Proof of Inference.
A committee recomputes every job. Over two thirds agree, it clears.
Four steps
Nothing here asks you to trust a provider. Every step is something the chain can check.
- 01 / Submit
A job goes in
A caller pays $AIOS to run a registered model. Escrow is caller-owned and refunded in full if no supermajority ever forms.
- 02 / Seat
VRF selects the committee
An unbiasable beacon seats Miners against this exact job. No one, including AIOS, picks who checks it.
- 03 / Match
Hashes agree
Each Miner recomputes on the AIOS Module. The work-weighted >2/3 hash becomes canonical.
- 04 / Clear
The proof commits
Job, model, committee hash and cost commit onchain, public and checkable from the first block.
Commit, then reveal
Committed before revealed
A Miner that waits to see the others and copies them has nothing to copy: each commits a sealed hash first, and the seals open only once all are in. Then the work-weighted supermajority decides, and weight is verified work, never capital.
- Paid on match. A hash on the >2/3 supermajority is paid on the spot, from fees and the mining pool.
- No pay on a wrong result. The compute is spent, the reward is never paid. No token slashing on the mining layer.
- Refund on no quorum. The job re-routes and the caller's escrow returns in full, untouched.
- Ejected for proven fraud. A failed honeypot or proven fraud ejects the miner ID; its burned registration is already gone.
Exact or sampled
The guarantee depends on the model. Neither is ever passed off as the other.
Small integer models: byte-identical
On deterministic integer models the committee recomputes the whole job, so a mismatch is exact and no-pay is objective. Large models are checked by sampled recomputation: a swap is caught with a probability set by the sampling rate, an open number calibrated with the security work before launch. Disputes there go to an optimistic challenge, loser pays.
A swapped model
A provider serves a smaller, cheaper model than the one you paid for. The reply still looks right. Here is how each class of network reacts.
A GPU marketplace: nothing
It rents compute time. Nobody checks what ran on it, so a swap is invisible by design.
A liveness network: the node keeps earning
Reward tracks presence, not output. The swapped model still answers and the reward keeps flowing.
Single-replica optimistic: caught only if challenged
One replica posts a result that settles unless someone disputes it in time. An uncontested swap settles as if correct.
AIOS: the hashes never agree
A seated committee recomputes the registered model on every job, not on dispute. The hashes diverge, no supermajority forms, the job never clears, and the Miner earns nothing, immediately.
A proof is a hash a committee produced
Read how determinism is pinned, or put your own hardware on the committees.