Hugging Face, End to End

Since January the clinic had been running one script. It took an audio file from a hearing, pushed it through a large open speech model, and wrote a transcript into the matter’s folder. Fourteen hundred hours of audio had gone through it by August. The script was ninety lines long and nobody had touched it since the week it was written.

Nobody in the clinic thought of it as software. It was the thing that turned nine hours of a bad recording made on a phone at the back of a courtroom into text a lawyer could read on a train. The volunteers called it the transcriber, and the only thing anybody ever changed about it was the folder it wrote to.

In August a paralegal called Sushma noticed that a respondent’s surname appeared as Waghmare in one transcript and Vaghmare in another, in the same matter, from two hearings six weeks apart. She assumed a typing error until she found three more, all in files produced after June.

Anup, the volunteer who had written the script, opened the model’s Files and versions tab and then its History. There were two commits since January. One in April replaced the tokenizer files. One in June reuploaded a corrected checkpoint, with a message saying it fixed a bug affecting proper nouns.

The script said from_pretrained("openai/whisper-large-v3"). No revision. So it had never meant one model. It had meant whatever was on the main branch at the moment each transcript was made, and the archive was not one archive but three, with nothing in any filename to say which.

The decision

The clinic quotes these transcripts in written submissions. Two options were on the table and both cost something real.

Re-transcribe everything. The donated allocation was twenty hours a week on a college lab machine. Fourteen hundred hours of audio at roughly real time is about three weeks of that allocation, during which no new intake could be transcribed. Intake does not pause. Three weeks meant roughly ninety new matters waiting on a transcript before anybody could read them.

Or pin from today, accept an archive produced by three different models, and carry the risk. That risk is not a daily cost. It is a credibility cost that arrives once, unpredictably, in front of a bench, when opposing counsel asks why two documents from the same clinic spell the same person’s name differently.

Anup made one more check before anybody chose. The June commit message said the fix concerned proper nouns. That narrowed the problem from everywhere to one place, and one place happened to be what a legal transcript is mostly about. He also asked a question nobody had asked yet: how much of the archive belongs to matters still before a court. The answer was a hundred and ninety hours. The rest was closed, or kept for research.

The cost on one side was ninety delayed matters. The cost on the other was a document nobody could vouch for. The information that made the choice tractable was already sitting in the repository, free, in a commit message and a list of dates.

The clinic also had to decide what it was willing to say out loud. A transcript in a submission is offered as a record of what was said. Saying that some of the clinic’s transcripts were produced by a model that has since been corrected is an uncomfortable sentence, and it is a sentence somebody would eventually have to say either way: the only question was whether the clinic said it first, in a note it had written calmly, or second, in an answer to a question from a bench.

Anup pointed out one more thing that made the pinning decision easy even if the re-running decision was not. Pinning costs nothing. It is one extra argument in three function calls, it can be done in ten minutes, and it does not compete with anything for the donated GPU hours. Whatever they chose about the existing fourteen hundred hours, there was no version of the argument in which they should keep loading an unpinned model tomorrow.

The forms came back from two hundred and twelve schools, most of them handwritten and then typed up by clerks. About two thirds were in Marathi and the rest in English or a mixture. The review meeting that would allocate a maintenance budget wanted a picture of what parents were complaining about, and nobody had ever put numbers on the forms before.

The clerks had done their part properly. Every form had a school code, a date and a line of free text that ran anywhere from four words to nine hundred. What nobody had was a way of saying how many of those lines were about a leaking roof and how many were about a teacher who does not come.

Rohit, on a three-month placement, had the pipeline working in an afternoon. Six lines, a well-known model name he had seen in a tutorial, and a loop over a spreadsheet. The output looked entirely believable: sixty-one per cent of forms in one category, the rest spread across three others, with confidence scores mostly above 0.95.

The labels came back as LABEL_0 and LABEL_1. He mapped LABEL_1 to positive because one usually means yes, and moved on.

The decision

Shalini Pawar, the deputy director, had a pack due in four days and this was the only quantitative thing in it. The alternative to using it was two days of people reading forms by hand, and there were no two days.

She took sixty forms home instead and labelled them herself over one evening. The model agreed with her on thirty-three. That is a coin flip with a very good opinion of itself.

