MAI-Base-2 is a lab note, not a release: 2.4x the EU's 10^25 FLOP line, and a 4 to 12x claim from a fit

About 2.4 x 10^25 FLOP from a lab note that releases nothing

Multiply the figures in Microsoft AI's lab note "Frontier Pre-training at Microsoft AI", dated 15 October 2026, and the training of MAI-Base-2 comes to about 2.4 x 10^25 floating-point operations (derived). Two routes get there. Six times 80 billion active parameters times 50 trillion tokens is 2.40 x 10^25. And 16,000 GPUs at 2.5 PFLOPS for 38 days, at 21 per cent utilisation for the 89 per cent of the time that training progressed, is 2.45 x 10^25; if the 21 per cent applies to all 38 days instead, it is 2.76 x 10^25 (all derived). That is 2.4 to 2.8 times the 10^25 FLOP at which Article 51(2) of the EU AI Act presumes a general-purpose AI model has high-impact capabilities.

What that does not establish is most of what a reader wants. The note says "MAI-Base-2 is currently undergoing post-training". No weights, no API, no post-trained result, no safety or dangerous-capability result and no independent evaluation are in it. It is a lab note about pre-training, not a launch, and every claim in it is Microsoft AI's own. The headline claim, that the model "is 4-12x more pre-training FLOPs-efficient" than the strongest open base model, is a fitted estimate with a 2.9-fold spread, drawn from a curve with no measured model in the stretch where the answer is read (see the sections on the efficiency claim and the bits-per-byte margins).

This briefing read the note's web page and its 13-page PDF in full, and the data that the page's figures embed, from 16:18 BST on Sunday 18 October 2026. Nothing was filled in or submitted and the PDF was not gated. Hardware figures were read from NVIDIA's own page, the reference model's figures from DeepSeek's own model card, the law from EUR-Lex and the European Commission, and UK material from the AI Security Institute, the Department for Science, Innovation and Technology and legislation.gov.uk. Microsoft's interest, in one sentence: it wrote the note about a model it intends to license through its Foundry service, it sells Foundry and Copilot, and its own 28 October 2025 statement says "Microsoft holds an investment in OpenAI Group PBC", a rival lab (not re-checked since).

One run, four estimates of its compute, and whether they agree

The note gives the inputs for a compute estimate in three places: the hardware sentence ("16k GB200 GPUs over 38 days", 21 per cent utilisation, 89 per cent goodput), the architecture table (80 billion active parameters, a 50 trillion token training horizon) and Figure 2, whose embedded data places the final run on a compute axis. All four routes are in the table. The standard approximation for a dense or sparse model's training compute is six times the active parameters times the tokens (labelled derived throughout).

Four estimates of MAI-Base-2's training compute from the lab note's own inputs. All results derived by this site; the note itself states none of them.

Route	Inputs, as the note gives them	Result (derived)
Parameters and tokens	6 x 80e9 active x 50e12 tokens (architecture table)	2.40 x 10^25 FLOP
The note's Figure 2	Final-checkpoint position in the figure's embedded data: 10^25.38	2.41 x 10^25 FLOP
Hardware, utilisation over productive time	16,000 GPUs x 2.5 PFLOPS x 38 days x 89% goodput x 21% MFU	2.45 x 10^25 FLOP
Hardware, utilisation over all 38 days	The same without the 89%	2.76 x 10^25 FLOP

The first three agree to within 2.3 per cent, and the productive-time reading is the one the note's other numbers support (all derived). The Figure 2 data carries the value 372,530 for the final run, which is 50 trillion divided by 2^27 tokens, so it reads as a step count (inference). The note says the Muon optimizer took 2.1 per cent, 165 milliseconds, of the average iteration, which implies about 7.9 seconds a step; 372,530 steps at that pace take 33.9 days, which is 89.2 per cent of the 38 days, the stated goodput. Spread over those 33.8 productive days, the Figure 2 compute is 0.515 PFLOPS a GPU, 20.6 per cent of 2.5 PFLOPS, against the 21 per cent stated. The June technical report for MAI-Base-1 defines utilisation against the step time, which, read plainly, leaves out time lost between steps, and counts attention as well as matrix multiplies, which is why a small excess over six times parameters times tokens is expected. The October note gives no definition beyond its normalisation and exclusions.

