Proof of Useful Inference

Computation can be relocated, not deleted.

It is worth stating the hard limit before the design, because it disciplines everything that follows. An inference result is a deterministic function of the input and the model weights. To obtain the output one must physically evaluate that function, and by Landauer's principle there is no computation without a physical substrate. No hash, no ledger structure, and no clever protocol performs inference for free. The honest goal is therefore not to avoid the computation, which is impossible, but to make that computation the security work, so the energy a proof-of-work network already spends produces something of value rather than a discarded number.

What a useful proof must satisfy.

A useful proof-of-work has to do everything the classical version does, and one thing more. We hold the design to six requirements.

1. Fair leader election. Winners are chosen in proportion to honest work, and the process resists grinding.
2. Sybil resistance. Influence is tied to a scarce physical resource, here the ability to perform inference.
3. Cheap public verifiability. Any participant can confirm the claimed work far more cheaply than performing it.
4. Genuine usefulness. The work is real inference that users want, not a synthetic puzzle.
5. Low variance. Rewards track sustained throughput rather than luck.
6. Decentralizability. The hardware can be obtained by many independent operators.

Classical proof-of-work meets every requirement except the fourth. Most naive attempts at useful work fail the third, because verifying the work costs as much as doing it, or the first, because the work has no tunable difficulty. PoUI is constructed to meet all six at once, and the rest of the paper is largely a study of how.

Each verified inference is a ticket.

A single pairing of a model and an input has exactly one correct output, so there is nothing to grind and no natural source of difficulty inside one inference. PoUI draws its difficulty from volume instead. A miner takes tasks from a shared, signed task pool, runs each forward pass, and treats the commitment H(taskId, modelId, output) as a lottery ticket. A ticket below the network target wins the right to extend the ledger. Because every distinct task yields one ticket, the probability of winning rises linearly with the number of inferences performed, which is the property we want: mining rate equals inference rate. Tasks cannot be invented, since each is signed into a canonical pool of user requests and protocol-defined useful filler, for example re-embedding public corpora, and this closes the door on ticket grinding.

Every model family, and where it lands on the roofline.

The scheme must serve every useful model family, yet these families behave very differently on real silicon, and a design that ignores this will fail in production. The two quantities that decide behaviour are the arithmetic intensity, meaning operations performed per byte of weights moved, and whether the weights fit in on-chip memory. When intensity falls below the roofline knee, that is peak operations divided by memory bandwidth, the model is limited by moving weights rather than by the arithmetic units. Single-stream decoding of a large language model is the extreme case, and batching is the remedy, since it amortizes each weight read across many tokens.

The asterisk marks results that are exact only with fixed integer kernels and a canonical reduction order, as specified in Section 7. Figures come from the virtual test in Section 13.

The implication for the silicon is decisive. Raw operations per second are not the design target for the models that matter most. For large models the design is dominated by memory bandwidth and capacity, and by whatever batching and parallelism let the arithmetic units reach the compute roof. Small and quantized models, meaning classifiers, embeddings, vision networks, and small language models, run compute-bound at very high throughput, and they are the natural first workloads for a young network.

The chip at the block level.

The mining chip is an inference accelerator, a large multi-precision multiply-accumulate fabric fed by a deep memory hierarchy, with two additions that a commercial part does not carry. The first is a consensus and attestation core that binds every forward pass to the protocol. The second is a determinism unit that guarantees a bit-reproducible result, which is what makes the work checkable by others.

The compute fabric is an array of systolic tiles doing multiply-accumulate, with multi-precision datapaths so a single fabric can serve ternary and integer models as well as models that need the range of FP8, along with structured sparsity for throughput and dedicated units for the work that is not matrix multiplication, namely vector operations, softmax and attention, and normalization. The memory hierarchy is the real bottleneck, as Section 3 showed, so the on-chip SRAM is generous and the HBM is sized for full model weights and the key-value cache. The interconnect exists because the largest models do not fit one chip, and the consensus layer treats a bonded multi-chip module as a single logical miner. The consensus core is what turns an accelerator into a miner, and the determinism unit, treated in Section 7, is what makes its output something others can check.

The processing tile, up close.

Zooming into one processing element clarifies both performance and verifiability. A tile is a small systolic array of multiply-accumulate lanes. Weights are held stationary in local registers while activations stream through, which is the arrangement that best amortizes weight movement for the general matrix multiplications that dominate a transformer. Each lane multiplies a weight by an activation and adds the product into a wide accumulator. The multiplier is reconfigurable across precisions, so the same lane can do two INT4 multiplies, one INT8 multiply, or one FP8 multiply per cycle, and structured sparsity lets the lane skip the zeros in a 2:4 pattern.

The single most consequential micro-architectural decision is the accumulator. If products were summed in floating point, the result would depend on the order of accumulation, because floating-point addition is not associative, and two honest chips could then disagree. By accumulating in a wide fixed-width integer with defined saturation, and by fixing the order in which partial sums are combined across lanes and tiles, the tile produces the same bits on any conforming device. Performance and verifiability are thus solved by the same piece of silicon, which is a satisfying property for a design to have.

Where the area and the watts go.

A useful sanity check on any accelerator is how its area and power divide across functions. The table gives an illustrative split for a datacenter-class part in the seven-hundred-watt range. The figures are engineering estimates meant to show proportion, not a tape-out specification, and the headline is that the consensus and determinism additions are small, while memory dominates as the roofline predicts.

The lesson is encouraging for the thesis. Turning an inference accelerator into a verifiable miner costs a small single-digit fraction of the die, because hashing and commitment are inexpensive next to matrix multiplication, and the determinism guarantee is mostly a matter of how the existing datapath is used rather than extra hardware.

