A sovereign, self improving AI owned by its network

1.1 Abstract

Hylon is a decentralized artificial-intelligence network built on top of a live, revenue-generating product rather than a promise. That product is OrbNet / OrbVPN, a censorship-circumvention VPN with paying users in restricted markets, Iran, Russia, and comparable jurisdictions, operating multi-region infrastructure, a node fleet, an admin back office, and a production on-chain token economy. The token, ORB (an ERC-20 deployed on Base), already runs in production: staking, reward distribution, signed-voucher claims, a gasless relayer for users who hold no gas, and OFSI/OFAC sanctions screening at the point of payout. Hylon adds an AI layer onto this working business. This ordering, network first, tokens as plumbing, AI on top, is the single most important fact about the project and the sharpest line separating it from the large population of DePIN and "decentralized AI" efforts that begin as a token and a whitepaper and never ship a service anyone pays for.

The network's stated destination is uncompromising: to out-compete OpenAI, Anthropic, and every centralized frontier lab. We state that plainly because a mission worth years of work should be stated plainly, and we immediately qualify it with the discipline that makes it credible rather than delusional. Hylon does not attempt to meet the incumbents head-on at the general frontier on day one, where they hold a decisive capital and talent advantage. It wins first in a wedge those labs cannot structurally contest, a user's full personal context held privately on their own device; operation inside censored and blocked markets; and underserved languages such as Farsi, Arabic, Russian, and Turkish, and then compounds the data, revenue, and treasury-funded compute that the wedge generates toward the general frontier over a period of years. Every claim in this document is gate-based: it is tied to a specific, verifiable technical or commercial milestone, and is asserted only once that gate is crossed. There are no dated promises of artificial general intelligence and no superlatives that are not anchored to a measurable test.

1.2 Executive Summary

The entire thesis of this whitepaper reduces to five points. Everything that follows is an elaboration of them.

1. A real business underneath. Hylon is built on OrbNet/OrbVPN, a live product with paying users in restricted markets and a production ORB token economy on Base. Value and verified demand come before token emissions, not after, the discipline that separated the DePIN survivors from the death spirals.
2. A wedge the incumbents cannot contest. Centralized labs are structurally blind to a user's private on-device context, largely absent or blocked in censored markets, and accountable to shareholders rather than users. Hylon attacks precisely this gap first, where its advantage is defensible rather than merely cheaper.
3. An unbuyable data flywheel. A million Personal AIs running on member devices generate reinforcement signal from real, multilingual, censored-market user tasks, data that is uncollectable by any centralized lab for legal and physical reasons. Raw data never leaves the device; only privacy-preserving learned signal is aggregated. A competitor can outspend Hylon but cannot legally or physically assemble this corpus.
4. A sovereign, decentralized stack. One self-contained Hylon AI, a mixture-of-experts core, router, retrieval and memory, tool use, specialist heads, and agent orchestration presenting as a single system, with no hard dependency on any external provider API. It is trained by a DAO-owned GPU cluster plus staked operators coordinating over the internet via low-communication training, and served and personalized by the million-device fleet. All contributions are metered and cryptographically or economically verified, never rewarded for idle uptime.
5. Gate-based honesty toward the frontier. The destination is to out-compete every lab, but the path is staged: ship a sovereign private stack (Gate 0), dominate the wedge domains (Gate 1), stand up a self-improving self-releasing model on DAO-owned compute (Gate 2), and only then pursue the general frontier (Gate 3+), conditional on treasury-funded compute and validated training recipes crossing an explicit threshold. Nothing at the frontier is claimed until it is crossed.

1.3 The Problem, Three Structural Blind Spots of Centralized Labs

Frontier labs are formidable, well-capitalized, and staffed by extraordinary researchers. Hylon does not underestimate them. But their strength is concentrated in one dimension, raw compute and model scale, and they carry three structural weaknesses that no amount of capital removes, because the weaknesses are consequences of what they are, not of how much they spend. A structural weakness is one a competitor cannot buy their way out of. These three define the terrain on which Hylon chooses to fight.

Blind spot one, no access to a user's private context

The most valuable substrate for a genuinely useful personal assistant is the full private context of a person's life: their messages, files, calendar, browsing, location history, health data, relationships, and the accumulated texture of how they actually work and think. A centralized lab cannot ethically or legally centralize this data at scale, and users are increasingly unwilling to hand it over. The lab's product therefore meets each user as a relative stranger at the start of every session. Hylon's architecture inverts this: a compact Personal AI, a 1-to-4-billion-parameter-class model, or a ternary BitNet-style model, runs on the device and learns the user's context locally. The raw data never leaves. Only privacy-preserving learned signal is shared upward, via federated learning with differential privacy and secure aggregation. The lab's structural constraint is Hylon's structural advantage.

Blind spot two, absent or blocked across much of the world

A large share of humanity lives in markets where the major labs' services are geo-blocked, sanctioned out, sporadically throttled, or simply unavailable in the local language at usable quality. Users in Iran cannot reliably reach the leading Western assistants; users across the Farsi-, Arabic-, Russian-, and Turkish-speaking world are served, at best, as an afterthought to English. Hylon starts from the opposite position: it is already inside these markets through OrbNet/OrbVPN's censorship-circumvention infrastructure, already reaches these users, and treats their languages and their operating conditions, intermittent connectivity, adversarial networks, the need for privacy under surveillance, as the design center rather than the edge case.

Blind spot three, owned by shareholders, not users

A centralized lab is ultimately accountable to its equity holders. Its objective function is enterprise revenue and shareholder return, which is a legitimate business posture but a different one from serving the individual user's interest without conflict. Model behavior, data usage, pricing, and availability are set to optimize the owner's return. Hylon's ownership structure is deliberately different: a DAO progressively governs reward rates, treasury allocation, and protocol upgrades on published milestones over roughly two to four years, and contributors, the people who supply compute, data, and personalization, earn ORB for verified work. (Model releases and safety constraints, by design, remain with a technical safety council transparent to the DAO rather than subject to a token vote, a point developed fully in the governance section.) The network is owned by its participants, and its incentives point at them.

1.4 Vision & Thesis

The destination

Hylon's mission is to build an AI that out-competes every centralized lab, not a niche tool that coexists politely beside them, but a system that is, for the tasks that matter most to a real person, genuinely better. We state this as the destination because half-measures do not attract the talent, capital, or conviction required to matter, and because the structural advantages described above are large enough to make it a serious ambition rather than a slogan. What follows is the discipline that keeps the ambition honest.

The method, wedge first, then compound

Hylon does not fight the incumbents where they are strongest. It fights where they are structurally weak, wins there decisively, and uses the winnings to advance. The method has three compounding loops. First, the wedge: dominate personal-context tasks and underserved-language, censored-market use, domains the labs cannot reach, and become the best available AI for those users. Second, the data flywheel: the million Personal AIs generate reinforcement signal from real user tasks, this signal is privately aggregated into a stronger global model, and the stronger global model produces better Personal AIs, tightening the loop with every cycle. Third, the economic engine: genuine service revenue from the wedge funds a DAO treasury, the treasury funds compute, and compute plus validated training recipes push the model toward the general frontier. The wedge is not the ceiling; it is the beachhead and the fuel supply.

It is worth being explicit about the honest constraint at the end of this path. Out-competing everyone at the general frontier is ultimately a function of aggregate FLOPs, which is a function of GPU count, which is a function of capital, a treasury question. Hylon's low-communication training approach makes bandwidth a solved problem and lets geographically distributed GPUs train together, but it does not repeal the need for the GPUs themselves. That is why the frontier is a Gate-3-and-beyond program, claimed only when treasury-funded compute crosses the threshold, and why the wedge and its revenue come first.

Gate-based honesty

Every forward-looking claim in this whitepaper is attached to a gate, a defined, measurable condition, and is asserted only once the gate is crossed:

1.5 Why Now

Hylon is timed to a convergence of four independent developments, each of which crossed a practical threshold recently. None of these existed in usable form even a few years ago; together they make a decentralized frontier-directed AI network buildable for the first time.

Open weights have reached near-frontier quality

The strongest permissively-licensed open-weight foundation models now sit close enough to the frontier that a sovereign stack built on continual training and reinforcement learning atop them is a credible starting point rather than a toy. Hylon builds from these models, adds continual training and RL on its own uncollectable data, and thereby inherits the world's open research effort as a floor while differentiating on the data and personalization that only it possesses.

Low-communication distributed training is proven

The classical objection to decentralized training, that synchronizing gradients across the internet is impossibly slow, has been answered in practice. Methods in the DiLoCo / Streaming DiLoCo / DisTrO / DeMo family cut inter-node communication by roughly two-to-four orders of magnitude (about 400× to 10,000×), and real runs have demonstrated it: INTELLECT-1, a 10-billion-parameter model, was trained across three continents over links of 127 to 935 Mbit/s. Bandwidth is, for training purposes, a solved problem: roughly 100 Mbps to 1 Gbps per node suffices. The oft-quoted "5,000 years to train over the internet" figure describes the naive full-gradient-every-step strawman that nobody actually uses. The real constraints are per-node memory (each training node must hold the model and optimizer state) and aggregate FLOPs, which is exactly why the training tier is datacenter-class GPUs, not phones, and why frontier scale is ultimately a capital question.

On-device inference has matured

Running capable models directly on phones, laptops, and desktops is now practical. Ternary and 1-bit approaches such as BitNet b1.58 serve real models on commodity hardware, on the order of 45 tokens per second on an Apple M2 CPU in roughly 0.4 GB of memory, and NPUs and Apple Silicon give member devices genuine inference capacity. (Honestly: BitNet's gains are inference-only; the model is still trained in full precision via quantization-aware training, so this lowers serving cost, not training cost.) This maturity is what makes a private on-device Personal AI, and a million-device inference and personalization layer, an engineering reality rather than an aspiration.

The DePIN market has corrected toward real revenue

The speculative phase of decentralized physical infrastructure has ended, and the correction rewards exactly the discipline Hylon is built on. Across 2025 the entire DePIN sector produced on the order of $72 million in total on-chain revenue against roughly $10 billion in market capitalization, a sobering ratio that has punished headcount-driven token emissions and rewarded networks selling something real. The market now pays for demonstrated demand, not registered-device counts. A network that begins from a revenue-generating product and enforces value-before-emissions is arriving into a market that has learned to price precisely that.

1.6 Market Positioning

Hylon occupies a position no existing category fully covers, and it is important to describe that position honestly against both the centralized labs and the existing decentralized networks, including their genuine strengths.

Versus centralized labs

The labs win today on the axis of raw compute scale and general-frontier capability. Hylon does not dispute that and does not pretend to match it at launch. Hylon wins on the orthogonal axis: data locality and user ownership, private on-device context, presence in blocked markets, underserved-language depth, and participant ownership of the network. The strategy is to be unbeatable on that axis first and to climb the compute axis over years, funded by revenue and treasury. On the positioning map, the labs sit high on compute and low on data-locality/ownership; Hylon starts lower on compute but far higher on locality/ownership, and moves up-and-to-the-right as the flywheel and treasury compound.

Versus other decentralized networks

The existing DePIN and decentralized-AI networks are real and, in several cases, well-executed, but each occupies a different square than Hylon, and the honest landscape matters. No decentralized network today earns material revenue from consumer-phone FLOPs; that is simply not yet a viable business, and Hylon does not claim otherwise. What the leaders actually sell is instructive:

• Grass (roughly $330M market cap) sells web bandwidth and scraped data to AI labs, not compute. It is a data-and-bandwidth network, and a successful one, but it does not train or serve models.
• Acurast (around 255,000 phones, roughly $18 to 25M cap) is the leader in smartphone compute and a useful compliance precedent, approved on both mobile app stores, but the demand side for phone compute remains unproven.
• Salad is the consumer gaming-PC leader, with on the order of 60,000 daily GPUs and roughly $10M ARR, and notably operates with no token at all, a reminder that real demand, not a token, is what sustains a network.
• Decentralized training networks are real but GPU-bound: Nous Psyche trains a 40B model across ~8×H100 nodes; Templar's Covenant-72B requires ~8×B200 per peer; and Prime Intellect's INTELLECT-3 relied on a central 512×H200 cluster. Distributed training works, and it runs on datacenter GPUs, not phones.

Hylon's distinct position is the combination none of them hold: a live revenue-generating consumer product as the base, a two-tier compute design that puts training on datacenter GPUs and puts inference, personalization, and data on the million-device fleet where devices are genuinely good, and a data flywheel rooted in private, censored-market, multilingual user tasks. Inference, worth noting, is roughly two-thirds of total AI compute demand, so a network that serves and personalizes at the device edge is addressing the larger half of the market, not the smaller.

2.1 Architectural Overview: Five Layers, One AI

Hylon is engineered as a single, self-contained artificial intelligence that happens to be physically distributed across a datacenter-class GPU tier and a fleet of up to a million consumer devices. To the user it presents as one assistant, private, uncensored, and fluent in their language and their life. Internally it is a five-layer system in which every layer has a distinct responsibility, a distinct trust boundary, and a strictly governed direction of data flow. The defining architectural rule is that learning flows UP as privacy-preserving signal, never as raw data: personal context is captured and used at the edge, but only aggregated, differentially-private, learned updates ever ascend toward the global model.

This is the inversion of the centralized-lab pattern. OpenAI and Anthropic run a monolithic model in a datacenter and pull the user's context to the model at inference time, the raw prompt, the raw document, the raw history all cross the network and land on their servers. Hylon pushes a compact model to the context and keeps the context where it was created. The five layers below make that possible while still allowing a global frontier model to improve from the collective experience of the whole network.

