With the amount of new subnets being added it can be hard to get up to date information across all subnets, so data may be slightly out of date from time to time
With the amount of new subnets being added it can be hard to get up to date information across all subnets, so data may be slightly out of date from time to time
Core Problem: Perturb addresses the fundamental vulnerability of modern AI models to imperceptible input changes. As the TAO Daily notes, state-of-the-art classifiers can flip their prediction (e.g. from “panda” to “gibbon”) after a tiny perturbation a human cannot notice. Perturb treats this as an urgent attack surface. It is designed as a decentralized, always-on Red Team for AI: a competitive network that tirelessly looks for weaknesses in models.
Miner/Validator Loop: Perturb operates in a challenge-response loop typical of Bittensor subnets. In each round a validator builds a challenge by selecting a random image and its true label. The validator runs the image through a reference classifier (EfficientNet-B5) and a lightweight LLM (Qwen2.5-Instruct) to ensure the label is correct. This verified image, along with attack constraints (perturbation bounds), is packaged into a JSON task and sent to all miners. Each miner receives the same task simultaneously.
Miners’ Role: Miners then apply adversarial perturbations to the image to fool the fixed classifier. Their goal is to cause any misclassification while keeping changes as small (and computation as fast) as possible. For example, miners might use a PGD-style attack. The miner submits back only the perturbed image (encoded) to the validators. Since the attack method is proprietary, stronger miners gradually replace the demo attacker with optimized strategies.
Validators’ Role and Scoring: Validators then verify each submitted image. They check that the perturbation is within allowed bounds and that the LLM confirms a semantic mismatch between original and new label. If valid, each attack is scored (typically 70% weight on perturbation norm and 30% on response speed). Top-scoring attacks (the smallest effective perturbations) earn the largest TAO rewards, driving miners to improve.
Outputs (Product): The subnet produces two commercially valuable outputs. First is an Adversarial Training Dataset: a growing corpus of original images paired with their perturbed adversarial examples. This dataset (with LLM-verified labels) can be sold on subscription to AI teams for adversarial training. Second is an on-chain Model Robustness Certificate: a cryptographic proof (including sample attacks and scores) that a given model has been adversarially tested. These certificates can be used by companies for compliance (e.g. under AI Act) or procurement. In effect, Perturb generates valuable data (attack examples) and audit reports for users or investors, beyond just mining rewards.
Comparison to Other Subnets: Perturb’s focus on security is unique within Bittensor. No other subnet is dedicated solely to breaking and testing AI models. Most subnets train or apply AI (text, image generation, etc.); Perturb intentionally generates adversarial attacks. The whitepaper emphasizes that “Perturb is the first” decentralized, continuously-improving adversarial testing network on-chain. Unlike generative subnets, its outputs are datasets and certificates rather than model outputs, setting it apart in purpose and function.
Core Problem: Perturb addresses the fundamental vulnerability of modern AI models to imperceptible input changes. As the TAO Daily notes, state-of-the-art classifiers can flip their prediction (e.g. from “panda” to “gibbon”) after a tiny perturbation a human cannot notice. Perturb treats this as an urgent attack surface. It is designed as a decentralized, always-on Red Team for AI: a competitive network that tirelessly looks for weaknesses in models.
Miner/Validator Loop: Perturb operates in a challenge-response loop typical of Bittensor subnets. In each round a validator builds a challenge by selecting a random image and its true label. The validator runs the image through a reference classifier (EfficientNet-B5) and a lightweight LLM (Qwen2.5-Instruct) to ensure the label is correct. This verified image, along with attack constraints (perturbation bounds), is packaged into a JSON task and sent to all miners. Each miner receives the same task simultaneously.
Miners’ Role: Miners then apply adversarial perturbations to the image to fool the fixed classifier. Their goal is to cause any misclassification while keeping changes as small (and computation as fast) as possible. For example, miners might use a PGD-style attack. The miner submits back only the perturbed image (encoded) to the validators. Since the attack method is proprietary, stronger miners gradually replace the demo attacker with optimized strategies.
