Pearl proof-of-useful-work blockchain

What it is

Pearl is a layer-1 blockchain developed by Pearl Research Labs (Pearl Research Labs). It replaces hash-based mining with a proof of useful work built on matrix multiplication ^{2 3}. Its specification describes a protocol "in which the unit of mining work is FP8 matrix multiplication on GPUs" ¹. This extends the integer proof of useful work of Komargodski and Weinstein ^{1 4}.

Pearl presents the scheme as "2-for-1": GPUs produce proof of work "as a side-effect of AI training and inference workloads" ². Its public monorepo contains several components ³:

• a reference full node;
• a vLLM-based GPU miner;
• a Plonky2/STARKy-based proof-of-work circuit and verifier.

How it works

Mining. A miner multiplies matrices of its choosing, which Pearl describes as "the operands of an AI training or inference workload" ¹. Each block involves four steps ¹:

1. Low-rank noise matrices are derived from public seeds.
2. The noised product is computed with quantised FP8 arithmetic.
3. Output tiles are hashed as lottery tickets.
4. A tile that meets the target wins the block.

The miner then subtracts lower-order correction terms to recover the useful product "at FP8-level accuracy" ¹.

Checks on winning tiles. A jackpot policy approves a winning tile only when several statistical checks pass. These checks are meant to exclude degenerate inputs ¹.

Verification. The verifier "checks one tile of the matmul, never the whole product" ¹. It recomputes that tile bit for bit, which relies on deterministic GPU arithmetic ¹. A zero-knowledge verifier can keep the miner's operand data private while proving that the tile satisfies the protocol rules ¹. The integer whitepaper describes hash-based SNARKs (Plonky2), compressed to "below 60KB" by recursion ². An appendix extends verification to mixture-of-experts layers ¹.

Evidence

• A live network. Pearl's integer whitepaper states that the chain became live when the node code was made public ². The repository supports mainnet and test networks, and has published release v1.2.1 ³.
• A serving benchmark. Pearl reports a benchmark on four H200 GPUs comparing Llama 3.3 70B with its "two-for-one" Pearl-certified variant, which re-implements a layer with a new quantisation mechanism ²:
  • the variant reached 17,206.26 tokens per second with pipeline parallelism, and 18,291.66 with four-way data parallelism;
  • the original bf16 model reached at most 15,269.81 tokens per second, and ran out of memory with four-way data parallelism;
  • MMLU scores were close: 0.8180 to 0.8198 for the variant against 0.8193 to 0.8198 ².
• The underlying theory. The construction behind Pearl proves a multiplicative overhead of 1 + o(1) over naive matrix multiplication ⁴. Pearl's FP8 specification states a "1 + o(1) factor" overhead, without a measured percentage ¹.
• Independent measurement. Basu measured Pearl's mainnet in May 2026, counting 8,012 online workers on the AlphaPool mining pool, estimated to hold about 21% of network hashrate. String analysis suggests that the dominant mining software, from a third party, contains no inference code and generates matrices from random seeds. Random matrices passed verification in the study's tests, and a mining pool accepted shares mined with them ⁵.

Limitations

Known speedups. Pearl documents known mining speedups and the checks against them ¹. It treats faster honest kernels or hardware as outside the threat model ¹.

Hardness assumption. Security rests on an informal hardness assumption specific to quantised, noised matrices ¹.

Usefulness is not verified. Verification checks the multiplication, not where the matrices came from ⁵.

Benchmark caveats. The benchmark compares a Pearl-certified model with the original model, and reports no run of the same certified model without mining ².

Fit to verification. Pearl's proofs show that work was performed, not that no other work ran. Attestable, which proposes proof-of-work accounting for AI agreements, notes that "a proof of some computation is not a proof of all computation", and that bounding spare capacity needs a credible estimate of the compute available ⁶.