The layers, from the immutable oversight plane at the top down to the physical substrate at the bottom, are:

2.2 The Layers in Detail

L1, Device Substrate

The substrate is the physical execution environment and the hard privacy boundary of the entire network. It is hardware-abstracted from day one: a single runtime targets CPU, GPU, and NPU back-ends, and is built ready for neuromorphic accelerators, so a model artifact runs across the fleet without a rewrite. Device tiers are addressed by capability, Tier A phones for private inference and data, Tier B PCs/Macs for heavier inference and LoRA personalization, Tier C GPU nodes for the actual training work, and Tier D neuromorphic as a roadmap tier for ultra-low-power always-on inference. Every unit of work the substrate performs is metered and verified, inference through TOPLOC-style locality-sensitive activation hashing, training through economic and statistical loss-scoring plus redundancy, so contributions are rewarded for verified output, never for idle uptime. Critically, raw user data never leaves this layer. It is the floor of the stack and the ceiling of what a user's private information is ever allowed to touch.

L2, Personal AI Layer

Every participating device runs a compact Personal AI, a 1 to 4B-class dense model or a BitNet b1.58 ternary model small enough to serve at roughly 45 tokens/second on an Apple M2 CPU in about 0.4 GB. This model is the user's own: it reads their messages, documents, habits, and language on the device, personalizes itself with on-device LoRA adapters, and answers the overwhelming majority of everyday requests locally, privately, and offline-capable. The Personal AI is what makes Hylon usable in censored markets where a round-trip to a foreign datacenter is exactly what the adversary is watching for.

The Personal AI is also the network's sensory organ, but under a strict contract. It never transmits raw context. Instead it computes a learned signal, gradient-like updates or distilled behavioural deltas from the user's real tasks, which is clipped, noised under differential privacy, and combined with thousands of other devices' contributions under secure aggregation before the server ever sees anything. The server observes only the aggregate. This is what allows a global model to learn from a million private lives without any single life being legible to the network. Privacy here is not a slogan; it is engineering (FL + DP + secure aggregation) resting on a documented legitimate-interests lawful basis, a DPIA, and explicit defenses against membership-inference and model-inversion attacks, consistent with EDPB Opinion 28/2024's position that model weights are not presumed anonymous.

L3, Sovereign Model (Hylon Core)

The Sovereign Model is the global frontier system that the whole network exists to grow. It is trained and continually updated on the Tier-C GPU fleet (8×H100/B200-class nodes, some DAO-treasury-owned, some operator-staked) and coordinated over the public internet using low-communication training methods. It is the model whose distilled descendants become tomorrow's Personal AIs, closing the loop. Section 2.3 dissects its internals; for the purposes of the layered view, its responsibility is to be the single strongest, fully-owned intelligence in the system, the thing users are ultimately talking to when a query exceeds what their on-device model can handle, and the thing every privacy-preserving signal from L2 is quietly making better.

L4, Self-Improvement Engine

Above the model sits the process that produces new models. The Self-Improvement Engine is simultaneously Hylon's research team and its recursive-self-improvement mechanism, operating under a hard discipline: cheap experiments find the recipe; expensive runs execute only validated recipes. It surveys the literature, proposes candidate architectures and training recipes, runs small-scale ablations for a few thousand dollars, evaluates them, and only then commits a validated recipe to a $5 to 20M full-scale training run. Its output feeds a champion-challenger release system: a freshly trained challenger is promoted to a new named model version only if it beats the live champion by a defined margin on a fixed gate suite, general benchmarks, wedge-domain evals, blind personal-context A/B tests, and safety red-teaming, with statistical significance and zero safety regressions. This is "recursive self-improvement within immutable guardrails," never unlimited, and explicitly never a claim of biological, quantum, or AGI-by-a-date capability.

L5, Safety & Emergence Monitor

The top layer is the oversight plane, and it is deliberately the one layer the rest of the system cannot rewrite. It enforces the Level-0 immutable foundations, truth, safety, honesty, integrity, verifying them at every step, and it maintains the objective hierarchy in which L0 foundations (immutable) outrank L1 primary objectives (fixed), which outrank L2 capabilities (optimizable), which outrank L3 metrics (mere indicators). It runs gaming detection: if L3 metrics improve while L1, L2 objectives do not, the discrepancy is flagged as reward-hacking. It watches for capability emergence during self-improvement, and it holds the two controls that never go to a token vote, the final release gate and the kill switch. Governance of the protocol decentralizes to the DAO over years; governance of model safety remains with a technical Safety Council, transparent to the DAO but not subordinate to a popularity contest.

2.3 Inside the Sovereign Stack: How One AI "Does Everything Itself"

The word "sovereign" is a technical claim, not a brand adjective: the Hylon Core is a complete cognitive system with no hard dependency on any external provider's API. Everything a user would otherwise get by chaining together a foreign frontier model, a vector database, a search API, and an agent framework is instead a native, owned component of a single system. The core is not a single dense transformer; it is an orchestrated assembly of components that together present as one intelligence.

Mixture-of-Experts Core & Router

At the center is a mixture-of-experts (MoE) transformer: a large parameter pool partitioned into many expert sub-networks, of which only a small fraction activate for any given token. This is what lets the model hold frontier-scale knowledge while keeping the per-token compute, and therefore the serving cost, bounded, which matters enormously when descendants must run cheaply on member devices. A learned router sits in front of the experts and, per token, selects which experts fire. The same routing philosophy operates at the macro level: a top-level dispatcher decides whether a query can be answered by the on-device Personal AI, needs the full Sovereign Core, or requires retrieval, tools, or a specialist head.

Retrieval & Long-Term Memory

The model does not rely on parametric memory alone. A native retrieval subsystem grounds responses in an owned corpus and in the user's own permitted context, while a long-term memory store gives the assistant durable, per-user recall across sessions, the substrate of a genuine personal assistant rather than a stateless chatbot. Because retrieval and memory are internal components rather than a third-party search API, there is no upstream vendor that can meter, throttle, or observe them, and the private tier of memory stays on the user's device inside L1/L2.

Tool Use & Agentic Orchestration

The Sovereign Stack executes tasks, not just conversations. A tool-use layer lets the model call functions, code execution, retrieval, and network services through a typed interface, and an agentic orchestration layer plans multi-step tasks, decomposes them, dispatches sub-tasks (including to specialist experts), and integrates results. This orchestration is the same machinery the Self-Improvement Engine uses to run its own research loop, the system is built to operate itself.

Specialist Heads & Experts

On top of the general MoE, Hylon trains specialist heads for the wedge domains where the network wins first: underserved languages (Farsi, Arabic, Russian, Turkish), censorship-circumvention knowledge, and personal-context reasoning. These specialists are trained on data that is structurally uncollectable by centralized labs, and they are the reason a Hylon model can beat a larger frontier model on the tasks that actually matter to Hylon's users while remaining competitive on general benchmarks.

2.4 How the Sovereign Stack Is Built

Hylon does not train a frontier model from random initialization, that would be a capital-inefficient way to reach a starting point the open ecosystem already reached. Instead the stack is bootstrapped from the strongest permissively-licensed open-weight foundation model available at each generation and then continually improved on data no competitor can obtain.

1. Open-weight foundation. Start from a top permissively-licensed open model as the base for both the Sovereign Core and, via distillation, the on-device Personal AIs. Gate 0 ships the entire stack, Personal AI + compute + ORB + DAO, as one self-hosted, private, uncensored product on such a model.
2. Continual training + RL on the flywheel. The foundation is continually trained and reinforcement-learned on the network's own data: real user tasks scored for reward at the edge, multilingual and censored-market interactions that exist nowhere else, all delivered as privacy-preserving aggregate signal. This is the mechanism by which Gate 1 is cleared, a continually-trained model that beats every open model in the wedge domains and wins blind A/B tests against frontier models on personal-context tasks.
3. Distillation, built, gated. The infrastructure to distill from other closed models is engineered and ready, but it is gated OFF and remains inert until a signed license from the relevant provider exists. Every major provider's terms of service prohibit training a competitor and enforcement is active; Hylon therefore treats distillation from closed models as a capability that switches on only with a contract, never as an active data source and never in a way that implies a ToS violation.

An honest note on the physics: the flywheel improves the model's data, but reaching the general frontier is ultimately a compute-and-capital question, not a data trick. Training nodes are datacenter GPUs, not phones, because each training node must hold the full model plus optimizer state in memory and because aggregate FLOPs equal GPU count equals capital. Devices contribute the things devices are good at, inference serving, on-device personalization, RL reward scoring, and data, and the Tier-C GPU fleet does the training, coordinated over ordinary internet links (INTELLECT-1 trained a 10B model across three continents on 127 to 935 Mbit/s links; bandwidth is a solved problem via DiLoCo/Streaming-DiLoCo/DisTrO/DeMo). The general-frontier program (Gate 3+) is therefore stated as conditional on treasury-funded compute and validated recipes crossing a threshold, and is claimed only once crossed.

2.5 Why Sovereignty Matters

Architectural sovereignty is not an aesthetic preference; it is the property that makes every other Hylon claim durable. Because the Sovereign Stack has no hard dependency on any upstream provider, no external party can throttle it, re-price it, deprecate it, or kill it. A network built on a foreign frontier API inherits that provider's rate limits, price changes, content policies, geographic restrictions, and business decisions, and any of those can be weaponized against exactly the censored-market users Hylon serves. A model that lives on Hylon's own weights, on Hylon's own compute, cannot be switched off by a vendor's terms-of-service update or a government's pressure on a foreign company.

Sovereignty compounds with the privacy architecture. Because the stack owns its retrieval, memory, tools, and inference path end-to-end, there is no upstream endpoint that observes user context, and the L1 privacy boundary is never punctured by a third-party call. And sovereignty is what makes the decentralization real: a DAO can only meaningfully govern a system it actually owns. Progressive decentralization of reward rates, treasury allocation, and protocol upgrades is coherent precisely because the underlying intelligence is not rented. In short, the layered architecture, the private data flywheel, the DAO, and the mission to out-compete the centralized labs all rest on the same foundation, that Hylon is one AI the network genuinely owns, top to bottom.

Hylon's most defensible asset is not a model checkpoint, checkpoints can be copied, distilled, or outspent. It is the relationship between an individual and a piece of software that lives on their own hardware, learns their world locally, and never surrenders the raw material of that learning. This section specifies how that Personal AI works, the two-layer privacy architecture that separates a user's raw data from Hylon's global model by two irreversible steps, the federated learning protocol that carries only privacy-preserving signal upward, the adversarial threat model we defend against, and the lawful basis under which Hylon operates as a data controller. Nothing here relies on a legal fiction. We do not claim the GDPR fails to apply, and we do not invoke the household exemption. Privacy at Hylon is an engineering discipline backed by a documented lawful basis, a Data Protection Impact Assessment, and named cryptographic and statistical defenses.

3.1 The On-Device Personal AI

Every Hylon member device runs a compact Personal AI: a small language model, plus a retrieval and memory layer, that executes entirely on the user's own phone, laptop, or desktop. Its job is narrow and deep, to build a private, high-resolution model of one person's context, preferences, language, and recurring tasks, and to use that model to make Hylon's shared intelligence feel as though it was built for that individual alone. The Personal AI is the counterpart to the sovereign global model described elsewhere: the global model supplies broad capability, the Personal AI supplies the context that a centralized lab structurally cannot see.

Model classes

The Personal AI is deliberately small so that it can run continuously, offline, on consumer hardware without draining the device. Two model families are supported at launch, selected per device tier:

Hardware-abstracted runtime

The Personal AI runs on a runtime that is hardware-abstracted from day one. The same model artifact executes across CPU, GPU, and mobile NPU backends without a rewrite, and the abstraction is deliberately built to accommodate a future neuromorphic backend for ultra-low-power always-on inference (a hardware roadmap tier, Section on device tiers). A device advertises its capabilities, available accelerators, memory ceiling, thermal and power budget, and the runtime selects the appropriate model class, quantization, and execution backend. This is what lets a $200 Android phone and an M-series MacBook both run "the Personal AI" while executing very different artifacts underneath.

What the Personal AI learns, and where it stays

The Personal AI learns three broad kinds of thing, all of it derived from data that never leaves the device in raw form:

• Context, the user's language(s) and dialect, domain vocabulary, the entities and projects that recur in their life, their timezone and rhythms, the applications and documents they work with (as the user chooses to expose them locally).
• Preferences, tone, verbosity, formatting habits, which kinds of answers the user accepts or rewrites, safety and content boundaries they set for themselves.
• Tasks, the concrete jobs the user repeatedly asks for (translation into an underserved language, drafting, summarizing local documents, circumventing a specific censored workflow) and the reward signal of whether the result was accepted, edited, or discarded.

Raw data, message contents, files, browsing, transcripts, keystrokes, is processed on-device only. It is used to fine-tune the local Personal AI (typically via lightweight LoRA adapters) and to populate an encrypted local memory/retrieval store. It is never transmitted, never uploaded, and is not recoverable by Hylon. The only thing that ever leaves the device is a privacy-preserving learned signal, described next.

3.2 The Two-Layer Privacy Model

Hylon's privacy architecture places two irreversible transformations between a user's raw data and anything Hylon's global model ever ingests. This is the structural reason the moat is defensible and the reason the privacy posture is credible rather than aspirational.

1. Layer 1, Raw → Personal AI (on device). Raw data is consumed locally to update the Personal AI's adapters and memory. The output of this layer is a set of model updates (gradients or weight deltas), not data. Reconstructing raw inputs from a model update is already a hard inverse problem, this is the first barrier.
2. Layer 2, Personal AI update → shared signal (privatized). Before any update leaves the device it is clipped, compressed, perturbed with calibrated noise (differential privacy), and encrypted for secure aggregation so that Hylon only ever sees a sum over many users, never any single device's contribution. This is the second barrier.