Validators’ Role and Scoring: Validators then verify each submitted image. They check that the perturbation is within allowed bounds and that the LLM confirms a semantic mismatch between original and new label. If valid, each attack is scored (typically 70% weight on perturbation norm and 30% on response speed). Top-scoring attacks (the smallest effective perturbations) earn the largest TAO rewards, driving miners to improve.
Outputs (Product): The subnet produces two commercially valuable outputs. First is an Adversarial Training Dataset: a growing corpus of original images paired with their perturbed adversarial examples. This dataset (with LLM-verified labels) can be sold on subscription to AI teams for adversarial training. Second is an on-chain Model Robustness Certificate: a cryptographic proof (including sample attacks and scores) that a given model has been adversarially tested. These certificates can be used by companies for compliance (e.g. under AI Act) or procurement. In effect, Perturb generates valuable data (attack examples) and audit reports for users or investors, beyond just mining rewards.
Comparison to Other Subnets: Perturb’s focus on security is unique within Bittensor. No other subnet is dedicated solely to breaking and testing AI models. Most subnets train or apply AI (text, image generation, etc.); Perturb intentionally generates adversarial attacks. The whitepaper emphasizes that “Perturb is the first” decentralized, continuously-improving adversarial testing network on-chain. Unlike generative subnets, its outputs are datasets and certificates rather than model outputs, setting it apart in purpose and function.
Current Status vs Development: Perturb went live on Bittensor’s mainnet in May 2026, complete with a published whitepaper and an open GitHub repository. The initial launch included a working validator/miner implementation to support the challenge loop. The team is now quickly iterating the system. For example, they have announced a public “Playground” demo (currently in invite-only testing) where users upload an image and watch a live perturbation flip the model’s prediction. Upcoming features include a full user dashboard and integrations (like Weights & Biases for tracking), expected in the next updates. Core parameters (such as per-task timeouts and reward distribution) are being tuned to improve performance and miner participation.
Technical Architecture: The subnet’s software is mainly Python-based, leveraging the Bittensor SDK. The whitepaper describes the core validator logic: a build_challenge script fetches a random image from an image API, runs it through EfficientNet-B5 and an LLM (Qwen2.5) for label verification, then outputs a JSON payload containing the image and perturbation constraints. Miners use a default attack client (provided) or their own code: they receive the JSON, perform an adversarial attack within the given L∞ bound, and return only the modified image. Validators then perform LLM semantic checks and compute scores as described (70% on attack strength, 30% on speed). The GitHub repo contains these components (challenge builder, baseline miner, scoring logic) along with setup scripts (setup_common.sh, run_miner.sh) to launch nodes.
GitHub Repository: The codebase was only recently published, so activity is light. ICM Analytics reports 0 forks or stars and only 3 contributors on the repo (as of Apr 2026). The repository holds a reference miner implementation (intentionally simple) and the validator code, but most development appears paused pending launch. Community posts indicate the presence of setup scripts and sample code to start mining immediately. In short, the GitHub contains the working parts of the subnet but lacks maturity (no releases or large ecosystem yet).
Metrics and Emissions: At launch, Perturb’s token price has been around $1–$3 per alpha (about 0.009–0.01 τ), with market cap in the low millions. On-chain emission rates for TAO to this subnet haven’t been formally disclosed (Kinitro was initially set at 0.35%, but Perturb has not published a new schedule). We infer standard Bittensor mechanics: each epoch a fixed amount of TAO is rewarded to miners pro rata to their scores. Early on only a few miners are active, so emitted TAO is not flooding the market, but stakers can observe metrics like alpha supply and locked amounts via block explorers. Trading volume (tens of thousands of dollars daily) suggests growing attention, but ultimate valuation will hinge on real-world adoption of Perturb’s outputs.