Rohit went back to the output of his first run and found the warning he had scrolled past. It said that two tensors, the classifier weight and the classifier bias, had not been found in the checkpoint and had been newly initialised, and that he should probably train the model before using it for predictions. He had loaded a base checkpoint with no classification head. The library had filled the head with random numbers, warned in a log line, and then run perfectly.

Two more things surfaced the same evening. The model was English-only, and two thirds of the forms were in Marathi. And on that model’s vocabulary a Marathi sentence cost three to four times as many tokens as its English equivalent, so the five-hundred-and-twelve-token truncation was cutting long complaints in half, and a complaint puts its polite introduction first and its accusation last.

So the choice in front of Shalini was not whether to trust a slightly noisy number. It was whether to present a fabricated distribution to a meeting that allocates money, or to arrive with less than she had promised.

Shalini’s evening of sixty forms is worth dwelling on, because it is the cheapest thing in this case study and it is the only reason anything was caught. She did not audit the code, read the model card, or ask anybody technical. She took the output and the input and compared them by hand, on a sample small enough to finish, and the answer was unambiguous within an hour.

Rohit’s instinct afterwards was to blame the model, which is the tenth item on the checklist rather than the first. The model was fine. It was a perfectly good base checkpoint, downloaded four million times, doing exactly what a base checkpoint does. What had gone wrong was a mismatch between the class he asked for and the weights that existed, and a warning that described the mismatch in plain English in the terminal, above the first result.

The doubt register was a paper book on the lab desk. A student wrote a question, a teacher answered it the next morning, and by then the student had moved on. Meena Joshi, who ran the centre, wanted something that answered at the moment the doubt existed.

The eleven machines were bought in 2019 for a computer-literacy course that no longer ran. Eight gigabytes each, integrated graphics, and a network that reached a printer. They were the centre’s only fixed asset that was not a whiteboard, and they sat idle from four in the afternoon.

One constraint was settled before any arithmetic. After a previous incident with a homework app, parents had objected to student work leaving the building. A hosted interface was therefore not a cheaper option to be weighed. Uploading is a disclosure, and the disclosure was the thing being refused.

That left two shapes. Buy one machine with a sixteen-gigabyte graphics card, roughly what the centre spends on electricity in two months, and put a good model on it. Or run a small model on each of the eleven machines already in the lab.

Arvind, who taught physics, did not argue about it. He took thirty real doubts out of the register, covering definitions, unit conversions, two-step numericals and three questions where the right answer is that the question is missing information. Then he measured three configurations on all four numbers.

On the proposed new machine, a seven-billion-parameter instruct model at a four-bit quantization: peak memory 5.9 gigabytes, first token in 0.8 seconds, thirty-one tokens a second, and twenty-seven of thirty doubts answered acceptably by two teachers marking without knowing which machine produced what.

On a lab machine, a three-billion-parameter model at the same quantization: peak 2.4 gigabytes, first token in 2.6 seconds, nine tokens a second, twenty-two of thirty.

On a lab machine, the seven-billion model: peak 4.6 gigabytes, first token in eleven seconds, 2.4 tokens a second, twenty-six of thirty, and the machine could do nothing else while it ran.

The decision

The quality column said buy the machine. The third configuration said quality was not the whole story, because it answered nearly as well and was unusable.

And the number that decided it was not in the table at all. At nine at night there are not eleven students in the lab. There are sixty. One good machine is one queue, and a queue at nine is a student who has gone to bed. Eleven adequate machines answer everybody at once, worse.

The cost on that side was real: a model that gets twenty-two of thirty is wrong eight times, in front of children preparing for an examination, and wrong confidently.

There was a third option that never reached the table, and it is worth naming because most centres take it. Buy nothing, put a chat model’s website on the lab machines and tell the students not to type anything personal. It is free, it is better than everything measured here, and it fails the one constraint that was not negotiable. Meena’s position was that a rule students are asked to keep, about information they do not think of as personal, is not a control.

What made the measurement possible at all was that the thirty doubts already existed. Nobody had to invent test cases or imagine what a student might ask. They were in a paper register on the lab desk, written by the people the system was for, in the words those people use, including the three that were missing information, which turned out to be the ones that separated the configurations most sharply, because a small model at four bits will confidently answer a question that cannot be answered.

The Space took a person’s complaint, typed in Hindi, and produced a formatted application naming the right public authority and the right section. Farhan, a volunteer, had written it in about a hundred and fifty lines. It had run for four months on free hardware at roughly ten visitors a day and had never once misbehaved.