So the lab's numbers hang together. That is a check on the note's internal consistency, not on the run: the GPU count, the days and the token count are Microsoft's statements, and the 16k could be 16,000 or 16,384, which would move the hardware figures to 2.51 and 2.82 x 10^25. The note says its utilisation "excludes FLOPs for rematerialization and the optimizer", so it counts model FLOPs, and the GPUs did more arithmetic than the table shows. How Article 51(2) counts compute for the presumption is a matter for the Commission's guidelines, which this briefing did not read in full.

"21 per cent of what?" matters too. The note normalises by "2.5 PFLOPS (GB200's theoretical max in BF16)". NVIDIA's GB200 NVL72 page lists 360 PFLOPS of 16-bit tensor throughput for 72 GPUs "in sparse" and says "Dense is one-half sparse spec shown", which is 2.5 PFLOPS a GPU, so the note uses the dense figure. But its architecture table says MAI-Base-2 trains with MXFP8, and NVIDIA's dense FP8 figure is 5.0 PFLOPS a GPU. Against that denominator 21 per cent would be 10.5 per cent (derived, and only if every matrix multiply ran at the FP8 rate, which the note does not say; the June report says training mixes FP8, BF16 and FP32 and still normalises by BF16). A utilisation figure compares only with another lab's on the same denominator. The note states no cost, no energy figure and no cluster layout. The hardware sentence alone implies 14.6 million GPU-hours (derived), on NVIDIA's GB200 rather than Microsoft's own Maia silicon, which this site covered separately.

What "4 to 12 times more FLOPs-efficient" measures

The note's sentence is "It is 4-12x more pre-training FLOPs-efficient than the strongest open base model, DeepSeek-V4-Pro-Base", followed by "we have put that saving into training a larger model". The method, from the note's text: for each of four held-out evaluations, fit a curve of bits per byte against training FLOPs on the lab's own ladder of small models, ask what compute that curve needs to reach DeepSeek-V4-Pro-Base's score, and divide DeepSeek's training compute by it. The four answers are in Figure 3 of the note, and are 4.2 to 12.3 times against DeepSeek and 6.3 to 12.7 times against the lab's own MAI-Base-1.

The four efficiency factors in Figure 3 of the lab note (labels in the figure and its alt text), who built each held-out set, and the compute each factor implies. Matched compute is DeepSeek's compute (9.4e24, derived below) divided by the factor.

Held-out set (who built it)	Against DeepSeek-V4-Pro-Base	Against MAI-Base-1	Matched compute (derived)
Code (MAI's own codebase)	12.3x	12.7x	7.6e23 FLOP
QA (commissioned from vendors)	4.2x	6.3x	2.2e24 FLOP
STEM (commissioned from vendors)	8.3x	8.3x	1.1e24 FLOP
Math (commissioned from vendors)	6.6x	7.5x	1.4e24 FLOP

Five things follow from the arithmetic and the figures. First, the range is wide and has no single number. High over low is 2.9 (derived). The top end, 12.3, is on the one set Microsoft built from its own source code; the three vendor-commissioned sets give 4.2 to 8.3. The geometric mean of the four is 7.3 (derived; the note gives none). The June report describes its equivalent set as "based on the source code for our internal training stack"; the October note says only "MAI's own codebase" and does not say whether it is the same repository. The vendors that built the other three are not named, and the sizes of all four sets are not given.

Second, every match point sits in a gap. The five ladder rungs, L18 to L42, run up to 1.8 x 10^23 FLOP in the Figure 2 data. The final run is at 2.4 x 10^25. The four matched compute values, 7.6e23 to 2.2e24, all lie between them, in a stretch of 2.1 decades, a factor of 132 (derived), where Figure 3 shows no measured model. The note says "MAI-Base-2's final performance is known, and we include it in the fits", so the curve is pinned at both ends and read in the middle. In its favour, the lab's Figure 2 forecast the final loss from the small rungs alone: predicted 0.80343, actual 0.80583, a miss of 0.30 per cent (derived). That is one check, on one weighted loss, that supports the curve's shape across the gap; it is not four checks.

