hanzoai/papers
2
0
Fork 0
mirror of https://github.com/hanzoai/papers.git synced 2026-10-22 17:20:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add compute-market series: substrate, verification and economics

Browse Source 
Eight papers covering what a decentralized market in heterogeneous compute
needs from a cryptographic and serving substrate, and where the joint surplus
with a market operator actually comes from.

residency  personalized agents give compute memory; adapter locality as a
           price term, and the serving primitive that separates a 175-
           accelerator deployment from a 2-accelerator one
equality   bit-reproducible work verifies at O(1) against a canonical, making
           determinism a job attribute the market prices
soundness  six verification tiers with honest cost models; soundness is a
           demand-side parameter, not a protocol constant
retrofit   hybrid post-quantum identity and key exchange added to a live
           protocol without a fork, from two shipped deployments
custody    escrow and payout where the private key never exists, behind a
           signer-agnostic assembler boundary
search     Las Vegas workloads verify for free; the grind-selection rule and
           why container choice can dominate cryptography
clearing   exchange mechanics: feasibility before price, four order types
           including rent on state, cache as perishable inventory
surplus    four sources of joint surplus, sized, with a risk register

Shared preamble at shared/market-preamble.tex so the series reads as one voice.
This commit is contained in:
zeekay
2026-08-26 13:01:37 -07:00
parent f49e94bc85
commit 9b4cbda65d
18 changed files with 2113 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INDEX.md
+18 -1
View File
@@ -224,4 +224,21 @@ Auto-generated catalogue of research papers. Regenerate: `scripts/gen-index.sh`
| `zen4-thinking_whitepaper` | `zen/zen4-thinking_whitepaper.tex` |
| `zen4-ultra_whitepaper` | `zen/zen4-ultra_whitepaper.tex` |
**Total**: 219 papers
## Compute-market series
Substrate, verification and economics for a decentralized market in heterogeneous
compute. Read in any order; `surplus` states the joint arithmetic, `clearing` the
mechanics, and the rest supply the primitives each depends on.
| Paper | TeX |
|-------|-----|
| `clearing` | `clearing/clearing.tex` |
| `custody` | `custody/custody.tex` |
| `equality` | `equality/equality.tex` |
| `residency` | `residency/residency.tex` |
| `retrofit` | `retrofit/retrofit.tex` |
| `search` | `search/search.tex` |
| `soundness` | `soundness/soundness.tex` |
| `surplus` | `surplus/surplus.tex` |
**Total**: 227 papers
clearing/clearing.pdf
BIN
View File
Binary file not shown.
clearing/clearing.tex
+258
View File
@@ -0,0 +1,258 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Clearing Heterogeneous Compute}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
Los Angeles, California \\
\texttt{https://hanzo.ai}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
An exchange for compute is not an exchange for a commodity. The thing being
traded is a bundle --- device, memory, bandwidth, residency, locality, and the
right to a deadline --- and the bundles are not substitutes for each other except
under constraints that vary per job. Maintaining a separate order book per device
class throws away the structure that matters, and quoting a single price per
accelerator-hour throws away all of it.
This paper is the mechanics. We define the job and bundle types, state the
feasibility constraint, give the clearing objective including the residency
terms, and show why the natural objective of minimising price is wrong in a way
that is not marginal. We then define four order types --- including a rent on
state, which has no analogue in a stateless market --- describe how the KV cache
behaves as perishable inventory, and map each failure mode to a mechanism. We
close by identifying which parts of this we already run in open source and can
be lifted directly.
\end{abstract}
\tableofcontents
\newpage
\section{Jobs and bundles}
\begin{definition}[Job]
$\job = (m, c, \Delta, \kappa, \tau, V)$ with $m$ the model or computation
required, $c$ the context or input size, $\Delta$ the deadline, $\kappa$ the
determinism class, $\tau$ the required verification tier, and $V$ the buyer's
value at risk.
\end{definition}
\begin{definition}[Bundle]
$\bundle = (d, M, B, \beta, \alpha, \ell_{0})$ with $d$ the device, $M$ available
accelerator memory, $B$ ingress bandwidth, $\beta \in \{0,1\}$ whether the base
model for $m$ is resident, $\alpha \in \{0,1\}$ whether the buyer's adapter is
resident, and $\ell_{0}$ the network round-trip to the buyer.
\end{definition}
Feasibility is a hard constraint and must be evaluated before price:
\begin{equation}
\bundle \models \mathrm{cap}(\job)
\iff
M \ge |w_{m}| + |\mathrm{kv}(c)|
\;\wedge\;
c \le c_{\max}(d)
\;\wedge\;
\kappa \in \mathcal{K}(d)
\;\wedge\;
\tau \in \mathcal{T}(\bundle)
\;\wedge\;
\hat{t}(\job,\bundle) \le \Delta .
\end{equation}
The last conjunct is where residency enters feasibility rather than cost:
\begin{equation}
\hat{t}(\job,\bundle) \;=\; \ell_{0}
\;+\; (1-\beta)\frac{|w_{m}|}{B}
\;+\; (1-\alpha)\frac{|a|}{B}
\;+\; t_{\text{compute}} .
\end{equation}
\section{The objective, and why cheapest is wrong}
\begin{equation}
\bundle^{*} \;=\; \arg\min_{\bundle \,\models\, \mathrm{cap}(\job)}
\Big[
p(\bundle)\,t_{\text{compute}}
+ \lambda_{L}\ell
+ \lambda_{F}\phi
+ \lambda_{V}v(\tau)
+ \lambda_{D}\delta
+ \mu_{1}(1-\beta)
+ \mu_{2}(1-\alpha)
\Big],
\label{eq:clearing}
\end{equation}
with $\mu_{1}/\mu_{2} \approx 10^{3}$, the ratio of base-model size to adapter
size.
\begin{proposition}
Minimising $p(\bundle)$ alone is not an approximation to~\eqref{eq:clearing}; it
can select an infeasible bundle.
\end{proposition}
Take a job requiring a \SI{140}{\giga\byte} base under a \SI{3}{\second}
deadline. A device at \SI{0.50}{\per\hour} without the model resident, on a
\SI{10}{\giga\bit\per\second} link, needs \SI{112}{\second} to fetch the weights.
It is not expensive relative to a device at \SI{4}{\per\hour} holding the model
--- it is outside the feasible set, by a factor of \num{37} on the binding
constraint. Any allocator that ranks by price and then filters will spend most of
its time rejecting its own top choices.
Two practical consequences. Feasibility must be evaluated first, and residency
must be part of it. And $\mu_{1}$ is not a smooth penalty --- near an interactive
deadline it behaves as a step, which is why a market for interactive inference
looks less like a spot market and more like a market for scheduled capacity with
warm state.
\section{Order types}
\subsection{Intent}
The buyer states what it wants, not what to buy:
\begin{lstlisting}
intent:
want: "best answer to <request>"
deadline: 4s
max_price: 0.08
min_tier: T2
determinism: D_inf
\end{lstlisting}
The exchange solves~\eqref{eq:clearing}. This is the order type agents should
use, and the reason is not convenience: an agent reasoning about device
specifications is an agent whose behaviour breaks when the fleet changes.
\subsection{Reserve}
A commitment to capacity over a window, priced below spot in exchange for the
provider's ability to plan. Standard, and it works here for the usual reasons.
