From a2aa22fc08e3551cf14e4f0b1f9727361cba500d Mon Sep 17 00:00:00 2001 From: Dobromir Popov Date: Mon, 29 Jun 2026 02:47:36 +0300 Subject: [PATCH] docs: clarify validation slash model --- CONTEXT.md | 8 ++++++++ docs/adr/0003-optimistic-fraud-detection.md | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/CONTEXT.md b/CONTEXT.md index 479d57a..2df5c7d 100644 --- a/CONTEXT.md +++ b/CONTEXT.md @@ -82,6 +82,14 @@ _Avoid_: mock contract, fake chain, temporary hack A trusted node (or the tracker itself) that re-runs a sample of inference requests to detect fraud. _Avoid_: auditor, checker, referee +**Validation Event**: +A completed inference record that contains enough information for a validator to decide whether to sample and re-run the request: session id, model preset, messages, inference route, node wallets, and observed output. +_Avoid_: audit log, trace, receipt + +**Slash Proof**: +The record submitted by a validator when a sampled re-run diverges from the observed output beyond tolerance. In the prototype this is deterministic local contract state; later it maps to an on-chain proof transaction. +_Avoid_: accusation, report, claim + ### Client-facing **Client**: diff --git a/docs/adr/0003-optimistic-fraud-detection.md b/docs/adr/0003-optimistic-fraud-detection.md index 50458f6..60f7f8c 100644 --- a/docs/adr/0003-optimistic-fraud-detection.md +++ b/docs/adr/0003-optimistic-fraud-detection.md @@ -2,6 +2,10 @@ All inference responses are trusted by default. Validators re-run a random sample (~5%) of requests on reference nodes and compare outputs. Nodes that fail are slashed (stake reduced). Enough strikes result in a permanent on-chain ban. +For the prototype, the gateway emits validation events after completed requests. A validation event records the session id, model preset, request messages, observed output, and the route metadata for each node that served the request. The validator samples events with a configurable rate and deterministic seed for tests. Sampled events are re-run against a trusted reference node/reference function; string outputs must match exactly for stub models, while future tensor/model outputs use a configurable floating-point tolerance. + +A slash proof is local contract-boundary state in the prototype. Submitting one reduces the offending node's stake, increments its strike count, logs a clear warning, and bans the wallet when the strike threshold is reached. The tracker excludes banned wallets from route selection, but routing is still not based on node token balance or stake size. + New wallets must complete N jobs without earning (probationary period) to raise the economic cost of re-entering after a ban — a banned node can't just create a new wallet and immediately cheat again; it must fund a new stake and contribute N free jobs first. zkML (zero-knowledge proofs of inference) would give cryptographic guarantees but is 1000–10000× slower than inference for large models and is not production-ready. Redundant execution consensus (Gensyn's approach) gives stronger guarantees but costs 2–3× compute per request. TEE (trusted hardware attestation) is cryptographically strong but excludes most consumer GPUs, defeating the viral GPU-sharing goal. Optimistic + slash is the pragmatic choice that ships and can be calibrated economically.