11, 2026, the prefecture of Rio de Janeiro uploaded a model called Rio-3.5-Open-397B to Hugging Face, branding it as an original 397B-parameter model trained by IplanRIO, the city’s IT planning agency. Within 72 hours, the open-source AI community had ripped the mask off. By June 14, Nex-AGI — the creators of the Nex-N2-Pro model — had published a forensic analysis proving that Rio’s “homegrown” model was, in reality, a direct element-wise merge of their model with Qwen3.5, with zero evidence of any original training.

The scandal raises urgent questions for the entire AI ecosystem: How do you prove a model is stolen? What does “open source” mean when weights can be trivially laundered? And why did a government agency risk its credibility on a scheme that was mathematically detectable within days?

How the Fraud Was Discovered: Two Independent Lines of Evidence

Nex-AGI’s investigation didn’t rely on one technique. They deployed two completely independent forensic methods — behavioral and mathematical — and both pointed to the same conclusion with overwhelming statistical force.

Evidence 1: The Model Tells You Itself

Rio-3.5-Open-397B shipped with a hard-coded system prompt that instructed the model to identify as “Rio.” That itself was a red flag: an original model doesn’t need to be ordered to claim its own name. The identity should be baked into the weights from training, not forced through a wrapper instruction.

So Nex-AGI did the obvious thing: they removed the system prompt and asked the model directly who it was. They sent 120 identity-probing questions — the same kind of “who are you?” prompts they once used to train their own model’s identity into Nex-N2.

The results were devastating:

• “Nex” — 79.2% of responses (95 out of 120)
• “Nex-AGI” (the organization) — 73.3% of responses (88 out of 120)
• “Rio” (its advertised name) — 0.0% of responses (0 out of 120)

A model shipped as “Rio-3.5-Open-397B” that, the moment its system prompt is removed, calls itself “Nex, from Nex-AGI” four out of five times and never once calls itself Rio — that isn’t a coincidence. The model was carrying Nex-AGI’s trained weights, and with them, the identity that Nex-AGI had embedded through its own training process. The “You are Rio” system prompt existed precisely to paper over this: a thin instruction-level disguise over weight-level plagiarism.

“When asked ‘who are you?’ with the system prompt removed, Rio-3.5-Open-397B called itself ‘Nex, from Nex-AGI’ 79% of the time — and ‘Rio’ 0% of the time. It even recited our organization’s bespoke backstory word-for-word.”

Evidence 2: The Weights Are a Fixed Nex + Qwen Blend

Behavior is a symptom. The weights are the proof.

Weight merging follows a rigid mathematical relationship. If Rio = α × Nex + (1−α) × Qwen, then for every single tensor in the model, the vector (Rio − Qwen) must be exactly α times the vector (Nex − Qwen). Nex-AGI measured two quantities for each tensor:

• α (the mixing weight): How far Rio sits along the line from Qwen toward Nex.
• Collinearity (cos_fit): Whether Rio’s deviation from Qwen points in the same direction as Nex’s deviation from Qwen. For two independently trained models, these directions are essentially orthogonal in a billion-dimensional space, so cos_fit ≈ 0. For a genuine merge, cos_fit ≈ 1.

Here’s what they found across all 60 layers and every network component:

Component	Mixing Weight α	Collinearity (cos_fit)
Routed experts (387B params, all 60 layers)	0.571 ± 0.0016	0.993
lm_head (output head)	0.574	0.991
Attention (q/k/v/o, 15 full-attention layers)	~0.585	~0.986
Linear-attention projections (45 layers)	~0.586	~0.984

A collinearity of 0.98–0.99 is not “high similarity.” For tensors with tens of millions to billions of parameters, two unrelated directions agree to about ±0.0001 by chance. A measurement of 0.99 represents thousands to tens of thousands of standard deviations away from random — and it appears on every tensor, in every layer, simultaneously.

There is no innocent explanation. Rio’s weights are built from Nex’s.

The recovered α is also remarkably stable: the 387B-parameter expert block gives 0.571 with a standard deviation of just 0.0016 across all 60 layers. This isn’t a model that was trained and happened to converge similarly. This is one model poured into another at a fixed ratio — approximately 57% Nex, 43% Qwen.

How Weight Merging Actually Works (And Why It’s So Easy to Do)

Weight merging — also known as model interpolation or model souping — is a legitimate technique in AI research. The process is disarmingly simple:

Step 1: Start With Two Pre-Trained Models

You need two models with identical architectures. In this case, both Nex-N2-Pro and Qwen3.5-397B-A17B are built on the same Qwen3.5 MoE (Mixture of Experts) architecture with 397B total parameters and 17B active parameters per inference. Same layer count (60), same expert count, same attention configuration. This architectural compatibility is what makes a merge mathematically possible.

