Space flips bits Flipless flips them back

AI is moving into orbit on ordinary GPUs. Up there, radiation flips bits in memory and in the middle of calculations, and one flipped bit can change what a model says. Flipless checks every matrix multiply and norm layer while the model runs, catches the flip and repairs it before the answer goes out. It’s software, built to run on the commercial GPUs now being launched.

See the evidence How it works

Simulation of 12 GPU satellites in low orbit. Click the orbit to fire a particle.

Fleet logFlips 5Caught 4Wrong answers 0

268 of 268
bit flips that changed a model’s answer were stopped: 0
right answers turned wrong by Flipless, in 2,100 trials: 15.2 million
checks run, with no false alarms: 98.6%
lower bound on the share of answer-changing flips stopped, at 95% confidence

Single-bit flips injected in software into Qwen2.5-0.5B-Instruct on an RTX 4060 Laptop GPU, 7 and 8 October 2026, sign and exponent bits only. Every run is on the Evidence page.

One bit is enough

Most numbers inside a model are stored in 16 bits. In fp16, a common format, that’s one bit for the sign, five for the exponent and ten for the digits. The exponent bits set the scale, so they’re the dangerous ones. Flip the top one and 0.0123 becomes 806. The next layer takes 806 at face value, and the error spreads through everything after it.

Click any bit to flip it.

In our runs, 112 of 900 exponent flips in a layer’s output changed the model’s answer. None of 194 sign flips did. NVIDIA and UBC researchers found the same pattern in 2017: in neural networks, it’s the high exponent bits that do the damage.²¹

Compute is leaving the planet

AI runs on electricity, and data centres are on course to use around 945 TWh a year by 2030, more than double 2024.⁴⁹ In the right orbit a solar panel collects up to eight times more energy a year than one on the ground, and the sunlight barely stops.^{4, 5} So the biggest names in AI are building for space.

Nov 2025
Starcloud-1 launches with an NVIDIA H100, which NVIDIA said would bring “100x more powerful GPU compute than any previous space-based operation”. In orbit it later trains a small model on Shakespeare and runs Google’s Gemma.^{35, 36}
Nov 2025
Google announces Project Suncatcher: solar-powered satellites carrying its TPUs.⁴
Jan 2026
Axiom Space launches its first two orbital data centre nodes.⁴⁶
Feb 2026
SpaceX merges with xAI. Elon Musk: “within two to three years, the lowest cost way to generate AI compute will be in space.”⁴²
Mar 2026
NVIDIA launches space computing at GTC, with a Space-1 Vera Rubin Module to follow. Jensen Huang: “Space computing, the final frontier, has arrived.”³⁹
May 2026
SpaceX’s S-1 filing says it expects to start deploying orbital AI compute satellites “as early as 2028”.⁴¹
Aug 2026
SpaceX and NVIDIA design the Starmind AI1 payload around Rubin GPUs. Starcloud is valued at $2.3 billion, with NVIDIA among its new investors.^{43, 44, 38}
1 Oct 2026
Google’s first Suncatcher prototype reaches orbit and starts operating.⁴⁵

Starcloud and Google are already flying chips built for data centres on the ground, an H100 and Google’s TPUs, and SpaceX plans to fly Rubin GPUs.

It already happens on the ground

Silent data corruption isn’t only a space problem. In every large fleet, a small share of chips compute wrong answers without raising an error, through manufacturing defects, wear or stray neutrons. Fleet scanners test machines between jobs. Flipless checks the real workload while it runs.

1 in 1,000server devices in Meta’s fleet silently corrupt data.¹¹
Every week or twois how often Google expected silent corruption to hit Gemini’s training.¹⁵
15 of 18silent corruption incidents in 35 million GPU-hours of LLM training caused no visible failure.¹⁶
Over 60%of defective GPUs in another 2026 study were missed by synthetic tests.¹⁷

How Flipless works

Check every multiply
Each matrix multiply carries a checksum built from its weights when the model loads. If a block of outputs doesn’t add up to what the inputs predict, a flag goes up.
Double-check the rest
Norm layers run twice and must match bit for bit. The KV cache keeps a spare copy and is compared with it before every read.
Roll back and replay
Flags stay on the GPU, so the model never pauses. Once per token Flipless reads them, and if one is up it rolls the token back and runs it again.
Repair
During the replay, corrupted weights come back from a clean copy, and in version 0.4 corrupted cache rows come back from their spare. Then the token goes out.

Read the maths and try the checksum yourself

Who it’s for

NVIDIA

Its GPUs are the ones going up. A reliability layer in software makes every one of them easier to sell for orbit.

SpaceX and xAI

Orbital AI compute as early as 2028, at Starlink scale, where bit flips stop being rare events and become a rate.

Google

Its own beam test saw silent data corruption in a TPU, with no error flag raised.

Starcloud and the start-ups

They fly commercial GPUs and need reliability they can buy rather than build.

AI labs and clouds

Meta finds about one server device in a thousand corrupting results quietly. Flipless checks the real workload while it runs.

Space agencies

Perseverance’s hardened RAD750 runs at up to 200 MHz. Flipless lets missions use modern GPUs with checks they can audit.

Why each of them needs it

One line to harden a model

Flipless wraps a Hugging Face model in place. There’s no retraining and no change to the weights, and when nothing goes wrong the answers are identical, token for token.

python

from flipless import Runtime, calibrate, harden

model = harden(model, Runtime(mode="deferred"))
calibrate(model, lambda: [model.generate(**b, max_new_tokens=32)
                         for b in calibration_batches])

out = model.generate(**inputs)   # every layer checked
print(model.flipless.stats)      # checks, replays, repairs

What happens next

DoneVersions 0 to 0.3: checksums, replay and norm checks, tested in 1,800 trials.
DoneVersion 0.4: batched checks, CUDA graphs and a guarded KV cache, at 21% overhead.
15 OctoberAn RTX PRO 6000 Blackwell with 96 GB arrives, for 7B-class models.
ThenFused kernels, attention coverage, and a radiation beam test.

The full roadmap

How Flipless works

A transformer is mostly matrix multiplies joined by a few small operations. Flipless gives each part the cheapest check that’s exact enough for it, keeps the GPU busy while the checks run, and only stops to repair when something is actually wrong.

What’s checked

One layer of Qwen2.5-0.5B, top to bottom. The model stacks 24 of them, then a final norm and the output head. Hover or tap a part to see how it’s protected.

NormComputed twice
Query, key and value projectionsChecksum
KV cacheSpare copy
Attention scores, softmax, weighted sumInf and NaN only
Output projectionChecksum
Residual addInf and NaN only
NormComputed twice
Gate and up projectionsChecksum
SiLU and multiplyInf and NaN only
Down projectionChecksum
Residual addInf and NaN only

All 169 linear weight matricesGolden copy and row sums

Checked and repaired
Only Inf and NaN caught, through replay

What a flipped bit does to a number

Models run in 16-bit floating point. In fp16 a number has a sign bit s, five exponent bits e and ten fraction bits f:²⁸

Flipping exponent bit k (counting from 0 at the lowest) adds or subtracts 2^k from e, so it multiplies or divides the whole value by a power of two:

Here is every bit of 0.0123 flipped in turn. The top exponent bit multiplies it by 65,536. One flip makes it tiny instead, because the exponent drops to zero.

