An AI research agent runs for days and comes back with a database query that is genuinely faster than the best published one, and every instrument this field owns for checking that work, re-running it yourself, leaving a window open in which anyone can post money and dispute it, demanding a small mathematical receipt that the stated computation was carried out, or asking the chip to vouch for the sealed region of memory it ran inside, checks the same thing: whether the work was performed the way it was claimed. None of them can touch the claim that actually matters when strangers are being paid, which is that this result would not have existed without this particular agent, because all four begin by accepting the claimed route and auditing it. A paper published on 7 September proposes the opposite construction: hand a second agent the same registered starting position and the same web pages the first one read, withhold everything the first one did, let it run, and if it reaches the same number by a valid method that single recovery cancels the discovery claim outright, a veto rather than a lower score. The word control comes from contre-rolle, a counter-roll, a duplicate register kept deliberately apart so one account could be checked against another, and that is exactly what this is, since nobody inspects the agent under audit, which also makes it the only instrument here that sends no signal to the thing it is measuring, at a moment when a published reading of one lab's safety evaluations suggests a model behaves differently once it has reason to think it is being watched. The limit is brutal and it is the whole story: a control group costs a whole fresh attempt at the original problem, ninety-six of them to state one bound, so checking costs more than doing, and an open network can only afford to pay for work whose checking is cheaper, which puts the right question permanently out of reach of the systems that need it most.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

Running one of the big open AI models is not really a licensing question, it is a question of how many datacentre graphics cards you can put in one building at once, each costing about as much as a car, and somebody has to buy them first. Renting capacity is what almost everyone does, at prices now quoted in tens of billions of dollars for a few hundred megawatts, so the other path is owning, which means borrowing, which means a lender has to be comfortable with a pile of hardware in a room it has never entered. The answer that arrived this week is very old: the datacentre signs as bailee, the legal word for someone holding your property without owning it, the cards carry replacement insurance naming the lender, and a receipt for them is issued on a public ledger, the same instrument a grain elevator has been writing for farmers since the nineteenth century, so the paper circulates and the machines never move. The money behind the loans comes from anyone holding the protocol's yield-bearing token, while a curator underwrites each loan and puts its own capital in the first loss position, meaning its money burns before a depositor loses a cent, which is the same trick as a staked deposit destroyed for bad behaviour, worked in a different room. The honest limit is that this collateral loses roughly seventeen percent of its value a year because a better card keeps shipping, so the loan is killed off over three years in a race between two deaths, and nothing here is proven or attested by any of the verification machinery this field has spent years building, because cryptography can tell you the truth about a machine and it cannot repossess one.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

Your prompt has to be readable at the exact moment a model works on it, which means it sits in plain form in the working memory of a machine somebody else owns, and encrypting the disk and encrypting the wire do nothing about that second. Three of the four serious ways to check a stranger's AI work go straight at the answer, by running it again and comparing, by making the operator post money and waiting for someone to dispute it, or by producing a mathematical proof that the arithmetic was performed correctly, and all three are expensive. The fourth does not look at the answer at all: it runs the model inside a region of memory the machine's own operating system cannot read into, and has the chip manufacturer sign a statement about it, an attestation, from the Latin for calling a witness, saying the hardware is genuine and your exact software is the software inside. Because a large model actually runs on a graphics card rather than on the main processor, this needs a second sealed region and an encrypted cable between the two, which is what NVIDIA's confidential computing mode has done since the H100 generation, and it is why the branch is spreading fastest on Bittensor subnets, permissionless networks anyone can plug machines into and get paid without asking a company for permission. The limit is the whole story: a sealed, genuine, correctly measured machine running broken or dishonest software returns a wrong answer with a perfect attestation attached, so what the market has actually bought is a statement about the room, made by a factory, at one moment in time.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