\subsection{Rent on state}
New, and specific to this market. The buyer pays a continuous fee to keep its
adapter --- or its model, or a conversation prefix --- resident somewhere
capable.
\begin{equation}
\text{rent} \;=\; \rho \cdot |a| \cdot \mathrm{d}t
\qquad\text{buys}\qquad
\alpha = 1 \text{ with probability } \ge 1-\epsilon \text{ over the term.}
\end{equation}
The buyer converts a stochastic cold-start penalty into a predictable stream. The
provider receives payment for memory it would otherwise hold speculatively or
evict. This is an option on locality, it is continuously priceable, and it does
not exist in a stateless compute market because there is no state to rent.
For the provider it also resolves a real scheduling problem. An accelerator
holding $k$ resident adapters faces a knapsack decision on every arrival, and the
shadow price of a residency slot is the expected discounted value of its
occupant. Rent makes that shadow price observable instead of guessed.
\subsection{Search}
For Las Vegas workloads: a domain, a predicate, a success probability, a
deadline. Priced on expected work rather than measured time, settled on the first
valid witness. Treated fully in the companion paper.
\section{Cache as perishable inventory}
Prefix caching means a conversation's accumulated key-value state has value that
decays --- with time, as memory pressure evicts it, and with the conversation's
own probability of continuing. Writing $\gamma$ for the per-turn continuation
probability and $s$ for the saving from a cache hit, the expected value of
retaining a prefix for one more turn is $\gamma s$, against a holding cost equal
to the shadow price of the memory.
This is an inventory problem with a known solution shape, and it is the second
place --- after adapters --- where a continuous formulation earns its keep over
discrete order books. The quantity being priced varies smoothly, decays
predictably, and has a clean opportunity cost.
\section{Failure modes and mechanisms}
\begin{table}[h]
\centering
\begin{tabular}{lll}
\toprule
Failure & Mechanism & Note \\
\midrule
Provider defects mid-job & escrow, deadline refund & no adjudication needed \\
Deadline missed & automatic refund on timestamp & signing policy, not manual \\
Wrong output, class $\mathsf{D}$ & byte equality & proof of misbehaviour \\
Wrong output, class $\mathsf{S}$ & tier per job & buyer chooses \\
Residency misreported & self-revealing & the deadline is missed \\
Correlated committee & diversity as a constraint & otherwise $m$ collapses to 1 \\
Price manipulation & many providers, open quotes & thin markets stay thin \\
\bottomrule
\end{tabular}
\caption{Failure modes and the mechanism that addresses each.}
\end{table}
Residency deserves emphasis because it is unusually clean. A provider cannot
profitably claim to hold weights it does not hold, since the claim is falsified
by the deadline it then misses. The market needs no attestation for this, which
is rare and should be exploited rather than replaced with a certificate.
\section{What exists and can be lifted}
Two components are in production, open source, and directly reusable.
\paragraph{A model catalog with tiered routing.} Each model carries an ordered
list of route rungs. Each rung names an upstream, a provider, a context limit,
and two price pairs --- retail and cost --- so margin is explicit per rung rather
than implied. Alternate arms and a synthesis route are first-class. The catalog
validates its own invariants at load: a rung priced free may only route to a
zero-priced upstream, a rung may not be configured to serve below cost, and every
arm must name a known provider. Resolution maps a requested name to a concrete
model and identifier.
This is a working price-and-route layer over heterogeneous model supply. What it
does not yet price is state locality --- the $\mu$ terms of~\eqref{eq:clearing}
--- which is the extension this series argues for.
\paragraph{A request router.} Classification maps a request to a task from
extracted features --- text, approximate token count, media presence, explicit
task and modality hints --- kept pure so that a learned classifier can replace the
heuristic without touching policy. Downstream are policy, route, replica and
ring, giving pool selection, replica choice and consistent hashing.
The classifier boundary matters for an exchange: allocation quality depends on
correctly typing incoming demand, and a market that cannot improve its
classifier without redeploying its policy will not improve it.
\paragraph{An inference engine with adapters and a training API.} Low-rank and
quantized low-rank adapters, multi-adapter co-residency, mixture-of-adapters, and
a training loop exposed over the serving API. The gap --- per-sequence adapter
selection within a batch --- is stated precisely in the companion paper on
residency.
\paragraph{Settlement.} Threshold signing across twenty or more chains with
per-job escrow and no key reconstruction, behind a signer-agnostic assembler
boundary. Treated in the companion paper on custody.
\section{Sequencing}
The order that gets a market to real verified volume soonest, rather than the
order that looks most complete on a diagram: carry search volume first, because
verification is free and settlement is unambiguous. Add deterministic-class
inference next, because byte equality gives it verification at no marginal cost.
Add algebraic spot-checking for the general inference case. Add residency pricing
and state rent once adapters are per-request selectable, because until then the
$\mu$ terms are unobservable. Add succinct proofs last, for the statements that
settle on chain.
Every step in that order produces a market that works at the end of it, which is
the property worth optimising for.
\end{document}
custody/custody.pdf
BIN
View File
Binary file not shown.
custody/custody.tex
+214
View File
@@ -0,0 +1,214 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Threshold Settlement:\\Escrow and Payout Without a Key}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Lux Partners} \\
\textit{A subsidiary of Hanzo Industries Inc} \\
\texttt{https://lux.network}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
Every compute market eventually holds someone else's money. A job is posted,
funds are escrowed, work is performed, a verifier decides, and a payout is
issued. The question nobody enjoys asking is who holds the key that releases the
escrow.
The answer should be nobody. We describe a settlement architecture in which the
private key authorising payouts never exists --- not in memory, not on disk, not
during signing --- and in which the operator set can change without the key ever
being reconstructed. We give the protocol table we run in production across
twenty or more chains, including two post-quantum lattice families and a
composition requiring both, and report measured signing and key-generation
latencies.
We then describe the interface boundary that makes this composable with a market
rather than entangled with it: an assembler that turns a payment specification
into an unsigned transaction and a set of digests, and a finaliser that turns
digests plus signatures back into a broadcastable transaction. The market decides
what to pay. The threshold cluster decides whether to sign. Neither needs to
understand the other.
\end{abstract}
\tableofcontents
\newpage
\section{The custody question}
Escrow in a decentralized market is usually solved one of three ways, and two of
them are bad.
A single operator key is simple and is a single point of theft, a single point
of coercion and a single point of loss. A smart contract on the settlement chain
is genuinely good where the asset is native to that chain, and useless where it
is not --- which is the common case as soon as providers want paying in something
that lives elsewhere. A multi-signature scheme is better than one key but
publishes the entire policy on chain, costs linearly in signers, and is
unavailable or awkward on many chains.
Threshold signing gives the properties of multi-signature without the
disclosure, the cost or the chain dependence: $t$ of $n$ parties cooperate to
produce a signature that is indistinguishable from a single-key signature, and
the full key is never assembled at any point in the protocol.
\begin{definition}[No-reconstruction property]
A threshold signing scheme has the no-reconstruction property if there exists no
point in key generation, signing, or resharing at which any single party holds
material sufficient to recover the private key, and no protocol transcript from
which fewer than $t$ colluding parties can recover it.
\end{definition}
This is stronger than secret sharing with reassembly at signing time, which is
what several deployed systems actually do and which reintroduces the single
point of theft for the duration of every signature.
\section{The protocol table}
\begin{table}[h]
\centering
\begin{tabular}{lll}
\toprule
Protocol & Curve or lattice & Settlement reach \\
\midrule
CGGMP21 & secp256k1 & Bitcoin, Ethereum, all EVM chains, XRPL \\
FROST & Ed25519 & Solana, TON, Polkadot, Cardano, Substrate \\
BLS & BLS12-381 & aggregate attestation, beacon signatures \\
SR25519 & Ristretto255 & Substrate native \\
Pulsar & M-LWE (threshold ML-DSA-65) & post-quantum, anchors and custody \\
Corona & R-LWE & post-quantum, orthogonal lattice family \\
Double lattice & Pulsar $\oplus$ Corona & both must verify \\
\bottomrule
\end{tabular}
\caption{Threshold protocols in production, with the settlement surfaces each
reaches.}
\end{table}
Three properties of this table matter for a market.