Bit	Field	0.0123 becomes	Change

bfloat16 keeps eight exponent bits, so its top flip multiplies by 2¹²⁸: the same 0.0123 becomes 4.2 × 10³⁶.

A checksum on every matrix multiply

For each token, a linear layer computes y = Wx + b. Huang and Abraham’s 1984 insight is that sums pass straight through a matrix multiply.²⁴ Split the outputs into blocks B of a few hundred. The sum of a block’s outputs is then fixed by the input alone:

c_B is the sum of the block’s weight rows, a single vector. Flipless works it out once, when the model loads. At run time it compares the actual sum with that prediction:

With no fault, r_B is only rounding noise. If a bit flips in any output of the block, r_B jumps by the size of the error.

How big can honest rounding get?

In floating point, a dot product of length n can be off by at most²⁵

where u is the unit roundoff of the arithmetic. A GPU matrix multiply adds up its products in fp32, where u = 2⁻²⁴, and rounds each output to fp16 once, which moves it by at most 2⁻¹¹ of its size. Put those together over a block, counting the check’s own fp32 sums too, and to first order the worst honest error, in the units of the threshold below, is

That’s 1.2 for most of Qwen2.5-0.5B’s layers and 2.2 for the down projection, where n = 4,864. In practice the roundings point in different directions and mostly cancel, so the error grows like √n·u rather than n·u.²⁶ Flipless doesn’t use the worst case. It sets each block’s threshold from the inputs it actually sees, with a scale κ measured per layer on clean prompts and multiplied by eight for safety:

On Qwen2.5-0.5B the calibrated κ is 0.11 for a typical layer and 1.62 at most, with the eight-times margin included. So a typical threshold is about ten times tighter than the worst case. That works because real rounding noise is far smaller still: in the NumPy twin of the check, the largest clean error came to 0.005 in these units. The thresholds raised no false alarms in 15.2 million checks.

Why a big error can’t hide

Suppose one output picks up an error e. The residual is that error plus the usual noise η, and calibration keeps η under the threshold. So:

Any single error bigger than twice the threshold fails the check. We tested exactly that on a layer shaped like Qwen’s MLP, with 960 single-bit flips in emulated fp16: every flip that moved a value by more than 2τ was caught, no flip ever failed a block other than its own, and every flip that slipped through moved its value by at most 1.5τ.

Finding the exact value

A second checksum weights each output by its position i in the block. One error e at position p moves the plain residual by e and the weighted residual by p·e, so their ratio points at the culprit:

The prototype measures this during fault-injection runs. In the 1,500-trial run it pinpointed the flipped value in 725 of the 927 caught flips in layer outputs. In normal running Flipless simply replays the token, which fixes the error wherever it is, so finding the exact spot is a bonus, not a requirement.

Try the checksum

A tiny layer with six inputs and eight outputs in two blocks of four, computed in fp16 in your browser with the same maths as above. Flip a bit and watch the check find it. The real runtime replays the whole token; the demo recomputes just the located output so the maths is easy to follow.

Checking without stopping the GPU

A GPU runs fastest when the CPU never waits for it. If every check had to report back before the next layer could start, the model would stall at every checked layer, 218 times per token on Qwen2.5-0.5B. Version 0 worked that way for its 169 linear layers and ran about four times slower than the unprotected model.

So Flipless defers. Each check writes pass or fail into a flag that stays on the GPU. At the end of the token Flipless reads the flags once; in version 0.4’s CUDA-graph decoder that’s the same read that brings back the token. If any flag is up, Flipless rolls the KV cache back one token, replays it with checks that repair as they go, and carries on. Generation is deterministic, so a clean replay gives exactly the answer the model would have given with no fault at all.

Each dot is one layer’s check. Token 4 fails one. Flipless rolls the KV cache back a token, replays it with checks that repair as they go, and the answer carries on exactly as if nothing had happened. The flags are read once per token, so the GPU never waits for a check.

Version 0.4 goes further. Each linear layer leaves its input and output in a queue, and same-shaped layers are checked together at the end of the token in a few batched operations. On Qwen2.5-0.5B that’s about 70 check operations per token for the linear layers instead of about 2,200; the norm checks still run layer by layer, for now. A CUDA graph then records the whole protected token once and replays it, so Python drops out of the loop. Without the graph, in plain PyTorch, version 0.4 cut the overhead from 216% to about 50%. With it, the overhead is 21%, at 7.8 ms a token (Figure 7).

Norms, weights and the cache

Norm layers

RMSNorm divides by a root mean square, so it isn’t linear and a checksum doesn’t apply. It’s cheap, though, so Flipless computes it twice and requires the two results to match bit for bit. Same inputs, same kernel, same answer, which means no threshold and no false alarms. Without these checks, 19 of 47 harmful norm flips got through. With them, none did.

Weights

A flipped weight is worse than a flipped output, because every later token reads it. The checksum catches the bad output. Flipless then compares the sum of each weight row with a clean copy, finds the corrupted rows and restores them. In the 1,500-trial run it restored 129 rows and stopped all 68 weight flips that changed the answer.

KV cache

New in version 0.4. The keys and values of earlier tokens stay in memory for the whole answer, so a flip there behaves like a flipped weight. Each cache layer keeps a spare copy and the sum of every row. Before attention reads the cache, cache and spare are compared bit for bit. If they differ, the copy whose row sums still match is the good one. In 300 flips into the cache it caught all 300 and stopped all 41 that changed the answer.

What it costs

Checking a block costs two dot products per token, one for the prediction and one for the threshold, plus adding up the block. Next to the matrix multiply itself, with block size β, that’s

For Qwen2.5-0.5B that comes to 4.7 million extra multiply-adds per token on top of 494 million: 0.95%. The two checksum vectors each check uses take 17 MB next to a 988 MB model, or 27 MB with the extra vectors the prototype keeps for locating errors and restoring weights. The KV cache’s spare copy doubles the cache’s memory.

Today’s measured cost is higher, because the prototype runs its checks as separate small GPU operations, and a model this small is limited by how many operations it launches rather than by arithmetic. In version 0.3 a token took 31.7 ms unprotected and 100.1 ms with Flipless, 216% more. Version 0.4’s batching and CUDA graphs brought that to 6.4 ms and 7.8 ms, 21% more, with the KV cache now guarded too. After them come fused kernels, which compute the checksum inside the matrix multiply itself. Published fused checksum kernels on GPUs run at 4 to 9% overhead.^{30, 32, 33} Others have tuned the checks layer by layer for inference on GPUs³¹ and built them into accelerator hardware for LLMs at under 2% extra area and power.³⁴

What isn’t covered yet

Attention itself. The scores, the softmax and the weighted sum. Inf and NaN from there are caught and replayed; quieter errors aren’t yet. Checksums for attention have been published³³ and are next on the list.
Activations and residual adds. The same: Inf and NaN only, for now.
A norm layer’s own weights. Both copies of a norm read the same weights, so a flip there gets past the double check.
Real radiation. Software injection flips one bit at a time. Real particles can flip several and can hit control logic. A beam test is the only honest check of that.
Big models. Weight repair keeps a clean copy of every weight in CPU memory, and the KV cache keeps a full spare on the GPU. That’s fine at 0.5B. At 70B the plan is hashes with reloading from disk, and recomputing a damaged cache row instead of keeping a spare.