The specification that makes verification possible.

Verification by re-execution only works if two honest devices produce identical output bits for identical input. This is not automatic. It requires a specification that every conforming implementation follows to the letter, and writing that specification carefully is one of the central contributions of this design. We state the rules that a canonical inference must obey.

1. Integer accumulation only. All reductions accumulate in a fixed-width integer with defined overflow and saturation. Floating-point accumulation is forbidden in the canonical path, because its non-associativity destroys reproducibility.
2. A fixed reduction order. Dot products and cross-tile reductions follow a specified tree, so the grouping of partial sums is identical regardless of how many lanes a given chip has.
3. Canonical quantization and rounding. Scale factors, zero points, per-tensor or per-channel parameters, and the rounding mode, which is round half to even, are fixed and are part of the model commitment.
4. Canonical nonlinearities. Activations, softmax, and normalization are computed from committed fixed-point approximations or lookup tables, never from a vendor math library, so every device produces the same bits.
5. No opportunistic precision. No fast-math, no silent reduced-precision accumulation, and a specified fused multiply-add behaviour.
6. A committed artifact. The model identifier is the hash of the weights together with the quantization parameters and the kernel-specification version, which pins exactly which computation is being proved.
7. Deterministic randomness. Dropout is off at inference, and any sampling seed is derived from committed chain entropy, so a stochastic decode is still reproducible given the seed.
8. Conformance vectors. The specification ships with golden input and output pairs that any implementation must reproduce bit for bit to be certified, which is how multiple vendors stay compatible.

With these rules an inference becomes a mathematical object with one correct answer that any party can recompute, and that is precisely what turns cheap re-execution into a real security guarantee.

From cheap and conditional to costly and trustless.

Given determinism, several verification methods become available, and they trade cost against the strength of their trust assumption.

The pragmatic default is probabilistic re-execution. A committee, selected by the verifiable random function inside the consensus core, re-runs a random sample of claimed inferences. On a deterministic model any mismatch is undeniable, so the offender's stake is slashed and the block is orphaned. An interactive fraud proof, which narrows a dispute by bisection to a single step, bounds the cost of adjudication. The virtual test in Section 13 shows that a sample rate near one percent catches a persistent cheater with near-certainty, since the probability compounds every round. Zero-knowledge proofs are the trustless endgame, once their cost falls, and trusted execution is a practical bridge for floating-point models at the price of a hardware-trust assumption.

Deliberately independent of the ledger.

PoUI provides Sybil-resistant, difficulty-tunable leader election together with useful output, and it does not prescribe how the ledger is organized. The ticket target sets difficulty, adjusted to hold a target block rate against the total inference throughput of the network. The winning ticket's verifiable random function supplies the randomness for committee selection and ordering. Because the mechanism only needs a rate-limited stream of verifiable winners, it composes with a linear chain, a block directed-acyclic graph, a blockless transaction graph in which each new inference vertex validates its predecessors, or an external settlement and verification layer. Finality and data availability are delegated to whichever of these is chosen.

Adversaries, and how each is answered.

Emission pays for real work, and demand is intrinsic.

Two revenue streams reach a miner for each verified inference, a protocol subsidy and a user task fee, and the miner posts stake that is slashed on a caught mismatch, so security capital stands behind correctness. The property that distinguishes this design from classical proof-of-work is useful energy. Nearly all of the power expended produces inference of value, against essentially none for hash-only mining. Because demand for the network's unit of account is now tied to demand for verified inference, usage and security reinforce each other rather than competing for the same budget. The incentive is compatible as long as verification is cheaper than the expected penalty for cheating, and as long as honest inference remains the cheapest way to earn a ticket, both of which the preceding sections are designed to ensure.

The hardest external risk is who can make the chips.

Any regime built on specialized silicon risks centralizing around whoever can fabricate or buy it, and we do not minimize this. Four measures push the other way. Early generations target commodity integer accelerators, so participation does not wait on custom silicon. An open reference architecture and, above all, the determinism specification let several vendors interoperate. A general-purpose fallback lane keeps the network open during the bootstrap. And the default verification method, re-execution, needs no specialized hardware of its own, so checking the network is always within reach of ordinary participants.

Feasibility numbers from simulation.

A runnable model exercises the mechanism, the roofline across model families, determinism, verification, and economics. The results below are illustrative, and the point is the ratios and the mechanism, not a hardware specification.

An honest ledger of what remains.

The path we favour begins in software and ends in new physics. It starts with a software implementation of PoUI on commodity integer accelerators, verified by re-execution over a deterministic model set, which proves the accounting and the verification economics on real workloads. A first-generation ASIC then adds the consensus and determinism blocks to an integer fabric for classifiers, embeddings, and small language models. A second generation brings FP8, mixture-of-experts, a trusted-execution path, and multi-chip operation for larger models, with zero-knowledge pilots. A third generation moves the matrix engine to analog or optical operation for low-energy inference of large models, with zero-knowledge proofs as the trustless default.

We are equally clear about the problems that are not solved. Deterministic, hardware-native models trail the best floating-point models, so PoUI serves bounded, verifiable inference first, not open-ended frontier generation. Cross-vendor determinism depends on the specification and the conformance vectors being adopted in practice. Trustless proofs for large models remain expensive, and re-execution or trusted execution must bridge the gap. Large-model economics are governed by the memory wall, which batching and sparsity ease but cannot abolish. Hardware access must be kept open deliberately, or the design centralizes. And the task supply must be genuinely useful, so that the protocol's filler work earns its keep rather than becoming busy-work by another name.

Authorship.