Integrations and External Services: Perturb connects to several key APIs and platforms. As noted, validators fetch images from an external API (e.g. Pexels/Unsplash) by label and use a local LLM (Ollama’s Qwen2.5) for semantic verification. It also leverages Bittensor’s on-chain logic to record results. The team has announced integration with Weights & Biases (for experiment tracking) in an upcoming release. Other subnets in the ecosystem are beginning to integrate Perturb’s output: OU’s Koyuki subnet, for instance, will retrain its models on Perturb’s collected adversarial examples. So far no specific third-party blockchains or external oracles are mentioned; Perturb is largely self-contained except for these ML service dependencies.
End Users and Customers: In the short term, the “users” of Perturb are its miners, validators, and stakers on Bittensor – essentially AI developers earning TAO rewards. Beyond that, the target customers are AI developers and enterprises. Any company deploying vision models could subscribe to Perturb’s continuously generated adversarial dataset or request robustness certificates to demonstrate compliance or security. Academic and research groups can also use the service for benchmark evaluations. In the near term, other Bittensor subnets (and their stakers) benefit indirectly by improving the robustness of AI shared in the network. Eventually, the vision is that Perturb’s product suite (datasets + certificates) will be monetized to AI labs and regulated industries as a standalone cybersecurity service in the AI space.
Current Status vs Development: Perturb went live on Bittensor’s mainnet in May 2026, complete with a published whitepaper and an open GitHub repository. The initial launch included a working validator/miner implementation to support the challenge loop. The team is now quickly iterating the system. For example, they have announced a public “Playground” demo (currently in invite-only testing) where users upload an image and watch a live perturbation flip the model’s prediction. Upcoming features include a full user dashboard and integrations (like Weights & Biases for tracking), expected in the next updates. Core parameters (such as per-task timeouts and reward distribution) are being tuned to improve performance and miner participation.
Technical Architecture: The subnet’s software is mainly Python-based, leveraging the Bittensor SDK. The whitepaper describes the core validator logic: a build_challenge script fetches a random image from an image API, runs it through EfficientNet-B5 and an LLM (Qwen2.5) for label verification, then outputs a JSON payload containing the image and perturbation constraints. Miners use a default attack client (provided) or their own code: they receive the JSON, perform an adversarial attack within the given L∞ bound, and return only the modified image. Validators then perform LLM semantic checks and compute scores as described (70% on attack strength, 30% on speed). The GitHub repo contains these components (challenge builder, baseline miner, scoring logic) along with setup scripts (setup_common.sh, run_miner.sh) to launch nodes.
GitHub Repository: The codebase was only recently published, so activity is light. ICM Analytics reports 0 forks or stars and only 3 contributors on the repo (as of Apr 2026). The repository holds a reference miner implementation (intentionally simple) and the validator code, but most development appears paused pending launch. Community posts indicate the presence of setup scripts and sample code to start mining immediately. In short, the GitHub contains the working parts of the subnet but lacks maturity (no releases or large ecosystem yet).
Metrics and Emissions: At launch, Perturb’s token price has been around $1–$3 per alpha (about 0.009–0.01 τ), with market cap in the low millions. On-chain emission rates for TAO to this subnet haven’t been formally disclosed (Kinitro was initially set at 0.35%, but Perturb has not published a new schedule). We infer standard Bittensor mechanics: each epoch a fixed amount of TAO is rewarded to miners pro rata to their scores. Early on only a few miners are active, so emitted TAO is not flooding the market, but stakers can observe metrics like alpha supply and locked amounts via block explorers. Trading volume (tens of thousands of dollars daily) suggests growing attention, but ultimate valuation will hinge on real-world adoption of Perturb’s outputs.
Integrations and External Services: Perturb connects to several key APIs and platforms. As noted, validators fetch images from an external API (e.g. Pexels/Unsplash) by label and use a local LLM (Ollama’s Qwen2.5) for semantic verification. It also leverages Bittensor’s on-chain logic to record results. The team has announced integration with Weights & Biases (for experiment tracking) in an upcoming release. Other subnets in the ecosystem are beginning to integrate Perturb’s output: OU’s Koyuki subnet, for instance, will retrain its models on Perturb’s collected adversarial examples. So far no specific third-party blockchains or external oracles are mentioned; Perturb is largely self-contained except for these ML service dependencies.