Third, the note never states DeepSeek's compute. Figure 3 plots it at about 9.4e24, read from the figure's own gridlines to about one per cent. That equals six times DeepSeek's 49 billion active parameters times 32 trillion tokens, and DeepSeek's model card says it pre-trained on "more than 32T" tokens, so on this convention 9.4e24 is a floor (derived). The same reading puts MAI-Base-1 at 6.3e24, which is six times 35 billion times 30 trillion, and the June report adds a further 3.55 trillion mid-training tokens that this convention leaves out. The "FLOPs" in the claim are therefore modelled pre-training FLOPs: six times active parameters times tokens, not GPU-hours, not money and not energy.

Fourth, a FLOP saving is not a cost saving. The note itself says "We rely mainly on EGtime", the wall-clock gain, because it reflects the state of its infrastructure. The ladder runs, the hyperparameter sweeps shown in Figure 4 and any failed runs sit outside the factor, and the factor does not compare the utilisation each lab achieved on its own hardware. Fifth, the saving was spent, not banked. MAI-Base-2's compute is 2.55 times DeepSeek-V4-Pro-Base's and 3.8 times MAI-Base-1's (derived).

Bits per byte: the margins, and a ruler that moved

Figure 1 reports bits per byte, a measure of how well a model predicts held-out text, lower being better and independent of the tokenizer. MAI-Base-2 has the lowest value of the six models on all four sets. Against the best of the other five, Kimi K3 on every set, it is 2.7, 2.5, 2.9 and 0.8 per cent lower on code, QA, STEM and Math; against DeepSeek-V4-Pro-Base it is 7.0, 4.3, 7.9 and 7.8 per cent lower (all derived). Kimi K3 has the same 2.8 trillion total parameters (104 billion active against 80 billion) and is, with Qwen3.8 and MiMo-V2.6-Pro-RL, a post-trained checkpoint. The note says "post-training may affect these evaluations" and does not say in which direction. It gives no uncertainty, no seeds and no set sizes. Bits per byte measures prediction of text; it is not a task benchmark, and the model is described as natively multimodal, with no vision result shown.

The ruler also moves. MAI-Base-1, the same named checkpoint of 35 billion active and 1 trillion total parameters, appears in the June technical report for MAI-Thinking-1 and in the October note, and its scores differ.

MAI-Base-1's bits per byte in two Microsoft AI documents: Figure 10 of the June technical report (read from the rendered page) and Figure 1 of the October note. Change derived.

Held-out set	June report	October note	Change
Code	0.2441	0.2401	-1.6%
QA	0.4421	0.4440	+0.4%
STEM	0.3978	0.4026	+1.2%
Math	0.3844	0.3939	+2.5%

The note does not say why. It does say it "additionally decontaminated all evaluation sets against our training data", so a change in the sets or the procedure is a likely cause (inference). The 2.5 per cent shift on Math is three times MAI-Base-2's 0.8 per cent lead over the best other model on that set. This is not evidence of an error; it is evidence that the October numbers compare within the note and not with the June report. A fitted efficiency factor is read off these same four scores.

One descriptive claim also does not survive a check. The note calls DeepSeek-V4-Pro-Base "the only released base pretraining checkpoint with more than one trillion parameters". Hugging Face's record for Moonshot's Kimi-K2-Base, created 3 July 2025, lists 1,026,470,731,056 parameters in its safetensors metadata, and Microsoft AI's own June report compared MAI-Base-1 with it. The "only" is narrower than the sentence reads, perhaps meaning recent or frontier-scale, which the note does not define. It changes none of the scores; it shows how a label can do the work of evidence.

Stated and not stated: the note, line by line

"Not stated" means not found in the web page or the PDF, both read in full, or in the data their figures embed. It does not mean the information does not exist.

What Microsoft AI's lab note of 15 October 2026 states, and what it does not. Derived figures are marked.