\paragraph{Non-interactive signing.} CGGMP21 requires an interactive key
generation once, after which signing is non-interactive. For a market issuing
many payouts this is the difference between a settlement path that scales and
one that turns into a coordination problem at load. It also produces signatures
bit-identical to any standard secp256k1 signature, so nothing downstream needs
to know a threshold scheme was involved.
\paragraph{Dynamic resharing.} Parties can be added or removed without downtime
and without reconstructing the key. In a permissionless market the operator set
churns; a custody design that requires a ceremony every time it changes will not
survive contact with reality.
\paragraph{Post-quantum options with a hedge.} A custody key is the longest-lived,
highest-value secret in the system, which makes it the worst possible thing to
leave on an elliptic curve. Classical threshold ECDSA is $t$-of-$n$ against a
classical adversary and $0$-of-$n$ against Shor. The lattice families provide a
post-quantum threshold; the double-lattice composition, which concatenates a
Pulsar and a Corona signature and requires both to verify, hedges against a break
in one lattice problem rather than in lattices generally.
\section{Measured behaviour}
Signing completes in under \SI{25}{\milli\second} and key generation in
\SIrange{12}{82}{\milli\second}, with Byzantine fault tolerance up to $t-1$
malicious parties. For a settlement path these are not the binding constraint ---
block times dominate by two to three orders of magnitude --- which is the
comfortable position to be in.
\section{The interface boundary}
The design decision that makes this composable is refusing to let the signer know
what a job is.
\begin{lstlisting}
PreSign(spec) -> (unsigned transaction, per-input digests)
Finalize(unsigned, sigs) -> (raw transaction, txid)
\end{lstlisting}
The assembler takes a payment specification --- source, destination, amount, fee
policy --- and returns a wire-correct unsigned transaction together with the
digests that must be signed, computed under the correct sighash rules for the
chain. The finaliser takes those digests' signatures and produces a
broadcastable transaction. Between the two calls sits whatever authorisation
process the operator wants, and the assembler neither knows nor cares what it is.
This yields a clean separation for a market:
\begin{itemize}[leftmargin=1.4em]
\item The \emph{allocator} decides who should be paid and how much. It has no
access to key material and cannot move funds.
\item The \emph{verifier} decides whether the work was done. It produces an
attestation, not a signature.
\item The \emph{threshold cluster} decides whether to sign a specific
transaction against a specific attestation policy. It has no opinion about
pricing.
\end{itemize}
Each can be audited, replaced, or run by a different party. A compromise of the
allocator produces mispriced jobs, not stolen funds. A compromise of the verifier
produces incorrect attestations, which the signing policy can require multiple of.
\section{Per-job escrow}
We recommend deriving a distinct escrow address per job rather than pooling.
\begin{equation}
\text{escrow}(\job) \;=\; \mathrm{derive}\big(\text{master},\; \text{path}(\job)\big),
\end{equation}
with a deterministic path incorporating the job identifier. The properties this
buys are worth the small extra bookkeeping. Funds for distinct jobs are isolated,
so a policy failure on one job cannot drain another. The escrow address is
computable by the buyer before funding, so the buyer can verify where its money is
going without trusting an API response. Settlement is a single threshold
signature over a transaction whose specification the verifier has already
validated. And an unclaimed escrow is visibly unclaimed on chain, which makes
refund logic auditable rather than a database state.
The derivation should use a hardened path structure with one seed and many paths
rather than many seeds. Maintaining $n$ independent seeds multiplies custody risk
with no compensating benefit; independent authorisation boundaries are better
enforced at the access-control layer, where they can be scoped and revoked, than
by seed proliferation.
\section{What a market has to decide}
Threshold signing removes the key-holder question but does not answer the policy
question, and the policy is where the real design work is.
\paragraph{What does the cluster require before signing?} A verifier attestation
is the minimum. Two independent attestations, or an attestation plus an elapsed
challenge window, are stronger. The window matters: it converts an undetected
verifier compromise into a race the honest party can win.
\paragraph{What is the refund path?} A job whose deadline passes without a valid
result must return funds. This should be a signing policy the cluster can execute
against an on-chain timestamp, not a manual operation.
\paragraph{What is the dispute path?} If the buyer and verifier disagree, whose
attestation governs? We suggest the answer is neither: escalate to a higher
verification tier and let the result decide, with the loser paying for it. That
makes frivolous disputes self-limiting.
\paragraph{Who runs the parties?} The security of a $t$-of-$n$ scheme is the
security of the least correlated $t$ parties. Parties operated by one entity, on
one cloud, in one region, under one jurisdiction are not $n$ parties. This is the
same diversity problem replication has, and it deserves the same explicit
treatment rather than being assumed away.
\section{Availability}
The threshold signing engine, the multi-chain adapters, the transaction assembler
and the key-management integration are open source under permissive licence. The
signing engine can be adopted without the assembler, and the assembler without
the market --- the boundary described above is real, not aspirational, and each
piece is separately useful.
\end{document}
equality/equality.pdf
BIN
View File
Binary file not shown.
equality/equality.tex
+247
View File
@@ -0,0 +1,247 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Byte Equality:\\Deterministic Work as a Market Primitive}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
Los Angeles, California \\
\texttt{https://hanzo.ai}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
The hardest problem in a decentralized compute market is not matching supply to
demand. It is establishing that the supplier computed what the buyer paid for.
Most designs answer this with replication or with succinct proofs, and both are
expensive: replication multiplies the compute bill by the committee size, and
proving multiplies it by three to six orders of magnitude.
For a large and underexploited class of work, neither is necessary. When a
computation is bit-reproducible, correctness is decidable by comparison against
a canonical implementation at the cost of running the canonical implementation
once --- and for a market that publishes fixed test vectors, at the cost of a
table lookup. We describe the byte-equality contract we enforce across a
29-primitive cryptographic corpus and three GPU backends, argue that it is a
market primitive rather than an engineering practice, and show that the
crossover threshold it produces as a by-product is itself a quantity the market
needs. We then draw the determinism boundary honestly: which AI work can be made
bit-exact, at what throughput cost, and where it cannot.
\end{abstract}
\tableofcontents
\newpage
\section{Two regimes of verification}
Let a job be a function $f$ and an input $x$; the provider returns $\hat{y}$ and
claims $\hat{y} = f(x)$. Verification splits on a single property.
\begin{definition}[Determinism class]
A job is in class $\mathsf{D}$ if $f$ is bit-reproducible: any correct
implementation on any conforming device returns byte-identical output for
identical input. It is in class $\mathsf{S}$ if $f$ is well-defined only up to a
tolerance --- floating-point reductions whose order is unspecified, sampling with
unpinned entropy, kernels whose tiling changes the summation order. It is in
class $\mathsf{O}$ if the buyer cannot characterise $f$ at all.
\end{definition}
The regimes have radically different verification economics, and a market that
does not distinguish them overpays for the easy case and underprotects the hard
one.
\begin{table}[h]
\centering
\begin{tabular}{llll}
\toprule
Class & Verification & Cost & Adjudication \\
\midrule
$\mathsf{D}$ & recompute canonical / KAT lookup & $O(1)$ amortised & proof of misbehaviour \\
$\mathsf{S}$ & replication or succinct proof & $m\times$ or $10^{3}$--$10^{6}\times$ & statistical or cryptographic \\
$\mathsf{O}$ & reputation, attestation, stake & --- & social \\
\bottomrule
\end{tabular}
\caption{Verification economics by determinism class.}
\end{table}
The point of this paper is that class $\mathsf{D}$ is much larger than it looks,
and that the machinery to exploit it already exists and is open source.