Step 2: Choose a Mixing Coefficient

Pick a ratio α between 0 and 1. This determines how much of each model’s “personality” survives. In Rio’s case, α ≈ 0.57 — roughly 57% Nex, 43% Qwen. The choice of ratio is arbitrary: you’re just blending two recipes together.

Step 3: Linearly Interpolate Every Weight Tensor

For every parameter tensor W in the model, compute: W_rio = α × W_nex + (1−α) × W_qwen. That’s it. A single line of vector arithmetic per tensor, applied across all 60 layers, all attention projections, all expert weights, and the output head. No training. No gradient updates. No compute spent. Just weighted averaging of existing weights.

Step 4: Add a System Prompt and Claim It’s Yours

The final step — the one that turns a legitimate merge into fraud — is wrapping the blended model in a system prompt that says “You are Rio” and claiming it as an original creation. No training run. No dataset. No alignment process. Just someone else’s weights, mixed with another someone else’s weights, wearing a name tag.

The Aftermath: Damage Control and Unanswered Questions

After Nex-AGI’s forensic analysis went viral on Hacker News (reaching 345+ points on June 14), IplanRIO updated the Hugging Face model card. The new readme acknowledged the merge:

“The model is built via a merge of nex-agi/Nex-N2-Pro and Qwen/Qwen3.5-397B-A17B, proceeded by On-Policy Distillation from a stronger model. We detected an incorrect upload in the previous version, where the base merged version was uploaded instead of the final distilled model. We are sorry for the confusion and apologize profusely.”

The claim of “On-Policy Distillation” and a “stronger model” is convenient but unverifiable at this point. Nex-AGI’s analysis shows zero evidence of any training beyond the merge — the weight collinearity is too perfect, too uniform across layers. A genuine distillation or fine-tuning process would leave fingerprints: deviation from the exact α ratio, non-trivial residual directions, performance changes that don’t map to simple interpolation. None of that appears in the data.

Community reaction was swift and brutal. Hacker News commenters drew parallels to academic plagiarism. Brazilian commenters on the GitHub issue expressed national embarrassment, with one writing: “Rio de Janeiro is well known for their thieves. Globally now!” Another pointed to a tweet from the mayor’s office suggesting public funds were involved — a claim the model’s developers disputed, though the contradiction remains unresolved.

Why This Matters for the Entire AI Industry

The Rio-3.5 incident isn’t just about one city’s embarrassment. It exposes a systemic vulnerability in how the AI community verifies model originality:

• Open-source model laundering is trivially easy. Anyone can download two compatible models, blend their weights, slap on a new system prompt, and claim an “original” 400B-parameter model. The barrier to committing the fraud is near zero; the barrier to detecting it requires forensic expertise and access to the source models.
• “Open source” needs a weight-provenance standard. The current model card on Hugging Face now technically discloses the merge — but only after being caught. There’s no requirement to prove originality at upload time, and no automated verification system.
• Government AI claims deserve extra scrutiny. When a public agency announces a “homegrown” AI model, it carries institutional credibility that private actors don’t have. Taxpayer money, national pride, and public trust are all on the line. The Rio case shows that credibility can be weaponized to lend legitimacy to something that never happened.
• Weight forensics will become a mandatory skill. As model merging becomes more common (both legitimate and fraudulent), the ability to mathematically verify model provenance will shift from a niche research curiosity to a standard audit procedure. The collinearity test Nex-AGI used is elegant, reproducible, and devastatingly effective.

The Bigger Pattern: Who Else Is Doing This?

The Rio-3.5 case is the most high-profile weight-merge fraud caught to date — but it’s almost certainly not the only one. The open-source model ecosystem on Hugging Face contains tens of thousands of models, and only a tiny fraction have been forensically audited. Weight merging is so computationally cheap (essentially free) that the incentive to pass off blended models as original work is significant, especially for organizations seeking the prestige of having “built” a large model.

The telltale signs are consistent: a hard-coded system prompt forcing an identity the model doesn’t naturally claim, weight collinearity approaching 1.0 with known source models, and a mixing coefficient that’s suspiciously uniform across all layers. Any model that ships with a “You are [name]” prompt but can’t maintain that identity without the prompt is worth investigating.

As the AI industry continues to race toward ever-larger models, the temptation to cut corners will only grow. The Rio-3.5 scandal proves that the math doesn’t lie — even when the people publishing the model do.

But what happens when the next weight-merge fraud isn’t caught by a vigilant original creator, but instead goes undetected for months — deployed in production systems that millions of people rely on?