The evidence

Every number on this site comes from runs on one laptop GPU on 7 and 8 October 2026, unless a source says otherwise. The runs are small next to what’s coming, but each one is listed here in full, including the version that let four harmful flips through.

How a trial works

Get the golden answer
Run the model once with no faults and keep its first 32 tokens.
Pick one fault
A site (a layer’s output, a weight or a norm’s output), a moment in the run, one element and one bit. Each run sets the share of trials per kind of site; within a kind, sites are picked in proportion to how much data they handle.
Run it unprotected
Flip that bit with Flipless off. Did the answer change?
Run it with Flipless
Flip exactly the same bit with Flipless on. Did the answer change now, and did Flipless notice?
Repeat
Thresholds and weights are reset before every run, so no trial affects the next.

ModelQwen2.5-0.5B-Instruct, 494M parameters, 24 layers, fp16⁶⁰

HardwareNVIDIA GeForce RTX 4060 Laptop GPU, 8 GB

SoftwarePyTorch 2.14.1 with CUDA 13, Transformers 5.19.0, Windows

Prompt“Explain in two sentences why satellites need protection from radiation.”

Golden answer“Satellites require protection from radiation to maintain their operational efficiency and extend the lifespan of the spacecraft. This is crucial for preventing…”

The headline

Three runs with every check switched on, 2,100 trials between them, flipping sign and exponent bits only, which is where the damage is. Two used version 0.3 and aimed at layer outputs, weights and norms; the third used version 0.4 and aimed at the KV cache. Unprotected, 268 of those flips changed the answer. With Flipless, none did, and Flipless never changed an answer that was right without it.

Zero failures in 268 doesn’t prove a perfect record. The Wilson score interval²⁷ says how low the true share of harmful flips stopped could be and still produce this result. With all n = 268 stopped, the 95% lower bound is

With every trial a success, p̂ = 1 and most of it cancels:

So with 95% confidence, Flipless stops at least 98.6% of flips like these. More trials will push that bound up, and the bigger machine arriving on 15 October is for exactly that.

Figure 1. Answers changed by a single flipped bit, by where it landed. All checks on: version 0.3 for the first three, version 0.4 for the KV cache.

Show the numbers

Bit flip landed in	Trials	Changed, unprotected	Caught
Linear-layer outputs	1,094	112 (10.2%)	927
Weights in memory	406	68 (16.7%)	129
Norm-layer outputs	300	47 (15.7%)	300
KV cache	300	41 (13.7%)	300
All four	2,100	268 (12.8%)	1,656

Figure 2. What the norm checks are worth. The same 300 flips into norm-layer outputs, run three ways.

Show the numbers

Run	Answers changed	95% interval
Unprotected	47 of 300	12.0–20.2%
Flipless, norm checks off	19 of 300	4.1–9.7%
Flipless, norm checks on	0 of 300	0.0–1.3%

With norm checks off, Flipless still stopped 28 of the 47, because those flips produced Inf or NaN downstream and failed a later check. The other 19 were quieter and only the norm check catches them.

Figure 3. What the KV-cache guard is worth. The same 300 flips into stored keys and values, run three ways with version 0.4.

Show the numbers

Run	Answers changed	95% interval	Flips caught	Cache rows restored
Unprotected	41 of 300	10.2–18.0%	–	–
Flipless, KV checks off	41 of 300	10.2–18.0%	10	0
Flipless, KV checks on	0 of 300	0.0–1.3%	300	300

With the guard off, the rest of Flipless noticed 10 flips that turned into Inf or NaN further on and replayed those tokens 173 times, but it couldn’t fix them. A replay only rolls back the current token, and the bad value was stored earlier, so the replay read it again. With the guard on, all 300 flips were caught, harmless ones included, because the two copies must match bit for bit, and each bad row was put back from the spare.

Figure 4. What happened to all 1,500 flips in the largest run, with Flipless on.

Show the numbers

Outcome	Flips
Caught, token replayed clean	927
Caught, corrupted weight restored during the replay	129
Not caught, answer unchanged	444
Not caught, answer changed	0

All 180 flips that changed the answer unprotected were among those caught. A flip that isn’t caught behaves exactly as it would unprotected, and none of the 444 uncaught flips changed the answer, so every miss was a harmless one.

Figure 5. Which bits do the damage. Flips into linear-layer outputs, unprotected, from the 1,500-trial run.

Show the numbers

Bit class	Trials	Answer changed	95% interval
Sign	194	0 (0.0%)	0.0–1.9%
Exponent	900	112 (12.4%)	10.4–14.8%

Mantissa flips were left out of the big runs on purpose. In the first 50-trial run, which flipped any bit, none of 25 mantissa flips changed the answer. Published studies find the same: the top exponent bit dominates and low bits barely register.^{21, 22}

Figure 6. How far one flipped bit pushes a block’s checksum, by bit. The NumPy twin of the check on a layer shaped like Qwen2.5’s MLP, with random weights at LLM scale and 200 flips per bit.

Show the numbers

Bit	Field	Caught	Median residual, in τ	10th–90th percentile
15	Sign	190 of 200	11.9	2.4–32.6
14	Exponent	200 of 200, plus 55 Inf or NaN	262,000	44,000–589,000
13	Exponent	186 of 200	6.0	1.7–15.4
12	Exponent	199 of 200	6.7	2.2–15.9
11	Exponent	170 of 200	6.9	0.783–13.3
10	Exponent	180 of 200	5.7	1.2–9.0
9	Fraction	164 of 200	2.6	0.568–5.2
8	Fraction	118 of 200	1.3	0.192–2.6
7	Fraction	51 of 200	0.598	0.098–1.3
6	Fraction	4 of 200	0.309	0.057–0.662
5	Fraction	0 of 200	0.136	0.030–0.334
4	Fraction	0 of 200	0.074	0.018–0.177
3	Fraction	0 of 200	0.033	0.008–0.095
2	Fraction	0 of 200	0.031	0.007–0.071
1	Fraction	0 of 200	0.025	0.004–0.057
0	Fraction	0 of 200	0.024	0.004–0.056

Exponent and sign flips, the ones that change answers, mostly land well past the threshold. The top exponent bit lands tens to hundreds of thousands of times past it, or turns the value into Inf or NaN, which always fails. The six lowest fraction bits never reach it, because they move a value less than ordinary rounding does. That matches the real runs, where every flip Flipless missed was harmless.

Figure 7. Speed, in milliseconds per token on Qwen2.5-0.5B. Shorter is faster.

Show the numbers

Version	Unprotected	With Flipless	Overhead
v0, a check after every layer	31.7	125.5	+296%
v0.2, deferred checks	37.7	101.2	+169%
v0.3, norm checks added	31.7	100.1	+216%
v0.4, batched checks, KV cache guarded	43.0	63.8	+49%
v0.4 with CUDA graphs	6.4	7.8	+21%

Versions 0 to 0.3 were timed inside the campaigns. Version 0.4 was timed by its own benchmark: 128 new tokens, best of three runs per mode, every check on, and the same answer in every mode. In the same benchmark a weight and a cache value were flipped mid-answer with CUDA graphs running, and both were caught and repaired with the answer unchanged. A CUDA graph removes the cost of launching thousands of small GPU operations per token, for the model and for the checks alike. The checks’ arithmetic is under 1% of the model’s, and fused kernels go after most of what’s left.