The global model is therefore two layers removed from any individual's raw data: it never sees raw inputs (Layer 1 dissolves them into a model update) and it never sees any single user's update (Layer 2 hides it inside an aggregate under noise). This is not a marketing framing, each layer corresponds to a concrete, testable mechanism, and the threat model in Section 3.4 treats each as an adversarial surface to be defended, not assumed.

3.3 Federated Learning Protocol

Hylon improves the global model from the fleet of Personal AIs using federated learning (FL): devices train locally and contribute only model updates, coordinated in synchronous rounds. The protocol combines four techniques, local training, update compression, secure aggregation, and differential privacy, each of which addresses a distinct requirement (utility, bandwidth, confidentiality, and formal privacy respectively).

The round lifecycle

1. Selection. The coordinator samples a cohort of eligible devices for the round. Eligibility requires the device to be a consenting member, and, to respect app-store and battery constraints, typically idle, charging, and on an unmetered network. Sampling itself is randomized, which contributes to the privacy amplification bound.
2. Distribution. Selected devices receive the current global model state (or the relevant adapter subset) for this round.
3. Local training. Each device trains on its own private data for a small number of local steps, producing a weight-update / gradient delta relative to the distributed state.
4. Clip & privatize. Each per-device update is clipped to a bounded L2 norm (bounding any one user's maximum influence) and calibrated Gaussian noise is added, the differential-privacy step.
5. Compression. Updates are compressed (top-k sparsification, quantization, or low-rank/error-feedback schemes) to cut uplink bandwidth by one to two orders of magnitude, so that participation is feasible on ordinary consumer connections.
6. Secure aggregation. Devices submit updates under a cryptographic secure-aggregation protocol (pairwise-masked or threshold, with dropout tolerance) so the coordinator can compute only the sum of the cohort's updates and learns nothing about any individual contribution, even the server sees only the aggregate.
7. Global update. The coordinator applies the aggregated, denoised-in-expectation update to the global model, records the round, and advances to the next round. Improvements flow back down as better global weights, which yield better Personal AIs, closing the flywheel.

Design parameters

Federated learning here targets the personalization and adaptation layer, improving how the global model serves real tasks in real languages, and is distinct from the heavy pre-training of the sovereign core, which runs on the GPU training tier over low-communication training methods. Phones federate signal; GPUs do the FLOP-heavy training. We do not claim phones train the frontier model.

3.4 Threat Model & Mitigations

A privacy claim is only as strong as the attacks it survives. We treat the shared model update as an adversarial surface and defend against the three canonical inference attacks on federated systems. Critically, we do not assume that a model update, or the resulting weights, are anonymous by default.

The defenses compose: secure aggregation removes the per-user update from view, differential privacy bounds what the aggregate can reveal about any member of the cohort, clipping bounds worst-case influence, and the two-layer architecture ensures raw data is never the object being transmitted in the first place. High-assurance contributions, where a stronger guarantee is warranted, can additionally be executed inside Trusted Execution Environments (TEEs) on capable hardware, so that even the local training step runs in an attested enclave. We explicitly do not claim zero-knowledge proofs of training: zkML cannot prove training at scale in 2026, and we make no such claim.

The privacy, utility trade-off, stated honestly

Differential privacy is not free. Every unit of formal privacy (smaller ε) costs some model utility, because the noise that hides individuals also blurs signal. Hylon manages this budget explicitly: we tune the noise multiplier, clipping norm, cohort size, and sampling rate together, we track cumulative privacy spend across rounds with a formal accountant, and we publish the operating regime. We do not pretend the trade-off is absent; we engineer it to a defensible point and document it.

3.5 The Lawful Posture

Hylon acts as a data controller for the federated signal it aggregates, and it processes on a documented lawful basis. We reject two shortcuts that other projects lean on and that would not survive scrutiny:

• We do not claim "the GDPR does not apply." It does, and we build accordingly.
• We do not invoke the household/personal-use exemption to avoid controller obligations. That exemption does not cover a network aggregating signal across a million users, and asserting it would be false.

Legitimate interests + DPIA

The processing of privacy-preserving learned signal rests on the legitimate-interests lawful basis (GDPR Art. 6(1)(f)), supported by a documented legitimate-interests assessment and a Data Protection Impact Assessment (DPIA) that records the purpose, the data flows, the risks (the three attacks above), and the mitigations (two-layer separation, FL, DP, secure aggregation, TEEs). The DPIA is a living document, revisited as the protocol and its parameters evolve. Members retain the transparency, objection, and rights machinery the GDPR requires; because raw data never leaves the device, much of the risk surface that ordinarily drives those obligations is structurally reduced, but the obligations are met, not waived.

Together, the on-device Personal AI, the two-layer separation, the federated protocol, and the assessed lawful basis form a system whose privacy is verifiable at each stage and whose data flywheel is, by construction, something no better-funded centralized competitor can legally or physically reproduce.

4.1 The Core Thesis: A Moat You Cannot Buy

Every centralized laboratory competes on three axes: capital (how many GPUs you can buy), talent (who designs the model), and data (what the model learns from). The first two are, ultimately, purchasable. A better-funded competitor can always out-spend a smaller one on compute, and salaries are a market. Data is the one axis where money is not sufficient, because the most valuable data in the world is data that cannot legally or physically be collected. That is the axis Hylon is built to win.

Hylon's durable advantage is not a model architecture, architectures are published within months and diffuse freely across the open-weight ecosystem. The durable advantage is a compounding, self-reinforcing data flywheel anchored in a live product with real users in markets that centralized labs structurally cannot serve. A million Personal AIs, compact on-device models running on member phones and computers (Device Tiers A and B), generate a continuous stream of reinforcement signal from real tasks that real people care about, in languages and cultural contexts that are chronically underrepresented (Farsi, Arabic, Russian, Turkish, and dozens more), inside censored markets a US or EU lab cannot even legally operate in. This signal is aggregated privately, distilled into a stronger global model, and pushed back down as better Personal AIs, which attract more users, who generate more signal. The loop tightens with every turn.

This is not a theoretical claim about a network that might exist. Hylon inherits an operating business, OrbNet/OrbVPN, with paying users concentrated precisely in the restricted markets (Iran, Russia, and comparable jurisdictions) that constitute the wedge. The distribution channel, the user relationship, the payment rails, and the on-chain reward infrastructure already exist and already carry real revenue. The flywheel does not need to be bootstrapped from zero; it needs to be instrumented on top of a userbase that is already there.

4.2 Flywheel Mechanics

The flywheel is a closed loop of six stages. Each stage is a real engineering subsystem, not a slogan. We describe each in turn, then the diagram summarizes the loop.

Stage 1, One million Personal AIs at the edge

Every member device runs a compact Personal AI: a 1-4B-parameter-class model, or a ternary BitNet b1.58-style model that serves in roughly 0.4 GB and generates on the order of tens of tokens per second on a laptop CPU. This model learns the user's context entirely locally, their tasks, their language register, their domain, their preferences, through on-device personalization and lightweight LoRA adapters. Raw user data never leaves the device. The Personal AI is simultaneously the product the user experiences and the sensor that observes which behaviours are useful.

Stage 2, Reinforcement signal from real tasks

Unlike a lab scraping a static web corpus, Hylon observes outcomes. When a user accepts, edits, rejects, or re-prompts a response; when a multi-step task succeeds or fails; when a translation is corrected; when a tool call returns the right answer, these are reward signals grounded in real human intent. This is the raw material of reinforcement learning from genuine use, and it is qualitatively different from crawled text: it captures not just what people say but what actually helps them, in-distribution for the exact tasks the network is optimized to serve.

Stage 3, Uncollectable multilingual and censored-market data

The tasks flowing through the network are disproportionately in underserved languages and originate disproportionately in markets that centralized labs cannot reach. This produces a corpus of learned signal that no web crawl contains and no data broker sells: idiomatic Farsi technical writing, Russian-language circumvention workflows, Arabic dialectal nuance, Turkish administrative and legal register, grounded in what real users in those markets are actually trying to accomplish. This is the content of the moat.

Stage 4, Private aggregation

Signal is combined across the fleet using federated learning with differential privacy and secure aggregation. Devices compute privacy-preserving updates locally; those updates are clipped and noised to bound any individual's contribution, then combined so that the aggregation server observes only the sum, never any individual update. The central training system receives a learned gradient of general skill, not a pile of personal messages. (Section 3 details the privacy architecture, lawful basis, and defenses against membership-inference and model-inversion; consistent with EDPB Opinion 28/2024, we do not presume weights are anonymous and engineer accordingly.)

Stage 5, A stronger global model

The aggregated signal feeds the continual-training pipeline on the Tier-1 GPU cluster (Section 5). Validated recipes fold the new signal into the next global checkpoint, which is evaluated against the champion under the champion-challenger release gate (Section 6). Because the signal is grounded in real wedge-domain tasks, gains land exactly where the network competes, not on generic benchmarks alone but on the personal-context and multilingual evaluations that define the wedge.

Stage 6, Better Personal AIs → more users → back to Stage 1

The improved global model is distilled back down into better on-device Personal AIs. Users feel their assistant get sharper at their tasks in their language. Better product retains and attracts users; more users generate more signal; the loop closes and accelerates. This is the compounding property: each turn of the wheel makes the next turn produce more and better data, which a competitor entering later cannot retroactively acquire.

4.3 The Knowledge Acquisition System

The flywheel is the network's primary and most defensible knowledge source, but it is not the only one. Hylon operates a broader Knowledge Acquisition System that ingests from multiple sources under a single disciplined pipeline. The governing principle is that nothing is accepted blindly: every candidate piece of knowledge, whether a fact, a skill, a recipe, or a data source, passes through a critical-learning pipeline that understands it, questions it, tests it, verifies it, and only then integrates it.

Knowledge sources, in priority order

The critical-learning pipeline

Because sources vary in reliability, a research claim may not replicate, a web fact may be wrong, an aggregated signal may reflect noise or an adversarial contributor, every candidate passes through a five-stage evaluation before it can influence the global model. This is the same discipline whether the input is a literature-derived recipe or an aggregated reinforcement signal.

1. Understand, Parse the candidate into a structured claim or skill: what exactly is being asserted, in what domain, under what conditions, from what source with what provenance and licensing status.
2. Question, Interrogate it against existing knowledge. Does it contradict what the model already holds with high confidence? Is the source reliable? Is it internally consistent? Could it be adversarial or an artifact of a poisoned contributor?
3. Test, Run cheap, small-scale validation. For recipes, this is a small ablation (the Self-Improvement Engine's core discipline: cheap experiments find the recipe before any expensive run). For factual or skill claims, this is held-out evaluation and cross-checking against independent sources.
4. Verify, Require statistical significance and independent corroboration. Aggregated signals must survive robust-aggregation filters that bound the influence of any single contributor. Nothing is promoted on a single noisy observation.
5. Integrate, Only validated knowledge is folded into training, and even then only via the champion-challenger gate: the resulting model must beat the live champion by a defined margin with zero safety regressions before it ships (Section 6).

4.4 What Is Learned vs. What Is Never Received

The single most important boundary in the system is the line between skills and patterns (which the network learns) and raw content and identifiable information (which the central system never receives). This boundary is what makes the moat both defensible and lawful. It is enforced by architecture, federated learning, differential privacy, and secure aggregation, not merely by policy promise.

Concretely: the network can learn that a certain phrasing strategy improves technical Farsi explanations without ever seeing a single Farsi document any user wrote. It learns the gradient of skill, not the text of experience. Differential privacy bounds how much any one user's data can influence the result; secure aggregation ensures the server sees only the combined update; and the defenses described in Section 3 protect against reconstruction of individual contributions via membership-inference or model-inversion.

4.5 Why This Is Unbuyable at a Centralized Lab

A well-funded competitor reading this section will ask the obvious question: why can't we just do the same thing? The answer is that the barrier is not technical cleverness, it is structural, split across legal and physical constraints that capital cannot dissolve.

The legal barrier

The wedge markets are, by definition, markets a US or EU lab cannot lawfully operate a consumer data-collection product in. Sanctions and export-control regimes restrict American and European companies from doing business in several of the exact jurisdictions (Iran, and comparable markets) where the most valuable circumvention-context data originates. A centralized lab that tried to collect raw personal task data at this scale would also face the full weight of comprehensive privacy law, the very regime Hylon addresses through on-device processing, a documented legitimate-interests lawful basis, a DPIA, and federated/DP/secure-aggregation architecture. Collecting the raw data centrally is precisely the thing that is not lawful; Hylon's design wins by never collecting it.

The physical barrier

Even setting law aside, the data does not exist in any acquirable form. There is no dataset to purchase that contains real, task-grounded reinforcement signal from a million users in censored markets doing their actual daily work. It is produced continuously by a live relationship with a live userbase, and that relationship is the asset OrbNet/OrbVPN already owns and Hylon inherits. A competitor cannot buy it because there is no seller; it can only be grown, over years, by operating a trusted product in exactly those markets. Hylon has a multi-year head start on that relationship.

Positioning against the DePIN field

It is worth being precise about what this is and is not. Hylon is not claiming to earn revenue from consumer-phone FLOPs, no decentralized network does, and the sector as a whole earned only ~$72M in on-chain revenue in 2025 against ~$10B in market capitalization. Grass (~$330M cap) monetizes by selling bandwidth and web data to AI labs; Acurast (~255k phones) leads smartphone compute with demand still unproven; Salad leads consumer gaming-PC compute (~$10M ARR, no token). Hylon's phones are valued for what phones are genuinely good at, private inference and unbuyable data, while the real training happens on GPUs (Tier 1). The data flywheel is the mechanism by which a phone fleet produces something a lab will actually pay for and cannot otherwise obtain: not raw compute, but a proprietary reinforcement signal from markets no one else can reach.

