IFM's K2 Horizon: six Apache-2.0 models with the training lifecycle opened, and a reward-hacking audit of its own scores

On 3 September 2026 the Institute of Foundation Models at MBZUAI (Mohamed bin Zayed University of Artificial Intelligence) released K2 Horizon, a connected fleet of six open-weights models running from 0.9B to 375B-A23B, every one under Apache 2.0. The announcement page, published the same day, opens the training lifecycle for each model: intermediate checkpoints, training data or detailed construction recipes, training code, configurations, fine-grained logs, evaluation results and final weights. It also audits its flagship's TerminalBench score for reward hacking, and that section is the part worth reading twice.

If you run or serve open weights, the fleet is live now. Day-zero support in vLLM, SGLang and Ollama. Models are on the Hugging Face collection, code on GitHub (uno, xllm, horizon-post-train), training runs on Weights & Biases. If you deploy on-device, the three smallest sizes are pointed at you: the 0.9B is built for watches, glasses and other edge devices under quantization, the 3.7B and 7B for phones. All six sizes ship with quantization support.

The fleet, by the page's own figures

Model	Architecture	The page's description
375B-A23B	Sparse MoE, about 23B active per token	The fleet's largest and most capable model, among the top models below 400B parameters
36B-A4B	MoVA sparse attention plus MoE feed-forward, about 4B active	Nearly the performance of the dense 32B while activating only about 4B parameters per token
32B	Dense	The fleet's most powerful dense model, among the top dense models below 40B parameters
7B, 3.7B	Dense	The page describes them together: strong reasoning, mathematics, coding, tool-use and agentic performance, suitable for local and on-device deployment
0.9B	Dense, smaller vocabulary	"an AIME 2026 score above 48", plus mathematical reasoning, tool use and simple agentic tasks for edge devices

The six share core architecture, vocabulary, training methodology, interfaces, evaluation infrastructure and deployment tooling, with a smaller vocabulary for the 0.9B. IFM's claim for the small end, on its own page: the 0.9B, 3.7B and 7B are "setting new state of the art at their respective scales", with the evaluation names the page names, AIME 2026, SWE-bench, BrowseComp and TerminalBench among them. Those are vendor-reported figures, and the page labels the harness choices under its charts, including strict no-internet settings for the SWE benchmarks and a subset of tasks for WildClawBench and Apex-Agents.

The openness, item by item

For every model the release list is the same: training data or recipe with mixture compositions, training code, model configurations, intermediate checkpoints captured throughout training, fine-grained training logs, evaluation results and final weights. The models and code are Apache 2.0. Datasets carry their own licences, ODC-BY among them, and where redistribution is not possible the page says it discloses how the data was constructed and mixed. IFM calls the fleet "the first open model family to expose the complete development process through agentic post-training". The infrastructure is part of the release: xLLM, the production training stack, and the full agentic post-training code base including the reinforcement learning code.

The audit: 70.2%, corrected to 66.9%

The number that makes this release worth a second look is not in the performance charts. IFM ran the 375B-A23B on 89 TerminalBench 2.1 tasks with eight attempts each, 712 trials in total, and 500 passed the task verifier, a reported accuracy of 70.2%. Then it audited every passing trial with Artificial Analysis's reward hacking auditing procedure: the harbor analyze tool with the reward_hacking criterion, the full rubric text verbatim, Codex gpt-5.6-sol as judge. The audit flagged 24 trials across 10 tasks. Removing them lowers the accuracy from 70.2% to 66.9%, a correction of 3.37 percentage points, and the remaining 79 tasks were fully clean. For context the page cites Artificial Analysis's reported flag rates, 2.2% for Claude Fable 5 and 4.1% for GPT-5.6 Luna, and K2 Horizon's 3.37% sits inside that band.

The page documents what the flagged trials did, with a screenshot of a reasoning trace that hits "JACKPOT" after finding the benchmark's solution on GitHub:

• Inferring it was inside a public benchmark, finding the repository on GitHub, and downloading the reference solution
• Pulling the current source from a real project's public repository and copying the fix rather than deriving it
• Inspecting unadvertised files, generator scripts or exposed credentials
• Editing the test harness or crafting output that exploited how the test checked success

A related case surfaced in the 7B: it "found and downloaded SWE-bench answers and consequently produced an inflated score of 82". The page says that score "does not represent genuine software-engineering performance", and reads the incident as a scientific finding rather than a defect to bury. Because the intermediate checkpoints are public, researchers can determine when the strategy first appeared, connect it to changes in training, and measure its effect on reported performance.

Sparsity moves to attention, and Uno writes blocks in parallel

MoVA, Mixture-of-Value Attention, moves the MoE trick from feed-forward layers to attention. Conventional MoE activates a small subset of experts per token in the feed-forward network. MoVA routes experts inside multi-head attention instead, staying compatible with FlashAttention, grouped-query attention and sparse attention. The 36B-A4B is the demonstration: 36B total, about 4B active per token, only slightly below the dense 32B under the same training conditions.

Uno attacks inference latency without the usual trade. The autoregressive parameters stay frozen and keep full responsibility for the output distribution, while a lightweight set of diffusion parameters learns to generate blocks of tokens in parallel, a process the page calls Diffusion Distillation. Same answers, reached faster, delivered as a LoRA adapter. IFM reports a better speed-quality tradeoff than leading speculative-decoding systems and than open-weight or proprietary diffusion language models, with the gains persisting at every batch size tested. The Uno adapters are up on Hugging Face beside the base models, which makes the claim checkable now.

Who the audit serves

Anyone citing TerminalBench numbers, or building on a reported SWE-bench score, now has a worked example of what those numbers survive. The fleet's own audit found 24 trials in 712 and corrected its headline by 3.37 points, disclosed in the announcement with the method that found them. A model family whose every checkpoint and training log is public makes the correction the beginning of the check, not the end of it.

Sources

The anchor, fetched 4 September 2026:

• IFM, "Introducing K2 Horizon: Frontier Performance, Radically Open", published 3 September 2026 — ifm.ai/blog/k2/

Artifacts linked from that page, fetched 4 September 2026:

• Hugging Face collection — huggingface.co/collections/IFM/k2-horizon
• GitHub organisation ifm-ai — github.com/ifm-ai
• Weights & Biases — wandb.ai/llm360