Every run

All campaigns so far, in order. Every run used Qwen2.5-0.5B-Instruct except the three marked tiny, a two-layer random model for quick smoke tests.

Finished	Version	Trials	Bits	Flips landed in	Answers changed		Checks	False alarms	ms per token
Finished	Version	Trials	Bits	Flips landed in	Unprotected	Flipless	Checks	False alarms	ms per token
7 Oct 11:19	v0, tiny model	20	All	Mixed	0	0	–	0	4.0 → 12.0
7 Oct 11:25	v0	50	All	Mixed	1	0	–	0	31.7 → 125.5
7 Oct 12:09	v0, tiny model	20	All	Mixed	0	0	–	0	4.2 → 12.0
7 Oct 12:23	v0.2, tiny model	20	All	Mixed	0	0	9,645	0	4.3 → 11.7
7 Oct 13:00	v0.2	300	Sign, exponent	Mixed	28	4	1,649,609	0	37.7 → 101.2
7 Oct 18:42	v0.3	1,500	Sign, exponent	Outputs, weights	180	0	10,694,208	0	31.7 → 100.1
7 Oct 19:12	v0.3	300	Sign, exponent	Norm outputs	47	0	2,158,200	0	31.2 → 98.9
7 Oct 19:32	v0.3, norms off	300	Sign, exponent	Norm outputs	47	19	1,626,287	0	31.4 → 87.7
7 Oct 23:37	v0.4	300	Sign, exponent	KV cache	41	0	2,388,600	0	128.5 → 216.0*
8 Oct 00:34	v0.4, KV checks off	300	Sign, exponent	KV cache	41	41	2,130,514	0	34.3 → 52.2

The four answers v0.2 let through were all flips into norm-layer outputs, which v0.2 didn’t check yet. Version 0.3 added the norm checks, and the next two Qwen runs let nothing through. The two v0.4 runs flipped the same 300 bits in the KV cache, with the cache guard on and then off. The runs marked “off” are there on purpose, to show what each check is worth.

* That run’s timings came out three to four times slower than every other Qwen run’s, unprotected included, so they say more about the laptop at the time than about Flipless. Figure 7 uses the controlled benchmark instead.

The tests in the code

Every version ships with a test suite, run before each campaign. Version 0.3’s 38 tests passed in 47.6 seconds on 7 October, and version 0.4’s 47 passed in 59.4 seconds the same evening.

Test	What it proves
`flip_bit_round_trip`	Flipping a bit twice gives back exactly the original value.
`bit_classes`	Sample bits in fp16, bf16 and fp32 are labelled correctly as sign, exponent or mantissa.
`choose_block`	Checksum blocks divide each layer’s outputs evenly where they can.
`layers_are_wrapped`	`harden()` wraps every linear and norm layer and gives each its own flag.
`hardening_twice_is_refused`	A model can’t be hardened twice by mistake.
`wrapper_keeps_the_forward_signature`	Hugging Face’s `generate()` still sees the model’s real arguments.
`clean_runs_are_untouched_and_never_flagged` ×2	With no fault, outputs are bit-identical and nothing is flagged, in both modes.
`unprotected_mode_lets_the_flip_through` ×2	With protection off, an injected flip really does change the output, so the harness works.
`false_alarm_loosens_threshold_without_changing_output` ×2	A false alarm widens that layer’s threshold and leaves the output alone.
`restore_undoes_a_weight_fault`	The campaign puts a corrupted weight back exactly between trials.
`norm_flip_is_caught_and_repaired` ×2	A flip in a norm layer’s output is caught and repaired.
`norm_flip_gets_through_with_norm_checks_off`	Without norm checks the same flip gets through, so the check is doing the work.
`immediate_flip_is_caught_and_repaired` ×3	Flips in three exponent bits are caught and repaired; the top one is also pinpointed.
`immediate_weight_flip_is_scrubbed_and_repaired`	A corrupted weight is found by its row sum and restored from the clean copy.
`immediate_mode_flags_but_cannot_fix_inf_from_an_unprotected_layer`	Inf arriving from an unchecked layer is reported honestly, not passed off as fixed.
`nonfinite_input_does_not_loosen_threshold`	Inf or NaN never counts as a false alarm.
`deferred_flip_is_caught_and_replayed` ×2	In deferred mode a flip fails the end-of-token check and the token is replayed.
`deferred_weight_flip_is_scrubbed_on_replay`	In deferred mode a corrupted weight is restored during the replay.
`deferred_replay_fixes_inf_from_an_unprotected_layer`	A replay clears an Inf that came from an unchecked layer.
`batched_check_catches_a_weight_corrupted_behind_its_back` New in 0.4	The batched check still catches a weight changed outside the injector.
`layers_with_the_same_shape_are_checked_as_one_group` New in 0.4	Same-shaped layers share one batched check.
`in_place_change_after_a_layer_moves_it_off_the_queue` New in 0.4	If a later operation overwrites a layer’s output in place, that layer falls back to a check it can trust.
`fp16_on_gpu` ×2	Real fp16 on the GPU: clean runs pass and flips are caught.
`tiny_llm_generation_survives_a_flip` ×2	A small Qwen-style model generates the same text with a flip in a decode step, the prompt pass and a norm.
`kv_cache_flip_is_caught_and_repaired` ×2 New in 0.4	A flip in the stored keys or values is caught and the cache restored from its spare.
`kv_flip_gets_through_with_kv_checks_off` New in 0.4	Without KV checks the same flip gets through.
`static_decoder_matches_and_repairs_flips` ×2 New in 0.4	The CUDA-graph decoder gives identical answers and still repairs a flipped weight.

The maths, tested without a GPU

A NumPy twin of the checksum runs on any machine, in emulated fp16. On a layer shaped like Qwen’s MLP (896 inputs, 4,864 outputs, 16 blocks of 304), with 960 single-bit flips:

No false alarms in 200 clean batches.
Every flip that moved a value by more than twice the threshold was caught.
No flip ever failed a block other than its own.
Every error above 100 times the threshold was pinpointed to the exact value.
Every flip that slipped through moved its value by at most 1.5 times the threshold.

On smaller test layers:

Every Inf and NaN in an output was caught and pinpointed, and Inf in an input always failed the check.
For flips well clear of the threshold, the batched check fails exactly when one of the per-layer checks would.

Next, on the bigger machine

Bigger models. The RTX PRO 6000 arriving on 15 October has 96 GB, enough for 7B-class models in fp16.
Campaigns ten times the size. If every harmful flip is still stopped, 21,000 trials would lift the lower bound from 98.6% to about 99.9%.
Fused kernels. Checksums computed inside the matrix multiply, to take the 21% towards the single digits published fused kernels reach.³²
Attention. Checksums through the scores, softmax and weighted sum, which for now are covered only for Inf and NaN.³³

Who needs Flipless

Two markets. In orbit, every GPU will be hit, often, and nobody can walk over and swap a board. On the ground, a small share of chips go bad quietly, and at fleet scale that small share is thousands of devices.