End Users and Customers: In the short term, the “users” of Perturb are its miners, validators, and stakers on Bittensor – essentially AI developers earning TAO rewards. Beyond that, the target customers are AI developers and enterprises. Any company deploying vision models could subscribe to Perturb’s continuously generated adversarial dataset or request robustness certificates to demonstrate compliance or security. Academic and research groups can also use the service for benchmark evaluations. In the near term, other Bittensor subnets (and their stakers) benefit indirectly by improving the robustness of AI shared in the network. Eventually, the vision is that Perturb’s product suite (datasets + certificates) will be monetized to AI labs and regulated industries as a standalone cybersecurity service in the AI space.
Leadership and Contributors: According to their whitepaper and site, Perturb is led by a small founding team. The public website names **Koyuki Nakamori** (Co-Founder & CEO), **Jeffrey Lamb** (Co-Founder & CTO), and **Vadym Shakuro** (Co-Founder & AI Advisor). These appear to be specialized blockchain/AI engineers; beyond these titles the team has not provided detailed bios. Development activity confirms only a few people on the repo (ICM Analytics notes 3 total contributors). The team’s mission is described in general terms, but specific backgrounds (education, prior experience) are not publicly documented.
Perturb is formally affiliated with the ThreeTau organization. In fact, a Bittensor profile for SN26 (when it was Kinitro) explicitly calls it “a @threetau project” that joined the network in August 2025..) Thus the Perturb team is essentially a ThreeTau-led project. They have not announced any corporate investors; communication has been via the main Bittensor channels. For example, the Kinitro Twitter account (now likely @perturbaix) had ~900 followers as of 2025, and the team posts updates on Discord. No Telegram or separate community forum is mentioned. In summary, Perturb’s team consists of a few known founders (linked to ThreeTau) with AI/blockchain expertise, working largely transparently but without revealing personal histories or external backers.
Partnerships and Community: Although the team itself is small, they’ve announced some early collaborators. In addition to cross-subnet plans (Koyuki integration) they are already engaging academia: a joint research project with MIT was mentioned as forthcoming. Community response has been positive; coverage on TAO Daily and social media has drawn attention. So far, though, the project remains largely bootstrapped within the Bittensor ecosystem.
Leadership and Contributors: According to their whitepaper and site, Perturb is led by a small founding team. The public website names **Koyuki Nakamori** (Co-Founder & CEO), **Jeffrey Lamb** (Co-Founder & CTO), and **Vadym Shakuro** (Co-Founder & AI Advisor). These appear to be specialized blockchain/AI engineers; beyond these titles the team has not provided detailed bios. Development activity confirms only a few people on the repo (ICM Analytics notes 3 total contributors). The team’s mission is described in general terms, but specific backgrounds (education, prior experience) are not publicly documented.
Perturb is formally affiliated with the ThreeTau organization. In fact, a Bittensor profile for SN26 (when it was Kinitro) explicitly calls it “a @threetau project” that joined the network in August 2025..) Thus the Perturb team is essentially a ThreeTau-led project. They have not announced any corporate investors; communication has been via the main Bittensor channels. For example, the Kinitro Twitter account (now likely @perturbaix) had ~900 followers as of 2025, and the team posts updates on Discord. No Telegram or separate community forum is mentioned. In summary, Perturb’s team consists of a few known founders (linked to ThreeTau) with AI/blockchain expertise, working largely transparently but without revealing personal histories or external backers.
Partnerships and Community: Although the team itself is small, they’ve announced some early collaborators. In addition to cross-subnet plans (Koyuki integration) they are already engaging academia: a joint research project with MIT was mentioned as forthcoming. Community response has been positive; coverage on TAO Daily and social media has drawn attention. So far, though, the project remains largely bootstrapped within the Bittensor ecosystem.