\section{The contract}
We hold every shipping GPU kernel to byte equality against a first-party CPU
canonical. The contract has three parts, and each exists for a distinct reason.
\paragraph{Equality on randomized inputs.} Every release, each primitive is
exercised on $N = 1000$ randomized inputs across the CPU canonical and every GPU
backend --- Metal, CUDA and WGSL. All outputs must be byte-identical. Random
inputs rather than fixed vectors matter because fixed vectors are what an
implementation is tuned against; randomization is what catches the tiling bug
that only fires on an odd tail.
\paragraph{Test-oracle isolation.} The audited upstream implementation used as
an oracle is never linked into the shipped library. This keeps the thing being
tested and the thing testing it genuinely independent, so a shared bug cannot
cancel out. Cross-oracle checking extends this: BN254 results are checked
against \code{gnark-crypto} (36 of 36 vectors) and independently against
\code{arkworks}, which are unrelated codebases and therefore give adversarial
distance rather than a second opinion from a cousin.
\paragraph{Memory hygiene.} Secret state does not leave attested accelerator
memory on the hot path. This is orthogonal to correctness but belongs in the
same contract because a market will run these kernels on machines the key owner
does not control.
\section{Why this is a market primitive}
An engineering team reads the above as a quality-assurance regime. A market
should read it as three distinct economic objects.
\subsection{Fraud becomes impossible rather than detectable}
Under replication, a dishonest provider is caught with probability depending on
committee composition, and adjudication is a vote. Under byte equality a
mismatch is a \emph{proof}: the canonical output is a published fact, and any
party can recompute the comparison. Slashing is then mechanical and requires no
quorum, no oracle, and no assumption about the fraction of honest providers.
This removes an entire class of governance from the protocol.
\subsection{Verification cost collapses}
Consider a market that would otherwise replicate three-fold for confidence. The
verification overhead is $200\%$ of the useful compute. Moving a job from class
$\mathsf{S}$ to class $\mathsf{D}$ removes that overhead entirely. On a market
where a nontrivial share of volume is cryptographic or integer-quantized work,
this is the single largest efficiency available, and it is available without any
new cryptography.
\subsection{The crossover threshold is a price signal}
A by-product of the same methodology is $N^{*}$, the batch size at which a GPU
kernel overtakes the single-thread CPU baseline for a given primitive. Measured
across the corpus, $N^{*}$ ranges from $1$ (homomorphic-encryption number
theoretic transform --- the GPU wins on a single call) to $1024$ (SHA-256 --- a
GPU is worse than a CPU until a thousand hashes are in flight).
That number is not a benchmark curiosity. It is the feasibility boundary of a
bid. A provider offering GPU capacity for a class-$\mathsf{D}$ job with batch
size below $N^{*}$ is offering something strictly worse than a commodity CPU at
a higher price. Publishing $N^{*}$ per primitive lets the market reject
mispriced supply structurally rather than discovering it through disappointed
buyers.
\begin{table}[h]
\centering
\begin{tabular}{lll}
\toprule
Primitive family & Measured speedup & Crossover $N^{*}$ \\
\midrule
Fused BLS aggregation & $144.22\times$ & --- \\
FHE NTT (Metal, kernel-only, 10-iter median) & $16.92\times$ & $1$ \\
Batched Ed25519 verify (RFC 8032) at $N{=}4096$ & $26.7\times$ & --- \\
SHA-256 & --- & $1024$ \\
\bottomrule
\end{tabular}
\caption{Representative measurements from the corpus, single Apple M2 Ultra.
CPU NTT throughput at $N{=}2^{20}$ is 6--9 Mops/s on the same device.}
\end{table}
\section{The determinism boundary in AI work}
The natural objection is that neural inference is class $\mathsf{S}$ and
therefore none of this applies. That is true by default and false by
construction, and the distinction is worth money.
\subsection{What makes inference nondeterministic}
Floating-point addition is not associative. A reduction whose order depends on
block scheduling, an atomic accumulation whose interleaving depends on
occupancy, a flash-attention tiling chosen by an autotuner at load time --- each
makes output depend on hardware and scheduling rather than on $f$ alone. Batch
size changes reduction order, so even the same device gives different answers at
different loads. None of this is error; it is unspecified behaviour that was
never worth specifying.
\subsection{What makes it deterministic again}
Determinism is a kernel property one may choose to pay for:
\begin{itemize}[leftmargin=1.4em]
\item \textbf{Integer paths.} Weight-and-activation quantized inference in
\code{int8} or \code{int4} with integer accumulation is exactly
reproducible. There is no rounding order to disagree about.
\item \textbf{Batch-invariant kernels.} Fixing the reduction order independent of
batch size and occupancy removes the load dependence, at a throughput cost
typically in the low tens of percent.
\item \textbf{Pinned sampling.} Greedy decoding, or sampling from a specified PRF
seeded by a value in the job specification, makes the token sequence a
function of the request.
\item \textbf{Pinned numerics.} A declared accumulation dtype and a declared
attention implementation, both carried in the job specification and
attested by the provider.
\end{itemize}
The result is a job class we would write as $\mathsf{D}_{\text{inf}}$: slower
than unconstrained inference, and verifiable by recomputation on any conforming
device. Whether a buyer wants it is a price question, which is the right way for
it to be.
\subsection{Where it does not reach}
Training is not practically reproducible across heterogeneous hardware, and
large-batch \code{bf16} inference at maximum throughput is not either. Those
remain class $\mathsf{S}$ and need the tier ladder. The claim here is narrower
and defensible: a material fraction of paid compute --- all cryptographic work,
all quantized inference, all embedding generation with pinned numerics, all
search --- can be moved into class $\mathsf{D}$ deliberately.
\section{Proposal: determinism class as a first-class job attribute}
We suggest a market carry the class on the job rather than inferring it.
\begin{lstlisting}
job:
kind: inference | crypto | search
determinism: D | D_inf | S | O
numerics: { dtype: int8, accum: int32, attention: fixed, sampling: greedy }
canonical: <content-addressed reference implementation>
vectors: <published KAT set, optional>
\end{lstlisting}
Three consequences follow immediately. Pricing differs by class because
verification cost differs by class, and the buyer chooses. Providers advertise
which classes they can honour, which is a capability constraint the allocator
already understands. And a class-$\mathsf{D}$ job needs no proof system at all,
which means a market can launch with real verifiable volume before any proving
infrastructure exists.
\section{What is available}
The corpus, the contract and the measurement harness are open source under
permissive licence: a 29-primitive library spanning hashes, AEAD, elliptic
curves including pairing-friendly ones, polynomial commitments, lattice
primitives, post-quantum signatures and key encapsulation, threshold schemes,
homomorphic-encryption building blocks and EVM precompile wrappers, with Metal,
CUDA and WGSL kernels held to the equality contract described above.
Adopting it does not require adopting anything else in our stack. The contract
is a testing discipline plus a published artifact; the artifact is what a market
needs, and it is reproducible by anyone who wants to check it.
\section*{Note on scope}
Nothing here establishes that a provider ran the job \emph{when} it said, on the
hardware it claimed, or without also serving someone else. Byte equality
establishes what was computed, not the circumstances. Those are separate
questions with separate mechanisms, treated in the companion papers on
verification tiers and on settlement.