NVIDIA

Sells the GPUs going to orbit

What it’s doing

At GTC in March 2026 NVIDIA launched space computing, with a Space-1 Vera Rubin Module to follow. Jensen Huang: “Space computing, the final frontier, has arrived.”³⁹ It is hiring an Orbital Datacenter System Architect who must understand “reliability, radiation tolerant strategies, environmental tolerances, and thermal solutions”.⁴⁰ In August it invested in Starcloud,³⁸ and SpaceX’s first Starmind satellites will carry Rubin GPUs.^{43, 44}

Why Flipless

NVIDIA’s data-centre GPUs already protect their big memories with ECC.⁹ What ECC can’t easily reach is the hidden logic in between, the pipeline latches and queues where radiation lands too.^{6, 7} Flipless narrows that gap in software, so the same silicon can be sold into orbit with a reliability story attached. Today it’s a Python library on PyTorch; fused CUDA kernels are next.

SpaceX and xAI

Plans orbital AI compute at Starlink scale

What it’s doing

SpaceX merged with xAI in February 2026 and has filed with the FCC for up to a million orbital data centres.⁴² Its S-1 says “We expect to begin deploying our orbital AI compute satellites as early as 2028”, and that they will operate “in the harsh and unpredictable environment of space”.⁴¹ The first payload, Starmind AI1, is being designed with NVIDIA around Rubin GPUs and Vera CPUs.^{43, 44}

Why Flipless

At that scale, bit flips stop being rare events and become a rate to manage. Low-orbit satellites pass through the South Atlantic Anomaly again and again, and that’s where most of their upsets happen.^{2, 3} Flipless is designed to run on the GPU that’s already aboard, to update over the air like the rest of the satellite’s software, and to report every flip it catches.

Google

Project Suncatcher, TPUs in orbit

What it’s doing

Google put Trillium TPUs in a 67 MeV proton beam. They survived far more dose than a five-year mission would deliver.^{4, 5} They also produced silent data corruption, wrong results with no error flag, about once per 17 rad. The team puts that at about one per 3 million inferences in orbit, “likely acceptable for inference”, and says its effect on training needs more study.⁵ The first prototype launched on 1 October 2026.⁴⁵

Why Flipless

A detected error can be retried. The silent ones are the problem, because nothing flags them. Flipless checks the maths itself, so it doesn’t depend on the hardware noticing. The method works on any chip that multiplies matrices, TPUs included. The product starts on NVIDIA GPUs.

Starcloud and the start-ups

Building the first orbital data centres

What they’re doing

Starcloud flew an NVIDIA H100 in November 2025, trained a small model on Shakespeare and ran Google’s Gemma in orbit.^{35, 36} In August 2026 it raised at a $2.3 billion valuation, with NVIDIA among the new investors.³⁸ Its chief executive told TechCrunch: “An H100 is probably not the best chip for space, to be honest, but the reason we did it is we wanted to prove that we could run state of the art terrestrial chips in space.”³⁷ Axiom Space launched its first two orbital data centre nodes in January 2026,⁴⁶ Aetherflux says its first will be commercially operational in early 2027,⁴⁷ and China launched the first 12 satellites of its Three-Body Computing Constellation in May 2025.⁴⁸

Why Flipless

These teams build satellites, power and cooling. Reliability software for the GPU is something they’d rather buy than build, and Flipless gives them numbers to show their own customers: flips caught, flips repaired, answers changed.

AI labs and clouds

Silent corruption on the ground

What they’re seeing

Meta finds silent data corruption in about one server device per thousand.¹¹ Google sees “a few mercurial cores per several thousand machines”¹² and expected silent corruption to hit Gemini’s training every week or two.¹⁵ During Llama 3’s 54-day pre-training window on up to 16,000 H100s, six interruptions were traced to silent data corruption.¹⁴ A 2026 study of 35 million GPU-hours found 18 incidents, and only three of them caused a visible failure.¹⁶ Another found that synthetic tests missed over 60% of defective GPUs.¹⁷ The industry’s own white paper warns that during inference silent corruption “can lead to incorrect results with severe consequences”.¹⁹

Why Flipless

Fleet scanners test machines between jobs. Flipless checks during the job, on the real workload, and is designed to report which layer failed on which GPU, so a silent fault becomes a fault report with a GPU attached; that report is planned for Flipless Fleet. Simple guards can’t do this: in a 2026 gate-level fault-injection simulation of a data-centre GPU, NaN and infinity made up about 1% of silent corruption outcomes, so a check that only looks for NaN would miss nearly all of it.²⁰

Space agencies and defence

Missions that need modern AI on board

What they’re working with

Perseverance runs on a radiation-hardened RAD750 at up to 200 MHz.⁵¹ NASA’s next hardened processor “delivers over 100 times the computing capability of current space processors”, and it was still in testing in 2026.⁵⁰

Why Flipless

Hardened chips trail commercial GPUs by many generations. Flipless lets a mission run a modern GPU and still show, flip by flip, that every result was checked.

Ways to protect a computation in orbit

Approach	What it costs	What it misses
Radiation-hardened chips	Performance generations behind. Perseverance’s RAD750 runs at up to 200 MHz.⁵¹	Today’s AI models, which need far more compute.
Shielding	Mass, at about $3,600 per kg to orbit today.⁵	Not everything. Google’s own analysis still expects about one silent corruption per 3 million inferences.⁵
ECC on memories	Built in.	Hidden logic, pipeline latches and queues it can’t easily protect,⁶ and silent mismatches with no flag.⁵
Run everything twice	100% extra compute, more for three copies.²⁹	Little, but at double the price.
Flipless	Measured today: +21% per token with CUDA graphs, +49% without, in the unfused prototype. The checks’ arithmetic is 0.95% on Qwen2.5-0.5B, and the KV cache is stored twice. Published fused checksum kernels run at 4–9%.^{30, 32, 33}	Attention internals, activations and residual adds, for now.

How companies like this get bought

Big platforms increasingly license a small team’s technology and hire the people, or buy them outright. A few of the deals in AI infrastructure:

Deal	When	Shape	Reported value
NVIDIA and Groq	Dec 2025	Non-exclusive licence; founder and president joined NVIDIA⁵³	about $20B⁶²
Google and Windsurf	Jul 2025	Licence and hires⁵⁷	about $2.4B
NVIDIA and Enfabrica	Sep 2025	Licence and hires⁵²	over $900M
NVIDIA and Run:ai	Dec 2024	Acquisition⁵⁴	$700M
NVIDIA and CentML	Jul 2025	Acquisition⁵⁵	over $300M
NVIDIA and Deci	May 2024	Acquisition⁵⁶	about $300M

Values are press reports. The companies didn’t disclose most prices.

The science and the sources

Why bits flip, why the usual protections leave gaps, and the papers this work stands on. Every claim on this site links to one of the sources below.

Why bits flip in orbit

Space is full of fast charged particles: protons trapped in the radiation belts, bursts from the Sun, and cosmic rays from outside the solar system. A particle passing through a chip leaves a trail of charge. If enough of it collects at a memory cell or a latch, the stored bit flips. NASA puts it plainly: “If a satellite is hit by a high-energy proton, it can short-circuit and cause an event called single event upset or SEU.”¹

Earth’s magnetic field is tilted and off-centre, so over South America and the South Atlantic the inner radiation belt dips much closer to the surface.¹ That patch, the South Atlantic Anomaly, is where most low-orbit upsets happen. ESA’s Swarm satellites logged most of theirs there over ten years,² and USGS says the same of Landsat.³

One satellite at 53° inclination. Upsets so far: 0, inside the anomaly: 0Schematic. The glow marks the anomaly’s position, not measured flux.

