{
  "schema_version": "1.0.0",
  "rubric_version": "1.0",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)",
  "record": {
    "id": "M-0007",
    "slug": "proofs-of-useful-work",
    "title": "Proofs of useful work and resource exhaustion",
    "aliases": [
      "proof of useful work",
      "PoUW",
      "proof-of-work accounting",
      "resource exhaustion"
    ],
    "status": "draft",
    "last_reviewed": "2026-09-23",
    "review_interval_days": 90,
    "steward": null,
    "provenance": {
      "drafted_by": "ai",
      "reviewed_by": []
    },
    "risk_flags": [
      "R-vendor-reputation"
    ],
    "flags": [
      "provider-reported"
    ],
    "one_liner": "Cryptographic evidence that hardware performed a given amount of agreed computation, proposed as a way to show no spare capacity remained for other work.",
    "summary": "A proof of work shows that a certain amount of computation was done. Proofs of useful work make that computation something valuable, such as the matrix multiplications at the heart of AI models. For verification, the idea is to keep declared hardware fully occupied with agreed, provable work, so that little capacity is left for anything unmonitored. The cryptographic building block exists: a 2025 construction adds asymptotically negligible overhead to large matrix multiplications, and a company reports running a public blockchain built on it. Using it to show that hardware has no spare capacity is only proposed. The biggest obstacle is that the verifier needs a credible estimate of how much compute the prover actually has. The biggest weakness is that such proofs show work was done, but cannot find hardware that was never declared, and do not show what the work was for.",
    "category": "cryptographic-computational",
    "secondary_categories": [],
    "verifies": [
      {
        "claim": "C-0010",
        "role": "primary",
        "note": "On declared hardware only: bounds capacity left for unmonitored work; cannot find undeclared facilities."
      },
      {
        "claim": "C-0003",
        "role": "supporting",
        "note": "Keeping declared hardware provably busy with agreed work, as an alternative to showing it idle."
      },
      {
        "claim": "C-0004",
        "role": "supporting",
        "note": "Attestable's pacing proposal pairs work accounting with ZK inference proofs."
      }
    ],
    "threat_model": "adversarial",
    "adversarial_evaluation": "analysis",
    "hardware_requirement": "none",
    "prover_cooperation": "required",
    "confidentiality": "partial",
    "depends_on": [],
    "readiness": {
      "assessment": true,
      "level": "R1",
      "rubric_version": "1.0",
      "rationale": "R1. The scheme is proposed, and the only implementation proves work for blockchain consensus, not that hardware has no spare capacity.\n\n- **R1** met: Attestable describes such a scheme, with its claim and a key assumption, namely a credible estimate of the actor's compute [[S-1102]]. The underlying proof-of-useful-work construction is publicly specified with its hardness assumptions [[S-1609]]. The capacity-bounding use rests on this one provider's blog proposal.\n- **R2** not met for this use. The most mature implementation, [[I-0004|Pearl]], is assessed R2 only for the narrower claim that GPUs performed matrix-multiplication work. It is built for blockchain consensus, and no public implementation or result uses proofs of useful work to bound the spare capacity of declared hardware [[S-1105]] [[S-1107]].",
      "evidence": [
        "S-1102",
        "S-1609",
        "S-1105",
        "S-1107"
      ],
      "next_level_gaps": [
        "A public implementation or reproducible end-to-end result that uses proofs of work to bound the spare capacity of declared hardware against a stated adversary.",
        "A method for the verifier to obtain a credible estimate of the prover's available compute."