The tool existed because filing a Right to Information application is not hard and is easy to get wrong. Name the wrong public authority and the application is transferred, or lost, and thirty days become ninety. The Space did one useful thing: it read a complaint in ordinary words and produced a correctly addressed application with the right section quoted.

Then a radio programme mentioned it, and traffic went to four hundred a day.

On the third day an email arrived from a user in Gumla. He had clicked the draft button and received an application about somebody else’s ration card, with a name and a village in it.

The cause was one line near the top of the file. A list, declared at module level, holding the conversation so far. A Space is one process serving everybody, so a module-level variable is shared by every visitor on the internet. At ten visitors a day, spread across a working day, two people were almost never in the handler at the same time. At four hundred a day they were.

The decision

It was nine in the evening. Farhan was confident the fix took twenty minutes: move the per-person state into a session object and leave only the model shared.

Anjali Toppo, who ran the NGO, asked two questions before agreeing to patch and stay up. How many people had seen somebody else’s text? And would they know if they had?

Nobody could answer either. The Space kept no logs and no analytics, because the readme said nothing you type is stored and that had been a deliberate choice.

That absence was the finding, and it cut both ways. It made the incident impossible to investigate. It was also the reason the exposure stopped at whoever happened to be on screen at that moment, rather than sitting in a file on a container that anybody who could reach the machine could read.

The second decision was harder than the first. Saying nothing meant the radio push kept working. Saying something meant announcing, in the same week the NGO was asking people to trust it with a grievance about their own ration card, that one person’s grievance had been shown to a stranger.

Anjali’s decision about disclosure turned on what the NGO was asking people for. It asks people to write down a grievance about their own household: a pension that has not arrived, a ration card that was cancelled, a road that was paid for and not built. The whole product is a request to trust it with something that is nobody else’s business. An organisation making that request cannot decide, privately, that one breach of it was small enough not to mention.

There was also a version of the fix that Farhan wanted and did not do. He could have kept the Space up and pushed the patch straight to the running container, which would have taken the same twenty minutes and lost no traffic. Anjali refused it on the grounds that a patch applied to a live service, at nine at night, by a tired volunteer, with no way to tell afterwards whether it had worked, is how a small incident becomes a larger one. Taking it down made the test possible: two browsers, two sessions, and a check that they stayed apart before anybody else could reach it.

The advisory’s classifier identified five cotton pests from a photograph a farmer sent from a phone. It reported ninety-four per cent accuracy on a held-out test split, and the press note said so.

The advisory itself was a genuinely good idea and popular. A farmer photographed a leaf, sent it, and got back a named pest and a recommendation within a few minutes, in Marathi, at no cost. Eleven thousand farmers had used it in the second season.

Over the following month the department’s own agronomists checked the advisory’s answers against what they found in the field. They recorded sixty-one per cent.

Nothing was wrong with the model. The split was the problem, and it had been made the way almost everybody makes one: randomly, over photographs.

A farmer reporting a problem does not send one photograph. He sends six: the same plant, the same field, the same light, minutes apart. A random split scattered those six across train and test. For a large share of the test set the model had already seen the neighbouring photograph of the same leaf, and what the ninety-four per cent measured was its ability to recognise a photograph it had effectively already been trained on.

An hour of checks that should have run before the training found two more things. Four thousand one hundred exact duplicates, nearly all of them one automated thumbnail resent by the intake system when a message failed. And a class balance nobody had written down: one pest was fifty-eight per cent of the rows, because collection had started in its season, while the rarest was three per cent, and the rare one was the one that costs a farmer the crop.

The decision

Arun Deshmukh, who led the team, had a number in a press note and a minister’s office that liked the number.

Re-splitting by contributor and retraining meant about two weeks, and it meant publishing a lower figure after a higher one, which in a government department is a specific and well-understood kind of cost. Somebody would have to explain, in writing, why the first number had been wrong.

Doing nothing meant the advisory carried on telling farmers something that was right three times in five, in a season, about a pest that eats cotton.

There was also a third thing on the table that nobody had asked for. The rare class at three per cent meant that whatever the headline accuracy said, the advisory’s performance on its most expensive case had never been measured separately at all.

