Preprints from the lab. Three results, one thesis: verifying an answer is far cheaper than producing it, and that asymmetry is enough to build a trustworthy network on untrusted machines. Every claim here is machine-checked and measured on a production engine.
The lab rests on a single asymmetry: re-checking a model's answer costs a small fraction of generating it, a few percent on datacenter GPUs. The papers below turn that one number into a mechanism. The first builds a permissionless market where every answer can be re-checked; the second carries the cheap check from text to diffusion image, audio, video, and speech; the third proves that once checking is this cheap, the slashable bond providers used to post is redundant.
The foundational paper. It shows you can verify a language-model answer with a single teacher-forced prefill of the prompt plus the claimed output, with no autoregressive decoding, and that this is sound rather than merely cheaper. A provider commits to its work in fixed windows of 32 tokens, binding two complementary fingerprints, a sign-random-projection sketch of the hidden states and a top-k logprob digest, into a Merkle root signed with a hybrid post-quantum key. Auditors, the Golden Eyes, re-check a random sample drawn from an unpredictable beacon, so a provider cannot tell which replies are watched; in deployment each audit runs through two independent auditors and is accepted only if both agree, so a single colluding auditor cannot wave a bad reply through.
An honest re-run scores essentially zero on both checks; a substituted, cheaper model scores about 1.1 on the hidden-state check, an order-of-magnitude margin decisive on a single reply. Sybil resistance is reassigned from staked capital to a proof-of-distinct-GPU throughput challenge that doubles as the audit itself.
The cheap text checks could not reach diffusion and flow models, because those produce no per-token distribution; they denoise a continuous latent over N steps. This paper introduces a lightweight, diffusion-specific trajectory commitment: a Merkle root over (step, latent digest) at sampled steps plus the final latent. A verifier re-runs a single reference denoising step and checks the committed next latent matches within a tolerance band, at cost roughly 1/N.
It was implemented and measured on three independent engines, a 3.5B diffusion-transformer audio model, a Euler latent-diffusion image model, and video. An honest re-run reproduces each checked sampled step to relative-L2 of zero; a 5% conditioning perturbation diverges to 0.27. Image and video (S2V) are single-step re-checkable at every step; the audio DPM++ guidance interval (about the middle half of the steps) is now closed too, by committing the per-step guidance momentum so a verifier re-checks a band step's update and its momentum recurrence together. The same idea extends to codec and vision-language models, where a generated token's hidden state already binds correct image processing for free.
The usual choice between posting a large slashable bond and subjective scoring with no bond is an artifact of verification cost. This paper proves that under full-coverage cheap verification a correctness bond is redundant: simply forfeiting the cheated request's escrowed fee already makes honesty the best response, because market viability forces the gain from cheating below the fee. Individual verdicts feed a sequential probability ratio test, so honest cross-hardware noise will not eject a provider while persistent cheating crosses the threshold in a number of audits that grows only logarithmically.
The result is fully machine-checked, in Z3 and Lean 4, including the Ville maximal inequality behind the false-ejection bound, with PRISM-games reproducing the honesty boundary. A corollary proves sharding a model across many machines cannot weaken the deterrence, which is what makes verified split inference possible at zero bond.
We state the open gate plainly. On the Verified tier the statistical soundness has a measured, not proven, margin in one narrow band: near-lossless quantization fraud, where the activation signal is the same magnitude as the honest cross-hardware drift. For that band the cheap statistical check alone may not separate, and the network falls back to the Confidential tier plus weight declaration. The diffusion verification and the zero-bond mechanism are the cleanest novelties; the verified-tier numbers are promising but unsettled, and we say so.