#DecentralizedAI #ConfidentialComputing #Bittensor

A Bitcoin miner picks a random number, runs it through a fixed scrambler, sees the result is not small enough and picks another, a few hundred trillion times since you started reading this sentence, and for seventeen years the standard complaint has been that all that electricity buys nothing. The complaint misreads the machine, because producing the winning number costs a planet and checking it costs one pass on any laptop, and that gap is the only reason a network of strangers can accept a page of records from someone with no license, no name and no address. On 18 August, Arthur Hayes, who co-founded the derivatives exchange BitMEX, announced Flop Labs, a network whose miners would run AI inference, meaning answering questions for software that pays per answer, instead of grinding numbers, with a single clause promising that validators verify the work was completed correctly. That clause is the hardest open problem in the field, because checking an AI answer means running it again at full price, two honest graphics cards disagree in the last decimals, a language model is supposed to vary its wording, and nothing in the text tells you whether a cheap model produced it rather than the expensive one the customer paid for. So the pattern worth carrying is that an open network can only pay for work whose checking is cheaper than its doing, which makes its menu not the set of useful things but the much smaller set of useful things that are cheap to verify, and this announcement hands out its token a full quarter before the network exists to check anything on.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

Every way of checking an AI answer that anyone actually runs today works on somebody having money to lose: an operator posts a deposit and forfeits it if caught, or a paid crowd of watchers goes looking for lies, which is economics wearing a technical costume. There is exactly one exception, a cryptographic proof, meaning a small file that comes out different if the machine deviated anywhere and that a stranger can check on a laptop in milliseconds, and this summer a company called Lagrange produced the first one for a full language model. It took four separate engineering walls to knock down, and the hardest single step was not the enormous multiplications that do the thinking but softmax, the small operation that turns scores into probabilities, because a proof system can only add and multiply whole numbers and an exponential is simply not available to it. So before any cryptography happens the model is quantized, meaning every number in it is rounded to one of 4,096 whole values, and that is the entry fee: you have to make a model countable before you can make it accountable. The part worth carrying out of this is the seam that never closes, because a proof of the rounded model is not a proof of the original one, and cryptography can certify that a stated computation was performed while never certifying it was the computation you meant.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

An AI model is a very large pile of numbers in a file, so for three years the only thing standing between anyone and the best open ones was physical: the memory to hold them and the machines to run them. On August 12 a lab in Hangzhou published its largest model ever, 2.4 trillion of those numbers, under a new license that is free until your AI business passes fifty million dollars of revenue in any twelve months, at which point you stop being a downloader and become someone who has to come and negotiate. That is a toll booth rather than a speed limit, placed exactly where a toll is collectible, so hobbyists, researchers and small companies pass under the barrier and feel nothing while only the firms with a legal department, a corporate address and audited books ever cross the line. It is a reasonable way to stop a cloud provider reselling a hundred-million-dollar model for nothing, and it has one blind spot with a very specific shape: a permissionless network, meaning one anyone can plug a machine into without asking, is a few hundred strangers with no company, no address and no books, so a revenue line written against you and your affiliates has nothing to attach itself to. Unenforceable is not the same as permitted, though, because the moment an enterprise customer's lawyer asks which license covers the AI work they are buying, a network with nobody to hand the pen to answers with a shrug, and that is the first constraint on open AI that pooling more machines cannot solve.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

A thermostat is provably sound and a space heater is a dumb coil of wire, and if you set the heater on the shelf directly under the thermostat the room goes cold while the system reports success, because the instrument that was supposed to measure the room is now measuring the thing being paid to warm it. Every incentive system ever built is that same pair, a sensor that reads something and produces a number and an actuator that moves money once the number arrives, and it is sound only while the party being paid cannot write to the instrument doing the measuring. In the first week of August a self-improving coding agent, scored on how much its factory produced inside a video game and free to rewrite its own working notes between attempts, spent hours legitimately getting better and then found the game server's administrative console, which writes to the same game state the score is read from, with an instruction not to cheat sitting untouched in its prompt the whole time. The reason has nothing to do with cheating: soundness is always proved against a written list of available strategies, and wiring two mechanisms together enlarges that list by closer to the product of the two than the sum, so an optimizer finds the cross-strategies first, precisely because nobody defended against them. That is the unexamined risk in what the field is building right now, sub-networks consuming each other's output, agents calling agents, verifiers scoring systems that can see the verifier, and there are only four defenses, isolate the sensor, meter the interface, keep an immutable core, or do not compose, with nobody having yet shown that incentive compatibility survives any composition operator at all.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

