The Expensive Part of Cheap Intelligence

The AI industry is trying to sell two seemingly incompatible futures. In one, a 304-billion-parameter model fits on a single accelerator, provided you are willing to regard 204.5 GB used out of 205.8 GB as a lifestyle choice. In the other, models can build interactive software, resolve famous mathematics problems, and apparently teach competitors their best moves through a sufficiently enthusiastic API client. The common constraint is not raw intelligence. It is operational trust.

A public deployment guide for DeepSeek-V4-Flash on one AMD MI300X is unusually candid about this. It does not present throughput as a magic property of weights; it presents it as the outcome of exact image digests, model-revision pins, ROCm overlays, FP8 semantics, MoE routing fixes, CPU-KV synchronization, tuned kernel shapes, and a machine with almost no HBM margin for amateur theatre. The claimed numbers are striking, but the more useful contribution is the admission that they are configuration-bound rather than portable vibes.

That distinction should govern the rest of the week’s news. A model generating a Three.js scene, an internal model producing a counterexample, and an API allegedly harvested at industrial scale are all demonstrations of capability. None, by itself, tells an engineering organization whether the result is correct, reproducible, secure, or even attributable. Intelligence is becoming cheaper to summon. Evidence remains stubbornly artisanal.

The single-MI300X recipe claims 168.6 median single-stream decode tokens per second, roughly 7.9–8.5K tuned prefill tokens per second, and 542.3 aggregate tokens per second across eight streams. But it also requires about 235 GiB of host RAM for CPU KV, about 500 GB of disk, a 20 GB FP8 GPU cache, and a 96 GiB CPU-offload tier. This is less a “one GPU” story than a reminder that infrastructure marketing has discovered the rhetorical utility of omitting the nouns around the GPU.

The interesting engineering detail is the MI300X’s fnuz E4M3 FP8 variant, which differs from newer AMD hardware’s OCP-standard FP8. Get those semantics wrong and, according to the repository, you can incur a factor-of-two scale-domain error. That is the sort of bug that survives the demo, attends the launch party, and waits until Monday to become a postmortem. The repository also reports non-upstream correctness patches, including a CPU-KV synchronization change whose cited upstream PR never merged. Reproducibility here is not bureaucracy; it is a map of the minefield with the coordinates left in.

There is a useful rebuke to benchmark culture in the README’s instruction: “Test correctness as well as throughput.” Its reported speculative-decoding acceptance is prompt-dependent; its validated context is 256K, not the architecture’s stated 1M; and its 64-stream burst used specific prompt and output-length conditions. Good. A performance claim that arrives with its boundary conditions is not weaker. It is finally becoming deployable.

Andrej Karpathy’s reported exercise—asking Claude Opus 5 to turn a paragraph of Tolkien into an interactive Three.js site under a one-million-token, roughly $10 budget—captures the new desired unit of evaluation: not a function, but an artifact. Can the system plan, write a great deal of code, allocate effort, and produce something a human can poke until it breaks? That is a better question than whether it completes a curated coding snippet, though the reporting provides neither the original prompt nor an independent scoring method for the resulting scene.

The catch is visual and product evaluation. A site can compile, respond to clicks, and still look like a municipal planning portal designed during a carbon-monoxide leak. Rendering, composition, interaction quality, and whether the thing feels coherent retain a human review burden. End-to-end tasks are more realistic precisely because they include the inconvenient parts that a unit test cannot smell.

Mathematics offers the cleaner but not frictionless version of the same problem. Quanta reports that OpenAI announced a counterexample to Erdős’ unit-distance conjecture in May, later substantially improved by human mathematicians, and that a reported AI resolution of another Erdős problem turned out to rediscover Erdős’ own 1977 work. Google DeepMind and OpenAI have reported further progress; meanwhile, the pipeline increasingly includes models proposing, other model instances checking, formal tools certifying coherence, and humans locating reviewers and old papers. The model may find the path. Someone still has to establish that it does not lead to a library shelf containing the same path, published half a century ago.

The industrial version of this verification problem is provenance. Forbes reports Anthropic’s allegation that Alibaba used 25,000 fraudulent accounts for 28.8 million exchanges with Claude between April and June, targeting agentic reasoning, software engineering, and long-horizon capabilities. Alibaba’s response is not included in the supplied reporting, and the token-volume calculations are the author’s estimates rather than Anthropic’s findings. But the allegation matters because it treats API access not merely as consumption but as an extraction surface at platform scale.

Distillation itself is not contraband; it is a standard way to transfer capability from a larger model to a smaller one under authorized conditions. The dispute is over permission, identity, volume, and intent—the same tedious nouns that separate a load test from an intrusion. Anthropic’s proposed remedies include threat-information sharing among US labs, chip-access restrictions, and penalties for labs responsible for distillation attacks. Whatever Congress does, the immediate engineering lesson is plainer: rate limits and account controls are now part of model IP protection, not merely API hygiene.

This is the unglamorous convergence. The MI300X operator needs pinned artifacts and correctness tests because an output token is not proof. The interactive-app evaluator needs humans because a running web page is not judgment. The mathematics community needs literature review and formal checking because a plausible derivation is not a theorem. And a frontier lab needs abuse detection because a customer session is not necessarily a customer. The industry has spent years treating the model as the product. The durable product is the system that can explain where its answers came from, how they were tested, and who was allowed to learn from them.