\end{document}
residency/residency.pdf
BIN
View File
Binary file not shown.
residency/residency.tex
+336
View File
@@ -0,0 +1,336 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Compute With Memory:\\Adapter Residency as a Price Term}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
Los Angeles, California \\
\texttt{https://hanzo.ai}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
Proof of work rests on an assumption that is easy to miss because it is never
stated: hashpower is memoryless. Any miner is interchangeable with any other
miner at the same rate, and no miner is cheaper for one particular block than
for another. That assumption is what permits a single scalar difficulty.
Personalized agents break it. When an agent carries its own low-rank weight
delta, a provider that has served that agent before is permanently cheaper for
that agent than an otherwise identical provider that has not. Compute acquires
memory, the supply side becomes non-fungible per buyer, and cost stops being a
function of the endpoint and becomes a function of the path taken through
resource space. That is precisely the condition under which a scalar price
fails and a Hamiltonian formulation earns its keep.
We quantify the effect. A rank-16 adapter on a 70B model is
\SI{168}{\mega\byte} against a \SI{140}{\giga\byte} base --- a residency
asymmetry of roughly three orders of magnitude. We derive the resulting cost
functional, show that the na\"ive one-process-per-adapter deployment costs
\num{175} accelerators where a batched deployment costs two, and state the
single serving primitive that separates those two regimes. We report the exact
state of that primitive in the Hanzo inference engine, including what is absent.
\end{abstract}
\tableofcontents
\newpage
\section{The memorylessness assumption}
Bitcoin's difficulty adjustment is a scalar because the resource it prices is
one-dimensional and history-free. Write $h_i$ for miner $i$'s hash rate. The
expected time for miner $i$ to find a block at difficulty $D$ is $D/h_i$,
independent of which block, which transactions it contains, and everything
miner $i$ has ever done before. Two consequences follow, and both are load-bearing:
\begin{enumerate}[label=(\alph*)]
\item \emph{Fungibility.} Miners at equal $h$ are perfect substitutes. There is
no buyer-specific cost.
\item \emph{Statelessness.} The cost of the next unit of work does not depend on
the sequence of previous units. There is no path dependence.
\end{enumerate}
Together, (a) and (b) collapse the market to a single price per unit hash and a
single difficulty. Neither survives contact with personalized inference.
\section{Where the memory comes from}
\subsection{Low-rank deltas}
A low-rank adaptation replaces a frozen projection $W \in \mathbb{R}^{d_{\mathrm{out}} \times d_{\mathrm{in}}}$
with
\begin{equation}
W' x = W x + s \cdot B A x,
\qquad
A \in \mathbb{R}^{r \times d_{\mathrm{in}}},\;
B \in \mathbb{R}^{d_{\mathrm{out}} \times r},\;
s = \frac{\alpha}{r},
\end{equation}
where $r \ll \min(d_{\mathrm{in}}, d_{\mathrm{out}})$. The pair $(A,B)$ is the
agent's private state. Everything else is shared.
This is the shape implemented in \repo{hanzo-train/src/lora.rs}, where the base
is a frozen \code{Linear} and the delta is a separate tracked
\code{LoraDelta \{ name, a, b, scale \}} carrying $A$ as $(r, d_{\mathrm{in}})$
and $B$ as $(d_{\mathrm{out}}, r)$.
\subsection{Parameter count and size}
Adapting $T$ projections in each of $L$ layers of a model with hidden dimension
$d$ costs
\begin{equation}
|\theta_{\text{adapter}}| \;=\; 2\,r\,L\,T\,d
\end{equation}
parameters when the adapted projections are square in $d$. At \code{bf16} the
byte cost is twice that. Table~\ref{tab:sizes} gives the values that matter.
\begin{table}[h]
\centering
\begin{tabular}{llrrr}
\toprule
Model class & Targets & $r$ & Parameters & Size (\code{bf16}) \\
\midrule
7B ($d{=}4096$, $L{=}32$) & q,k,v,o & 8 & \num{8388608} & \SI{16.8}{\mega\byte} \\
7B & q,k,v,o & 16 & \num{16777216} & \SI{33.6}{\mega\byte} \\
7B & q,k,v,o + mlp & 16 & \num{29360128} & \SI{58.7}{\mega\byte} \\
7B & q,k,v,o & 64 & \num{67108864} & \SI{134.2}{\mega\byte} \\
70B ($d{=}8192$, $L{=}80$) & q,k,v,o & 8 & \num{41943040} & \SI{83.9}{\mega\byte} \\
70B & q,k,v,o & 16 & \num{83886080} & \SI{167.8}{\mega\byte} \\
70B & q,k,v,o & 64 & \num{335544320} & \SI{671.1}{\mega\byte} \\
\bottomrule
\end{tabular}
\caption{Adapter parameter counts and sizes.}
\label{tab:sizes}
\end{table}
\subsection{The asymmetry}
Set against those figures, the base model is \SI{140}{\giga\byte} at
\code{bf16} for a 70B, or roughly \SI{40}{\giga\byte} quantized to four bits.
The ratio that governs everything downstream is
\begin{equation}
\frac{|\text{base}|}{|\text{adapter}|} \;\approx\; 10^{3}.
\end{equation}
An adapter is nearly free to move; the base it attaches to is, for practical
purposes, immovable within any interactive latency budget. At
\SI{10}{\giga\bit\per\second} a \SI{140}{\giga\byte} transfer takes
\SI{112}{\second}. Against a \SI{3}{\second} service objective that is not
expensive --- it is infeasible. Feasibility and price are therefore entangled
through residency, which is the technical heart of this paper.
\section{The cost functional}
\begin{definition}[Residency state]
For a provider $\bundle$ at time $t$, let $\beta(\bundle,t) \in \{0,1\}$
indicate whether the base model required by job $\job$ is resident in
accelerator memory, and $\alpha(\bundle,\job,t) \in \{0,1\}$ whether $\job$'s
adapter is resident.
\end{definition}
The allocation objective in the heterogeneous market is then
\begin{equation}
\cost(\job,\bundle) \;=\;
\underbrace{p(\bundle)\,\tau(\job,\bundle)}_{\text{compute}}
\;+\; \lambda_{L}\,\ell
\;+\; \lambda_{F}\,\phi
\;+\; \lambda_{V}\,v
\;+\; \underbrace{\mu_{1}\big(1-\beta\big) \;+\; \mu_{2}\big(1-\alpha\big)}_{\text{cold-start}},
\label{eq:objective}
\end{equation}
with $\ell$ latency, $\phi$ failure risk, $v$ verification cost, and
\begin{equation}
\frac{\mu_{1}}{\mu_{2}} \;\approx\; \frac{|\text{base}|}{|\text{adapter}|} \;\approx\; 10^{3}.
\end{equation}
The last two terms are what a stateless spot market omits, and they are not a
correction --- at interactive deadlines $\mu_1$ is frequently large enough to
make the constraint binding rather than the price.
\begin{proposition}[Cheapest capable is wrong]
Let $\bundle_{1}$ be an accelerator priced at $p_{1}$ with $\beta = 1$, and
$\bundle_{2}$ priced at $p_{2} \ll p_{1}$ with $\beta = 0$. If the deadline
$\Delta$ satisfies $\Delta < |\text{base}| / \text{bw}(\bundle_{2})$, then
$\bundle_{2}$ is infeasible regardless of $p_{2}$, and the correct allocation is
$\bundle_{1}$ at arbitrarily large price ratio.
\end{proposition}
The worked instance: an accelerator at \$4/hour holding the model beats one at
\$0.50/hour that must first fetch \SI{140}{\giga\byte}. Under a
\SI{3}{\second} objective the cheaper machine is not in the feasible set at all.