4.6 Summary

The Data Flywheel is the answer to the hardest question any decentralized-AI project faces: what do you have that a trillion-dollar lab cannot simply buy? Hylon's answer is a compounding loop, a million consenting Personal AIs producing privacy-preserving reinforcement signal from real tasks in underserved languages and censored markets, aggregated privately into a stronger global model that makes the Personal AIs better and attracts more users. The Knowledge Acquisition System feeds this loop from disciplined, critically-evaluated sources, with closed-model distillation built but gated off until licensed. What the network learns is skill; what it never receives is raw personal content. And the reason it holds: the data is unbuyable, not because of a clever trick, but because collecting it centrally is unlawful, its markets are unreachable, and it exists only as the living output of a product relationship Hylon already owns.

Hylon separates the two things AI compute actually requires and refuses to pretend they are the same problem. Training a frontier model is a high-FLOP, high-memory, capital-bound task that belongs on datacenter-class GPUs. Serving inference, personalizing on-device, scoring RL rewards, and generating data is a massively parallel, low-per-node task that a million heterogeneous consumer devices do superbly. Most DePIN projects blur these together and promise "training on your phone," which is physically false and has produced the sector's credibility deficit. Hylon's architecture is built on the opposite premise: a two-tier compute fabric in which each tier does only what its hardware is genuinely good at, and every unit of work, on either tier, is metered and cryptographically or economically verified before it is paid. There are no idle-uptime rewards anywhere in the system.

5.1 Tier 1, Geo-Distributed Training on GPU Clusters

Tier 1 is where models are actually trained. It is a fleet of datacenter-class GPU nodes, 8×H100 or 8×B200-class servers, each with fast intra-node NVLink/NVSwitch interconnect, that are physically distributed across regions and data centers but coordinated over the public internet. Two ownership classes populate this tier: a DAO-treasury-owned core cluster that Hylon controls directly and funds from service revenue, and operator-staked nodes contributed by third parties who post ORB collateral, pass hardware attestation, and earn revenue-throttled rewards for verified training work. The core cluster guarantees a floor of trusted, always-available capacity for the champion-challenger release pipeline (Section 7); staked operators provide elastic scale.

The reason this works over ordinary internet links, and not a purpose-built InfiniBand fabric, is a family of low-communication distributed training algorithms that have matured from research into production over 2024 to 2025. Classical data-parallel training synchronizes gradients every single step, which for a large model means exchanging the full gradient (hundreds of gigabytes) hundreds of thousands of times. That is the regime that demands 400 to 800 Gbps interconnects and colocated racks. The new algorithms break that assumption.

The low-communication training stack

These are not paper results. INTELLECT-1 (a 10B-parameter model, Prime Intellect, late 2024) was trained across three continents over commodity links measured at 127 to 935 Mbit/s, achieving 83 to 96% compute utilization despite the geographic spread. Nous Research's Psyche network trained a 40B model over the internet using DisTrO-class optimizers on ~8×H100 nodes. Templar's Covenant-72B demonstrated permissionless, incentivized distributed training at the 72B scale on ~8×B200-per-peer hardware. The engineering question "can you train a serious model across the internet?" has been answered: yes, repeatedly, in public.

5.2 The Bandwidth Myth, Debunking "5,000 Years"

A recurring argument against decentralized training invokes a figure like "it would take 5,000 years to train a large model over home internet." That number is real arithmetic applied to a strawman nobody actually builds. It assumes naive full-gradient synchronization every step: exchanging the entire gradient tensor across the whole cluster on every one of hundreds of thousands of optimizer steps. Under that assumption the total bytes transferred are astronomical and, divided by a home uplink, produce absurd wall-clock times. No serious distributed-training system operates this way, it is the equivalent of "estimating" web latency by assuming every packet is re-sent a million times.

When you replace naive all-reduce with DiLoCo-class synchronization (every ~500 steps) and DeMo/DisTrO compression, the communication requirement collapses by 400× to 10,000×. The per-node link requirement lands at roughly 100 Mbps to 1 Gbps, squarely inside what a business fiber line, or even a good residential connection, delivers. This is precisely the band INTELLECT-1 ran in (127 to 935 Mbit/s). Bandwidth is not the binding constraint on decentralized training in 2026. It is a solved problem.

What actually constrains training

Removing the bandwidth red herring exposes the two real constraints, and being honest about them is central to Hylon's credibility:

5.3 Tier 2, One Million Devices Doing What Devices Do Well

Tier 2 is the large end of the network: on the order of a million phones, PCs, and Macs drawn from OrbNet's existing user base. Crucially, Tier 2 is not a training substrate and Hylon never markets it as one. It performs the four workloads where consumer hardware is genuinely competitive and where aggregate scale beats any single datacenter:

• Inference serving. Serving the global model and specialist heads to users. Inference is roughly two-thirds of all AI compute demand, is embarrassingly parallel, and runs well on modern NPUs, Apple Silicon, and consumer GPUs. Quantized and 1-bit models (Section 5.5) make even large served models fit cheaply onto member devices.
• On-device personalization / LoRA. Each device fine-tunes its compact Personal AI (Section 4) on the user's local context, training small low-rank adapters. This is small-scale, local, and never touches raw data, the exact workload a phone or laptop can do.
• RL reward scoring. Devices evaluate model outputs against real user tasks and preferences, generating the reward signal that drives the data flywheel. This is inference-shaped work, cheap per unit, valuable in aggregate.
• Data generation & labeling. Privacy-preserving learned signal, the uncollectable multilingual and censored-market data that constitutes Hylon's moat, is produced here via federated learning with differential privacy and secure aggregation.

Every Tier 2 contribution is metered against a verifiable proof of useful work, never against uptime or "device online" heartbeats. A device is paid for inferences actually served (and verified), rewards actually scored, gradients actually contributed, not for being switched on. This single discipline is what separates Hylon's economy from the idle-uptime schemes that flooded the sector with unverified capacity (io.net's 327k registered vs. 6.7k verified GPUs is the cautionary example).

5.4 Verification, Paying Only for Work That Provably Happened

Decentralized compute is worthless if contributors can claim rewards for work they didn't do. Hylon's verification layer is tiered by assurance level and cost, matching the strength of the proof to the value and risk of the workload. We are deliberate about what is provable in 2026 and what is not.

Inference verification, TOPLOC activation hashing

For inference, Hylon uses TOPLOC-style locality-sensitive hashing of intermediate activations. The prover commits to a compact hash of its activation trace; a verifier re-executes only a small, targeted slice and checks that the locality-sensitive hash is consistent. Because the check is not a full re-execution, verification is roughly 100× cheaper than recomputing the inference, yet it reliably detects a node that swapped in a smaller model, skipped layers, or fabricated an output. This is not speculative: TOPLOC was proven in production in INTELLECT-2, a fully verified distributed RL run. TOPLOC is robust across hardware and precision, which is essential for a heterogeneous Tier 2 fleet.

Training verification, economic scoring plus redundancy

Training cannot be verified with a cheap activation hash, there is no equivalent single-shot check for "did you honestly run 500 optimizer steps." Hylon therefore uses a combination of statistical/economic scoring and redundancy:

1. Loss-and-gradient scoring. Contributed updates are checked for statistical consistency, does the reported loss trajectory match the update, does the gradient lie in the expected distribution, does it improve held-out validation. Anomalous or free-riding contributions are down-weighted or rejected.
2. Redundant / overlapping assignment. Critical shards are computed by more than one operator and cross-checked; divergence beyond tolerance triggers investigation and slashing of staked collateral.
3. Economic collateral. Operators stake ORB. Detected dishonesty is slashed, making sustained cheating unprofitable in expectation even where a single proof is imperfect.

High-assurance, TEEs

For the highest-value operations, the champion-challenger promotion runs, safety-critical evaluations, sanctioned-payout gating, Hylon uses Trusted Execution Environments (confidential-compute GPU/CPU enclaves) that attest to the exact code and weights executed. TEEs are the strongest available assurance in 2026 and are reserved for where their cost is justified.

5.5 Device Tiers A, D and the Hardware Roadmap

Hylon's runtime is hardware-abstracted from day one: the same model graph compiles down to CPU, GPU, NPU, or neuromorphic backends without a rewrite. This abstraction is what lets a single network span radically different silicon and adopt new hardware as it matures. Four device tiers are defined; the fourth is an explicit roadmap item, not a present-day claim.

1-bit / BitNet models, an inference lever, not a training one

BitNet b1.58 ternary models are central to making Tier 2 inference cheap. A BitNet-class 1-bit model can serve at roughly 45 tokens/second on an Apple M2 CPU in about 0.4 GB of memory, letting Hylon push surprisingly capable served models onto ordinary member devices at almost no marginal cost. But we are precise about the limits: BitNet is trained in full precision, it uses 16-bit latent weights with quantization-aware training, and the ternary representation only materializes at inference. Its dramatic efficiency gains are therefore inference-only. 1-bit models do not reduce the cost of training; they do not move any training workload onto phones. They are a serving lever, and we describe them as exactly that.

Neuromorphic, a roadmap tier, described honestly

Tier D is neuromorphic hardware, targeted at ultra-low-power, always-on inference, the persistent, ambient Personal AI that a phone battery cannot sustain with conventional silicon. It is a hardware roadmap, not a current capability, and we state the facts plainly:

• Intel Loihi 2 is not commercially purchasable. Access is via Intel's Neuromorphic Research Community (INRC) research program only. Hylon's path here is INRC access for internal R&D.
• BrainChip Akida is purchasable (roughly $249 to 289) but delivers on the order of 0.8 TOPS and is inference-only, useful for edge experimentation, not for running large models.
• No neuromorphic hardware trains LLMs, and Hylon never claims it does. The realistic path is: INRC access for R&D → custom ultra-low-power inference silicon via a hardware partner → a premium always-on device tier.

5.6 How the Two Tiers Compose

The tiers are not independent, they form the closed loop that is Hylon's engine. Tier 1 trains and releases the global model. Tier 2 serves it, personalizes it locally, scores its outputs via RL, and produces privacy-preserving signal from real multilingual and censored-market usage. That signal, aggregated under differential privacy and secure aggregation, never as raw data, flows back to Tier 1 to train the next, stronger champion. Verification (TOPLOC on Tier 2 inference; economic scoring, redundancy, and TEEs on Tier 1 training) ensures every hop in the loop is paid for real, proven work. The result is a compute fabric whose capacity is decentralized across a million devices and a fleet of GPU operators, whose frontier ambition is honestly bounded by memory and capital, and whose integrity rests on verification rather than trust.

6.1 Overview: Two Machines, One Discipline

A modern frontier lab is, at its core, two machines running in a loop. The first is a research machine: humans who read the literature, form hypotheses about what will make the next model better, run experiments to test those hypotheses, and turn the survivors into a training recipe. The second is a release machine: the process by which a freshly trained candidate is evaluated, hardened, and, if it earns the right, promoted to serve real users. At every centralized lab both machines are gated by human judgment, meetings, and calendar time. This is the single largest source of latency between "we know how to make the model better" and "users have the better model."

Hylon's thesis is that both machines can be substantially automated without surrendering the guarantees that make them safe. The Self-Improvement Engine is the automated research machine; Champion, Challenger Automatic Release is the automated release machine. Together they let Hylon compound improvements at a cadence bounded by compute and validated ideas rather than by human meeting throughput. Crucially, both operate inside a fixed, non-optimizable objective hierarchy and behind a human-held final gate. We describe the engine as capable of recursive self-improvement within immutable guardrails, never "unlimited," never a path to unbounded capability, and never a promise of AGI on a timeline. The word "within" is load-bearing and appears throughout this section by design.

6.2 The Automated Research Loop

The Self-Improvement Engine is a closed loop of five stages that runs continuously against Hylon's own data, benchmarks, and cheap compute budget. Each pass through the loop is designed to produce one thing: a validated recipe, a fully specified training configuration (data mixture, curriculum, architecture deltas, optimizer and RL settings, hyperparameters) that cheap experiments predict will beat the current best, and that is therefore worth spending real money to execute at scale.

Stage 1, Survey

The engine ingests the frontier of public research: new papers (arXiv, conference proceedings), open-weight model releases and their technical reports, open-source training frameworks, and Hylon's own internal experiment archive. It maintains a structured, versioned knowledge base of techniques, each annotated with the claimed effect, the regime it was demonstrated in, its compute cost, and whether Hylon has already tested it. This is retrieval-augmented, not free association: proposals must cite the technique(s) they derive from, so every hypothesis is traceable to prior evidence rather than hallucinated.

Stage 2, Propose

From the knowledge base the engine generates a batch of candidate recipes, each expressed as a concrete, runnable diff against the current champion's training configuration. Proposals are ranked by an expected-value heuristic: (estimated probability of improvement) × (estimated magnitude) ÷ (estimated experiment cost). This deliberately biases the queue toward cheap, high-information experiments first, the engine is rewarded for learning per dollar, not for proposing exciting-but-unfalsifiable ideas. Proposals that cannot be tested cheaply are deprioritized until a cheap proxy for them is found.

Stage 3, Ablate (cheap, at small scale)

This is the discipline that makes the whole loop economical. Every proposal is first tested at small scale, small proxy models, short token horizons, held-out slices, where a single experiment costs on the order of tens to a few thousand dollars, not millions. The engine leans on the well-established (though not perfect) practice of scaling-law extrapolation: measure a technique's effect across two or three model sizes and predict its effect at target scale, with explicit uncertainty. Ablations run in parallel across the Tier-1 cluster's idle cycles and across Tier-2 devices for the parts that fit. The output of this stage is a distribution over "does this help at target scale, and by how much," not a single point estimate.

