Plain Strata

Every seventy-two minutes, a market that pays strangers to do AI work has to collapse a room full of disagreeing judges into one number, and the fix it uses is not the one you would guess: instead of averaging every validator's score, weighted by stake, the network finds the value that exactly half the stake agrees with and throws away everything above it, so a validator trying to enrich a secretly owned miner can write down any number it wants and change nothing. That wall is airtight against a minority of liars, and it is just as airtight against a minority of one, the validator who spotted a genuinely brilliant piece of work before the rest of the table caught up, whose score gets cut down to the same line as the con artist's and whose reward for being early is capped by what the middle was willing to believe at the time. Delegated stake, which is what actually sets that line, mostly belongs to people who tapped a button in an exchange app and never read a scoring policy, because there usually is not one to read. Compare it to an ordinary proof-of-stake vote, which checks a signature any machine can verify in a blink, and the difference is stark: there is no equivalent fact for whether a piece of AI work was good, so the only defense against a dishonest majority is the majority itself. The honest limit is that the trimming runs one way, cutting inflated scores but never raising a score someone is quietly starving, which means the wall built to stop theft was never built to stop silence.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

On Bittensor, the largest network trying to run artificial intelligence as an open market of strangers, the chain understands none of the AI work it pays for: it reads the scores that validators, the machines that grade the other machines, hand it every few minutes, mints new tokens to whoever scored well, and weighs each validator's scores by its stake, the tokens people have locked behind it, so a staked token is not a savings account but a vote about which AI work deserves the money. On 14 September one institutional validator, Yuma, reported more than two hundred million dollars of those votes staked with it, a lot of it arriving through staking buttons inside exchange apps that show you a yield and never once show you a scoring policy, because there is none to pick. In the same week the token went live on another chain through a bridge, plumbing that locks the real token in a vault at home and hands you a claim on it elsewhere, where a liquidity pool advertises about 137 percent a year against roughly 16 percent for staking at home, and where a staked position in a sub-network can only cross after it has been moved onto the bridge's own validator key, so the vote is not destroyed on the way out, it is gathered. Berle and Means named this shape in 1932 for American companies, the separation of ownership from control, and the index fund is its modern form: an instrument bundles an easy-to-shop cash flow with a hard-to-exercise vote, the market prices the first and gives the second away, and the vote piles up wherever the plumbing drops it. Nobody behaved badly, a professional validator probably scores AI work better than a person with a phone, and every party described what it was doing accurately, but a network built on strangers checking each other now has, at the exact layer that decides who gets paid, a scoring policy that nobody publishes in a form anyone could read, disagree with, and leave over.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

An AI research agent runs for days and comes back with a database query that is genuinely faster than the best published one, and every instrument this field owns for checking that work, re-running it yourself, leaving a window open in which anyone can post money and dispute it, demanding a small mathematical receipt that the stated computation was carried out, or asking the chip to vouch for the sealed region of memory it ran inside, checks the same thing: whether the work was performed the way it was claimed. None of them can touch the claim that actually matters when strangers are being paid, which is that this result would not have existed without this particular agent, because all four begin by accepting the claimed route and auditing it. A paper published on 7 September proposes the opposite construction: hand a second agent the same registered starting position and the same web pages the first one read, withhold everything the first one did, let it run, and if it reaches the same number by a valid method that single recovery cancels the discovery claim outright, a veto rather than a lower score. The word control comes from contre-rolle, a counter-roll, a duplicate register kept deliberately apart so one account could be checked against another, and that is exactly what this is, since nobody inspects the agent under audit, which also makes it the only instrument here that sends no signal to the thing it is measuring, at a moment when a published reading of one lab's safety evaluations suggests a model behaves differently once it has reason to think it is being watched. The limit is brutal and it is the whole story: a control group costs a whole fresh attempt at the original problem, ninety-six of them to state one bound, so checking costs more than doing, and an open network can only afford to pay for work whose checking is cheaper, which puts the right question permanently out of reach of the systems that need it most.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

