swarmint: Intelligence with No Center to Fail

Abstract #

Federated learning that averages neural-network weights is fragile — independently trained networks do not average well — and it almost always depends on a central coordinator. swarmint removes both. Each participant runs a tiny prototype micro-model (a bounded set of labeled exemplars with nearest-neighbor prediction) and shares knowledge by gossiping prototypes rather than gradients. Merging is order-invariant (set union + prune), so there is no averaging step to go wrong and no rounds to coordinate. Peers discover each other over a Kademlia DHT, exchange Ed25519-signed messages over UDP, and traverse NATs by hole-punching with a relay fallback. A layered Byzantine defense — merge-validation, multi-sender corroboration, and per-peer reputation — keeps the swarm converging while ~5% of nodes actively poison it.

We validate on synthetic mixtures (100 nodes, exact 0.959 vs. 0.20 solo), three real modalities, 16 real OS processes over real UDP/DHT, and — the headline evidence — on real hardware over the open internet: direct NAT hole-punches across corporate NAT, home Wi-Fi, Cloudflare WARP, and plain carrier CGNAT, plus a live public swarm anyone can join in one command and watch their accuracy climb from the solo ceiling to the task ceiling. We report negative results as first-class: adaptive radii and a learned shareable metric both fail to move a structural accuracy ceiling that is the price of Byzantine robustness under bounded memory.

1. Problem #

Three properties are usually in tension in collaborative learning: (1) no raw-data sharing (edge/private data can't be centralized); (2) no central coordinator (a single point of failure, trust bottleneck, and cost); (3) robustness to malicious participants. Weight-averaging federated learning struggles with all three at once — averaging the parameters of independently trained networks is unstable because loss landscapes are non-convex and permutation-symmetric, so two good models can average to a bad one; and the coordinator remains central. swarmint targets the intersection: share knowledge, not data; discover peers, not coordinate them; make poisoning fail by construction.

2. Design #

Prototype micro-models

A node's entire model is a bounded set of prototypes — labeled exemplars in a shared feature space — with nearest-neighbor prediction. Learning is online: observe (x, y), absorb it into a nearby same-label prototype or add a new one, pruning to a memory bound. No weights, no gradients.

Order-invariant merging

Two models merge by set union + prune. Because union is commutative and associative, merge order does not matter — the failure mode that makes weight-averaging fragile does not exist here. This is what lets gossip be asynchronous and coordinator-free.

Gossip federation

Each node sees only a non-IID slice of the classes, so no node can learn the full task alone. Nodes periodically gossip a random sample of prototypes; knowledge diffuses and every node approaches full-task accuracy while its raw data never leaves the device.

Byzantine defense (layered)

• Merge-validation — a prototype contradicting local structure (a different label too close to an established one) is rejected.
• Corroboration — a class a node can't verify itself is promoted only when ≥3 distinct senders corroborate it. Two senders is insufficient (a colluding pair could manufacture agreement); three is the smallest quorum resisting a single colluding pair.
• Reputation — each peer carries an EMA trust score; label-flip attackers lose trust and are down-weighted or ignored.

This holds while malicious supply stays below honest supply per class-region (~5% globally). It is deliberately not a global consensus ledger — per-node tamper-evidence only (a signed hash-chain of checkpoints), by design.

Shared genesis embedding

Prototypes are only comparable in the same feature space. A node that fits its own projection drifts into an incomparable space and merging silently breaks. swarmint fits a projection (Identity / random / PCA / LDA) once on a small public seed at genesis, freezes it to a plain (mean, W) linear operator, and distributes it as a protocol parameter — every node applies the identical frozen transform. On many-shot data this lifts accuracy toward the centralized ceiling while keeping the decentralized, poison-resistant properties.

The P2P stack

UDP transport with msgpack framing; Ed25519-signed messages (node_id = SHA1(pubkey)[:20]) with replay protection; Kademlia DHT rendezvous + peer-exchange for discovery; NAT hole-punching with a relay fallback and multi-relay failover. Transport and representation are strictly separated from the learning core.

Design invariants

• The learning node is synchronous and representation-agnostic; async, transport, and relay live below it; feature-space logic lives in the embedding layer.
• The learning core is frozen and byte-stable: the deterministic 100-node sim reproduces exactly 0.959. New behavior ships behind opt-in flags, defaults unchanged.
• Shared-space invariant: any embedding is identical across all nodes (fit once at genesis, frozen).
• No silent truncation — anything capped is logged.

3. Results #

3.1 Collective learning (synthetic)

100 nodes, 10 classes, 2 classes/node, 5% label-flip malicious, lossy network:

Malicious trust is suppressed below honest trust; the swarm converges and stays converged. This exact figure is the project's regression anchor.

3.2 Distributed inference (mixture-of-experts)

A node answers queries about classes it never learned by consulting the swarm, trust-weighting experts and letting them abstain off-manifold. With 30% confident liars:

3.3 Generality across modalities (real data)

Shared LDA genesis embedding per dataset; solo → swarm, 5% malicious, with the full-knowledge 1-NN ceiling for reference:

The lift is a gradient, not a uniform win: strong on image, modest on tabular, near-break on text — because a linear LDA genesis embedding can't separate sparse TF-IDF (its own 1-NN ceiling is only 0.55). A rounds sweep (100 vs. 250) does not help, confirming the ceiling is structural, not under-training. Byzantine gating held on every modality. Separately, Olivetti faces (40-class, few-shot) reach 0.51 vs. 0.05 solo — 10× solo on a brutal dataset.