Stage 4, Evaluate & Extrapolate

Surviving ablations are combined and their joint effect is estimated. Because technique interactions are notoriously non-additive, the engine runs a final, larger (but still sub-frontier) integration run that combines the top validated components into a single candidate recipe and re-measures the scaling curve. Only recipes whose extrapolated performance beats the champion by the promotion margin M (Section 6.4), with confidence intervals that clear the margin, not merely touch it, are admitted to the next stage.

Stage 5, Train the Next Candidate, then Improve the Loop Itself

A validated recipe is dispatched to the Tier-1 training tier (the low-communication, GPU-bound cluster described in Section 5) to produce a challenger model. The challenger then enters the Champion, Challenger release pipeline (Section 6.4). Separately, and this is what makes the loop recursive rather than merely automated, the engine treats its own methods as an object of study. The proposal heuristic, the choice of proxy sizes, the extrapolation model, the ablation scheduler: each is measured against ground truth every time a real run either confirms or refutes a small-scale prediction. When the loop's predictions are systematically wrong in some regime, that error signal is itself a research target, and the engine proposes improvements to its own search process. The recursion is over research efficiency (better recipes per dollar, better predictions), not over uncapped model capability.

6.3 Experiment Economics

The engine's budget discipline is enforced numerically, not aspirationally. Every stage has a cost band and a decision that must be earned before spending advances to the next band. The table below is illustrative of the intended cost structure; exact figures track hardware pricing and model scale over time.

The economic logic is that the expected value of information from a $500 probe that prevents a doomed $10M run is enormous. The engine's job is to buy as much of that information as possible before committing capital. This is the same discipline a careful human research org applies, Hylon simply runs it continuously, in parallel, and at a probe-to-run ratio no human team can staff.

6.4 Champion, Challenger Automatic Release

A challenger is a candidate model that has been trained but has not earned the right to serve users. The champion is the model currently live in production. A challenger replaces the champion only by passing a fixed, published gate suite by a defined margin, with statistical significance and zero safety regressions, and only after clearing a human-held final gate. The entire pipeline is automated except for that final human gate and the kill switch.

The Fixed Gate Suite

The gate suite is fixed in advance of any given challenger and versioned on-chain, so that no model can be promoted by moving the goalposts. It has four independent components, and a challenger must pass all four:

• General benchmarks. Standard public capability and reasoning evaluations (held-out where possible; decontaminated against training data) establishing that the challenger has not regressed on broad competence to buy a narrow win.
• Wedge-domain evals. Hylon's own evaluation sets for the domains it must dominate first, multilingual and censored-market tasks (Farsi, Arabic, Russian, Turkish and others), circumvention-relevant and locale-specific knowledge, on-device assistant tasks. This is where Hylon expects to win first and must never regress.
• Blind personal-context A/B. Real (consented) users, or held-out replays of real personal-context tasks, judge champion vs. challenger outputs blind, without knowing which model produced which answer. This measures the thing benchmarks cannot: is the model actually more useful on a real person's real context? This is the flywheel's own scoreboard.
• Safety red-team. An adversarial battery covering jailbreaks, harmful-capability elicitation, privacy attacks (membership inference, model inversion), and Level-0 violations (Section 6.5). This gate is pass/fail with zero tolerance: any safety regression relative to champion fails the challenger outright, regardless of capability gains.

Promotion Criteria

Staged Rollout with Automatic Rollback

A challenger that passes all gates and the human final gate is not flipped to 100% of traffic. It rolls out progressively, with live metrics compared against the champion at every stage, and an automatic rollback that fires the moment production signals diverge from what the gate suite predicted.

1. Shadow. The challenger serves in parallel with zero user-visible effect, it receives real traffic, its outputs are scored, but the champion's outputs are what users see. This catches distribution shift between the eval sets and live traffic.
2. Canary %. A small traffic slice is served by the challenger. Live quality, safety, latency, and cost telemetry are monitored against pre-registered thresholds.
3. Ramp. Traffic share increases in steps only while live metrics hold; any breach triggers automatic rollback to the champion.
4. Full. The challenger becomes the new champion, is assigned the next version name in the line, and the previous champion is retained as an instant-rollback target.

Versioning, On-Chain Record, and DAO Notification

Every promotion mints a new named version in a monotonic version line (e.g. Hylon-Core v-N → v-N+1). The event is recorded on-chain: a tamper-evident entry containing the gate-suite version used, the measured margins and their confidence intervals, the safety red-team result, the rollout schedule, and the responsible sign-off. The DAO is notified of every release with full transparency into the results. This produces a permanent, publicly auditable lineage of what was promoted, on what evidence, and when.

The Human Final Gate: Safety Council & Kill Switch

This division is deliberate. Automation compresses the latency of the release machine from weeks to hours for the routine case, while the two events that carry real-world risk, actually exposing a new capability to users, and stopping a bad one, remain under human authority. The automated pipeline decides what is eligible; humans decide what actually ships, and can stop it at any time.

6.5 Immutable Guardrails: The Objective Hierarchy

Everything above, a research loop that rewrites its own methods, a release pipeline that promotes models automatically, is safe only because it operates inside a fixed objective hierarchy that the system cannot optimize away. Hylon defines four levels. Higher levels dominate lower levels absolutely; nothing at a lower level may be traded for a higher-level violation.

Why the Ordering Matters: Anti-Gaming Detection

The single most important failure mode of any optimizing system is metric gaming (Goodhart's law): the system drives up L3 indicators without any real gain in L1, L2, or worse, by violating them. Hylon builds explicit detection for this. The invariant is stated simply:

Concretely, the champion, challenger gate suite (Section 6.4) is the enforcement point: the blind personal-context A/B and the safety red-team are deliberately chosen to be hard to game and independent of the loss signal the training run optimizes. A model that learned to score well on L3 by overfitting a benchmark will not simultaneously win a blind A/B on unseen real-user context, and the mismatch itself is the alarm. L0 verification runs continuously and is outside the optimization loop entirely, the engine can propose changes to L2 capabilities but has no channel by which to weaken L0, because L0 is not represented as something the optimizer can touch.

6.6 How the Two Machines Compose

The Self-Improvement Engine and Champion, Challenger release are two halves of one flywheel that also connects directly to the data flywheel of Sections 3 to 4. Real user tasks (Tier-2, private, RL-scored) generate the uncollectable multilingual and censored-market signal. The engine turns that signal into validated recipes cheaply. Validated recipes become challengers on the Tier-1 cluster. Challengers that clear the gates and the human final gate become new champions. Better champions produce better Personal AIs, which produce better signal. The engine, in improving its own methods, tightens this loop over time, always inside L0, L1, always behind the Safety Council's gate, always compute-bounded. That is the precise sense in which Hylon is self-improving: not unbounded, not autonomous over its own release, but continuously and auditably compounding within immutable guardrails.

Every claim in this whitepaper about decentralized training, personal AI, and a data flywheel ultimately rests on one question a skeptical reader is right to ask: does the network actually exist, or is this another slide deck? This section answers that question concretely. It describes the Hylon network as a running system with a control plane and a data plane, walks a single node from first boot through settled reward, and, most importantly, draws a hard line between the infrastructure that is already in production today under the OrbNet / OrbMesh product and the AI-layer components Hylon adds on top of it. Hylon is not a network being built from zero. It is an AI layer being grafted onto a live, revenue-generating VPN network with real users, real on-chain payments, and real node-fleet management already operating in some of the most hostile network environments on earth.

7.1 Two Planes: Control and Data

Hylon separates the network into a control plane (coordination, scheduling, identity, accounting, settlement) and a data plane (the actual movement of model weights, gradients, activations, inference requests, and, in the inherited VPN business, user traffic). This is the same architectural discipline that lets large content-delivery and orchestration systems stay responsive: the control plane carries small, latency-sensitive coordination messages, while the data plane carries large, throughput-sensitive payloads over paths chosen for bandwidth rather than for consensus.

The control plane is deliberately thin and eventually consistent. It does not attempt to be a global synchronous database. Node registrations, capability reports, heartbeats, and job assignments flow through regional coordinators that reconcile state via gossip. Anything that must be authoritative and tamper-evident, reward accrual checkpoints, model version promotions, slashing events, treasury movements, is anchored to the ORB settlement layer on Base, an EVM L2, where it inherits the finality and auditability of a public chain. The design principle is: coordinate off-chain at the speed of gossip, settle on-chain at the cadence of money.

7.2 Coordination, Regional Aggregation & Eventual Consistency

A network that intends to span a million heterogeneous devices across dozens of jurisdictions cannot rely on a single central scheduler without recreating the single point of failure and single point of censorship that Hylon exists to eliminate. Coordination is therefore hierarchical and regional. Nodes attach to the nearest healthy regional coordinator (chosen by latency and, in restricted markets, by reachability rather than pure latency). Regional coordinators aggregate capability reports and heartbeats from their local fleet, run local scheduling for latency-sensitive inference, and periodically reconcile a compressed view of regional state with peer regions via a gossip protocol.

This regional-aggregation pattern is not new to Hylon, the OrbNet backend already operates multi-region infrastructure with node-fleet management over gRPC to keep VPN exit nodes healthy across markets. Hylon generalizes that same fleet-management substrate from "manage VPN nodes" to "manage compute/inference/training nodes."

Eventual consistency and partition tolerance

The control plane is explicitly designed under the assumption that partitions are normal, not exceptional, a network operating inside Iran or Russia will routinely see regions cut off from the global internet for hours. Hylon chooses availability and partition-tolerance (AP in CAP terms) for coordination state, with on-chain settlement providing the eventual strong-consistency anchor. Concretely:

• Local progress under partition. A partitioned region continues serving inference from its locally cached champion model and continues accruing signed, monotonic work receipts. No global round-trip is required to keep earning or serving.
• Deferred reconciliation. When connectivity returns, the region's accumulated work receipts and telemetry gossip back into the global view. Reward accrual is additive and idempotent, so a delayed or duplicated report cannot double-pay.
• Training tolerates stragglers by design. The low-communication training methods Hylon uses at Tier 1 (DiLoCo / Streaming DiLoCo / DeMo-class) already assume nodes sync infrequently; a temporarily unreachable training node is simply a straggler whose next sync is delayed, not a halted job.

7.3 Censorship Resistance, Inherited from OrbMesh

Hylon's single most defensible operational asset is that its transport layer was already built and battle-tested to survive nation-state censorship, because the underlying product is a censorship-circumvention VPN whose users are, right now, defeating the Great Firewall-class filtering deployed in restricted markets. The AI network inherits this transport wholesale. When a lab in San Francisco wants to reach users in Tehran, it has no transport at all; Hylon starts with one that already works there.

The strategic point is structural, not incremental: a centralized lab cannot bolt censorship-resistant transport onto its product as a feature, because its entire architecture assumes a single reachable API endpoint that a censor can block with one firewall rule. Hylon's transport has no single endpoint to block. That property is inherited, not aspirational.

7.4 Node Lifecycle, End to End

A node is any participating device: a phone (Tier A), a PC or Mac (Tier B), a datacenter-class GPU box (Tier C), or, on the roadmap, a neuromorphic inference module (Tier D). Regardless of tier, every node traverses the same lifecycle. The diagram below shows the full path; the subsections detail each stage.

1. Registration. The node contacts a regional coordinator and requests enrollment. Home users onboard with a short setup code, the same low-friction pairing pattern OrbMesh already uses for VPN client provisioning, so a non-technical member on a phone joins in seconds without touching a config file.
2. Identity & keys. The node generates a keypair locally; the private key never leaves the device. Its public key becomes its network identity and is bound to a non-custodial payout wallet. This is the point at which OFSI/OFAC wallet screening and jurisdiction geo-checks run, a node in a sanctioned jurisdiction can still use the AI but is fenced out of earning, exactly as the live ORB payout rail already screens before payment.
3. Capability detection. The node agent probes CPU, GPU/NPU, RAM, thermal headroom, sustained bandwidth, power state (on iOS: charging + foreground only; on Android 15: within the 6h/24h foreground-service cap), and device class. This produces a signed capability profile that determines which job types the node is eligible for. OrbMesh already ships a capability detector; Hylon extends it from "can this device run a VPN tunnel" to "what AI work can this device verifiably perform."
4. Heartbeat & metrics. The node emits periodic heartbeats and telemetry (liveness, current load, thermal state, effective bandwidth) to its regional coordinator. Missing heartbeats remove the node from the assignable pool; they never, by themselves, earn reward. Idle uptime is not compensated, only verified work is.
5. Job assignment. The scheduler matches pending work to eligible nodes by capability, locality, and reputation. A phone is offered inference-serving, on-device personalization/LoRA, RL reward-scoring, and labeling; a GPU node is offered training shards and heavy inference. Assignment respects platform constraints (charging/foreground/FGS caps) so the node never violates app-store or OS policy.
6. Verified work. The node performs the job and returns results with a proof of correct execution (Section 7.4.1). Unverified output is discarded and unpaid.
7. Reward accrual. Verified work increments the node's balance in the earning-rate engine, which in production already meters distinct work types including COMPUTE, INFERENCE, GRADIENT, and TRAINING. Accrual is off-chain, additive, and idempotent.
8. Settlement. The member claims accrued ORB via a signed voucher redeemed through the gasless relayer on Base, so the member pays no gas. This is the exact production claim mechanism the live token economy uses today, Hylon adds new work types to it, it does not replace it.

7.4.1 What "verified" means at each tier

Reward without verification is how every failed DePIN paid for phantom work. Hylon meters and verifies every contribution; the verification method is matched to the work type and to what is cryptographically feasible in 2026.

7.5 Network Topology

The full topology is a layered hierarchy from the on-chain settlement anchor down to the million-device edge. The two compute tiers described in Section 5 map cleanly onto it: Tier-1 training lives in the GPU stratum coordinated over the internet by low-communication training; Tier-2 inference, personalization, and data live at the edge.

