Proposal Explorer

Add claims to see which ones the mechanisms address.

Not counted

Excluded by your filters: Proofs of useful work for capacity accounting and Sampled inference recomputation

Published attempts to break a system, including those that found failures. Testing history does not show that open flaws are resolved.

• Proofs of useful work for capacity accounting: Analysis · excluded by filters
• Sampled inference recomputation: Analysis · excluded by filters

Excluded by your filters

• Proofs of useful work for capacity accounting Prover cooperation is required; the filter allows not required.
• Sampled inference recomputation Prover cooperation is required; the filter allows not required.

Open significant flaws

6 flaws in 2 mechanisms

• Proves that work was done, not that no capacity remains in Proofs of useful work for capacity accounting

  Proof-of-work accounting bounds unmonitored compute only relative to an estimate of what the actor has. Attestable states that the verifier "needs a credible estimate of the compute available" to the actor, and that a proof "cannot discover a datacenter that was never declared". ¹

  Theoretical argument · Significant · Open. On the record

  Related mechanism R1 Chip registries and manufacturing records: A registry of chips is one basis for the estimate of available compute that the flaw's source says the verifier needs. A pointer, not evidence that this flaw is mitigated. Add

  Related mechanism R1 Remote detection of data centres: Looks for data centres that were never declared, which a proof cannot discover. A pointer, not evidence that this flaw is mitigated. Add

• Security rests on new hardness assumptions in Proofs of useful work for capacity accounting

  Komargodski and Weinstein base security on hardness assumptions about batches of low-rank random linear equations, and list PoUW "from more standard or well-studied assumptions" as an open problem. Pearl's floating-point variant introduces a further "quantized-subspace hardness" assumption. ^{3 4}

  Open question · Significant · Open. On the record

• Known shortcuts let a miner claim somewhat more work than it did in Proofs of useful work for capacity accounting

  Pearl's specification lists known mining speedups: crafted inputs, precision shortcuts, seed grinding, work reuse, and faster kernels or hardware. A policy check caps the summands a miner may skip at one-sixteenth of those in a tile. For capacity bounding, any gap between work proven and work possible leaves spare capacity. ⁴

  Theoretical argument · Significant · Open. On the record

• Tolerance for numerical noise leaves a covert channel in Sampled inference recomputation

  Schemes that accept approximate matches can put an upper bound on an adversary's covert bandwidth, but they cannot close the channel. The weight-exfiltration detector cut exfiltratable information to under 0.5%, not to zero, on a 30-billion-parameter mixture-of-experts model under benign prompt traffic. Its authors called the channel's size under adversarial prompts an open empirical question. An independent study showed that an adversary who controls the prompts roughly doubles the bits leaked per token. Across six models, that cut the slowdown from 146–254 times under benign prompts to 60–118 times. The attack widens the exfiltration bound. It does not target the check that outputs match the declared model. ^{6 14 17}

  Demonstrated attack · Significant · Open. On the record

  Related mechanism R3 Deterministic and bit-exact inference: Bit-exact inference would remove the numerical tolerance if exact replay can be deployed with the required weights and configuration. A pointer, not evidence that this flaw is mitigated. Add

• Only recorded traffic is checked in Sampled inference recomputation

  Recomputation checks that recorded, declared workloads are correct. It cannot show that the record is complete. The published schemes do not cover hidden workloads run on the same compute, or substituted work. Rinberg et al. say their exfiltration-detection scheme cannot stand alone. ^{6 18}

  Theoretical argument · Significant · Open. On the record

  Related mechanism R1 Network taps and certifiers: Taps copy and hash all traffic on the monitored links, which bears on whether the traffic record is complete. They do not show what else ran on the same chips. A pointer, not evidence that this flaw is mitigated. Add

• Some inference optimizations are not covered in Sampled inference recomputation

  TOPLOC's authors state that it cannot detect speculative decoding in which a cheaper model does the decoding. They did not test whether it distinguishes types of key-value (KV) cache compression. DiFR was evaluated only on sampling from a single model. Its authors sketch an extension to one speculative-decoding algorithm but do not test it. ^{7 8}

  Theoretical argument · Significant · Open. On the record

Open minor flaws

1 mechanism with minor findings

• Mixed hardware widens the honest baseline in Sampled inference recomputation

  When honest reference runs span different GPU types, the spread of benign scores grows. In DiFR's tests on Qwen3-30B-A3B, pooling A100 and H200 runs left Token-DiFR unable to separate the two smallest tested changes, a temperature of 1.1 instead of 1.0 and a simulated top-2 sampling bug, at the target false-positive rate, while cross-entropy separated them. Matched provider and verifier environments, or pooling that weights rare large deviations, restored detection. ⁷

  Open question · Minor · Open. On the record

Not yet demonstrated

R1 Proofs of useful work for capacity accounting

Mechanisms on the map that are not in the proposal. Pointers, not recommendations. ?