The question	Stated in the note	Not stated
Status	Pre-training "recently completed"; the model "is currently undergoing post-training".	A release date, post-trained results, or whether weights or an API will exist on any date.
Hardware and time	16k GB200 GPUs, 38 days in August and September 2026, 21% MFU, 89% goodput.	Cluster layout, whether 16k is 16,384, whether utilisation is over productive time, cost, energy, whether mid-training is inside the 50T tokens or the 38 days.
Training data	Pre-training "built on organic data", no distillation, every token processed in-house, March 2026 knowledge cutoff, a crawler that respects robots.txt, 50T tokens.	Sources, licences, handling of personal data, any audit of the no-distillation statement.
Internal consistency	Unique corpus "grew by roughly 36%" (Figure 10).	Why Figure 10's own values sum to 11.7T unique tokens for MAI-Base-1 and 19.2T for MAI-Base-2, which is +63% (or +39.5% without the new vision-only data), derived.
Evaluation	Bits per byte on four held-out sets; code from MAI's own codebase, three sets commissioned from vendors; all decontaminated.	Vendor names, set sizes, uncertainty, any task or vision or multilingual result.
Comparison set	Four named models; three are post-trained checkpoints.	How the four were chosen, the direction of the post-training effect, any closed frontier model.
Efficiency claim	4.2 to 12.3x against DeepSeek-V4-Pro-Base, 6.3 to 12.7x against MAI-Base-1.	DeepSeek's compute and how it was obtained, the fitted equations, intervals, the cost of the ladder and sweeps.
Safety and governance	Nothing on testing, risk or regulation. One footnote excludes web sources that breach Microsoft's Responsible AI policies.	Any framework assessment, dangerous-capability result, external tester, EU notification or UK access.
Licence	An intention to "license our model weights to trusted partners through Foundry".	Terms, who is trusted, the format, price, permitted use, territory, hashes or signing.
Independent evidence	None.	No independent evaluation; Artificial Analysis lists no MAI-Base-2 entry and Hugging Face lists no MAI-Base-2 weights (checked 18 October 2026).

Friendly names: what each label does and does not establish

A label is not a control and a claim is not evidence. The table takes each comforting phrase in the note and sets it against what the note, the licence texts and the earlier Microsoft AI documents show.

Labels in the lab note, how it uses them, and what the record shows. Quotations are the note's own words.

Label	How the note uses it	What the record shows
"state-of-the-art"	"our new state-of-the-art model, MAI-Base-2".	Lowest bits per byte of six models on four sets, by 0.8 to 2.9% over the nearest. No closed frontier model, no task benchmark, no uncertainty.
"outperforms every open-weight model we tested"	The four open-weight models compared.	"Tested" means chosen by the lab; three are post-trained. DeepSeek-V4-Pro-Base's weights carry the MIT licence and can be downloaded and re-run by anyone. MAI-Base-2 cannot be re-run by anyone outside.
"organic data", "does not involve distillation"	"pre-training is built on organic data which does not involve distillation from other models".	A statement of the lab's, with no audit and no source list. The June MAI-Thinking-1 page makes the same claim in other words. Figure 9 shows a code sequence that starts with an Apache 2.0 licence header from a public pull request; the note says nothing about code licences.
"strong data provenance"	"every training token" processed in-house; a crawler that respects robots.txt.	In-house processing says where data was handled, not where it came from or whether it was licensed. The note does not claim licences.
"trusted partners"	The planned recipients of licensed weights.	Undefined and unpublished. Licensed weights are not the open weights of the comparison set and not an API Microsoft controls: each licensee would hold a copy.
"FLOPs-efficient"	"4-12x more pre-training FLOPs-efficient".	Modelled FLOPs from a fitted curve, not cost, energy or time; the high end is on Microsoft's own code set.

On provenance, this site's briefing on MiMo-V2.6-Pro, one of the four compared models, found that an open-weight licence tag and a provenance statement are different things. The same applies here: a no-distillation statement is a promise a licence could warrant, and the note does not say that one will.

The EU line, and what Microsoft's own framework says about it

Article 51(2) of Regulation (EU) 2024/1689 says a general-purpose AI model "shall be presumed to have high impact capabilities" when "the cumulative amount of computation used for its training measured in floating point operations" exceeds 10^25. Article 52(1) requires the provider to notify the Commission "without delay and in any event within two weeks after that requirement is met or it becomes known that it will be met". Article 55 then adds model evaluation including adversarial testing, assessment and mitigation of systemic risk, serious-incident reporting and cybersecurity protection. The consolidated text of 27 July 2026, which EUR-Lex says is "meant purely as a documentation tool" and "has no legal effect", leaves Articles 51 and 52 unchanged after the Digital Omnibus (Regulation (EU) 2026/1744); Chapter V has applied since 2 August 2025 and, reading Article 113 as consolidated, the Commission's fining power over providers, up to 3 per cent of worldwide turnover or EUR 15 million, from 2 August 2026. This site's briefing on the Act and agentic AI sets out the Omnibus dates.