      ],
      "confidence": "low",
      "assessed_by": [
        "ai-draft"
      ],
      "assessed_on": "2026-09-23",
      "status": "current",
      "dispute": null
    },
    "flaws": [
      {
        "assessment": true,
        "title": "Proves that work was done, not that no capacity remains",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Proof-of-work accounting bounds unmonitored compute only relative to an estimate of what the actor has. Attestable states that the verifier \"needs a credible estimate of the compute available\" to the actor, and that a proof \"cannot discover a datacenter that was never declared\" [[S-1102]].",
        "sources": [
          "S-1102"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Security rests on new hardness assumptions",
        "kind": "open-question",
        "severity": "significant",
        "status": "open",
        "description": "Komargodski and Weinstein base security on hardness assumptions about batches of low-rank random linear equations, and list PoUW \"from more standard or well-studied assumptions\" as an open problem [[S-1609]]. Pearl's floating-point variant introduces a further \"quantized-subspace hardness\" assumption [[S-1105]].",
        "sources": [
          "S-1609",
          "S-1105"
        ],
        "response": null
      },
      {
        "assessment": true,
        "title": "Known shortcuts let a miner claim somewhat more work than it did",
        "kind": "theoretical-argument",
        "severity": "significant",
        "status": "open",
        "description": "Pearl's specification lists known mining speedups: crafted inputs, precision shortcuts, seed grinding, work reuse, and faster kernels or hardware. A policy check caps the summands a miner may skip at one-sixteenth of those in a tile [[S-1105]]. For capacity bounding, any gap between work proven and work possible leaves spare capacity.",
        "sources": [
          "S-1105"
        ],
        "response": null
      }
    ],
    "blockers": [
      {
        "text": "Bounding spare capacity needs a credible estimate of the compute available to the actor, including third-party access [[S-1102]].",
        "theme": "capacity-bounds",
        "blocked_by": null,
        "sources": [
          "S-1102"
        ]
      },
      {
        "text": "Proofs of work cannot find facilities that were never declared [[S-1102]].",
        "theme": "coverage-hidden-compute",
        "blocked_by": null,
        "sources": [
          "S-1102"
        ]
      },
      {
        "text": "As of September 2026 no implementation, demonstration or independent evaluation of proofs of work for capacity bounding has been published.",
        "theme": "adversarial-validation",
        "blocked_by": null,
        "sources": []
      }
    ],
    "challenge_themes": [
      "capacity-bounds",
      "coverage-hidden-compute",
      "protocol-soundness",
      "adversarial-validation"
    ],
    "organizations": [
      "O-0120",
      "O-0121"
    ],
    "people": [],
    "sources": [
      {
        "source": "S-1609",
        "supports": "PoUW construction for arbitrary matrix multiplication; overhead; assumptions; open problems",
        "locator": "abstract; §2; Remarks 2.1–2.2; §3; §5; §6.5"
      },
      {
        "source": "S-1105",
        "supports": "Pearl FP8 protocol, verifier, known mining speedups, assumption (provider-reported)",
        "locator": "abstract; §2; §4; §5; §6; §7; App. B"
      },
      {
        "source": "S-1106",
        "supports": "Pearl INT scheme, benchmark and launch statement (provider-reported)",
        "locator": "§3; §4.7; §7 Table 1"
      },
      {
        "source": "S-1107",
        "supports": "public Pearl network code",
        "locator": "README; release v1.2.1"
      },
      {
        "source": "S-0071",
        "supports": "independent measurement of Pearl's mainnet: random-matrix mining; verification does not check matrix provenance",
        "locator": "abstract; measurement and verification sections; conclusion"
      },
      {
        "source": "S-1102",
        "supports": "proposal to use proof-of-work accounting to bound unmonitored compute (provider-reported)"
      },
      {
        "source": "S-1608",
        "supports": "earlier PoUW for fine-grained complexity problems",
        "locator": "abstract"
      },
      {
        "source": "S-0005",
        "supports": "proof-of-work to confirm compute declared as mining is mining",
        "locator": "'Proof-of-Work methods' in the section on verifying known compute is not used for a large training run"
      },
      {
        "source": "S-0018",