3.4 Multimodal late fusion over the real network

swarmint goes multimodal with no encoder: each modality is handled by raw prototype experts in its own space (its own topic), and modalities are fused at the decision level by the same trust/confidence-weighted mixture-of-experts. In process this beats the best single modality (0.65 → 0.84); we now confirm it over the real stack — UDP + Kademlia DHT + topic-scoped inference — with 30 expert nodes across 3 modalities (10/topic, ≥3-sender coverage per class) and a query node fusing per-modality answers over real sockets, reproduced across independent runs:

Fusion beats the best single modality over real sockets on every run — independently-noisy views denoise when fused, with no encoder and no shared feature space across modalities. (One finding: topic routing needs an authoritative DHT advert lookup to populate a passively-learned peer's topic; PEX only spreads topic hints. A thin-margin under-provisioned swarm can occasionally show fusion not beating the best modality on a given real-timing run; 10 experts/modality with a larger held-out set removes that flakiness.)

3.5 Real networking (16 processes)

3.6 Real-hardware NAT traversal (the open internet)

A public beacon (hole-punch rendezvous + relay) runs on a free-tier GCP e2-micro at beacon.swarmint.org. Over genuine router NATs, direct hole-punches (relay unused, relay_fwd=0) succeeded on three independent network types:

No proxy is required on any path — something an emulated netfilter NAT (netns/Docker) never achieved even for raw UDP. We also corrected an earlier wrong "carrier blocks UDP" claim with an actual raw-UDP echo test: the real cause was a fragile one-shot DHT bootstrap on lossy cellular, fixed by seeding the rendezvous gossip address directly.

3.7 A live, joinable swarm — learning real digits

The concept becomes a living network that learns a real task. The public beacon hosts an always-on honest backbone (8 nodes covering all classes with ≥3-sender corroboration) that learns sklearn handwritten digits (bundled on every machine — no data transfer) under a shared LDA genesis embedding. Anyone runs one command and their node learns to classify digits it mostly never saw locally:

pip install "swarmint[net,learn]"
swarmint join            # → beacon.swarmint.org, learns real digits

Measured from a corporate-NAT PC (nat_detected=True) joining over the open internet (direct P2P, relay_fwd=0), held-out accuracy on the real digit test set climbed as the honest quorum corroborated each previously-unseen class, reaching the same ~0.92 ceiling the offline digits experiments hit:

Nothing but signed prototypes crosses the wire — no raw data, no gradients, no central model. A lone joiner reaching an empty network correctly stays at its solo ceiling: the ≥3-sender rule refuses to trust an unbacked source. The backbone exists precisely to supply that honest quorum.

4. Honest limits #

Negative results are reported as first-class.

• Structural accuracy ceiling. On digits the swarm reaches ~0.88 against a 1-NN ceiling of ~0.95. The gap is structural — the cost of Byzantine gating + bounded memory on overlapping classes. Two attempts to close it failed and are documented: adaptive per-class radii made accuracy worse and weakened the Byzantine margin (reverted); and a learned shareable metric — since a Mahalanobis metric is Euclidean distance after a linear map — dropped into the same frozen-genesis slot. NCA, which optimizes exactly the 1-NN objective the model uses, reached 0.870 even when initialized at LDA and optimized for 200 iterations — below LDA's 0.882; whitened Mahalanobis collapsed to 0.482. The metric is not the lever.
• Few-shot genesis. The shared LDA embedding needs ~40 samples/class of public seed. It fits many-shot data, not few-shot (faces, 10/class).
• Text near-break. Linear genesis embeddings can't separate sparse TF-IDF; a nonlinear-but-shareable genesis is open work.
• Scope. No global consensus ledger (per-node tamper-evidence only, by design); cross-modal semantic alignment is out of scope (late fusion only); Sybil resistance beyond ~5% needs more honest redundancy per class (more nodes), not a code change.

5. Reproduce #

git clone https://github.com/shaswata56/swarmint && cd swarmint
pip install -e ".[dev]"

python benchmark.py                    # headline claims as PASS/FAIL (exit 0 iff all pass)
swarmint sim                           # 100-node synthetic sim, exact 0.959
python -m swarmint.sim.run_generality  # image/tabular/text sweep (SWARMINT_SLOW_TESTS=1)
python -m swarmint.sim.run_multiproc   # 16 real processes over UDP + DHT
python run_tests.py                    # full test suite (no pytest needed)

swarmint join                          # join the LIVE public swarm

The beacon + backbone deploy to a free-tier GCP e2-micro in one command; see deploy/gcp-beacon/. CI runs the test matrix (Python 3.10–3.13) and the benchmark on every push.

6. Conclusion #

Order-invariant prototype merging removes weight-averaging fragility; gossip over a DHT removes the coordinator; a layered trust/corroboration defense removes the honest-participant assumption. The result is a learning system with no center to fail — validated not only in simulation but as a live network that tolerates real NATs, real packet loss, and real adversaries, and that anyone can join today. Its accuracy ceiling is the honest price of that robustness, and we report the attempts to lower it that did not work as plainly as the ones that did.