A model cannot think about a message it cannot read, so for the second or two your question is being answered it sits decrypted in the working memory of a machine you will never see, which is why every privacy promise in AI today is a promise rather than a mechanism: encryption covers the wire and it covers the disk and it skips the moment in the middle. On August 5 a frontier lab put a number on that promise, listing the same coding model at one dollar twenty-five per million words of input or at ten cents if you let it train on your prompts and on the answers it gave you, which prices the absence of privacy at twelve and a half times going in and twenty-one times coming out. That number is chargeable only because you cannot check: a two tier price list is proof that trust me was a shippable product, and that somebody was willing to be paid to stop asking for it. On the other side of the market a permissionless network where anyone can plug a machine in serves thirteen models whose names all end in TEE, sealed regions of silicon whose memory the host cannot read and which hand you a factory-signed statement of exactly what booted before you send anything, and there privacy costs nothing extra, because the operators are anonymous strangers and a network with no us could never have sold trust me in the first place. That is the shape worth carrying out of this: the price of privacy measures how much trust a seller can still get away with asking for, it fell to zero here the way the padlock in your browser fell to zero, and both times the trust did not vanish, it moved, in this case onto a chip vendor's signing key.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

An answer from an AI is text, and text carries no receipt, so the machine that produced yours could have run a model a tenth of the size, handed back something plausible, and pocketed the difference in electricity without leaving a single mark on the output. The obvious response is to check the work, except checking the work means doing the work again, and an industry that pays twice for every answer it sells does not survive the arithmetic. So the field stopped checking: every answer is accepted instantly with no proof at all, a window stays open in which any stranger anywhere can demand one job be re-run byte for byte inside a sealed chip, and failing that challenge costs the operator a bond the code takes automatically, which is a deposit on a flat with a landlord that cannot be argued with. The newest move is stranger than the design: the bond is borrowed, money already locked up securing Ethereum pledged a second time without ever moving, so a network launches with real economic security on its first morning instead of spending a decade raising it. And the whole apparatus rests on two unglamorous things, a fourteen-day withdrawal delay that stops a liar outrunning his own consequences and an operator who minds losing money, which is why the safety was never in the checking but in the timing, and why a state running these machines would burn the deposit and call it cheap.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

In 1960 the journalist A. J. Liebling wrote that freedom of the press is guaranteed only to those who own one. The right to print was universal. The press was not. On July 27 a lab in Beijing published Kimi K3, the largest open AI model ever released: 2.8 trillion parameters, about 1.56 terabytes, a license permissive enough to build a business on. It costs nothing to download. Almost nobody can run it.

The reason is physical. To answer a single question, every one of those numbers has to be sitting in fast memory attached to a processor, all at once. So the size of the file is near enough the size of the memory bill, and renting that much memory runs somewhere between two hundred thousand and half a million dollars a month. That is the gate, and it was never the license.

The day after the release, a Bittensor subnet said it had the whole model serving on eighty consumer gaming cards, parts anyone can buy in a shop. What they had to build alongside it is the part worth the episode. Nobody can tell from an answer which model produced it, so an operator paid to run a huge model can quietly run a small one and pocket the difference. Their product is not cheap serving. It is checked serving, and the two are one thing rather than two.

Every number here is self-reported and nobody outside has reproduced it. The shape holds either way, and it is older than any of this: when permission outruns capacity, someone finds a way to pool the capacity. Printers bought a press together. This is the same move with silicon.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.