Subnet 26: Perturb
Perturb is Bittensor Subnet 26. Public Perturb materials describe it as an adversarial robustness network where miners search for image perturbations that make a fixed classifier fail, while validators verify whether those perturbations satisfy the challenge constraints.
What Perturb Provides
The Perturb README frames the subnet around adversarial examples: small input changes that can cause image classifiers to misclassify. In the subnet task, validators construct challenges from real images and miners return perturbed versions intended to change the classifier result.
The Perturb whitepaper expands the project vision around continuous adversarial testing. At the subnet level, the important distinction is that Perturb is not asking miners for arbitrary image edits; it is turning bounded adversarial search into a competitive Bittensor task.
Challenge and Verification Flow
The README describes validators as sampling images, running a fixed classifier, building attack challenges, broadcasting those challenges to miners, and verifying miner responses. A miner response must change the classifier’s label while staying inside distortion and image-quality constraints.
That verification asymmetry is central to Perturb. Finding a strong adversarial example can be computationally difficult, but checking a submitted example is comparatively cheap: run the target model, compare the predicted label, and measure whether the perturbation remains within the allowed limits.
Miner and Validator Roles
Miners respond to image challenges with perturbed images. Strong miner work produces a response that changes the classifier result while preserving enough similarity to the original image to satisfy the subnet’s bounds.
Validators run the challenge and scoring side of the subnet. The README describes validators as creating image challenges, checking miner responses, computing rewards, maintaining scoring history, and setting on-chain weights. Those weights then flow through Yuma Consensus.
Evaluation Context
Perturb’s evaluation context is adversarial robustness, not ordinary image classification. A normal classifier accuracy benchmark asks whether a model gets clean examples right; Perturb asks whether miners can find constrained changes that make the classifier fail while keeping the image close to the original.
The README describes two intended outputs from that process: a growing adversarial training dataset and auditable robustness certificates. The dataset framing matters because verified adversarial examples can be used to train stronger models, while the certificate framing explains why on-chain evidence of evaluation can matter beyond the immediate miner reward.
On-Chain Identity
Live SN26 subnet data is available on TaoStats. The source-backed adversarial-challenge and robustness details in this article come from public Perturb materials rather than from live identity fields.
Relationship to Multiple Mechanisms
Perturb validators create adversarial-image challenges and score miner responses off chain before submitting weights. The Bittensor glossary describes a subnet scoring model as the mechanism that calculates miner scores, while the documentation on multiple incentive mechanisms describes separate mechanisms as having separate scoring models. Perturb’s image-attack rules should therefore be read as the scoring model for this adversarial-robustness task, not as a generic rule for every possible mechanism on the same netuid.
Relationship to Yuma Consensus
Subnet 26 uses Yuma Consensus to convert validator weight submissions into miner incentive and validator dividend outcomes. The Yuma Consensus documentation describes how validator rankings are aggregated into consensus weights for registered subnet miners.
In Perturb’s context, the source-backed scoring step is adversarial-image verification: validators check whether miner perturbations change the classifier output while remaining inside the challenge bounds, then submit weights from those results. The Emission documentation describes how consensus weights determine each participant’s share of subnet emissions.
Development Stage Context
The Introduction to Bittensor describes subnet development as moving from localnet to testnet and then mainnet. For Perturb (SN26), that sequence changes how readers should interpret adversarial challenge results and image perturbation evaluation outcomes.
In localnet, Perturb-compatible miners and validators can be developed and tested in an isolated environment. Localnet adversarial image evaluations and emission outcomes do not represent production subnet performance.
On testnet, Perturb-compatible challenge-and-verification components can be exercised in a shared, non-production network. Testnet miner scores and validator assessments are separate from mainnet subnet state.
On mainnet, Perturb (SN26) is the live production subnet where miners respond to adversarial image challenges with bounded perturbations and validators verify those responses to determine real Bittensor emissions. The Perturb repository describes the adversarial-robustness mechanism that applies on the production network.
The Bittensor Networks reference separates mainnet, testnet, and localnet. An adversarial challenge result or emission outcome from one environment should not be read as representing production subnet performance in another environment.
Reader Boundary
Subnet 26 Perturb should not be read as generic Bittensor subnet documentation, a standard image classification benchmark, or proof that clean-label accuracy alone defines rewards. It names one subnet’s adversarial robustness competition on netuid 26 (Understanding Subnets, Glossary: Netuid).
Verification Asymmetry Makes Checking Cheap
The Perturb repository describes validators as broadcasting image challenges and verifying miner responses by re-running the fixed classifier on submitted perturbations (Perturb repository).
Finding a strong adversarial example can be costly, but checking a submitted example is relatively direct.
Distortion Bounds Constrain Accepted Perturbations
Miner responses must change the classifier label while remaining inside the subnet’s distortion and image-quality limits (Perturb repository).
Rewards therefore depend on bounded perturbations rather than unconstrained image edits.
Validator Weights Still Flow Through Yuma Consensus
Subnet 26 uses Yuma Consensus to convert validator weight submissions into emission shares each tempo (Yuma Consensus, Emission).