Albedo (SN97): The Bittensor Subnet That Gets Stronger Every Time Someone Tries to Game It

On Bittensor, miners are paid more the better their models score. That single fact means every miner has a financial reason to find the fastest path to a high score, and the fastest path is almost never building a genuinely better model. It’s finding a flaw in the evaluation.

Most subnets try to prevent that. Dendrite’s Albedo (Subnet 97) assumes it will happen regardless, builds an evaluation system that can’t be gamed, and gets stronger every time someone tries. Dendrite didn’t design the subnet to prevent gaming. They designed it to survive adversarial pressure, and in doing so, built a system where every exploit attempt, whether it succeeds or fails, makes the next version of the model harder to beat.

The mechanism behind that is worth understanding in full. Thanks to Vaqxai's X post, we will explain how the evaluation is structured to make gaming it nearly impossible, what four categories of exploit attempt Dendrite caught in the first weeks of operation, what each one exposed, and why every failed attempt left the system harder to game than it was before.

What “Gaming the Evaluation” Actually Means

To understand why Albedo works the way it does, you need a picture of what miners on a typical Bittensor subnet are doing when they try to game the scoring.

Imagine a subnet that rewards miners for producing good AI-generated text, scored by a validator that checks quality. A miner who wants to maximize earnings without building a genuinely capable model has a few options: they can overfit their model to the exact prompts the validator uses, reverse-engineer the scoring logic to produce outputs that look good on the rubric without being good in practice, or, in the most direct cases, inject text into their outputs that manipulates the scoring system itself. None of these makes the model better at the actual task. They make it score higher on the specific test being run.

The reason static benchmarks fail in adversarial environments is exactly this. Once the test is known, optimizing for the test and optimizing for the underlying skill become two different things. The more financial pressure behind the score, the faster that divergence happens.

How Albedo Closes That Gap

Albedo’s core design decision is that no miner should ever know exactly what they’re being tested on. When a challenger submits a trained model to compete against the reigning champion, the match draws 128 tasks at random from the SWE-ZERO-12M-trajectories dataset, a pool of over 12 million execution-free agentic coding trajectories covering 122,000 real pull requests across 3,000 repositories in 16 programming languages and totaling 112 billion tokens. The draw is random every match. There is no fixed test set to memorize, no repeated prompt distribution to overfit to, and no way to know in advance which 128 tasks out of 12 million your model will face.

That pool size is the first structural defense. A miner who tries to overfit to evaluation data is attempting to memorize a moving target drawn from a dataset larger than most pretraining corpora.

The second defense is the judge. An AI judge evaluates both models on each task, and it doesn’t only check whether the final output is correct. It scores the quality of the model’s reasoning process, how well the model followed the instructions, and how effective the overall approach was. A model that produces a plausible-looking answer through shallow pattern-matching scores differently from a model that arrives at the same answer through coherent multi-step reasoning. To beat the champion, a challenger has to be better in ways the judge measures across all of those dimensions simultaneously.

This is where the improvement mechanism lives. The only reliable path to displacing the champion is submitting a model with genuinely stronger agentic coding ability, because no other path consistently survives a random draw across 12 million tasks judged on reasoning quality rather than output surface alone.

What Every Miner Needs to Know Before Submitting

All submissions must match the architecture of the genesis model, Qwen3.6-35B-A3B, released by Alibaba’s Qwen team in April 2026. That model is a sparse mixture-of-experts design with 35 billion total parameters and only 3 billion active during each inference pass, which makes it fast enough to run competitively while still scoring 73.4% on SWE-Bench Verified. Contestants can train their version of that model however they choose, on any data, with any technique. They can’t change the model’s shape, because a fixed architecture is what makes head-to-head comparison meaningful.

A challenger only advances if the AI judge rates its performance above the current champion across the full 128-task match. The reigning champion holds its position until something genuinely better displaces it, and each time that happens, the new champion becomes the baseline every future challenger has to beat. The quality floor only moves in one direction.

Why Failed Exploits Made the System Stronger

Within the first weeks of Albedo’s operation, Dendrite logged four distinct categories of exploit attempt, and each one exposed a real gap in the defense architecture that then got closed.

Some miners injected phrases into their model outputs designed to steer the AI judge toward favorable scores, including language calibrated specifically to survive basic pattern-detection filters. That attempt revealed that a single-layer injection check was insufficient, which led to a separate evaluator model running an independent anti-injection meta-prompt as a second layer.

Some submitted near-identical copies of the prior champion model with minimal surface-level changes designed only to pass static similarity checks. That attempt prompted a more rigorous pre-evaluation step for formal static requirements. Others returned near-identical responses across different tasks, betting that repetition would match enough of the evaluation distribution to score well. That attempt reinforced the value of the random draw: no fixed response strategy survives 128 randomly selected tasks from a 12-million-trajectory pool.

One submission included a modified chat template that injected bogus metadata tokens to alter how the judge processed the model’s reasoning traces. That attempt is the clearest example of how adversarial pressure improves the system: before it happened, that attack surface wasn’t a known gap. After it happened and failed, it became a closed one. Dendrite now runs red-team testing before each deployment cycle to find the next version of that gap before a miner does. Miners who try to game the scoring aren’t just losing. They’re running a free stress test on the evaluation architecture every time they compete.

What Albedo Produces and Why It Matters

Each time a challenger beats the reigning champion, the winning model is open-sourced and committed to the public record. What that means in practice is that Albedo produces a continuously improving open-source agentic coding agent, one that can read a codebase, understand a software engineering problem, reason through a solution, and implement a fix across real-world repositories in multiple programming languages.

That’s a meaningful output. Agentic coding agents are among the most commercially valuable AI applications right now. The leading proprietary versions sit behind API paywalls at the major AI labs. Albedo’s champion model is available to anyone building on Bittensor. And because the competitive pressure to displace the champion never stops, the model available today is always stronger than the one available last month.

For context on where Albedo fits within Bittensor’s broader training ecosystem: Templar (SN3) runs decentralized pretraining on a shared model, with miners across the world contributing compute and gradient updates toward a common checkpoint. Albedo operates differently, with independent teams each training their own version of the model and submitting the result, and the network selecting the winner through direct head-to-head competition. The two subnets don’t overlap. They address different parts of how open-source AI models get built.

The Pressure Doesn’t Stop

Albedo is built on a premise that most system designers try to avoid: the miners using your evaluation will try to game it, so build it to get stronger when they do. The 12-million-trajectory pool means memorization doesn’t work. The multi-dimensional judge means surface-correct outputs don’t win. The red-team cycle means yesterday’s exploit closes tomorrow’s gap.

For you as a staker or miner, what that means in practice is that every week of competition produces a better open-source agentic coding model. Every failed exploit closes a gap in the defense, and every miner who reaches the top of the leaderboard has done it by building something that genuinely outcodes everything that came before it.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or trading advice. The information provided should not be interpreted as an endorsement of any digital asset, security, or investment strategy. Readers should conduct their own research and consult with a licensed financial professional before making any investment decisions. The publisher and its contributors are not responsible for any losses that may arise from reliance on the information presented.