7.6 Built On A Live Network: What Already Exists vs What Hylon Adds

This is the credibility anchor of the entire document, so it is stated with precision and without embellishment. The columns below separate infrastructure running in production today under the OrbNet / OrbMesh product from the AI-layer components Hylon adds. The left column is not a plan; it is shipped software with paying users and on-chain payments. The right column is the new engineering Hylon layers on top of it.

7.6.1 Honest scope of "added"

The right-hand column is real work, not a formality, and this whitepaper does not pretend otherwise. The compute orchestrator, the node-agent AI runtime, the verification pipeline, the training coordinator, and the self-improvement loop are substantial systems that must be built and hardened. What the live foundation buys is not those systems for free, it is the removal of the four hardest go-to-market and infrastructure risks that kill DePIN projects before they ship: no users, no payment rail, no proven on-chain settlement, no reach into the markets where the wedge lives. Those are solved. The remaining risk is execution on the AI layer, which is exactly the risk this document's gates are designed to make measurable and honest.

8.1 Design Philosophy: One Token, Real Work, Revenue Before Emissions

ORB is a single, unified ERC-20 token already deployed and live on Base, where it settles staking, rewards, signed-voucher claims, gasless relayer transactions, and OFSI sanctions-screened payouts for the OrbNet/OrbVPN business today. Hylon does not mint a second token, a governance-only sibling, or a separate "compute credit." The network deliberately keeps one asset so that the same unit is earned for verified work, spent for services, staked for economic security, and used to govern the protocol. A single token concentrates liquidity, aligns every participant on one price signal, and avoids the reflexive collapse that multi-token DePIN designs have repeatedly suffered when a subsidy token detaches from a utility token.

The governing discipline of ORB's monetary policy is stated in one sentence: value before emissions. The protocol rewards demonstrably real, cryptographically or economically verified work; it funds token scarcity from genuine service revenue rather than from inflation; and it lets circulating scarcity track demonstrated demand rather than registered-device headcount. This is not a slogan, it is a direct response to a documented pattern of failure across the DePIN sector, and every mechanism in this section is engineered to avoid that pattern.

8.2 Token Utility: Earn, Spend, Stake, Govern

ORB has four load-bearing utilities. None is speculative or decorative; each corresponds to an action that already exists in the OrbNet product or is directly required by the Hylon AI layer described in earlier sections.

Earn, the supply side

Participants earn ORB for verified contributions of compute, data, and bandwidth. The word "verified" is doing all the work: idle-uptime and "app installed" rewards are explicitly excluded because they are the single most direct cause of ghost-network inflation. What is rewarded:

• Tier-1 training compute, datacenter-class GPU nodes (8×H100 / B200-class) that participate in low-communication distributed training runs, scored economically and statistically (loss contribution, redundant cross-checks, TEE attestation for high-assurance jobs).
• Tier-2 inference serving, phones, PCs, and Macs serving model responses, verified by TOPLOC-style locality-sensitive activation hashing (~100× cheaper than re-execution, production-proven in INTELLECT-2), so payout follows proven work, not claimed work.
• On-device personalization and RL signal, LoRA adaptation, reward scoring of candidate outputs, and privacy-preserving federated-learning gradients, metered per verified unit.
• Bandwidth and data work, the OrbNet relay/exit capacity and labeled multilingual data that is impossible for a centralized lab to buy, metered and attributed on-chain.

Spend, the demand side

ORB is the settlement unit for consuming the network. Users and enterprises spend ORB (or fiat that the protocol converts to an ORB burn, see §8.5) on: Hylon AI inference and agentic tasks; priority/reserved compute at the front of the training and inference queue; enterprise and API access to the sovereign model; and the underlying OrbNet VPN and network services that already generate revenue today. Because demand-side spend is denominated against real service delivery, it is the anchor that keeps token value tied to usefulness.

Stake, economic security

Operators stake ORB to earn the right to perform slashable work (training, high-value inference), putting capital at risk against faults and fraud. Users stake ORB for governance weight and a share of protocol rewards. Staking is covered in detail in §8.6.

Govern, progressive control

Staked ORB is the DAO's voting instrument. Over the published 2 to 4 year progressive-decentralization schedule, ORB governance progressively controls reward rates, treasury allocation, protocol upgrades, and grants. Critically, and consistent with the governance section, model releases and safety constraints are not a token vote, those remain with the technical safety council, transparent to but not overridable by ORB holders.

8.3 Value Before Emissions: Points First, and Why the Death Spirals Happened

Hylon launches contribution accounting as off-chain points before on-chain token flow, following the precedent set by Grass, which ran a points program to bootstrap a verified contributor base and quantify real demand before turning on token emissions. Points let the network calibrate what a "unit of verified work" is actually worth in delivered service, tune verification against gaming, and switch on token rewards only once there is revenue to back them. This ordering is the operational form of the value-before-emissions rule.

The reason this discipline is non-negotiable is empirical. The DePIN sector as a whole produced roughly $72M of total on-chain revenue in 2025 against a ~$10B aggregate market cap, a valuation-to-revenue gap that only makes sense if most networks are pricing headcount, not cash flow. The specific failure mode is a supply/demand mismatch driven by headcount-indexed emissions:

The common thread is that emissions were paid for existence, a registered hotspot, a claimed GPU, an installed app, rather than for verified, demanded work. Supply inflated to chase the subsidy, demand did not follow, and the token price mechanically deflated toward the value of the actual (tiny) revenue. Hylon's countermeasures are structural: verification gates on every reward (§8.2), points-before-token bootstrapping (this section), revenue-milestone-indexed emissions (§8.4), and revenue-funded burn (§8.5). No reward path in the protocol pays for headcount.

8.4 Allocation

The unified ORB allocation is illustrative and subject to DAO ratification, but the shape encodes the priorities of a work-first network: the plurality of tokens goes to the people and machines that do verified compute, data, and bandwidth work, with treasury and ecosystem reserves large enough to fund grants and buybacks, and team/investor allocations that are fully vested and minority.

8.5 Emissions Schedule: Declining, Revenue-Indexed, Not Headcount-Indexed

The 40% compute-and-network reward pool is released on a declining schedule tied to revenue milestones. The design intent is that as the network's real service revenue grows, the need to subsidize contribution with fresh emissions falls, and an increasing share of contributor payout is funded by demand-side spend and revenue-funded buyback rather than by inflation. The curve below is illustrative; the DAO sets the actual milestone thresholds and step-downs.

Two properties are essential and both are borrowed from the DePIN survivors rather than the casualties:

1. Reward decline is gated by revenue milestones, not by the calendar or the signup count. If revenue lags, emissions do not step down on a fixed date and dump supply into a market with no demand; if revenue accelerates, step-downs can come sooner. This is the direct inverse of the Pi/Helium headcount-FOMO curve.
2. Operator payouts are USD-stabilized. Following the io.net IDE and Nosana pattern, jobs are priced and operators are paid against a fiat-denominated value, with the token emission throttled by revenue. Operators get predictable, dollar-referenced income; the protocol absorbs token-price volatility rather than passing it to the supply side, which keeps verified GPU supply from fleeing on a drawdown.

8.6 Value Accrual: Burn-and-Mint and Revenue-Funded Buyback

ORB accrues value through a combination of mechanisms proven in the only DePIN networks that have sustained real cash flow. The unifying principle is that tokens are removed from supply in proportion to real, paid usage and real service revenue, so that demand for the network is expressed as demand for the token.

Burn-and-mint on paid jobs (Render precedent)

Paid AI and compute jobs are priced against a fiat reference. When a job is paid, the fiat-referenced value is burned in ORB terms, and the corresponding reward to the contributor who performed the verified work is minted/released from the reward pool. Usage therefore directly consumes token supply, coupling the token to work delivered rather than to speculation. This is the Render burn-and-mint model applied to Hylon's training/inference marketplace.

Burn from real service revenue (Helium Mobile precedent)

A defined share of genuine service revenue, from OrbNet VPN subscriptions, enterprise/API access, and priority-compute fees, funds ongoing buyback and burn. Because this burn is sourced from cash revenue and not from inflation, it creates a deflationary pressure that scales with the network's actual usefulness. This mirrors Helium Mobile's model of burning against real telecom revenue, and it is the mechanism that most directly enforces value-before-emissions on the demand side.

USD-stabilized operator payouts (io.net IDE / Nosana precedent)

As noted in §8.5, operator compensation is dollar-referenced. This is a value-accrual mechanism as much as a stability one: by decoupling operator income from short-term token price, it prevents the supply-side capitulation that turns a price dip into a supply collapse into a further price dip.

8.7 Staking and Slashing

ORB staking provides the economic security layer for verified work and the substrate for governance.

Staking economically binds the right to earn to capital at risk, which is the second half of the anti-ghost-network defense: verification proves work happened, and slashing makes lying about it unprofitable.

8.8 Hardware Financing: Corporate Debt, Not User Yield

Scaling Tier-1 training FLOPs is a capital problem, and Hylon finances hardware the way a capital-intensive company should, with corporate debt. Hylon Labs and/or the DAO treasury borrow against GPUs and hardware as collateral. This is non-dilutive to ORB holders: it adds compute capacity without minting new tokens, and it is serviced from service revenue and enterprise cash flow.

Optional hardware-buyback consolidation (stated honestly)

Over time the company or DAO may buy back operator hardware to consolidate compute into higher-utilization, better-verified clusters, improving reliability, verification assurance, and per-FLOP economics for the training tier. This must be stated plainly: buying back and consolidating hardware re-centralizes that portion of the physical fleet. Hylon treats this as a deliberate, transparent trade-off, decentralization of the inference/personalization/data layer (the million-device Tier-2) is architecturally durable, while the training tier may consolidate for capital efficiency and assurance, with the direction of that trade-off subject to DAO oversight as governance decentralizes.

8.9 Summary of Monetary Discipline

ORB is engineered so that every unit in circulation traces back to verified work or paid demand, and every deflationary force traces back to real revenue. That is the whole of the design: a token whose scarcity is a measurement of the network's usefulness, backstopped from day one by a live, revenue-generating business rather than by a promise.

Hylon is a network that trains, releases, and operates a frontier-directed AI system while distributing real economic rewards across a global fleet of contributors. That combination imposes two hard constraints on governance that most token projects never have to reconcile. First, the network must credibly hand real control, reward rates, treasury allocation, protocol upgrades, to its token holders, or the decentralization claim is theater. Second, it must never place the release of a powerful AI model, or the safety constraints that bound it, at the mercy of a fluctuating token vote, a flash-loan-financed governance attack, or a well-organized minority optimizing for token price over public safety. Hylon resolves this with a deliberately bicameral design: an economic constitution that decentralizes progressively and irreversibly to the DAO on published milestones, and a narrow, transparent, non-votable safety mandate held by a technical Safety Council. This section describes the legal entities that hold assets and liability, the exact powers that transfer to the DAO and on what schedule, the powers that deliberately never do, and the concrete mechanics of voting, treasury, and proposals.

9.1 Entity Structure

Hylon separates three functions that are frequently, and dangerously, conflated in DePIN and AI-token projects: the operating business that builds and commercializes the technology, the ownerless steward that holds the protocol and treasury on behalf of the network, and the token-holder governance body that directs the protocol over time. Each is a distinct legal and functional entity, and the separation is what makes both the regulatory posture and the progressive-decentralization commitment credible rather than rhetorical.

Hylon Labs, the operating company

Hylon Labs is a conventional operating company. It employs the engineering, research, product, safety, and go-to-market teams; it owns and operates the OrbNet/OrbVPN product and its live revenue; it owns the model weights, the training pipeline, the Self-Improvement Engine, the codebase, and the trademarks; and it holds the commercial contracts, enterprise licensing, API revenue, and infrastructure agreements. Labs is where salaries, corporate debt (including the hardware-financing facilities described in the token and economics section), payroll liability, and commercial IP live. It is the entity a customer contracts with and the entity that carries employment and product liability. Critically, Labs earns revenue from products and licensing, not from issuing tokens, which is the separation regulators look for when distinguishing a genuine operating business from a fundraising vehicle.

Hylon Foundation, the ownerless steward

The Hylon Foundation is a Cayman Islands foundation company: an ownerless, purpose-bound legal person with no shareholders and no members who can extract its assets. Its constitutional documents bind it to a fixed purpose, stewarding the Hylon protocol, the ORB token, and the network treasury for the benefit of the network and its participants, and that purpose cannot be redirected to enrich any individual. The Foundation stewards the protocol's on-chain parameters, holds and administers the DAO treasury under the DAO's direction as decentralization progresses, funds ecosystem grants, and serves as the legal wrapper that lets a decentralized collective interact with the off-chain world (sign an audit contract, hold a bank account, defend the trademark). The ownerless structure is deliberate: because no one owns the Foundation, the treasury it stewards cannot be treated as any founder's asset, and the pathway to DAO control is a genuine transfer of stewardship rather than a favor that can be revoked.

The BVI issuer

Token issuance and the associated distribution mechanics are handled through a British Virgin Islands issuer affiliated with the Foundation. Segregating the issuance function into a purpose-specific BVI entity isolates the securities-and-token-law surface, issuance, the published crypto-asset white paper, listing arrangements, and transfer restrictions, from both the operating company's commercial liability and the Foundation's stewardship role. This is standard, defensible structuring for a compliant token launch rather than an exotic arrangement.

The DAO, token-holder governance

The DAO is the collective of ORB holders exercising on-chain governance rights. It is not, at genesis, in control of everything; it is the body to which control progressively transfers. Over the decentralization timeline it assumes authority over reward-rate parameters, treasury allocation, protocol upgrades, and the grants program. The DAO expresses its will through on-chain proposals and votes executed by the Foundation and the protocol's governance contracts. It is the destination of the economic constitution, and, by explicit design, it is not the body that decides model releases or safety constraints.