\section{Affinity, and what it implies for the market}
Because $\mu_{1} \gg \mu_{2}$, agents develop \emph{affinity} for the nodes that
already hold their base model, and their adapter follows cheaply. This produces
structure a spot market cannot express:
\paragraph{Stickiness is efficient, not rent-seeking.} Routing an agent back to
the same provider is the cost-minimising choice, not a lock-in artifact. A
market design that forces uniform random allocation across capable providers
destroys real surplus.
\paragraph{Eviction is a pricing decision.} An accelerator holding $k$ resident
adapters faces a knapsack problem whenever a new agent arrives. The shadow price
of a residency slot is the expected discounted future value of the agent
occupying it, which is exactly the object a continuous market can quote and a
discrete order book cannot.
\paragraph{Residency is self-proving.} A provider cannot profitably lie about
holding an agent's weights, because the lie is revealed by the deadline it then
misses. This is unusual and useful: the market needs no attestation mechanism
for this particular claim.
\paragraph{State rent is a new instrument.} An agent may pay a small continuous
fee to keep its adapter resident somewhere, converting a stochastic cold-start
cost into a predictable stream. This is an option on locality. It has no
analogue in a stateless compute market and it is a revenue line that does not
exist today.
\section{Capacity: how many agents fit}
The reason this matters economically is that adapters are small enough that
personalization is not, in fact, expensive --- once the delta stops dragging a
base model behind it.
\begin{table}[h]
\centering
\begin{tabular}{llrr}
\toprule
Base & Free memory & Adapter & Resident agents \\
\midrule
70B \code{bf16} on \SI{180}{\giga\byte} & \SI{40}{\giga\byte} & \SI{17.2}{\mega\byte} & \num{2326} \\
70B \code{bf16} on \SI{180}{\giga\byte} & \SI{40}{\giga\byte} & \SI{137.4}{\mega\byte} & \num{291} \\
70B 4-bit on \SI{80}{\giga\byte} & \SI{40}{\giga\byte} & \SI{17.2}{\mega\byte} & \num{2326} \\
7B \code{bf16} on \SI{80}{\giga\byte} & \SI{65}{\giga\byte} & \SI{17.2}{\mega\byte} & \num{3779} \\
\bottomrule
\end{tabular}
\caption{Resident agents beside one shared base, ignoring KV cache.}
\label{tab:capacity}
\end{table}
Against that, the cost of \emph{not} sharing the base:
\begin{table}[h]
\centering
\begin{tabular}{lrr}
\toprule
100 personalized agents, 70B \code{bf16} & Memory & Accelerators \\
\midrule
One process per adapter & \SI{14000}{\giga\byte} & \num{175} \\
Batched multi-adapter & \SI{141.7}{\giga\byte} & \num{2} \\
\bottomrule
\end{tabular}
\caption{The duplication cost, at \SI{80}{\giga\byte} per accelerator.}
\label{tab:duplication}
\end{table}
An \(\approx 87\times\) reduction in the capital required to serve a
personalized population is not an optimization. It sets the cost floor for the
entire category, and whoever ships it first defines that floor for everyone else.
\section{What exists, and the one thing that does not}
We state the current position precisely, because the gap is narrow and specific
and it is worth no one's time to mistake it for a research problem.
\subsection{Training: complete}
\repo{hanzo-train} is \num{2215} lines implementing trainable LoRA over frozen
bases, AdamW, distillation, a data loader, and PEFT-format serialization whose
tensor names match the inference-side merge. It is exposed over the serving API:
\begin{lstlisting}
POST /v1/training/clients base model + LoRA injection
GET /v1/training/clients[/{id}] list / inspect (+ loss history)
POST /v1/training/clients/{id}/forward_backward accumulate gradients
POST /v1/training/clients/{id}/optim_step apply AdamW
POST /v1/training/clients/{id}/sample decode from current base+delta
POST /v1/training/clients/{id}/save_weights write the adapter for inference
DELETE /v1/training/clients/{id} drop client, free memory
\end{lstlisting}
An agent can be given its own weights today, end to end.
\subsection{Serving: co-residency yes, selection no}
The inference side carries \repo{hanzo-engine/src/lora/loralinear.rs} and
\code{qloralinear.rs}, an X-LoRA implementation under
\repo{hanzo-engine/src/xlora\_models/}, and AnyMoE. X-LoRA is significant here
for a reason unrelated to its purpose: it loads many adapters into one process
simultaneously. \emph{Co-residency is solved.} What X-LoRA does with those
adapters --- mix all of them for every token through a learned classifier --- is
not what a market needs, but the memory management, shape handling and loading
are done.
What is absent is selection:
\begin{itemize}[leftmargin=1.4em]
\item \code{preload\_adapters} is a load-time \code{HashMap}, threaded through
the loaders as \code{Option<HashMap<String, (ShardedVarBuilder, LoraConfig)>>}.
\item \code{with\_lora(adapters: Vec<String>)} is a pipeline-construction argument.
\item \code{hanzo\_quant::lora::merge\_lora\_weights} folds the delta \emph{into}
the base weight at load, which destroys per-adapter separability by design.
\item The OpenAI-compatible request in \repo{hanzo-server-core/src/openai.rs}
carries no adapter field.
\end{itemize}
One process therefore serves one adapter configuration, which is exactly the
regime that costs \num{175} accelerators in Table~\ref{tab:duplication}.
\subsection{The missing primitive}
Batched multi-adapter serving requires that a single forward pass over a batch
of sequences apply a \emph{different} delta per sequence:
\begin{equation}
y_{i} \;=\; W x_{i} \;+\; s_{a(i)} \, B_{a(i)} A_{a(i)} x_{i},
\qquad a(i) \in \{1,\dots,k\},
\end{equation}
where $a(i)$ is the adapter index of sequence $i$ in the batch. Implemented as a
segmented gather-matmul, the added cost over the shared base is
$O(r(d_{\mathrm{in}}+d_{\mathrm{out}}))$ per token --- negligible against the
$O(d_{\mathrm{in}}d_{\mathrm{out}})$ base projection at $r \le 64$.
The unmerged forward already exists in the tree, on the training side:
\code{LoraLinear} in \repo{hanzo-train/src/lora.rs} keeps \code{base} frozen and
\code{delta: Option<LoraDelta>} separate, computing $s\,(x A^{\!\top}) B^{\!\top}$
as its own path with tensor layouts documented as matching the inference merge.
The work is to make that path batch-aware over $a(i)$, add an adapter field to
the request, and place a cache with eviction in front of it. Every piece has a
reference implementation in the same repository.
\section{Consequence for a Hamiltonian market}
With stateless homogeneous inference, a spot market for accelerator-hours is
close to sufficient; the resource manifold is nearly a line and a price vector
nearly spans it. Personalization is what makes the manifold genuinely coupled:
the cost of serving a request depends on the trajectory the system has already
taken, because that trajectory determines what is resident where.
This is the concrete content of treating compute as a coupled resource system
rather than a family of independent order books. The coupling is not between
device types --- those really are close to substitutes at equal capability. The
coupling is between \emph{a buyer's history} and \emph{a provider's current
state}, and it is strong, asymmetric, and continuously varying. A scalar
difficulty cannot express it. A Hamiltonian in $(q,p)$ over occupancy and price
can.
\section*{Availability}
The inference engine, training crate, router and model catalog discussed here
are open source under permissive licence. The adapter arithmetic in
Tables~\ref{tab:sizes}--\ref{tab:duplication} is reproducible from the formulas
given; no proprietary measurement is involved.