Arun made one decision before any of the others that made the rest possible. He asked the agronomists to keep recording field agreement, weekly, whatever the model said. It cost each of them about twenty minutes a week and it is the only reason anybody knew there was a problem at all. A held-out test split can be wrong in a way that no amount of staring at it reveals; a measurement taken outside the pipeline cannot be fooled by anything inside it.

The duplicate check is worth its own sentence. Four thousand one hundred copies of one automated thumbnail is two things at once: a training set that over-weights a picture of nothing, and a test set that repeatedly asks the same non-question. It took one query to find and one line to remove, and it had been sitting in the data for two seasons while three people argued about model architectures.

Nilesh, the service manager, wanted an engineer standing next to a broken machine to find the right procedure on a phone. A consultant had quoted for a hosted vector database with an annual licence at about a quarter of the department’s software budget.

The manuals were PDFs, some of them scanned from the 1990s and some produced last year, covering fourteen machine families. The service team’s working method was a WhatsApp group and a man called Ramesh who had been there twenty-two years and knew where everything was. Ramesh was retiring in eighteen months, which is what started the project.

Priyanka, a trainee on a six-month placement, built the cheap version first, because it was two days rather than a procurement cycle. She split the manuals into chunks on their headings, embedded them with a ninety-megabyte model, saved the vectors to a file, and searched them with one matrix multiply. Thirty-one thousand chunks, a few milliseconds a query, no server.

On questions phrased in words it worked well. How do I reset the servo after a power cut returned the right page.

On the queries the service team actually types, it failed. TX-4410 seal kit. Error E-207. The 2019 machine at Kulkarni’s. An embedding model places a part number roughly nowhere in particular, because the number carries no meaning it was trained to place, and the vector for TX-4410 is not close to the page that contains TX-4410.

The decision

Nilesh had a quote in front of him and a trainee asking for two more days.

The quoted product genuinely offered things the file did not: metadata filtering, incremental updates, several services sharing one index, and somebody to telephone when it broke. None of those was the problem the service team had. But a trainee on a placement is a support contract with an end date, and Nilesh had been burned before by a system whose author left.

What settled it was thirty questions. Priyanka took them out of the search log, kept the phrasing exactly as engineers had typed it, and recorded for each one the page that should come back. Four configurations, one afternoon.

Embeddings alone: the right page in the top five for fifty-three per cent of questions. Keyword ranking alone: sixty-one per cent, strong on codes and weak on paraphrases. Both, with their ranked lists merged: eighty-four per cent. Both plus a small cross-encoder rescoring the top fifty results: eighty-eight per cent, and the proportion where the right page was first went from forty-one per cent to sixty-six.

Two extra dependencies, both free, both installed with one command. About a hundred and thirty milliseconds a query, of which the rescoring step was a hundred.

The thirty questions took Priyanka a morning and taught her something the measurements did not. Nearly half the queries in the log contained an identifier of some kind: a part number, an error code, a machine serial, or a customer’s surname standing in for a machine. That distribution is a fact about the service desk rather than about retrieval, and it explains why the keyword method on its own beat the embeddings on its own, which is the reverse of what every tutorial had led her to expect.

She also checked one thing that is easy to skip. She printed the lengths of the vectors after encoding, to confirm they were all 1.0 and that the search was therefore comparing angles rather than being biased toward long documents. They were not normalised in her first version. Fixing that one argument moved recall by three points before any of the other work, and it is the kind of defect that otherwise shows up only as a system that is slightly worse than expected and is never diagnosed.

Harsha, the founder, wanted a fine-tune. The base model answered in Kannada, but in a register that read like a textbook, and it did not know the chain’s warranty rules, which are rewritten twice a year.

The chain runs forty-one service centres across two states. A customer writes in Kannada, usually from a phone, usually annoyed, and usually about a machine that is under warranty or has just fallen out of it. The assistant was meant to draft the first reply, which an agent would then send or rewrite.

Divya, the engineer, asked the question the module opens with: is the gap knowledge or behaviour. The honest answer was both, and the two halves needed opposite treatments.

The warranty rules are facts. Facts trained into weights come back fluent, confident and subtly wrong, because the model learns the shape of a policy document rather than its contents, and they change in April and October. That half became retrieval: sixty pages of policy, chunked on headings, a small multilingual embedding model, and thirty questions taken from the call log.