Phase 1 (Q2 2026 – Launch and Initial Updates): Perturb’s mainnet launch was announced in early May 2026. This phase focused on stabilizing the core system. Immediately after launch the team rolled out updates to improve scoring and validation, and began integrating larger vision models (e.g. beyond the initial EfficientNet B5) into the pipeline. They also discussed technical refinements like reducing per-task timeouts (toward 5–10s) and enabling Apple Silicon miners. The immediate goal in this phase has been to prove the system works at scale with its baseline model and to fix any launch issues (for example, a validator IP mismatch report was addressed). No new token emission schedule has been announced beyond continuing the existing plan.
Phase 2 (Mid–Late 2026 – Tooling and Partnerships): In this stage, Perturb is rolling out its first user-facing tools. The interactive *Playground* demo site (where users can upload images to see perturbations in real time) is launching to the public (currently via waitlist). A comprehensive dashboard and logging interface (with Weights & Biases integration) are slated for release soon. Concurrently, the team is solidifying external collaborations: for example, they plan to share perturbation datasets with other subnets (like Koyuki) for model retraining. They have announced that enterprise partnerships and research projects (including a joint MIT project) are in the pipeline. Milestones for this phase include opening the demo site, releasing the dashboard, and finalizing early data-sharing deals.
Phase 3 (Late 2026 and Beyond – Commercial Scale): The long-term roadmap envisions commercial and global scale. Past 2026, the goal is to onboard enterprise customers for ongoing model testing. This involves expanding capabilities (supporting larger or multi-modal models, automating report generation, etc.). The team’s vision (from the whitepaper) is that “any company training or deploying an AI model can plug into Perturb to get a continuous, decentralized…red team”. Achieving this will require finalizing subscription services for datasets and certificates, and ensuring the network can handle heavy usage. No firm dates are set beyond 2026, but stated targets include dashboard release and broader adoption. In summary, the announced milestones (mainnet, dashboard, partnerships) lead into a fully realized network whose success will be measured by adoption and revenue from its adversarial AI services.
Phase 1 (Q2 2026 – Launch and Initial Updates): Perturb’s mainnet launch was announced in early May 2026. This phase focused on stabilizing the core system. Immediately after launch the team rolled out updates to improve scoring and validation, and began integrating larger vision models (e.g. beyond the initial EfficientNet B5) into the pipeline. They also discussed technical refinements like reducing per-task timeouts (toward 5–10s) and enabling Apple Silicon miners. The immediate goal in this phase has been to prove the system works at scale with its baseline model and to fix any launch issues (for example, a validator IP mismatch report was addressed). No new token emission schedule has been announced beyond continuing the existing plan.
Phase 2 (Mid–Late 2026 – Tooling and Partnerships): In this stage, Perturb is rolling out its first user-facing tools. The interactive *Playground* demo site (where users can upload images to see perturbations in real time) is launching to the public (currently via waitlist). A comprehensive dashboard and logging interface (with Weights & Biases integration) are slated for release soon. Concurrently, the team is solidifying external collaborations: for example, they plan to share perturbation datasets with other subnets (like Koyuki) for model retraining. They have announced that enterprise partnerships and research projects (including a joint MIT project) are in the pipeline. Milestones for this phase include opening the demo site, releasing the dashboard, and finalizing early data-sharing deals.
Phase 3 (Late 2026 and Beyond – Commercial Scale): The long-term roadmap envisions commercial and global scale. Past 2026, the goal is to onboard enterprise customers for ongoing model testing. This involves expanding capabilities (supporting larger or multi-modal models, automating report generation, etc.). The team’s vision (from the whitepaper) is that “any company training or deploying an AI model can plug into Perturb to get a continuous, decentralized…red team”. Achieving this will require finalizing subscription services for datasets and certificates, and ensuring the network can handle heavy usage. No firm dates are set beyond 2026, but stated targets include dashboard release and broader adoption. In summary, the announced milestones (mainnet, dashboard, partnerships) lead into a fully realized network whose success will be measured by adoption and revenue from its adversarial AI services.