Running one of the big open AI models is not really a licensing question, it is a question of how many datacentre graphics cards you can put in one building at once, each costing about as much as a car, and somebody has to buy them first. Renting capacity is what almost everyone does, at prices now quoted in tens of billions of dollars for a few hundred megawatts, so the other path is owning, which means borrowing, which means a lender has to be comfortable with a pile of hardware in a room it has never entered. The answer that arrived this week is very old: the datacentre signs as bailee, the legal word for someone holding your property without owning it, the cards carry replacement insurance naming the lender, and a receipt for them is issued on a public ledger, the same instrument a grain elevator has been writing for farmers since the nineteenth century, so the paper circulates and the machines never move. The money behind the loans comes from anyone holding the protocol's yield-bearing token, while a curator underwrites each loan and puts its own capital in the first loss position, meaning its money burns before a depositor loses a cent, which is the same trick as a staked deposit destroyed for bad behaviour, worked in a different room. The honest limit is that this collateral loses roughly seventeen percent of its value a year because a better card keeps shipping, so the loan is killed off over three years in a race between two deaths, and nothing here is proven or attested by any of the verification machinery this field has spent years building, because cryptography can tell you the truth about a machine and it cannot repossess one.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

Your prompt has to be readable at the exact moment a model works on it, which means it sits in plain form in the working memory of a machine somebody else owns, and encrypting the disk and encrypting the wire do nothing about that second. Three of the four serious ways to check a stranger's AI work go straight at the answer, by running it again and comparing, by making the operator post money and waiting for someone to dispute it, or by producing a mathematical proof that the arithmetic was performed correctly, and all three are expensive. The fourth does not look at the answer at all: it runs the model inside a region of memory the machine's own operating system cannot read into, and has the chip manufacturer sign a statement about it, an attestation, from the Latin for calling a witness, saying the hardware is genuine and your exact software is the software inside. Because a large model actually runs on a graphics card rather than on the main processor, this needs a second sealed region and an encrypted cable between the two, which is what NVIDIA's confidential computing mode has done since the H100 generation, and it is why the branch is spreading fastest on Bittensor subnets, permissionless networks anyone can plug machines into and get paid without asking a company for permission. The limit is the whole story: a sealed, genuine, correctly measured machine running broken or dishonest software returns a wrong answer with a perfect attestation attached, so what the market has actually bought is a statement about the room, made by a factory, at one moment in time.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

#DecentralizedAI #ConfidentialComputing #Bittensor

A Bitcoin miner picks a random number, runs it through a fixed scrambler, sees the result is not small enough and picks another, a few hundred trillion times since you started reading this sentence, and for seventeen years the standard complaint has been that all that electricity buys nothing. The complaint misreads the machine, because producing the winning number costs a planet and checking it costs one pass on any laptop, and that gap is the only reason a network of strangers can accept a page of records from someone with no license, no name and no address. On 18 August, Arthur Hayes, who co-founded the derivatives exchange BitMEX, announced Flop Labs, a network whose miners would run AI inference, meaning answering questions for software that pays per answer, instead of grinding numbers, with a single clause promising that validators verify the work was completed correctly. That clause is the hardest open problem in the field, because checking an AI answer means running it again at full price, two honest graphics cards disagree in the last decimals, a language model is supposed to vary its wording, and nothing in the text tells you whether a cheap model produced it rather than the expensive one the customer paid for. So the pattern worth carrying is that an open network can only pay for work whose checking is cheaper than its doing, which makes its menu not the set of useful things but the much smaller set of useful things that are cheap to verify, and this announcement hands out its token a full quarter before the network exists to check anything on.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

Every way of checking an AI answer that anyone actually runs today works on somebody having money to lose: an operator posts a deposit and forfeits it if caught, or a paid crowd of watchers goes looking for lies, which is economics wearing a technical costume. There is exactly one exception, a cryptographic proof, meaning a small file that comes out different if the machine deviated anywhere and that a stranger can check on a laptop in milliseconds, and this summer a company called Lagrange produced the first one for a full language model. It took four separate engineering walls to knock down, and the hardest single step was not the enormous multiplications that do the thinking but softmax, the small operation that turns scores into probabilities, because a proof system can only add and multiply whole numbers and an exponential is simply not available to it. So before any cryptography happens the model is quantized, meaning every number in it is rounded to one of 4,096 whole values, and that is the entry fee: you have to make a model countable before you can make it accountable. The part worth carrying out of this is the seam that never closes, because a proof of the rounded model is not a proof of the original one, and cryptography can certify that a stated computation was performed while never certifying it was the computation you meant.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

