The trust problem
A black box returns text
You cannot check which model ran, whether the provider quietly downgraded it, or whether it ran at all. The trust root of the whole AI economy is a provider's word. That is tolerable while people read the output; it stops being tolerable when agents act on it.
- Which model ran, or whether it was swapped for a cheaper one
- Whether the inference ran at all, or was cached, truncated or forged
- What you were actually billed for
Proof of Inference as consensus
The pieces are reachable and each has lineage. What nobody has done is fuse them into a chain where verified inference is the economic engine.
- 01 / Determinism
Pin the runtime
The AIOS Module: pure integer, fixed point, batch-invariant. The same bytes out on every conforming node.
- 02 / Committee
Recompute independently
An unbiasable VRF seats a Miner committee. Each Miner recomputes on its own hardware.
- 03 / Agreement
Commit, then reveal
Hashes are committed before any reveal, so copying the majority is closed off. The work-weighted >2/3 hash is canonical.
- 04 / Settlement
Proof on the block
Miners on the canonical hash are paid; a wrong result earns nothing. The call settles with its proof.
Four pillars in one proof
AI is models plus data plus compute. Each pillar exists somewhere on its own; the fusion is the product.
Chain-state as model
Small integer-quantized models live in chain state and run deterministically in consensus. Toy scale by physics, labelled that way.
Blockspace as inference
Jobs are verified by committee consensus and committed by a work-gated producer set. Buy verified inference the way you buy gas.
The Model Internet
Every model and adapter gets an address, a price, an owner and a verification mode bound to Proof of Inference.
Data as context
Corpora register as owned, priced assets and the committee recomputes the retrieval, so an answer proves which corpus and which chunks grounded it.
Mechanism first
Verified by consensus.
- The mechanism: inference clears by independent agreement
- The category: the machine-intelligence Layer 1
- Provenance of execution, stated as exactly that
- The wedge: the verification binding, never being first
What it cannot prove.
- A frontier chatbot runs onchain
- Verified means correct
- Verified data means the data is true
- There is zero stake anywhere
- Verification solves agent security
All eight risks
A thesis that hides its failure modes is an advertisement.
Proof of Inference is unproven at scale
No project makes verified inference the consensus mechanism in production. The best precedent is a single-developer testnet whose throughput numbers failed independent verification. Throughput at our target model size is an open benchmark, not a promise.
Token-first bleed, mitigated, not zero
The launch is sequenced proof-first: the testnet before any token, then an ERC-20 with the live testnet as evidence. The residual risk is real: a testnet is not mainnet, the token trades before native fee revenue, and proof of mechanism is not proof of demand.
Model registries are not greenfield
Onchain model registries exist elsewhere. AIOS claims no first-mover advantage; the wedge is the verification binding, that a call is proven to have run the registered model.
Frontier LLMs cannot run in consensus, ever
Floating-point non-determinism across heterogeneous hardware makes exact consensus over frontier model math impossible. Onchain models are small and integer-quantized; an FP16 model verifies statistically, never exact-hash. The pitch is never a chatbot onchain.
Bridge risk
The permanent Ethereum to L1 bridge is a high-value target, and bridges are the most exploited component in crypto. AIOS writes no bridge cryptography, uses an audited external provider and keeps it single-asset. That reduces the surface; it does not remove it.
No-stake mining is a weaker base than staking
Security rests on an honest majority of committed work. The only at-risk value is a burned registration fee: it prices a Sybil fleet, not each committee seat. Bounded, not closed, by value caps, a burn floor, raised honeypots and per-entity caps. The fallback is bonded mining.
The private mode shifts trust to chip vendors
Mode B proves attested execution, not correctness, and its trust root moves to chip vendors. Quote-forging attacks with physical access are demonstrated, not hypothetical, so: a multi-vendor quorum, a hard value cap at submit, never in consensus, never called verified.
Verifiable retrieval is unproven engineering
The data pillar holds only if embed and retrieve are byte-deterministic across hardware. Float embeddings and approximate indexes are not; the integer-embedding, exact-kNN path is a target, not a shipped guarantee. Verified data means provenance, never that the data is true.
Read the whole case
The thesis is the why. The mechanism pages are the how, including where it can fail.