• R1 Remote detection of data centres Add
  • Bears on the open significant flaw “Proves that work was done, not that no capacity remains” in Proofs of useful work for capacity accounting. Looks for data centres that were never declared, which a proof cannot discover.
• R3 Deterministic and bit-exact inference Add

  Excluded by filters: prover cooperation required

  • Bears on the open significant flaw “Tolerance for numerical noise leaves a covert channel” in Sampled inference recomputation. Bit-exact inference would remove the numerical tolerance if exact replay can be deployed with the required weights and configuration.
• R1 Chip registries and manufacturing records Add

  Excluded by filters: prover cooperation required

  • Bears on the open significant flaw “Proves that work was done, not that no capacity remains” in Proofs of useful work for capacity accounting. A registry of chips is one basis for the estimate of available compute that the flaw's source says the verifier needs.
• R1 Network taps and certifiers Add

  Excluded by filters: prover cooperation required

  • Bears on the open significant flaw “Only recorded traffic is checked” in Sampled inference recomputation. Taps copy and hash all traffic on the monitored links, which bears on whether the traffic record is complete. They do not show what else ran on the same chips.
  • Sampled inference recomputation waits on it. In tap-based retrofit designs, recording all inference traffic needs network taps and recomputation servers that can ingest it, in the worst case one recomputation-server network interface per inference front-end interface.

Blockers

8 blockers recorded

• Proofs of useful work for capacity accounting
  • Bounding spare capacity needs a credible estimate of the compute available to the actor, including third-party access. Capacity bounds ¹
  • Proofs of work cannot find facilities that were never declared. Coverage & hidden compute ¹
  • As of September 2026 no implementation, demonstration or independent evaluation of proofs of work for capacity bounding has been published. Adversarial validation
• Sampled inference recomputation
  • In tap-based retrofit designs, recording all inference traffic needs network taps and recomputation servers that can ingest it, in the worst case one recomputation-server network interface per inference front-end interface. Coverage & hidden compute. Waits on Network taps and certifiers ^{13 20}
  • In retrofit designs, the recomputation server must sit inside the prover's data centre, possibly under the prover's physical control, and still be protected from a compromised provider, which Amodo rates 'not on track'. Hardware trust ^{6 13}
  • No independent red-team of a recomputation consistency check has been published (the one independent attack study targets the weight-exfiltration bound), and Amodo rates recomputation red-teaming 'not started'. Adversarial validation ^{13 14}
  • Tolerance-based checks need calibration on trusted hardware and exact knowledge of the provider's sampling procedure, and in one prototype a sampling-implementation mismatch produced large spurious differences. Performance & compatibility ^{7 12}
  • The verifier needs the model weights, so checking a closed-weights model requires a trusted, confidential recomputation environment, which the retrofit designs place inside the prover's facility. Privacy & leakage ^{7 18 19}

From the family or selected implementation's record. ?

Model weights

Depends on the design for Proofs of useful work for capacity accounting and Sampled inference recomputation.

Inputs and outputs

Depends on the design for Proofs of useful work for capacity accounting and Sampled inference recomputation.

Training data

Not involved: Proofs of useful work for capacity accounting and Sampled inference recomputation.

Proofs of useful work for capacity accounting

• R3 Pearl proof-of-useful-work blockchain Open-source project, Pearl Research Labs

Sampled inference recomputation

• R1 AI 2040 inference-only verification stack Proposed architecture, AI Futures Project
• R2 DiFR (Divergence From Reference) Research prototype
• R1 Low-trust AI compute verification system overview Proposed architecture, Machine Intelligence Research Institute
• R1 SASH confidential network logger Research prototype, Singapore AI Safety Hub (SASH)
• R3 TOPLOC Open-source project, Prime Intellect

1. Pacing AI Requires Proof, Attestable (2026). Original
2. Mechanisms to Verify International Agreements About AI Development, A. Scher & L. Thiergart (2025). Original
3. Proofs of Useful Work from Arbitrary Matrix Multiplication, I. Komargodski & O. Weinstein (2025). Original
4. Pearl Floating Point Scheme Specification, Pearl Research Team (2026). Original
5. pearl: Monorepo for the Pearl network, Pearl Research Labs (2026). Original
6. Verifying LLM Inference to Detect Model Weight Exfiltration, R. Rinberg et al. (2025). Original
7. DiFR: Inference Verification Despite Nondeterminism, A. Karvonen et al. (2025). Original
8. TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable Inference, J. M. Ong et al. (2025). Original
9. PrimeIntellect-ai/toploc (GitHub repository), Prime Intellect (2025). Original
10. INTELLECT-2: A Reasoning Model Trained Through Globally Decentralized Reinforcement Learning, Prime Intellect Team et al. (2025). Original
11. adamkarvonen/difr (GitHub repository), A. Karvonen (2025). Original
12. Scaling Recomputation Inference Verification, Amodo Design (2026). Original
13. AI 2040 Plan A — Verification SITREP, Amodo Design (2026). Original
14. Adversarial Entropy Inflation Against Gumbel-Based Inference Verification, N. Kezins (2026). Original
15. SYNTHETIC-2 Release: Four Million Collaboratively Generated Reasoning Traces, Prime Intellect (2025). Original
16. An Inference Verification Prototype — Stage 1, Amodo Design (2026). Original
17. Bit-Exact AI Inference Verification Without Performance Tradeoffs, N. Cankaya (2026). Original
18. Example Schemes for Verifying High-Stakes AI Agreements, Amodo Design (2026). Original
19. A System Overview for Near-Term, Low-Trust AI Compute Verification, N. Cankaya (2026). Original
20. Verification Plan, R. Dean (2026). Original