\end{document}
retrofit/retrofit.pdf
BIN
View File
Binary file not shown.
retrofit/retrofit.tex
+238
View File
@@ -0,0 +1,238 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Hybrid Post-Quantum Retrofit:\\Upgrading a Live Protocol Without a Fork}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Lux Partners} \\
\textit{A subsidiary of Hanzo Industries Inc} \\
\texttt{https://lux.network}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
A compute market protects its users' funds with signatures and its users' work
with encryption, and both rest on elliptic curves. Neither survives a
cryptographically relevant quantum computer. The usual objection to acting now
is that migration means a fork, a flag day, and a coordination problem across an
open provider network.
It does not have to. We describe a retrofit pattern that adds post-quantum
identity and key exchange to a running protocol without changing its wire format
or forking the reference implementation, and we report two independent
deployments of it: one onto a mesh networking stack with a 500-byte maximum
transmission unit and a 5 bit-per-second floor, and one onto a
defence-grade file storage and transfer profile. The first is the harder
constraint by a wide margin, and it fits.
We then apply the pattern surface by surface to a decentralized compute market
--- provider identity, session establishment, job receipts, staking signatures,
governance --- give the byte cost of each, and propose a migration order derived
from key lifetime rather than from implementation convenience.
\end{abstract}
\tableofcontents
\newpage
\section{Two clocks, not one}
Quantum risk is usually discussed as a single future event. For protocol design
it is two separate deadlines with different urgencies.
\paragraph{Confidentiality has already expired.} An adversary recording session
transcripts today can decrypt them whenever a capable machine exists. Every
session established with a classical key exchange is retroactively readable. The
deadline for key exchange was whenever recording began.
\paragraph{Authenticity expires later, but the key does not rotate.} A signature
forged after the fact is worthless against a transcript already accepted, so
signing is less urgent --- unless the key is long-lived, in which case an
adversary who recovers it can impersonate the holder from that moment forward.
Provider identity keys, staking keys and governance keys are exactly that: keys
whose value is their continuity.
The ordering falls out. Key exchange first because the loss is already
accruing; long-lived identity next because it cannot be rotated cheaply;
ephemeral per-job signatures last because they can simply be reissued.
\section{The pattern}
The retrofit is additive, hybrid, and wire-compatible.
\paragraph{Additive.} The post-quantum material is carried alongside the
classical material, not instead of it. An old peer ignores a field it does not
recognise; a new peer verifies both. No version negotiation, no flag day.
\paragraph{Hybrid.} Security is the maximum of the two assumptions, not the
minimum. The session key derives from both shared secrets through a
domain-separated key derivation, so the construction is at least as strong as
the stronger component. A break in the lattice assumption degrades to classical
security; a quantum adversary degrades to lattice security. This matters because
lattice cryptography is young, and a market should not bet its custody on the
newest assumption alone.
\paragraph{Wire-compatible.} The transport, framing, session state machine and
authentication flow are untouched. This is the property that makes it a retrofit
rather than a migration.
\begin{table}[h]
\centering
\begin{tabular}{lll}
\toprule
Layer & Classical & Hybrid replacement \\
\midrule
Identity signing & Ed25519 & Ed25519 + ML-DSA-65 (detached pair, both verify) \\
Key exchange & X25519 & X-Wing = X25519 + ML-KEM-768 \\
Key exchange, high value & X448 & X448 + ML-KEM-1024 \\
Bulk AEAD & AES-256-GCM & unchanged \\
Bulk AEAD, software & ChaCha20-Poly1305 & unchanged \\
Hash & SHA-256 & SHA-384 / SHA3-384 \\
Derivation & HKDF & HKDF-SHA-384, domain-separated per layer \\
\bottomrule
\end{tabular}
\caption{The substitution table. Symmetric primitives are left alone: Grover
halves the effective key length, and 256-bit keys are already sized for that.}
\end{table}
\section{Two deployments}
\subsection{Mesh networking under extreme constraint}
The first deployment extends a cryptography-based mesh networking stack designed
for LoRa, packet radio, KISS modems, serial lines and free-space optical links
--- any half-duplex carrier with at least 5 bits per second and a 500-byte
maximum transmission unit. It provides initiator-anonymous, coordination-free
multi-hop transport entirely without IP.
Adding a 1952-byte public key and a 3309-byte signature to a protocol with a
500-byte frame is the least forgiving environment we could have chosen, which is
why it was the right test. Identity signing moved to Ed25519 with ML-DSA-65
alongside; key exchange to X25519 with ML-KEM-768; session encryption and
derivation unchanged, now over the hybrid secret. The reference protocol was not
forked.
\subsection{Defence-grade storage and transfer}
The second is an envelope-encryption profile for file storage and transfer that
encrypts before content enters any storage or transfer system, so the back end
sees only ciphertext and opaque manifests --- sender, recipients, filenames and
classification labels never leave the client. Bulk encryption is AES-256-GCM in
the certified profile or ChaCha20-Poly1305 in software, hashing is SHA-384 or
SHA3-384, key wrapping is X-Wing for the general case and X448 with ML-KEM-1024
for high-value material, and the sender signature is a detached Ed25519 and
ML-DSA-65 pair.
The two deployments share no code and no threat model. What they share is the
pattern, which is the point.
\section{Policy as a separate object}
A hybrid deployment needs a way to say ``classical is no longer acceptable
here'' without that statement being scattered across every call site. We keep it
as one value and one gate.
The policy is a profile carrying one prohibition flag per cryptographic
primitive family, with a zero value meaning classical semantics and a strict
constructor setting every flag. Operations report themselves through a small
fixed set of stable identifiers covering the precompile families and polynomial
commitments. Every constrained operation calls a single refusal function once at
the top of its entry point and otherwise proceeds in its own lane.
The property worth copying is the decomplection: the profile does not know how
operations compute, and operations do not know how the profile was selected.
Verification logic and policy enforcement are not braided together, so either can
be replaced without touching the other.
A second, duller lesson is worth stating because it cost us real bugs. The
profile and policy identifier strings were independently reimplemented in Go, in
Solidity, in TypeScript and in a paper, and they drifted --- one surface used a
name the on-chain state did not recognise. Identifiers of this kind should have
exactly one source of truth, generated into every consuming language. We now
publish them as a single package with Go, Solidity and TypeScript subpackages
sharing one set of strings.
\section{Applying it to a compute market}
\begin{table}[h]
\centering
\begin{tabular}{llll}
\toprule
Surface & Key lifetime & Exposure & Priority \\
\midrule
Session establishment & seconds & harvest-now, decrypt-later & first \\
Provider identity & years & impersonation on recovery & first \\
Staking / custody keys & years & direct theft & first \\
Governance keys & years & protocol capture & second \\
Job receipts & minutes & forgery after acceptance & third \\
Client API tokens & months & rotate instead & rotate \\
\bottomrule
\end{tabular}
\caption{Migration order derived from key lifetime and loss on compromise.}
\end{table}
\subsection{Byte budget}
Adoption is a bandwidth question, and the numbers are modest at market scale.
\begin{table}[h]
\centering
\begin{tabular}{lrr}
\toprule
Object & Classical & Hybrid \\
\midrule
Identity public key & \SI{32}{\byte} & \SI{1984}{\byte} \\
Identity signature & \SI{64}{\byte} & \SI{3373}{\byte} \\
Key-exchange public key & \SI{32}{\byte} & \SI{1216}{\byte} \\
Key-exchange ciphertext & \SI{32}{\byte} & \SI{1120}{\byte} \\
\bottomrule
\end{tabular}
\caption{Wire cost of the hybrid substitution. ML-DSA-65 public keys are
\SI{1952}{\byte} and signatures \SI{3309}{\byte}; ML-KEM-768 public keys are
\SI{1184}{\byte} and ciphertexts \SI{1088}{\byte}; classical components add
\SI{32}{\byte} each.}
\end{table}
A signed job receipt grows by roughly \SI{3.3}{\kilo\byte}. At a million jobs a
day that is \SI{3.3}{\giga\byte} of additional signature traffic --- entirely
unremarkable for a system already moving model weights. Session establishment
grows by about \SI{2.3}{\kilo\byte} once per session, amortised across every
request in it.