        "supports": "memory filling with incompressible noise as a capacity check",
        "locator": "§5.1.2"
      },
      {
        "source": "S-1607",
        "supports": "proofs of space as the storage analogue of proofs of work",
        "locator": "abstract"
      }
    ],
    "concepts": [
      "K-0011",
      "K-0012",
      "K-0016",
      "K-0023",
      "K-0025"
    ],
    "complements": [
      "M-0004",
      "M-0015"
    ],
    "alternatives": [],
    "type": "mechanism",
    "implementations": [
      {
        "id": "I-0004",
        "title": "Pearl proof-of-useful-work blockchain",
        "url": "https://trustbutveri.fyi/implementations/pearl-proof-of-useful-work/"
      }
    ],
    "url": "https://trustbutveri.fyi/mechanisms/proofs-of-useful-work/",
    "source_file": "content/mechanisms/proofs-of-useful-work.md",
    "flags_all": [
      "provider-reported",
      "ai-drafted"
    ],
    "body_markdown": "## How it works\n\n**Proofs of work.** A proof of work gives confidence that some declared amount of computation took place. In cryptocurrency mining, workers hash variants of a message until one hash meets a target, and a verifier can check it quickly [[S-0005]]. Scher and Thiergart note that applying proof of work \"could verify that compute declared to be doing crypto mining is indeed doing it\" [[S-0005]].\n\n**Proofs of useful work.** A proof of useful work (PoUW) makes that computation serve another purpose. Ball et al. gave constructions for problems such as Orthogonal Vectors, 3SUM and All-Pairs Shortest Path [[S-1608]]. Komargodski and Weinstein give a PoUW for arbitrary matrix multiplication, which lets the miner choose its own matrices [[S-1609]]. Their protocol works in three steps [[S-1609]]:\n1. Low-rank random \"noise\" matrices are derived from public randomness and added to the inputs.\n2. The noised product is computed in blocks, and the transcript of intermediate blocks is hashed.\n3. A hash below a difficulty threshold is a winning proof.\n\nThe noise can then be subtracted cheaply to recover the useful product [[S-1609]]. Hardness rests on the transcript rather than the output, so choosing trivial matrices gives no shortcut [[S-1609]].\n\n**Pearl's variant.** Pearl's floating-point specification adapts this to FP8 matrix multiplication on GPUs [[S-1105]]:\n- quantising after the noise is added lets output tiles be hashed directly;\n- the verifier \"checks one tile of the matmul, never the whole product\", recomputing it bit for bit [[S-1105]].\n\n**Use for resource exhaustion.** Attestable proposes proof-of-work accounting to bound compute available for unmonitored activity [[S-1102]]. In its scheme, \"Useful, approved inference contributes to the required work budget\". When demand falls short, \"additional protocol-defined work fills the shortfall\" [[S-1102]].\n\n**Memory analogues.**\n- Proofs of space require dedicating \"a significant amount of disk space\" [[S-1607]].\n- A verification system design proposes filling device memory with incompressible noise and challenging random samples [[S-0018]] (see [[M-0015]]).\n\n## What it establishes\n**What it can establish.**\n- A valid proof of useful work shows that a stated amount of matrix-multiplication work was performed on inputs committed through the noise derivation [[S-1609]] [[S-1105]].\n- If the verifier knows the capacity of declared hardware, a sustained rate of such proofs could bound the capacity left for other work. This is Attestable's proposal [[S-1102]], and it bears on [[C-0010]] and [[C-0003]] for declared hardware.\n\n**What it cannot establish.**\n- **Undeclared hardware.** Attestable states that a proof \"cannot discover a datacenter that was never declared\" [[S-1102]].\n- **What the work was for.** The proof does not show which AI workload, if any, the matrices came from. Komargodski and Weinstein do not address auditing whether matrices come from real AI workloads [[S-1609]]. On Pearl's network, an independent study found that verification \"does not check whether the matrices originate from an AI model\" [[S-0071]]. Attestable proposes pairing work accounting with [[M-0004|proofs of inference]] for that [[S-1102]].\n\n## Threat model\nThe adversary is a miner who tries to produce accepted proofs faster than honest work would allow [[S-1609]]. Security holds in the random-oracle model under a \"direct-product\" hardness assumption about intermediate values of multiplying random low-rank matrices [[S-1609]]. Pearl's variant assumes that computing quantised products of noised matrices \"is not substantially easier than generic quantized products\" [[S-1105]]. It also relies on deterministic, reproducible GPU arithmetic for bit-exact verification [[S-1105]].