Verification

What gets audited, and what cannot be

Only batch work. That is a structural limit rather than a choice: an interactive completion's prompt is never written to disk — it lives for the length of the request that streams it and is gone — so there is nothing left to re-run. A batch command keeps its prompt and its answer, because a batch outlives the request that queued it, and that is exactly the evidence an audit needs.

We could audit everything by storing every prompt anyone has ever sent. We would rather audit a sample of the work than keep all of your text.

And of that batch work, only the commands that asked for temperature 0. A command that left the model on its own default, or named any temperature above zero, drew its answer from a distribution: a second node would produce something different no matter how honest both were, so replaying it would manufacture strikes rather than find anything. Sampling is the caller's to set, and we would rather give that up than charge honest operators for it — but it does mean this layer is opt-in, and almost nobody opts in. A check that survives sampling is what needs building next; until it does, the paragraphs below describe a mechanism with very little left to chew on.

Answers shorter than 24 tokens are skipped. A dozen tokens of "Sure, here you go" agree across every model in existence, so a pass proves nothing and a failure is noise. Jobs whose metering was already disputed are looked at first; everything else is sampled at random, because auditing the newest work first would tell every node exactly which of its jobs are safe.

Why the comparison is a prefix, not an exact match

The tempting rule is exact token equality. Under greedy decoding the same weights on the same arithmetic really do give the same tokens, so it sounds like a clean test with no threshold to argue about. It is also a test that would suspend the honest half of the network inside a day.

Two honest nodes are not running the same arithmetic. They may hold different quantisations of the same weights, on different cards, with different kernel versions. Greedy decoding is deterministic given identical arithmetic and not otherwise: a Q4 and a Q8 of the same 8B agree for a sentence or two and then pick differently at the first near-tie, and after one different token the two answers are unrelated forever.

So the measurement is how far the two agree from the start, as a fraction of the shorter answer — the length of the agreeing head is the entire signal, because there is nothing meaningful after the divergence. Over 50% is a pass. Under 15% is a strike. In between, the audit is recorded as inconclusive and nothing happens to anyone.

Be clear about what that buys. Half an answer arriving character-for-character identical is not something a node can produce without running the model it claimed to run, so this catches a node serving a smaller model, a canned string, or another model's output. It does not catch subtle quality degradation, and we are not going to pretend otherwise.

Who does the checking

The peer is drawn at random from the nodes that can serve the same model, excluding the node under audit and excluding every other node belonging to the same account — an operator running two cards would otherwise be asked to check their own homework. It must also be on the same accelerator: a CUDA GPU and an Apple Silicon Mac execute the same matmul in a different order, floating-point addition is not associative, and a cross-platform replay would convict an honest node. This is why Apple hardware is welcome without weakening anything — the canonical output is defined per backend, not across all of them.

The draw is random rather than deterministic so that two operators cannot work out that they always audit each other and agree not to look. If no independent peer exists for a model, nothing is audited and nothing is claimed; the job stays marked as metered rather than verified.

The replay is a real job, and the peer is paid for it at the market price, out of the venue's own fee revenue. No buyer funds an audit of a job they already paid for.

What a failed audit does

• The job is marked failed and the buyer is refunded in full, out of the house. That happens on the first strike, immediately — they paid for work the venue can no longer stand behind, and making them wait on someone else's third strike would be punishing them for our evidentiary standard.
• The node's failed-audit counter increments. It is published on the node's supply listing, so buyers can price the risk themselves.
• At 3 strikes from at least 2 different peers, the node is suspended and its resting asks are pulled off the book. Both conditions matter: a run of failures all against the same peer is one disagreement repeated, not several independent ones, and that is precisely the shape a node would use to frame a competitor.
• A replay that never ran — the peer dropped, the model was not loaded — is not evidence against anyone. The audit is recorded as an error and the job goes back in the pool for a later sweep with a different peer.

There is no bond. Nothing is staked, nothing is slashed, and no money is burned. A suspended node simply cannot open its link or rest an ask until an operator reinstates it.

The bandwidth bound

Autoregressive decoding at batch size one reads the whole weight set for every token. That gives a hard ceiling:

max tokens/sec = memory bandwidth (bytes/sec) ÷ bytes touched per token

A 70B model at Q4_K_M is roughly 43 GB of weights. On a card with 1008 GB/s of bandwidth that is about 23 tokens per second, and no amount of optimisation moves it much. This is why the venue stores bytes-per-token-pass per model rather than only a node's total VRAM: without the model's size the ceiling cannot be computed, and the check has nothing to compare against.

A node quoting above its own ceiling is not fast. It is either serving a smaller model than it claims or not serving one at all, and it is rejected at registration rather than audited later.

What this does not cover

Verification is evidence that the tokens were produced by the model that was paid for. It is not proof, it does not run on every job, and it does not make a node trustworthy with your prompt. Anything sent to a third-party machine should be treated as seen by its operator. Confidential workloads should stay on hosted providers with a contract behind them until attested execution lands.