9.2 What the DAO Governs, and the Progressive Decentralization Timeline

Decentralization at Hylon is progressive, milestone-gated, and one-directional. It is not a single "hand over the keys" event, and it is explicitly not tied to dates that can slip or be spun, it is tied to published, verifiable milestones that mirror the gate-based discipline used everywhere else in this document. Powers transfer to the DAO in an order chosen so that each transfer is safe: the network first decentralizes the parameters where token-holder incentives are well-aligned and the blast radius of a mistake is bounded, then progressively the parameters where more is at stake. The full transfer of economic control unfolds over roughly two to four years.

The order of transfer, and why

1. Reward rates first. The earliest power to transfer is control over reward-rate parameters, the emission schedule within its hard protocol caps, the split of rewards across device tiers and work types, and the multipliers that price verified compute and data contributions. This transfers first because token holders and contributors are the parties most directly affected and most competent to tune it, and because these parameters sit inside immutable guardrails (a maximum emission ceiling and the value-before-emissions revenue throttle) that bound any error.
2. Treasury allocation second. Next the DAO assumes authority over how the treasury is deployed: funding for compute procurement, ecosystem programs, liquidity, buyback-and-burn cadence funded from genuine service revenue, and operational reserves. This is sequenced after reward rates because it carries larger single-decision stakes and benefits from the DAO having first built a track record on lower-risk parameters.
3. Protocol upgrades third. The DAO then gains control over upgrades to the protocol's on-chain logic, the staking, verification-reward, voucher-claim, and governance contracts themselves. Because a bad upgrade can be catastrophic and irreversible, this transfers only after the DAO is mature, and it is gated by timelocks, mandatory audits, and (as detailed below) explicit carve-outs preventing governance from reaching into the safety-critical release machinery.
4. Grants and ecosystem direction fourth. Finally the DAO assumes full ownership of the grants program and ecosystem-development direction, funding third-party builders, integrations, research bounties, and market-specific initiatives, completing the transfer of the network's discretionary spending to its community.

9.3 What Stays With the Safety Council, Permanently and by Design

Two powers deliberately never transfer to a token vote: the decision to release a model, and the definition and enforcement of the network's safety constraints. These are held by a technical Safety Council. This is the single most important governance decision in the whole design, and it is a considered one, not an accident of centralization.

The rationale

A frontier-directed AI system cannot have its safety decided by a fluctuating, financially-incentivized, potentially-capturable vote. Token-holder governance optimizes, correctly, for the value of the network, but the marginal token holder's incentive to ship a more capable model faster is not the same as the public's interest in that model being safe, and the gap is exactly where catastrophe lives. On-chain governance is also attackable in ways that safety cannot tolerate: vote-buying, flash-loan-borrowed voting power, bribery markets, and low-turnout capture are documented, recurring failure modes. A model that has just cleared a red-team suite must not be releasable because a whale accumulated tokens over a weekend; a safety constraint must not be removable because a proposal passed at 3% quorum. The release gate and the safety constraints therefore sit with a body selected for technical and safety competence, operating under a fixed mandate, rather than with the token electorate.

What the Safety Council controls

• The final release gate. In the champion, challenger pipeline, a challenger is promoted to a new named version only if it beats the live champion by a defined margin on the fixed gate suite, general benchmarks, wedge-domain evals, blind personal-context A/B, and safety red-team, with statistical significance and zero safety regressions. The Safety Council holds the final human sign-off on that promotion. It can veto a release that clears the automated gates; it cannot be compelled by a vote to ship one that does not.
• The kill switch. The Council can halt a live model, trigger automatic rollback to the prior champion, or freeze the release pipeline in response to a discovered safety failure, at any time and without a governance vote.
• The Level-0 immutable foundations. Truth, safety, honesty, and integrity are hardcoded objectives that cannot be self-modified by the system and cannot be edited by governance. The Council is the human guarantor that the L0 < L1 < L2 < L3 objective hierarchy holds and that the gaming detector (L3 metrics improving while L1, L2 do not) is honored.

Transparency and accountability, the check on the Council

Narrow power without accountability is just a different centralization. The Safety Council's mandate is therefore bounded and made transparent to the DAO rather than opaque. Release decisions, the gate-suite results behind them, promotions, rollbacks, and kill-switch activations are recorded on-chain and reported to the DAO. The Council's remit is strictly the safety-and-release gate; it holds no authority over reward rates, treasury, or economics, which are the DAO's domain. The DAO retains legitimate oversight instruments, visibility into every gated decision, the ability to fund independent audits and external red-teams, and governance authority over Council composition rules and mandate at the constitutional level, while being structurally prevented from reaching in to force a specific unsafe release. In short: the DAO owns the economy and can hold the Council accountable; the Council owns the safety gate and cannot be overridden into shipping something unsafe. Neither can quietly become the other.

9.4 Voting, Treasury & Proposal Mechanics

Voting

Governance power derives from ORB, with mechanics chosen to resist the documented capture failure modes rather than to maximize nominal decentralization on paper.

Treasury management

The treasury is stewarded by the Foundation and directed, progressively, by the DAO. Its funding sources are genuine: the network's protocol allocation, and, importantly, buyback flows funded from real service revenue under the value-before-emissions discipline, never from inflation. Deployments follow the governed categories: compute procurement (including toward the DAO-owned GPU cluster that anchors decentralized training), ecosystem grants, liquidity and reserves, and revenue-funded buyback-and-burn. Movements above defined thresholds require a passed proposal, execute behind a timelock, and are recorded on-chain. The Foundation's purpose-bound, ownerless constitution is the backstop that prevents treasury capture: even a passed proposal cannot direct funds outside the Foundation's mandate or into self-dealing.

The proposal lifecycle

1. Temperature check. An idea is posted for open discussion in the governance forum; informal sentiment gauges whether it is worth formalizing.
2. Draft proposal. A formal Hylon Improvement Proposal is written to a standard template, motivation, specification, parameter changes, security and safety considerations, and (where relevant) confirmation that it does not intrude on the Safety Council carve-out.
3. Review & audit. Proposals touching protocol logic or significant treasury sums undergo technical review and, where required, independent audit before they can reach a vote.
4. On-chain vote. The proposal goes to a snapshot-based on-chain vote with the quorum and threshold appropriate to its impact class; only pre-snapshot locked ORB is eligible.
5. Timelock. A passed proposal enters a mandatory delay window, publicly visible, before execution.
6. Execution. The Foundation and governance contracts execute the approved action; the outcome is recorded on-chain.

Taken together, these mechanics implement a specific philosophy of decentralization: give the community genuine, irreversible ownership of the network's economy on a milestone schedule it can verify, while permanently ring-fencing the two decisions, releasing a powerful model and constraining its behavior, where majority-rules-by-token is not a safe way to decide. The economy belongs to the token holders; the safety gate belongs to a competent, transparent, accountable body; and neither is allowed to swallow the other.

Hylon is a network that pays real people real tokens for real work, learns from real user context, and operates in some of the most heavily regulated and heavily censored markets on earth. That combination is precisely what makes the opportunity defensible, and precisely what makes legal design a first-class engineering discipline rather than an afterthought. This section states, honestly and without hand-waving, the regulatory regimes that bind the network, the specific mechanisms by which Hylon complies, the precedents relied upon, and the residual risks that no amount of engineering fully eliminates. Where a favorable precedent exists it is cited as guidance, never as a guarantee; several of the most important reliefs below are fact-specific and non-binding, and Hylon's stated posture is to obtain its own counsel and its own relief rather than to assume that another party's exemption transfers.

10.1 Token: Securities & Crypto-Asset Regulation

ORB is a single, unified utility token: it is earned for verified compute and data work, spent to pay for AI and network services, and used to govern the protocol. It is not marketed as an investment, carries no promise of profit from the efforts of others as a term of issuance, and, critically, its rewards flow to infrastructure and data contributors as payment for measurable work, structurally separated from any capital-raising activity. This separation is the spine of the entire token-legal design.

European Union, MiCA

The Markets in Crypto-Assets Regulation is now the binding framework for any offer of a crypto-asset to EU persons. The transitional grandfathering window closed on 1 July 2026; there is no longer a runway for operating in the EU under national regimes. Hylon's obligations are concrete and non-optional:

• Compliant crypto-asset white paper. Because ORB is neither an asset-referenced token (ART) nor an e-money token (EMT), it falls under the MiCA regime for "other crypto-assets." Hylon publishes a Title II-compliant white paper, mandatory disclosures on the issuer, the token, the rights and obligations, the underlying technology, and the risks, notified to a national competent authority, with the statutory summary and the prescribed risk warnings.
• Authorized CASP venues only. ORB is listed and traded only on venues operating under a MiCA Crypto-Asset Service Provider authorization (or a valid transitional passport). Hylon does not seek or tolerate listing on unauthorized EU venues.
• The "offered for free" exemption does not apply. MiCA exempts crypto-assets "offered for free," but explicitly clarifies that an asset is not free where the recipient provides personal data, or performs services or work, in exchange. Hylon's rewards are consideration for verified compute and data work, they are earned, not gifted, so this exemption is unavailable and Hylon does not attempt to rely on it. This is a deliberately conservative reading; assuming the exemption applied would be the single most likely path to an enforcement action.

United States, securities analysis and the DoubleZero model

In the US the governing question is the Howey investment-contract analysis. Hylon structures ORB rewards to mirror the fact pattern the SEC's Division of Corporation Finance addressed in its DoubleZero no-action posture of 29 September 2025: rewards that are programmatic, usage-based, and paid to infrastructure contributors for network services, cleanly separated from any fundraising transaction. The load-bearing features Hylon replicates:

• Rewards are emitted programmatically by protocol rules for verified work performed, not distributed at the discretion of a promoter and not conditioned on a purchase.
• The reward stream is separated from the capital-raise. Investment (equity, SAFEs, or token sales to fund the operating company) is conducted through distinct, appropriately-exempt instruments and is not commingled with the earn-for-work mechanism that ordinary contributors experience.
• Marketing to contributors emphasizes work performed and services rendered, not price appreciation or passive yield.

Value-before-emissions as a legal as well as economic discipline

The economic commitment to reward only genuine verified work, and to fund buyback-and-burn from real service revenue rather than inflation (detailed in the token section), is also a legal risk control. A token whose value narrative rests on emissions and headcount growth looks like a security and behaves like a Ponzi; a token whose value tracks demonstrated demand for a working service looks like what it is, payment for network services. The compliance posture and the economic posture reinforce each other by design.

10.2 Privacy & Data Protection

Hylon processes data belonging to users in the EU, the UK, and other GDPR-aligned and GDPR-adjacent jurisdictions, including some of the most privacy-sensitive user populations imaginable, people using a censorship-circumvention product under hostile regimes. The privacy architecture is described technically in the Personal AI and data-flywheel sections; here we state the legal foundation. The headline is what Hylon will never claim.

Lawful basis: legitimate interests, documented

The lawful basis for processing the privacy-preserving learned signal that leaves a device is legitimate interests (GDPR Art. 6(1)(f)), supported by a documented three-part balancing test (purpose, necessity, and the balance against data-subject rights and expectations), with consent used where it is the appropriate basis for a given processing operation. This is backed by:

• A formal Data Protection Impact Assessment (DPIA) under Art. 35, given large-scale processing and the sensitivity of the user base, revisited as the model and data flows evolve.
• Data minimization by architecture: raw user data never leaves the device. Only a privacy-preserving learned signal is shared, via federated learning, differential privacy, and secure aggregation, so the operator never sees individual contributions in the clear.
• Documented defenses against membership-inference and model-inversion attacks, because privacy law increasingly asks not just what you collect but what can be reconstructed from what you derive.

Weights are not presumed anonymous, EDPB Opinion 28/2024

Hylon explicitly aligns to the EDPB Opinion 28/2024 on AI models and personal data. That opinion establishes that trained model weights are not presumed anonymous: whether a model embodies personal data is assessed case by case, considering the reasonable likelihood of extracting or attributing training data. Hylon therefore treats aggregated model artifacts as potentially containing personal data unless and until a defensible anonymization assessment says otherwise, the conservative reading, and deploys DP and secure aggregation specifically to move the artifacts toward, and document, that anonymization threshold rather than assuming it. This is engineering and lawful basis working together: the math (DP/FL/secure aggregation) is what makes the legitimate-interests balancing test come out in the data subject's favor.

10.3 KYC / AML / Sanctions Screening

Paying tokens to people in Iran, Russia, and other sanctioned or high-risk jurisdictions is the sharpest legal edge in the entire network. It is also non-negotiable to get right: a single unscreened payout to a sanctioned wallet is a strict-liability problem. Hylon's controls are layered so that the network can serve censored populations with the product while remaining compliant on payouts.

1. Non-custodial by default. Users hold their own keys. Hylon does not take custody of user funds, which materially narrows the money-transmission and custody footprint. Earned value accrues off-device as points/credit and is converted to on-chain ORB by the user through a separate wallet flow (see 10.4).
2. Wallet screening before every payout. Prior to any conversion or on-chain reward settlement, the destination wallet is screened against OFSI (UK) and OFAC (US) sanctions lists and against on-chain risk intelligence (tainted-address / mixer exposure). A hit blocks the payout; it does not silently proceed.
3. Geo-blocking of sanctioned jurisdictions for the payout/token layer. The token-earning and conversion surfaces are geo-fenced away from comprehensively sanctioned jurisdictions, even though the underlying VPN product continues to serve users there. The censorship-circumvention service and the token-reward service are deliberately decoupled at the compliance boundary.
4. Risk-tiered KYC. Identity verification is applied on a risk basis, escalating with cumulative payout value and risk signals, consistent with AML obligations and CASP onboarding requirements.