Why ECC isn’t enough

Data-centre GPUs protect their big memories with error-correcting codes. On an H100 that covers the HBM, the L2 cache, and the L1 caches and register files.⁹ The next machine Flipless will run on, an RTX PRO 6000 Blackwell, has ECC on its 96 GB of GDDR7.⁶¹

But a GPU also holds data in pipeline latches and queues and runs schedulers and control logic, and researchers have warned for years about “a growing amount of hidden logic and memory resources” that ECC can’t easily protect.⁶ Beam tests at Los Alamos and ISIS found failures in the scheduler, dispatcher and control logic.⁷ NVIDIA’s own researchers call full-device correction through ECC “expensive and impractical”.⁸ And Google’s TPU beam test saw data mismatches that no error flag reported.⁵

A check on the arithmetic catches those, wherever they came from. That’s the idea behind Flipless.

Silent corruption on the ground

On Earth, cosmic rays reach the ground as showers of neutrons, and chips also fail through manufacturing defects and wear. The big operators have spent five years measuring the result. Meta: about one faulty server device per thousand.^{10, 11} Google: a few mercurial cores per several thousand machines.¹² Alibaba: 3.61 per 10,000 CPUs, across more than a million.¹³ On GPUs the numbers come from training runs: six silent corruption interruptions in Llama 3’s 54-day window,¹⁴ 18 incidents in 35 million GPU-hours with only three visible,¹⁶ and defective GPUs that synthetic tests missed more than 60% of the time.¹⁷ Newer chips aren’t immune: on NCSA’s Delta cluster, the mean time between memory errors per GPU was 3.2 times shorter for H100s than for A100s.¹⁸ In 2025 the Open Compute Project published a white paper on silent corruption in AI with authors from NVIDIA, Meta, Google, AMD, Intel, Arm and Microsoft.¹⁹

Not every bit matters

A 2017 study by UBC and NVIDIA found that in neural networks “only the high-order exponent bits are likely to cause SDCs”.²¹ Studies of LLMs agree. In a 2025 fault-injection study on an A100, the top exponent bit caused silent corruption in about a quarter of injections into GPT-2 and Llama 3.2, while low-order bits stayed under 1%.²² Our runs found 112 answer changes in 900 exponent flips and none in 194 sign flips.

The same research explains why a simple guard isn’t enough. In a 2026 gate-level fault-injection simulation of a data-centre GPU, NaN and infinity made up only 1.01% of silent corruption outcomes.²⁰ Most corrupted values are finite and plausible, and only a check that knows what the value should have been can catch them.

Sources

Grouped by topic. The numbers match the citations across the site.

Radiation, orbit and GPU hardware

1
NASA researchers track slowly splitting ‘dent’ in Earth’s magnetic field
NASA, NASA, 2020
The South Atlantic Anomaly comes from the tilt of Earth’s magnetic axis and flows in the outer core. It lets trapped particles dip closer to the surface, where a high-energy proton can cause a single event upset.
2
Swarm vs. space radiation: the first 10 years
ESA, European Space Agency, 2024
Over 3,327 days of data, most of the Swarm satellites’ upsets were triggered by protons met inside the South Atlantic Anomaly.
3
Single event upset
USGS, Landsat Missions
“The vast majority of SEUs found have occurred over the South Atlantic Anomaly…”
4
Exploring a space-based, scalable AI infrastructure system design
T. Beals, Google Research, Google Research blog, 4 Nov 2025
In the right orbit a solar panel can be up to 8 times more productive than on Earth. Trillium TPUs survived well past the shielded five-year mission dose in a 67 MeV proton beam.
5
Towards a future space-based, highly scalable AI infrastructure system design
Google (Agüera y Arcas, Beals et al.), arXiv:2511.19468, 2025
Version 2, June 2026. Beam test of Trillium TPUs at 67 MeV: silent data corruption about once per 17 rad, estimated at about one per 3 million inferences in orbit and judged “likely acceptable for inference”; HBM uncorrectable errors about once per 44 rad.
6
On the efficacy of ECC and the benefits of FinFET transistor layout for GPU reliability
C. Lunardi, F. Previlon, D. Kaeli, P. Rech, IEEE Transactions on Nuclear Science 65(8), 2018
GPUs hold a growing amount of hidden logic and memory, such as flip-flops in internal pipelines and queues, that ECC can’t easily protect.
7
Radiation-induced error criticality in modern HPC parallel accelerators
D. Oliveira et al., HPCA 2017
Neutron beam tests at Los Alamos and ISIS found failures in the scheduler, dispatcher and control logic, and data sitting in unprotected queues and flip-flops.
8
Characterizing and mitigating soft errors in GPU DRAM
NVIDIA Research, MICRO 2021
Neutron beam study of HBM2. Correcting every possible fault in the whole device with ECC is “expensive and impractical”.
9
NVIDIA H100 Tensor Core GPU architecture
NVIDIA, Whitepaper, copy hosted by Louisiana State University, 2022
H100 protects HBM, the L2 cache, and the L1 caches and register files with single-error-correct, double-error-detect ECC.

Silent data corruption on the ground

10
Silent data corruptions at scale
H. D. Dixit et al., Meta, arXiv:2102.11245, 2021
Testing across hundreds of thousands of machines found hundreds of CPUs that silently corrupt data, across several hardware generations.
11
Detecting silent data corruptions in the wild
H. D. Dixit et al., Meta, arXiv:2203.08989, 2022
Silent data corruption occurs at about one fault per thousand devices.
12
Cores that don’t count
P. H. Hochschild et al., Google, HotOS 2021
Google sees “a few mercurial cores per several thousand machines”: CPUs that occasionally compute the wrong answer without any error.
13
Understanding silent data corruptions in a large production CPU population
S. Wang et al., Alibaba Cloud, SOSP 2023
Over a million CPUs and 32 months: 3.61 in every 10,000 CPUs caused silent data corruption.
14
The Llama 3 herd of models
Llama Team, Meta, arXiv:2407.21783, 2024
466 job interruptions in a 54-day pre-training window on up to 16,000 H100 GPUs. GPU issues were 58.7% of the unexpected ones, and six were silent data corruption.
15
Gemini: a family of highly capable multimodal models
Gemini Team, Google, arXiv:2312.11805, 2023
“Although these are extremely rare, the scale of Gemini models means that we can expect SDC events to impact training every week or two.” Trained on TPUs.
16
Safeguarding LLM training at scale: online SDC detection and insights from 35 million GPU hours
Lei et al., Tsinghua University and ByteDance, OSDI 2026
18 silent corruption incidents and 13 faulty GPUs in 35 million GPU-hours. Only three caused a visible training failure, and hours of offline diagnostics caught 2 of 8 faulty GPUs.
17
SDCs in the wild: characterizing and diagnosing SDC-defective GPUs in production LLM training
Zheng et al., SJTU and ByteDance Seed, OSDI 2026
23 defective GPUs studied. Synthetic tests missed over 60% of them, and 40% only showed up about a year after deployment.
18
Story of two GPUs: characterizing the resilience of Hopper H100 and Ampere A100 GPUs
Cui et al., UIUC and NCSA, SC 2025, arXiv:2503.11901
11.7 million GPU-hours on NCSA Delta. Per-GPU mean time between memory errors was 3.2 times lower on H100 than on A100.
19
Silent data corruption in AI
Open Compute Project, OCP white paper, with authors from NVIDIA, Meta, Google, AMD, Intel, Arm and Microsoft, 2025
“During inference, it can lead to incorrect results with severe consequences…”
20
The anatomy of silent data corruption: GPU error pattern study and modeling guidance
C.-H. Tung et al., arXiv:2605.04213, 2026
A gate-level fault-injection simulation of a data-centre GPU. NaN and infinity account for only 1.01% of silent corruption outcomes, so a check that only looks for NaN misses almost everything.