The Commission's questions-and-answers page adds two points a reader should hold together. The Act's duties apply to providers placing a model on the Union market, and its Article 2(8) excludes development "prior to their being placed on the market or put into service". But the page says certain duties "pertain to the development phase", naming the duty "to notify the Commission that their general-purpose AI model meets or will meet the training compute threshold", and says providers can know before training ends whether they will cross it. What is not established: whether Microsoft has notified, whether MAI-Base-2 will be placed on the EU market (licensing weights through Foundry may be how), whether Microsoft would argue under Article 52(2) that the presumption is rebutted, and how post-training compute will count. This briefing did not find or read any list the Commission has published of models with systemic risk. It is not legal advice.

Microsoft's own Frontier Governance Framework, dated February 2026, points the same way. It says a leading-indicator assessment is run on "any model that is in scope for frontier model requirements under applicable laws, such as the EU AI Act", and that it is "run during pre-training, after pre-training is complete, after post-training, and prior to deployment". It adds that the model's capabilities, evaluations and risk classification "will be shared publicly", with care taken over information hazards and commercially sensitive information. The lab note says pre-training is complete and says nothing about that assessment. That is an absence in a lab note, not evidence that the assessment was not run. The June technical report for MAI-Thinking-1, a model whose base sits at 6.3e24 to 7.0e24 FLOP on the lab's convention, under the line before post-training (derived), states that "Structured dangerous-capability / uplift evaluations" "are out of scope for this release". Of the two MAI base models in the note's comparison, only MAI-Base-2 sits above the line (derived).

Microsoft AI's draft Code of Conduct for MAI models, published for consultation on 14 September 2026, says "we are not using it to train our models today" and that MAI models "undergo red-teaming, safety evaluations, and pre- and post-deployment review". A draft is a statement of intent. None of it is referred to in the lab note.

UK: no compute threshold found, and what the UK does say

What was looked for, and found. A UK compute threshold, or a statutory duty to give government pre-release access, was searched for on the AI Security Institute's about, home, research and trends-report pages and its July 2026 blog post, in the government's 12 October 2026 speech and news release on AI risks, in the Department for Science, Innovation and Technology's Code of Practice for the Cyber Security of AI, and in gov.uk search. None was found. No AI Security Institute publication on MAI-Base-2 or any MAI model was found.

What the UK says is about access and testing by arrangement. The Institute's about page lists "Testing leading AI systems before they are released publicly and collaborating with top AI companies" and "Pre-deployment access to leading AI models". The AI Minister's speech of 12 October 2026 says the government has been working with the US government and the labs "to retain access for Britain's AI Security Institute to the most powerful AI models before they are released", that the Institute is now evaluating the latest generation of models (it names one from another lab, not Microsoft), and "We will legislate wherever necessary". To developers it says "if you can't adequately control the risks, do not release the system". Those are statements of policy and arrangement, not a threshold in law, as read.

On weights, the Institute's 17 July 2026 post tested DeepSeek V4-Pro, the lab note's reference model, and reported that "Our evaluations of recent open weight models were largely unimpeded by safeguards" and that "Once open weight models are released, these options are lost permanently". MAI-Base-2 is not an open-weight release, so that is context rather than a finding about it. The point that carries over, as inference, is that each licensed copy sits outside Microsoft's own controls, and what binds the holder is the licence, which is unpublished, and the holder's own security.

The DSIT Code of Practice ("Published 31 January 2025") is voluntary, and its "shall" marks a requirement of the voluntary code. Microsoft would be a Developer under it and a licensee a System Operator. The provisions that bear on this model are: 5.4.2, "Where training data or model weights could be confidential, Developers shall put proportionate protections in place"; 7.3, "Developers and System Operators shall re-run evaluations on released models that they intend on using"; 8.1.2, "Developers shall release cryptographic hashes for model components that are made available to other stakeholders to allow them to verify the authenticity of the components"; and 9.2, "System Operators shall conduct testing prior to the system being deployed with support from Developers". Provision 8.2 also asks Developers to document how public training data was obtained. None of this is law.

