Proof of Inference
Why it can't be faked
An inference provider can promise a high-quality model and quietly run a cheaper one. As long as the random draw is private, this cannot be proven. A weaker answer can always be blamed on chance, and the customer may even start doubting their own prompt, while the real cause is the lower-quality model they were sold.
TensorCash makes the draw public, so every inference provider leaves a trail. The proof records the scores the model gave at each step together with the outcome of the hash that picked each word (see How it works).
Every model scores words in its own way, so the scores work as an identifier of the model. A verifier reruns the promised model over the same question and answer, at a fraction of the original effort, and checks two things [1][2].
Check 1
Do the recorded scores match those of the promised model?
Check 2
Does the outcome of each hash, applied to those scores, pick the word that was actually written?
Only when both checks pass is the answer accepted as coming from the promised model.
Ran the promised model
- Your58%
- favourite44%
- animal71%
- is92%
- probably18%
- a87%
- dog35%
Ran a different model
- Your58%
- favourite44%
- animal71%
- is92%
- probablyrecorded 41% · promised 18%
- a87%
- dogrecorded 62% · promised 35%
Same text, different scores, and the verifier still catches it.
A different model can pick the same word by chance, but not throughout a whole answer. That is why a block needs a full window of 256 tokens, and why windows with too little uncertainty, called entropy, are rejected. If the model was on average almost certain of every word, the window says too little about which model wrote it [1].
Other ways to cheat
Some attempts are already ruled out by the way blocks are made. Work cannot be prepared before the latest block exists, and a lighter model faces a harder target. A window also only competes for a block once all 256 tokens have been written, so there is no way to stop early and skip to the result. Two other attempts remain, and both are limited.
Registering a hollow model
A model that claims more computation than it actually uses is stopped at registration, and if caught later, it is banned and its deposit burned [1].
Using a cheap model to pick promising prompts
A miner could let a cheap model search for prompts that lead to a winning answer, assuming the expensive model will give that same answer, and then run only those prompts on the expensive model. The expensive model does not give the same answer, so the cheap model's result says nothing about it. Every block still needs a full window from the promised model that passes all three checks, so the real work still has to be done [1].
References
- [1]Inference Verification: Mathematical Specification, Attack Surface.tensorcash.org/whitepapers/Verification_Whitepaper-modern.pdf
- [2]Verifiable Inference: Making Model Execution Checkable, Tradeable, and Mineable.tensorcash.org/whitepapers/Verifiable_Inference.pdf