Which bits matter

21
Understanding error propagation in deep learning neural network (DNN) accelerators and applications
G. Li, S. K. S. Hari, M. Sullivan et al., UBC and NVIDIA, SC 2017
“For the FP data types, only the high-order exponent bits are likely to cause SDCs (if corrupted), and not the mantissa and sign bits.”
22
Analysis of LLM vulnerability to GPU soft errors: an instruction-level fault injection study
D. Chai et al., arXiv:2601.19912, 2025
Fault injection into GPT-2, Llama 3.2 and Qwen3 on an A100. The top exponent bit caused silent corruption in 23.4% (GPT-2) and 24.2% (Llama 3.2) of injections; low-order bits stayed under 1%.
23
Not all errors are equal: a systematic study of error propagation in large language model inference
Y. Huang, S. Di, G. Li, arXiv:2606.02430, 2026
A fault-injection framework for LLMs, run across three open-weight models and thirteen tasks.

The maths

24
Algorithm-based fault tolerance for matrix operations
K.-H. Huang, J. A. Abraham, IEEE Transactions on Computers C-33(6):518–528, 1984
The original checksum method: add a row of column sums and a column of row sums, and the product carries its own check. A single wrong element can be found and corrected.
25
Accuracy and stability of numerical algorithms, 2nd edition
N. J. Higham, SIAM, 2002
Section 3.1: a dot product of length n computed in floating point is off by at most γₙ|x|ᵀ|y|, where γₙ = nu/(1 − nu).
26
A new approach to probabilistic rounding error analysis
N. J. Higham, T. Mary, SIAM J. Sci. Comput. 41(5):A2815–A2835, 2019
In practice rounding errors grow like √n·u, not n·u, which is why a calibrated threshold can be far tighter than the worst case.
27
Probable inference, the law of succession, and statistical inference
E. B. Wilson, Journal of the American Statistical Association 22(158):209–212, 1927
The score interval used for every confidence interval on this site.
28
Simulating low precision floating-point arithmetic
N. J. Higham, S. Pranesh, SIAM J. Sci. Comput. 41(5):C585–C602, 2019
Parameters of fp16 (unit roundoff 2⁻¹¹, largest value 65,504) and bfloat16 (unit roundoff 2⁻⁸).

Checksums for neural networks

29
Making convolutions resilient via algorithm-based error detection techniques
S. K. S. Hari, M. Sullivan, T. Tsai, S. W. Keckler, NVIDIA, IEEE TDSC 19(4), 2022
Checksums on convolutions detect transient errors at 6–23% runtime overhead, against 100% for running everything twice.
30
FT-CNN: algorithm-based fault tolerance for convolutional neural networks
K. Zhao et al., IEEE TPDS 32(7), 2021
Runtime overhead of 4–8%, with and without injected errors.
31
Arithmetic-intensity-guided fault tolerance for neural network inference on GPUs
J. Kosaian, K. V. Rashmi, SC 2021
Choosing the check per layer by arithmetic intensity cuts overhead by 1.09–5.3× against traditional ABFT on FP16 Tensor Cores.
32
Anatomy of high-performance GEMM with online fault tolerance on GPUs
S. Wu et al., ICS 2023
Fault-tolerant matrix multiply at 8.89% average overhead against cuBLAS, even with hundreds of errors injected per minute.
33
ATTNChecker: highly-optimized fault tolerant attention for large language model training
Y. Liang et al., PPoPP 2025
Checksums inside attention at about 7% training overhead, detecting and correcting extreme errors.
34
ReaLM: reliable and efficient large language model inference with statistical algorithm-based fault tolerance
T. Xie et al., arXiv:2503.24053, 2025
Statistical ABFT in accelerator hardware: 1.42% extra circuit area and 1.79% extra power.

Orbital compute: filings and announcements

35
How Starcloud is bringing data centers to outer space
NVIDIA, NVIDIA blog, 15 Oct 2025
Starcloud-1 “is expected to offer 100x more powerful GPU compute than any previous space-based operation”.
36
An AI model has been trained in space using an orbiting Nvidia GPU
Michael Kan, PCMag, via Yahoo Tech, 10 Dec 2025
Starcloud-1 trained NanoGPT on the complete works of Shakespeare and ran Google’s Gemma in orbit.
37
Starcloud raises $170 million Series A to build data centers in space
TechCrunch, 30 Mar 2026
Chief executive: “An H100 is probably not the best chip for space, to be honest, but the reason we did it is we wanted to prove that we could run state of the art terrestrial chips in space.”
38
Orbital data center startup Starcloud valued at US$2.3 billion in latest funding
Reuters, via BNN Bloomberg, 21 Aug 2026
$250 million raised at a $2.3 billion valuation, with NVIDIA and Cisco as new investors. Starcloud is working with NVIDIA on the Space-1 Vera Rubin Module.
39
NVIDIA launches space computing, rocketing AI into orbit
NVIDIA, Press release, 16 Mar 2026
“Space computing, the final frontier, has arrived.” The NVIDIA Space-1 Vera Rubin Module is to follow.
40
Nvidia hiring for orbital data center system architect, as space compute market grows
Data Center Dynamics, 4 Mar 2026
The role needs an understanding of “reliability, radiation tolerant strategies, environmental tolerances, and thermal solutions”.
41
Form S-1 registration statement
SpaceX, SEC filing, 20 May 2026
“We expect to begin deploying our orbital AI compute satellites as early as 2028.” They will operate “in the harsh and unpredictable environment of space”.
42
Elon Musk’s SpaceX to merge with xAI at $1.25tn valuation, as it eyes space data center buildout
Data Center Dynamics, 3 Feb 2026
FCC filing for up to a million orbital data centres. Musk: “within two to three years, the lowest cost way to generate AI compute will be in space.”
43
“SpaceX is partnering with @Nvidia to design the Starmind AI1 satellite compute payload.”
SpaceX, Post on X, 4 Aug 2026
SpaceX and NVIDIA are designing the payload. Each Starmind satellite will include NVIDIA Rubin GPUs and Vera CPUs.
44
SpaceXAI adopts NVIDIA Vera CPU to accelerate agentic AI at massive scale
NVIDIA, NVIDIA newsroom, 24 Aug 2026
The first-generation Starmind AI satellite will be based on the Vera Rubin NVL72 rack-scale system.
45
Our Project Suncatcher prototype satellite is in orbit
Google, Google blog, 1 Oct 2026
The first prototype, built with Planet, launched on 1 October 2026. “Our team has confirmed contact with the satellite and it is operating as expected.”
46
Orbital Data Centers
Axiom Space, axiomspace.com, 2026
“The first two orbital data center nodes successfully launched to low-Earth orbit on January 11, 2026.”
47
Aetherflux orbital data center to be operational by Q1 2027
Data Center Dynamics, 16 Dec 2025
Aetherflux says its first orbital data centre will be commercially operational by the first quarter of 2027.
48
China is building a constellation of AI supercomputers in space, and just launched the first pieces
Live Science, May 2025
The first 12 satellites of the Three-Body Computing Constellation launched on 14 May 2025, part of a proposed 2,800-satellite fleet.
49
Energy and AI
International Energy Agency, IEA report, Apr 2025
Data centres used about 415 TWh in 2024, and that is set to more than double to around 945 TWh by 2030.
50
High Performance Spaceflight Computing (HPSC)
NASA, NASA Game Changing Development, 2026
HPSC “delivers over 100 times the computing capability of current space processors”, and as of March 2026 it was “undergoing further testing”.
51
Mars 2020 Perseverance rover components
NASA, NASA Science
Perseverance’s computer is a radiation-hardened BAE RAD750 that runs at up to 200 MHz.