\n\nFor capacity bounding, the verifier also needs \"a credible estimate of the compute available\" to the actor [[S-1102]].\n\n## Evidence\n- **Theory.** Komargodski and Weinstein prove a multiplicative overhead of 1 + o(1) over naive matrix multiplication [[S-1609]].\n- **[[I-0004|Pearl]].** Pearl publishes the code of a network built on this construction [[S-1107]], and reports that the chain went live when the node code became public [[S-1106]]. It also reports a benchmark on four H200 GPUs. Its \"two-for-one\" variant of Llama 3.3 70B, which re-implements a layer with a new quantisation mechanism, reached up to 18,291.66 tokens per second. The original model's best configuration reached 15,269.81 tokens per second; with the four-way data parallelism that gave the variant its best figure, the original bf16 model ran out of memory [[S-1106]].\n- **Independent measurement of Pearl.** Basu studied Pearl's mainnet in May 2026. String analysis suggests that the dominant mining software, from a third party, contains no inference code and generates matrices from random seeds. Random matrices passed verification in the study's tests [[S-0071]].\n- **Capacity bounding.** As of September 2026 no public result applies proofs of useful work to bounding the capacity of declared AI hardware. Attestable describes its proposal as near-term work [[S-1102]].\n\n## Limitations\n**Verification cost.** Komargodski and Weinstein note that plain verification is \"relatively expensive on the verifier's side\", and suggest the prover can use a zkSNARK to lighten it [[S-1609]]. They also note that storing the transcript takes significant memory [[S-1609]].\n\n**Known shortcuts.** Pearl lists known mining speedups: crafted inputs, precision shortcuts, seed grinding and work reuse. It adds checks to limit them [[S-1105]]. It describes faster kernels or hardware as \"not an attack on the protocol\" [[S-1105]].\n\n**Assumptions and scope.** Open problems include PoUW from more standard assumptions, and PoUW for tasks beyond matrix multiplication [[S-1609]].",
    "body_text": "How it works Proofs of work. A proof of work gives confidence that some declared amount of computation took place. In cryptocurrency mining, workers hash variants of a message until one hash meets a target, and a verifier can check it quickly [S-0005]. Scher and Thiergart note that applying proof of work \"could verify that compute declared to be doing crypto mining is indeed doing it\" [S-0005]. Proofs of useful work. A proof of useful work (PoUW) makes that computation serve another purpose. Ball et al. gave constructions for problems such as Orthogonal Vectors, 3SUM and All-Pairs Shortest Path [S-1608]. Komargodski and Weinstein give a PoUW for arbitrary matrix multiplication, which lets the miner choose its own matrices [S-1609]. Their protocol works in three steps [S-1609]: 1. Low-rank random \"noise\" matrices are derived from public randomness and added to the inputs. 2. The noised product is computed in blocks, and the transcript of intermediate blocks is hashed. 3. A hash below a difficulty threshold is a winning proof. The noise can then be subtracted cheaply to recover the useful product [S-1609]. Hardness rests on the transcript rather than the output, so choosing trivial matrices gives no shortcut [S-1609]. Pearl's variant. Pearl's floating-point specification adapts this to FP8 matrix multiplication on GPUs [S-1105]: - quantising after the noise is added lets output tiles be hashed directly; - the verifier \"checks one tile of the matmul, never the whole product\", recomputing it bit for bit [S-1105]. Use for resource exhaustion. Attestable proposes proof-of-work accounting to bound compute available for unmonitored activity [S-1102]. In its scheme, \"Useful, approved inference contributes to the required work budget\". When demand falls short, \"additional protocol-defined work fills the shortfall\" [S-1102]. Memory analogues. - Proofs of space require dedicating \"a significant amount of disk space\" [S-1607]. - A verification system design proposes filling device memory with incompressible noise and challenging random samples [S-0018] (see Memory wiping and proofs of secure erasure). What it establishes What it can establish. - A valid proof of useful work shows that a stated amount of matrix-multiplication work was performed on inputs committed through the noise derivation [S-1609] [S-1105]. - If the verifier knows the capacity of declared hardware, a sustained rate of such proofs could bound the