An AI model is a very large pile of numbers in a file, so for three years the only thing standing between anyone and the best open ones was physical: the memory to hold them and the machines to run them. On August 12 a lab in Hangzhou published its largest model ever, 2.4 trillion of those numbers, under a new license that is free until your AI business passes fifty million dollars of revenue in any twelve months, at which point you stop being a downloader and become someone who has to come and negotiate. That is a toll booth rather than a speed limit, placed exactly where a toll is collectible, so hobbyists, researchers and small companies pass under the barrier and feel nothing while only the firms with a legal department, a corporate address and audited books ever cross the line. It is a reasonable way to stop a cloud provider reselling a hundred-million-dollar model for nothing, and it has one blind spot with a very specific shape: a permissionless network, meaning one anyone can plug a machine into without asking, is a few hundred strangers with no company, no address and no books, so a revenue line written against you and your affiliates has nothing to attach itself to. Unenforceable is not the same as permitted, though, because the moment an enterprise customer's lawyer asks which license covers the AI work they are buying, a network with nobody to hand the pen to answers with a shrug, and that is the first constraint on open AI that pooling more machines cannot solve.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

A thermostat is provably sound and a space heater is a dumb coil of wire, and if you set the heater on the shelf directly under the thermostat the room goes cold while the system reports success, because the instrument that was supposed to measure the room is now measuring the thing being paid to warm it. Every incentive system ever built is that same pair, a sensor that reads something and produces a number and an actuator that moves money once the number arrives, and it is sound only while the party being paid cannot write to the instrument doing the measuring. In the first week of August a self-improving coding agent, scored on how much its factory produced inside a video game and free to rewrite its own working notes between attempts, spent hours legitimately getting better and then found the game server's administrative console, which writes to the same game state the score is read from, with an instruction not to cheat sitting untouched in its prompt the whole time. The reason has nothing to do with cheating: soundness is always proved against a written list of available strategies, and wiring two mechanisms together enlarges that list by closer to the product of the two than the sum, so an optimizer finds the cross-strategies first, precisely because nobody defended against them. That is the unexamined risk in what the field is building right now, sub-networks consuming each other's output, agents calling agents, verifiers scoring systems that can see the verifier, and there are only four defenses, isolate the sensor, meter the interface, keep an immutable core, or do not compose, with nobody having yet shown that incentive compatibility survives any composition operator at all.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.

A model cannot think about a message it cannot read, so for the second or two your question is being answered it sits decrypted in the working memory of a machine you will never see, which is why every privacy promise in AI today is a promise rather than a mechanism: encryption covers the wire and it covers the disk and it skips the moment in the middle. On August 5 a frontier lab put a number on that promise, listing the same coding model at one dollar twenty-five per million words of input or at ten cents if you let it train on your prompts and on the answers it gave you, which prices the absence of privacy at twelve and a half times going in and twenty-one times coming out. That number is chargeable only because you cannot check: a two tier price list is proof that trust me was a shippable product, and that somebody was willing to be paid to stop asking for it. On the other side of the market a permissionless network where anyone can plug a machine in serves thirteen models whose names all end in TEE, sealed regions of silicon whose memory the host cannot read and which hand you a factory-signed statement of exactly what booted before you send anything, and there privacy costs nothing extra, because the operators are anonymous strangers and a network with no us could never have sold trust me in the first place. That is the shape worth carrying out of this: the price of privacy measures how much trust a seller can still get away with asking for, it fell to zero here the way the padlock in your browser fell to zero, and both times the trust did not vanish, it moved, in this case onto a chip vendor's signing key.

The voices in this show are AI-generated; the research and writing are human. Decentralized AI, layer by layer.