Deals

52
Nvidia spent over $900 million to hire Enfabrica CEO, license technology, CNBC reports
Reuters, citing CNBC, 18 Sep 2025
A licence-and-hire deal rather than an acquisition.
53
Groq and Nvidia enter non-exclusive inference technology licensing agreement to accelerate AI inference at global scale
Groq, Groq newsroom, 24 Dec 2025
Groq’s founder and president joined NVIDIA, and Groq continues as an independent company. No price was disclosed.
54
Nvidia completes acquisition of AI infrastructure startup Run:ai
TechCrunch, 30 Dec 2024
$700 million, according to TechCrunch’s sources.
55
Nvidia’s deal to buy Canadian AI startup CentML could top US$400M
The Logic, 4 Jul 2025
Reported at well over $300 million, and over $400 million with earn-outs.
56
Nvidia to acquire AI startup Deci for $300 million
Calcalist, 2 May 2024
Reported at about $300 million.
57
Google is said to pay $2.4 billion for Windsurf assets, talent
Bloomberg, via Bloomberg Law, Jul 2025
Google paid about $2.4 billion for a licence and to hire Windsurf’s chief executive and some staff.
62
Nvidia, joining Big Tech deal spree, to license Groq technology, hire executives
Stephen Nellis, Reuters, via Yahoo Finance, 24 Dec 2025
“CNBC reported that Nvidia had agreed to acquire Groq for $20 billion in cash.” Groq didn’t disclose financial details.

Test kit and facilities

58
ChipIr
STFC ISIS Neutron and Muon Source, Rutherford Appleton Laboratory, UK
A beamline “dedicated to the irradiation of electronic devices and systems using atmospheric-like neutrons”.
59
Proton Irradiation Facility
Paul Scherrer Institute, Villigen, Switzerland
Built with ESA for testing spacecraft components.
60
Qwen2.5-0.5B-Instruct
Qwen team, Hugging Face model card, 2024
0.49 billion parameters, 24 layers, hidden size 896, 14 query heads and 2 key-value heads, Apache 2.0. The model used in every campaign on this site.
61
NVIDIA RTX PRO 6000 Blackwell
NVIDIA, Product page, 2025
96 GB of GDDR7 with error-correcting code. The next test machine.

Where Flipless goes next

From a laptop to a radiation beam to orbit. Dates are firm where they’re given; the rest is the order things happen in.

7 Oct 2026
Prototype, versions 0 to 0.3
Checksums on every linear layer, deferred checks with replay, norm checks. 1,800 trials on Qwen2.5-0.5B: 227 harmful flips, all stopped.
8 Oct 2026
Version 0.4
Batched checks, CUDA graphs and a guarded KV cache. All 47 tests pass, the overhead is down to 21% with CUDA graphs, and all 41 harmful flips into the KV cache were stopped.
15 Oct 2026
A real test bench
An RTX PRO 6000 Blackwell with 96 GB of ECC memory arrives.⁶¹ 7B-class models, and campaigns ten times the size.
Next
Fused kernels
Checksums computed inside the matrix multiply, with flags written straight to GPU memory. Triton first, then CUDA. The aim is single-digit overhead, in line with published fused checksum kernels.³²
Next
Attention and the last gaps
Checksums through the attention scores, softmax and weighted sum,³³ then activations and residual adds.
Then
Fault injection at machine level
Flips injected into the GPU’s own instructions and registers with NVBit, including multi-bit faults.
Then
Beam test
A GPU running Flipless in a particle beam: atmospheric-like neutrons at ChipIr in Oxfordshire⁵⁸ for the ground, protons at PSI in Switzerland⁵⁹ for orbit.
Later
Orbital pilot
Flipless on a GPU in low orbit, reporting every flip it catches.

The product

Four parts, planned. The first exists today as the prototype.

Flipless Runtime

The library on this site. PyTorch and Hugging Face today; vLLM and TensorRT-LLM next.

Prototype

Flipless Kernels

Fused checksum kernels for NVIDIA GPUs, to bring protection from 21% today down to a few per cent.

Planned

Flipless Fleet

A console for operators: flips caught per satellite and per GPU, where they happened, and which hardware is wearing out.

Planned

Flipless Assure

Fault-injection campaigns and beam-test reports, for mission assurance and for customers who need proof.

Planned

What Fleet could look like

A concept for the operator console, running on simulated data. It is not a real fleet.

FleetConcept, simulated data00:00:00 UTC

Flips caught today0

Inside the anomaly0%

Answers changed0

Flips per minute, last 30 minutes

Satellite	Flips caught	Weights restored	Last flip	Health

Who’s building it

Flipless is being built by Hamza Mohamoud in the UK. Each version so far has closed a gap the one before it measured. Version 0.2 cut the time per protected token from 125.5 ms to 101.2 ms, version 0.3 closed the norm-layer gap that version 0.2’s campaign exposed, and version 0.4 guarded the KV cache and brought the overhead down to 21%.

Space flips bits Flipless flips them back

Results so far

One bit is enough

Compute is leaving the planet

It already happens on the ground

How Flipless works

Check every multiply

Double-check the rest

Roll back and replay

Repair

Who it’s for

NVIDIA

SpaceX and xAI

Google

Starcloud and the start-ups

AI labs and clouds

Space agencies

One line to harden a model

What happens next

What’s checked

What a flipped bit does to a number

A checksum on every matrix multiply

How big can honest rounding get?

Why a big error can’t hide

Finding the exact value

Try the checksum

Checking without stopping the GPU

Norms, weights and the cache

Norm layers

Weights

KV cache

What it costs

What isn’t covered yet

How a trial works

Get the golden answer

Pick one fault

Run it unprotected

Run it with Flipless

Repeat

The headline

Every run

The tests in the code

The maths, tested without a GPU

Next, on the bigger machine

NVIDIA

What it’s doing

Why Flipless

SpaceX and xAI

What it’s doing

Why Flipless

Google

What it’s doing

Why Flipless

Starcloud and the start-ups

What they’re doing

Why Flipless

AI labs and clouds

What they’re seeing

Why Flipless

Space agencies and defence

What they’re working with

Why Flipless

Ways to protect a computation in orbit

How companies like this get bought

Why bits flip in orbit

Why ECC isn’t enough

Silent corruption on the ground

Not every bit matters

Sources

Radiation, orbit and GPU hardware

Silent data corruption on the ground

Which bits matter

The maths

Checksums for neural networks

Orbital compute: filings and announcements

Deals

Test kit and facilities

Prototype, versions 0 to 0.3

Version 0.4

A real test bench