capacity left for other work. This is Attestable's proposal [S-1102], and it bears on There is no undeclared relevant compute and Declared hardware is idle or shut down for declared hardware. What it cannot establish. - Undeclared hardware. Attestable states that a proof \"cannot discover a datacenter that was never declared\" [S-1102]. - What the work was for. The proof does not show which AI workload, if any, the matrices came from. Komargodski and Weinstein do not address auditing whether matrices come from real AI workloads [S-1609]. On Pearl's network, an independent study found that verification \"does not check whether the matrices originate from an AI model\" [S-0071]. Attestable proposes pairing work accounting with proofs of inference for that [S-1102]. Threat model The adversary is a miner who tries to produce accepted proofs faster than honest work would allow [S-1609]. Security holds in the random-oracle model under a \"direct-product\" hardness assumption about intermediate values of multiplying random low-rank matrices [S-1609]. Pearl's variant assumes that computing quantised products of noised matrices \"is not substantially easier than generic quantized products\" [S-1105]. It also relies on deterministic, reproducible GPU arithmetic for bit-exact verification [S-1105]. For capacity bounding, the verifier also needs \"a credible estimate of the compute available\" to the actor [S-1102]. Evidence - Theory. Komargodski and Weinstein prove a multiplicative overhead of 1 + o(1) over naive matrix multiplication [S-1609]. - Pearl. Pearl publishes the code of a network built on this construction [S-1107], and reports that the chain went live when the node code became public [S-1106]. It also reports a benchmark on four H200 GPUs. Its \"two-for-one\" variant of Llama 3.3 70B, which re-implements a layer with a new quantisation mechanism, reached up to 18,291.66 tokens per second. The original model's best configuration reached 15,269.81 tokens per second; with the four-way data parallelism that gave the variant its best figure, the original bf16 model ran out of memory [S-1106]. - Independent measurement of Pearl. Basu studied Pearl's mainnet in May 2026. String analysis suggests that the dominant mining software, from a third party, contains no inference code and generates matrices from random seeds. Random matrices passed verification in the study's tests [S-0071]. - Capacity bounding. As of September 2026 no public result applies proofs of useful work to bounding the capacity of declared AI hardware. Attestable describes its proposal as near-term work [S-1102]. Limitations Verification cost. Komargodski and Weinstein note that plain verification is \"relatively expensive on the verifier's side\", and suggest the prover can use a zkSNARK to lighten it [S-1609]. They also note that storing the transcript takes significant memory [S-1609]. Known shortcuts. Pearl lists known mining speedups: crafted inputs, precision shortcuts, seed grinding and work reuse. It adds checks to limit them [S-1105]. It describes faster kernels or hardware as \"not an attack on the protocol\" [S-1105]. Assumptions and scope. Open problems include PoUW from more standard assumptions, and PoUW for tasks beyond matrix multiplication [S-1609].",
    "referenced_by": [
      {
        "id": "M-0004",
        "title": "Zero-knowledge proofs of inference",
        "url": "https://trustbutveri.fyi/mechanisms/zk-proofs-of-inference/"
      },
      {
        "id": "I-0005",
        "title": "Attestable zero-knowledge inference prover",
        "url": "https://trustbutveri.fyi/implementations/attestable-zk-inference/"
      },
      {
        "id": "I-0004",
        "title": "Pearl proof-of-useful-work blockchain",
        "url": "https://trustbutveri.fyi/implementations/pearl-proof-of-useful-work/"
      },
      {
        "id": "C-0003",
        "title": "Declared hardware is idle or shut down",
        "url": "https://trustbutveri.fyi/claims/declared-hardware-is-idle/"
      },
      {
        "id": "C-0010",
        "title": "There is no undeclared relevant compute",
        "url": "https://trustbutveri.fyi/claims/no-undeclared-compute/"
      },
      {
        "id": "K-0011",
        "title": "Proof of (useful) work",
        "url": "https://trustbutveri.fyi/concepts/proof-of-useful-work/"
      },
      {
        "id": "O-0120",
        "title": "Attestable",
        "url": "https://trustbutveri.fyi/organizations/attestable/"
      },
      {
        "id": "O-0121",
        "title": "Pearl Research Labs",
        "url": "https://trustbutveri.fyi/organizations/pearl-research/"
      }
    ]
  }
}