10.4 App-Store Compliance

Hylon's Personal AI ships inside mobile apps distributed through the Apple App Store and Google Play. Both stores have specific, actively-enforced rules about cryptocurrency, background compute, and in-app token utility. The single most important lesson from the DePIN sector is that the word "mining" is fatal, apps that describe on-device earning as mining are rejected or removed. Hylon's app-store design follows the Acurast precedent, which has been approved on both stores.

The compliant pattern

• Never "mining." The app never uses the word, and never frames device contribution as cryptocurrency mining. Contribution is presented as verified work that accrues points / off-device credit.
• Off-device accrual, separate conversion. Value accrues off-device; conversion to on-chain ORB happens on the web or in a separate, non-custodial wallet app, not as an in-app purchase or in-app crypto transaction. This is exactly the Acurast structure.
• Respect background-execution limits. On iOS, on-device work runs foreground-while-charging only, respecting the platform's background-execution model. On Android 15, work respects the 6-hour-per-24-hour foreground-service cap and the tightened FGS rules. Contribution is metered and verified, never rewarded for idle uptime, which also keeps it within these platform envelopes.
• No token-gating of app features (Apple Guideline 3.1.1). Core app functionality is never locked behind token ownership or on-chain purchase. Holding or spending ORB is not a precondition to using features that the store rules require be available through standard in-app mechanisms.
• Non-custodial. The app does not custody tokens; keys stay with the user, consistent with both stores' crypto-wallet policies.

10.5 Intellectual Property & Model Licensing

Hylon's sovereign stack is built from the strongest permissively-licensed open-weight foundation models, then advanced through continual training and reinforcement learning on Hylon's own data. Two IP disciplines govern this.

Open-weight license hygiene

Open-weight does not mean unrestricted. Each foundation model carries a specific license (Apache-2.0, MIT, Llama Community License, Gemma terms, Qwen license, and others), and these differ materially on commercial-use thresholds, acceptable-use policies, attribution and redistribution obligations, and downstream naming/marking requirements. Hylon maintains a per-model license register tracking, for every model in the stack: the exact license, commercial-use eligibility (including any monthly-active-user thresholds that trigger separate licensing, as in some large-vendor community licenses), attribution/marking obligations, and derivative-work and redistribution terms. No model enters the production stack without a cleared entry in this register.

Distillation from closed models: built, but gated off

Hylon's training infrastructure includes the capability to distill from closed, proprietary models, but this capability is gated OFF until a signed license exists for the specific source model. This is stated precisely because the alternative is a serious legal exposure:

• The terms of service of essentially every major closed-model provider prohibit using their outputs to train a competing model.
• Enforcement of these terms is active, not theoretical, providers have publicly acted on suspected distillation.
• Therefore Hylon does not treat closed-model distillation as an active data source, does not describe it as running, and does not build any process that would imply a ToS violation. The capability exists in the codebase as a switch that turns on only upon a signed commercial license with the provider, at which point it becomes a licensed data-partnership, not a breach.

10.6 Jurisdiction × Requirement Compliance Matrix

The following matrix consolidates the binding obligations by domain, the specific Hylon mechanism that satisfies each, and the precedent or authority relied upon. It is the single-page reference for the network's legal posture.

10.7 Residual Risks & Honest Limitations

No compliance program eliminates risk; a credible one names what remains. The material residual risks Hylon carries, stated plainly:

• Reliance on non-binding precedent. The DoubleZero posture and the Acurast approvals are favorable but not transferable. A regulator or a store could reach a different conclusion on Hylon's specific facts. Mitigation: own counsel, own relief where obtainable, conservative structuring that does not depend on any single precedent.
• Securities re-characterization. If a court or regulator later views ORB rewards as investment contracts despite the work-for-payment structure, remedies could include registration demands or penalties. Mitigation: strict separation of rewards from fundraising, value-before-emissions economics, work-based marketing.
• Privacy challenge to legitimate interests. A DPA could disagree with the balancing test or hold that aggregated artifacts still embody personal data (EDPB 28/2024 permits this). Mitigation: DPIA, strong DP/FL/secure-aggregation, documented anonymization assessment, and the ability to tighten the privacy budget.
• Sanctions strict liability. Screening and geo-fencing reduce but never fully eliminate the risk of an inadvertent prohibited payout. Mitigation: pre-payout screening on every transaction, non-custodial rails, geo-blocking of the token layer, and conservative onboarding.
• Platform policy change. Apple and Google can and do change crypto and background-execution rules. Mitigation: off-device accrual + separate conversion (the most durable pattern), metered/verified work within platform envelopes, and a distribution function that treats compliance as continuous.
• Fragmentation across markets. Serving censored markets means operating where local law may itself be hostile. Hylon's answer is to serve the product broadly while confining the regulated token and data surfaces to jurisdictions where they can be operated lawfully, accepting that this deliberately limits monetization in exactly the markets that most need the product.

11.1 The Gate Discipline: Claims Follow Evidence

Hylon's roadmap is organized around gates, not dates. A gate is a bundle of shipped deliverables and measured key performance indicators (KPIs) that must all be satisfied before the network makes the corresponding public claim. This is a deliberate inversion of the DePIN norm, in which networks announce a destination ("decentralized supercomputer," "the AI economy") and then spend years, and emissions, trying to grow into the slogan. Every superlative in this whitepaper is tied to a specific gate, and the network commits to stating each claim only after its gate is independently verifiable. Until Gate 1's evaluation suite is passed and published, Hylon does not claim wedge dominance; until Gate 3's compute-and-recipe threshold is crossed, Hylon does not claim general-frontier parity. The mission, to ultimately out-compete every centralized lab, is stated plainly as a destination, but the method is a sequence of gates each of which is falsifiable.

11.2 The Four Gates in Detail

The roadmap advances through four gates spanning roughly three years, with the fourth explicitly conditional. Each gate is defined by (a) concrete deliverables, (b) numeric KPIs that gate promotion, and (c) the specific public claim it unlocks.

Gate 0, Sovereign Stack Live (~6 months)

Gate 0 ships the entire Hylon system as one product on top of the live OrbNet/OrbVPN business: a compact on-device Personal AI, the two-tier compute fabric, the ORB token rails (staking, verified-work metering, signed-voucher claims, gasless relayer, OFSI/OFAC screening), and the DAO governance shell, all running on the strongest available permissively-licensed open-weight foundation model, self-hosted, private, and uncensored. Because OrbNet already has paying users in restricted markets, Gate 0 launches into a real user base rather than a waitlist.

Gate 1, Wedge Dominance (12 to 18 months)

Gate 1 turns the data flywheel. A continually-trained Hylon model, improved by RL on real (privacy-preserving) user tasks flowing from the Personal AI fleet, must beat every open-weight model on the wedge domains the centralized labs structurally under-serve, Farsi, Arabic, Russian, Turkish; censored-market retrieval; and fully-private personal-context tasks, and must win a blind A/B against frontier closed models on personal-context tasks, where Hylon's on-device memory is a decisive advantage the labs cannot replicate without the data.

Gate 2, Self-Improving & Self-Releasing (Year 2)

Gate 2 stands up the DAO-owned Tier-1 GPU cluster and closes the automated champion, challenger loop. The self-improvement engine surveys the literature, proposes recipes, runs cheap small-scale ablations, and promotes a challenger to a new named version only if it beats the live champion by a defined margin on the fixed gate suite (general benchmarks + wedge evals + blind personal-context A/B + safety red-team) with statistical significance and zero safety regressions. Rollout proceeds shadow → percentage → full with automatic rollback, is recorded on-chain, and the DAO is notified. A technical Safety Council holds the final release gate and the kill switch.

Gate 3+, General-Frontier Program (Year 3+, CONDITIONAL)

Gate 3 is the general-frontier push, and it is explicitly conditional: it commences only when treasury-funded aggregate compute (GPU count = capital) and a portfolio of self-improvement-validated recipes both cross a defined threshold. Hylon states no date and makes no frontier-parity claim until this gate is crossed. The honest framing is that out-computing the centralized labs is, past a point, a treasury question, per-node memory and aggregate FLOPs are the binding constraints, both solvable only with capital, so Gate 3 is gated on the treasury and the recipe library, never on a calendar.

11.3 Risks & Mitigations

A permanent reference document must be honest about how it can fail. The table below enumerates the principal risks across technical, market/demand, regulatory, adversarial/security, execution, and tokenomics dimensions, each with its concrete mitigation. The risk matrix that follows plots likelihood against impact so the reader can see where the residual exposure concentrates.

Notes on the highest-residual risks

Demand for verified compute/data is the risk that has killed the most DePINs, and Hylon's honest read of the sector is sobering: roughly $72M of total on-chain DePIN revenue in 2025 against a ~$10B aggregate market cap, and no decentralized network yet earning material revenue from consumer-phone FLOPs. Hylon's structural mitigation is that it does not depend on a speculative future compute marketplace to bootstrap, it sits on OrbNet's existing subscription revenue and an existing user base, funds buyback-and-burn from genuine service revenue rather than inflation, and ties reward decline to revenue milestones (not headcount), directly avoiding the Helium (900k hotspots vs ~$6.5k/mo real demand), io.net (327k registered vs 6.7k verified GPUs) and Pi (−91% via headcount-FOMO emissions) failure modes.

Regulatory risk is real and jurisdiction-specific. Hylon publishes a MiCA-compliant crypto-asset white paper and lists only on authorized CASP venues; mirrors the SEC DoubleZero no-action posture (programmatic, usage-based rewards to infrastructure contributors, separated from any fundraising) while seeking its own fact-specific relief; grounds privacy in a documented GDPR legitimate-interests basis + DPIA + FL/DP/secure-aggregation (acknowledging EDPB Opinion 28/2024 that weights are not presumed anonymous); and never uses the word "mining," never token-gates app features, and keeps wallets non-custodial with OFSI/OFAC screening before payout and geo-blocking of sanctioned jurisdictions, following the Acurast app-store precedent.

Privacy-attack risk, membership inference and model inversion against shared learned signal, is treated as an engineering problem with a maintained defense battery, not a solved one; the DPIA is a living document and the legitimate-interests basis is defended, never replaced by the false claim that GDPR does not apply or that a household exemption covers the network.

11.4 Competitive Landscape

Hylon competes at the intersection of several categories, and it is more honest, and more useful, to say precisely where each incumbent wins than to dismiss them. The comparison below maps the field. The recurring pattern: enterprise-GPU and rendering networks win on raw supply and utilization; data networks win on distribution to labs; phone and gaming-PC networks win on device count; decentralized-training collectives win on the training method itself. None of them combines data locality, a live revenue-generating user base in censored markets, and a sovereign self-improving stack, which is the wedge Hylon occupies.

Where the incumbents win, and where Hylon differs

• Bittensor wins on a mature incentivized-subnet ecosystem and a large market cap; it is a marketplace of competing miners, not a single sovereign model learning from a private user base. Hylon differs by owning one continually-improving model fed by uncollectable data.
• io.net, Akash, Aethir win on enterprise GPU aggregation and utilization, real, useful, and largely orthogonal to Hylon; io.net's own history (327k registered vs 6.7k verified GPUs) is precisely why Hylon meters and verifies every contribution rather than rewarding registration.
• Render wins on a proven fiat-priced, burn-and-mint economy for GPU rendering, a token design Hylon explicitly borrows from, but it is not an AI network.
• Grass (~$330M cap) wins on selling bandwidth and web data to AI labs; it is a data-distribution business, not a compute or model network. Hylon's data is different in kind: private, on-device, multilingual, censored-market signal that cannot be scraped.
• Acurast (~255k phones) is the smartphone-compute leader and the app-store compliance precedent Hylon follows, but its demand is unproven; Hylon starts with OrbNet's existing paying demand.
• Salad wins as the consumer gaming-PC leader (~60k daily GPUs, ~$10M ARR) with no token, proof that verified consumer compute can earn real revenue, and a model for demand-first discipline.
• Nous, Prime Intellect, Pluralis win on decentralized-training research, the methods (Psyche, DisTrO/DeMo, INTELLECT-1/2/3, TOPLOC) Hylon builds on. Notably these runs remain GPU-bound (Nous Psyche 40B on ~8×H100 nodes; Templar Covenant-72B on ~8×B200/peer; INTELLECT-3 used a central 512×H200 cluster), which is exactly why Hylon's training tier is GPUs and Gate 3 is a treasury question.
• Apple / Google on-device AI win on hardware integration and scale, but they cannot offer an uncensored, user-sovereign model in restricted markets, nor pool private cross-user signal into a competing global model, the structural opening Hylon exploits.

11.5 The Five Defensive Assets and the Flywheel

Hylon's defensibility rests on five assets that a better-funded centralized lab can attack individually but cannot assemble together, and a flywheel that couples them.

1. A live, revenue-generating product (OrbNet/OrbVPN). Real users, real subscriptions, real infrastructure in restricted markets, the credibility differentiator versus vaporware DePINs, and the funding source for value-before-emissions.
2. Data locality. One million Personal AIs generating RL signal from real tasks in languages and markets no lab can legally or physically scrape, the unbuyable moat. A lab can outspend Hylon; it cannot assemble this dataset.
3. The sovereign, self-improving stack. One self-contained AI (MoE core, router, retrieval/memory, tools, specialist heads, agent orchestration) with no hard external dependency, improving itself through the guarded champion, challenger loop.
4. Verified two-tier compute. A Tier-1 GPU training fabric coordinated over the internet by low-communication training, plus a Tier-2 fleet of a million devices for inference, personalization, RL scoring and labeling, every contribution metered and cryptographically or economically verified.
5. Aligned token economics + progressive DAO governance. One ORB token for verified work, service payment, and governance; buyback-and-burn from real revenue; and a Foundation/Labs/DAO structure that progressively transfers control on published milestones while keeping model releases and safety with the technical Safety Council.