On training data, sections 135 and 136 of the Data (Use and Access) Act 2025 require the Secretary of State to publish an economic assessment and a report that must cover, among other things, "the disclosure of information by developers of AI systems about" their use of copyright works and their use of web crawlers. Those are duties on government to report, not duties on developers to disclose, and the reports themselves were not read for this briefing. No UK counterpart to the EU's training-content summary duty was found in what was read. In what was read, then, no UK rule on training-data disclosure applies to developers, and "organic data" is a claim nothing requires Microsoft to substantiate.

If weights arrive: what holding them would take (illustrative)

The note states no release format and no serving specification, so this is arithmetic on the stated 2.8 trillion total and 80 billion active parameters at three common formats, set against NVIDIA's own GB200 figures: 372 GB of HBM3E and 16 TB/s per two-GPU superchip, which is 186 GB and 8 TB/s a GPU, and 13.4 TB and 576 TB/s for a 72-GPU NVL72 rack.

Weights memory for 2.8 trillion parameters at three formats, against one GB200 NVL72 rack (13.4 TB HBM3E, 576 TB/s, NVIDIA page read 18 October 2026). Derived; format not stated by the note.

Format (not stated)	Weights	Share of one rack's HBM	Decode ceiling, one rack, batch one
BF16, 2 bytes	5.6 TB	41.8%	3,600 tokens a second
FP8, 1 byte	2.8 TB	20.9%	7,200 tokens a second
FP4, 0.5 byte, scales ignored	1.4 TB	10.4%	14,400 tokens a second

The ceiling is memory bandwidth divided by bytes read per token (80 billion active parameters times bytes per parameter): an upper bound, not a benchmark. It ignores batching, the KV cache, expert placement and load imbalance, interconnect and speculative decoding, and every expert must be resident whichever are read. An eight-GPU node holds 1.49 TB, so only the FP4 case fits in one node and then with almost no room for a cache. Capacity is not the limit, since even BF16 weights fit in under half of one rack's memory. Bandwidth sets the speed, and the number of racks a licensee needs depends on the format and the throughput wanted, neither of which is stated.

What to do now, in order

What could not be verified

• The run. The GPU count, days, utilisation, goodput, parameters and tokens are Microsoft's statements. The reconciliation shows they agree with each other.
• The evaluation. Vendor names, set sizes and uncertainty are not stated, and MAI-Base-2 cannot be evaluated by anyone outside Microsoft.
• DeepSeek's compute. Derived from the model card's "more than 32T" tokens and 49 billion active parameters, and consistent with where the note's Figure 3 plots it; the note states no figure.
• Figure data. Figures 1 and 3 print their values or labels in the PDF. The Figure 2 and Figure 10 values, including 372,530 read as a step count, come from data embedded in the web page, not from the visible text.
• The 36% against 63%. The prose says roughly 36%; the figure's values give 63%, or 39.5% excluding vision-only data. The note may define unique differently.
• June report. Figure 10 was read from the rendered page. Its DeepSeek entry names the post-trained repository, DeepSeek-V4-Pro, not the Base.
• EU. The Official Journal text, the consolidated text of 27 July 2026 and the Commission's questions and answers were read. The Commission's guidelines on how compute is counted, any list of systemic-risk models and any Microsoft notification were not. This is not legal advice.
• UK. No compute threshold and no Institute publication on MAI models was found. The reports the Data (Use and Access) Act requires were not read.
• Not read. The MAI-Code-1.1-Flash post, which the note does not refer to, and Microsoft's Foundry catalogue, which needs scripts. Microsoft's OpenAI stake is as stated on 28 October 2025.
• Time-stamped. Sources were read between 16:18 and 16:35 BST on 18 October 2026. Post-training results, a release, an evaluation or a notification could appear within hours.

The question that exposes the gap

If MAI-Base-2 reached you next quarter as licensed weights, which part of the 4 to 12 times claim could you check yourself: the evaluation sets, the fitted curves, or the reference model's compute?

The answer is the last one, and only partly. The sets are Microsoft's or unnamed, the curves are fitted on a ladder you cannot rerun, and the one input an outsider can rebuild, DeepSeek's compute, is a floor derived from a model card.

Key facts