The register is behaviour: how a service agent speaks to a customer whose washing machine has been broken for four days. No prompt got it reliably, and few-shot examples got it for two turns and then drifted. That half was a fine-tune.

The decision

The decision with a cost on both sides was about the training data, and it was not a technical one.

Forty thousand historical chat transcripts existed. They were free, they were already labelled by who wrote what, and they were full of exactly the register they wanted. They were also full of customer names, addresses, telephone numbers, and, in a few hundred cases, card details pasted by customers who had been told not to paste card details.

The alternative was six hundred examples written by hand with two of the chain’s best agents, which meant eight working days of two people who were needed on the service floor, in a month the chain was short-staffed.

Harsha wanted the forty thousand. Divya ran the check rather than the argument: an automatic redaction pass over a sample of five hundred transcripts, then reading them. The pass caught the telephone numbers and the obvious identifiers. It missed a full address written across three lines of chat, and it missed the sentence where a customer named their employer, which in a small town names the person.

Automatic redaction misses context. Reading five hundred rows is what told them so.

Before any of this Divya spent a morning on the cheaper options, in order, because the module says to. A larger model with a better prompt closed perhaps half the register gap and none of the warranty gap. Five worked examples in the prompt closed most of the register gap for the first two turns of a conversation and then drifted, which is a known shape and not a fixable one. Only after both of those had been tried and written down did fine-tuning become the answer rather than the instinct.

The six hundred examples cost more than the model did, and that is the ordinary case rather than a surprise. Three hours of a free GPU session against nine days of two experienced agents is not a close comparison. It is also why the data went into a repository and the adapter did not particularly matter: when the base model is superseded in a few months, the adapter expires and the six hundred conversations do not. Retraining against a new base is then an afternoon rather than another nine days on the service floor.

The model at the centre of the product was a fine-tune published by an individual. Four hundred thousand downloads, a readable card, a demo Space that worked on a phone, and a licence tag reading apache-2.0. The studio had built on it for four months.

The tool itself was small and good. A seller photographs a kurta on a bedsheet in a room with one window, and gets back a clean cut-out on a white background with the light corrected. Two hundred rupees a month, aimed at people selling forty items rather than four thousand.

The check happened by accident. A prospective customer’s procurement form asked for a statement of every third-party component and its licence, with a signature underneath.

Ritu, the partner filling it in, opened the model page and followed the front matter. The fine-tune named a parent. The parent named another parent. The third repository, with no parent of its own, was under a non-commercial research licence.

The apache-2.0 tag at the top of that chain was either a careless tick or a sincere belief that an adapter is a separate artefact. It made no difference which. A fine-tune inherits its base model’s terms whatever its own card says, and the studio was three weeks from charging money for a derivative of a model that may not earn money.

The decision

Swapping meant a permissively licensed alternative. Two existed. On the studio’s thirty test photographs (textiles, brass and steel, shot on phones in the back rooms of Gujarati sellers, which is the case no public benchmark contains) the better of the two scored four points worse, and the loss was concentrated in the hard cases: fine fabric edges, and hair on a model’s forearm.

Launching anyway meant shipping. Nobody would notice on day one. The uploader probably did not know either. The risk is not a letter in the first week; it is a customer’s own procurement form asking the same question in a year, when the tool sits inside forty shops’ workflows and the answer has to be no.

They did write to the uploader to ask. Eight days, no reply, which is what an unpaid maintainer of a popular repository usually has time for.

So the choice was four quality points and eight days of schedule, against a dependency they could not answer a question about, in a product other people were about to put in their shop window.

The studio had done a version of this check at the start, which is why the mistake is worth studying rather than dismissing. Four months earlier somebody had opened the model page, seen apache-2.0 in the sidebar, and written it in a notebook. That is the check most people perform and it is the wrong one, because the tag describes an intention and the chain describes an entitlement. Nothing about the page announces that the badge at the top is only the first link.

Ritu also asked what the honest fallback would have been if no permissive alternative had existed at any quality. The answer they arrived at was to charge for the part they had made rather than the part they had borrowed (the pre-processing, the batching, the seller-facing workflow) and to let the customer bring their own model or run the non-commercial one themselves for their own use. It was not needed. Writing it down took ten minutes and it turned an argument about whether to ship into an argument about which of two lawful products to ship, which is a much easier argument to have three weeks before a launch.