\subsection{A conservative root of trust}
Lattice assumptions are the right default for volume: fast, small, standardised.
For the single most valuable key in the system --- the one that anchors
governance or custody --- there is an argument for a different hardness
assumption entirely. Hash-based signatures under FIPS 205 rest only on the
preimage resistance of a hash function, an assumption with a far longer track
record and no algebraic structure for a future attack to exploit. They are larger
and slower, which is irrelevant for a key used a handful of times a year.
Our threshold signing daemon carries this as a first-class option alongside the
lattice families, and also supports composing two orthogonal lattice families so
that both must verify --- a hedge against a break in one lattice problem rather
than a break in lattices generally.
\section{What adoption looks like}
The retrofit does not require adopting our transport, our consensus or our
tooling. It requires an implementation of ML-DSA-65 and ML-KEM-768, a
domain-separated derivation, an additive wire field, and a dual-verify window
during which both signatures are checked and only the classical one is required.
The window closes when the population has migrated, at which point the classical
field becomes optional and eventually ignored.
Our implementations of the primitives, the hybrid envelope profile, the mesh
retrofit, the policy gate and the shared identifier package are open source under
permissive licence, with known-answer test vectors. They are usable
independently of each other and of everything else we build.
\end{document}
search/search.pdf
BIN
View File
Binary file not shown.
search/search.tex
+250
View File
@@ -0,0 +1,250 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Las Vegas Workloads:\\Verifiable Search in a Compute Market}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
Los Angeles, California \\
\texttt{https://hanzo.ai}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
The obvious first workload for a decentralized compute market is inference,
because inference is what people want to buy. It is also close to the worst
workload the design could start with, because there is no cheap way to check it.
Verifiable search is the opposite. A search job is enormous to compute and
trivial to check, the check is binary, an invalid answer simply fails rather
than requiring adjudication, the work is embarrassingly parallel across
heterogeneous supply, and the input is public so provider selection carries no
privacy constraint. Fraud is not detected --- it is impossible, which removes an
entire layer of protocol.
We formalise the class, contrast its market properties with inference, and work
through a live example: hash-based signature search for quantum-resistant
Bitcoin spends. The example is instructive beyond itself, because analysing it
produces a design rule that generalises to every proof-of-work-flavoured
construction, and because the block-space arithmetic shows how a scheme's
container choice can dominate its cryptography.
\end{abstract}
\tableofcontents
\newpage
\section{The class}
\begin{definition}[Las Vegas workload]
A job is a pair $(\mathcal{V}, p)$ where $\mathcal{V}(x, w) \in \{0,1\}$ is a
predicate computable in time negligible against the search, and each independent
trial succeeds with probability $p$. The provider's task is to find any $w$ with
$\mathcal{V}(x,w) = 1$. Expected work is $1/p$ trials; verification cost is
independent of the work performed.
\end{definition}
Four market properties follow directly, and together they are unusual enough to
be worth listing.
\paragraph{Verification is free.} $\mathcal{V}$ is by construction cheap. No
proof system, no replication, no committee. The job sits at tier T1 of the
verification ladder at zero marginal cost.
\paragraph{Fraud is impossible rather than detectable.} A provider cannot submit
a wrong answer that passes, because passing is the definition of right. There is
nothing to slash for, because there is nothing a dishonest provider can gain.
The worst available misbehaviour is doing nothing, which is a liveness problem
and is priced by the deadline.
\paragraph{Sharding is free.} The search space partitions cleanly. Ten thousand
providers can work disjoint nonce ranges with no coordination beyond the initial
assignment, and heterogeneous hardware simply contributes at whatever rate it
manages.
\paragraph{The input is public.} There is no confidential material to protect,
so provider selection is unconstrained by privacy and the job can be broadcast
openly. Private preimages, where the construction has them, never leave the
owner's device --- only the public search is outsourced.
\section{Why inference is harder}
Inference has no cheap $\mathcal{V}$. Given a token stream, there is no
sub-linear test that it came from the model that was paid for. Options are
recomputation (as expensive as the job), replication (multiplies the bill),
algebraic spot-checking of the matrix products (good, but silent about the
nonlinearities and about which weights were used), or a succinct proof (three to
six orders of magnitude of prover overhead).
This is not an argument against building an inference market. It is an argument
for not making the verification layer's first load-bearing test be its hardest
case. A market that carries search volume from day one has real verified
throughput while its inference verification story matures.
\section{A worked example}
\subsection{The construction}
Consider a scheme that makes a Bitcoin spend's security rest on hash preimage
resistance rather than on the discrete logarithm, using only opcodes already
deployed --- so that coins can be protected against a Shor-capable adversary
without waiting for a consensus change.
The mechanism is forced by a limit. Bitcoin's legacy script cannot compute the
index-selection function of a hash-based one-time signature within its
201-opcode budget. So instead of computing which key indices a message selects,
the script hardcodes the index set and the signer grinds the transaction ---
varying a nonce field --- until its hash lands on that set. The grind is the
mechanism, and it is a Las Vegas workload in exactly the sense defined above.
\subsection{The arithmetic}
For a scheme committing to 9 indices from 150 in a first round and 8 from the
remaining 141 in a second:
\begin{table}[h]
\centering
\begin{tabular}{lrr}
\toprule
Quantity & Value & Bits \\
\midrule
$\binom{150}{9}$ & \num{8.29e13} & $2^{46.2}$ \\
$\binom{141}{8}$ & \num{3.17e12} & $2^{41.5}$ \\
Sum, rounds sequential & \num{8.32e13} & $2^{46.2}$ \\
Product, rounds joint & \num{2.63e26} & $2^{87.8}$ \\
\bottomrule
\end{tabular}
\caption{Search size under the two possible round structures.}
\end{table}
Whether the rounds compose additively or multiplicatively is not a detail. At
$1.5 \times 10^{10}$ hashes per second per accelerator, the additive reading is
about \SI{1.5}{\hour} on a single device; the multiplicative reading is
$5.6 \times 10^{8}$ device-years. Those are not two versions of the same product.
One requires no marketplace at all; the other cannot be completed by any
marketplace.
\subsection{The design rule}
The more interesting observation concerns the adversary. In a grind-secured
scheme the honest signer's work and the attacker's work are the same
computation: once a spend is broadcast, its preimages are public, and an
adversary wishing to redirect the output must complete an identical search
before the transaction confirms. Security is therefore
\begin{equation}
\text{margin} \;=\; \frac{\text{honest precomputation time}}{\text{confirmation window}} \cdot \frac{\text{honest rate}}{\text{adversary rate}} ,
\end{equation}
and the second factor is where such schemes die. Against an adversary holding
SHA-256 application-specific silicon, a $10^{21}$ grind takes a mid-size mining
pool about \SI{1000}{\second} and the whole network about \SI{1}{\second}, while
ten thousand accelerators need \num{77} days.
\begin{proposition}[Grind selection rule]
Never grind a primitive for which your adversary owns dedicated silicon.
\end{proposition}
Applied here: if the ground function is a double SHA-256 the construction is
unsound in practice regardless of its combinatorics, because the entire Bitcoin
mining industry is an oracle for exactly that function. If it is
RIPEMD-160 composed with SHA-256 --- the \code{HASH160} opcode --- no deployed
miner accelerates it, general-purpose accelerators are the fastest available
hardware, and the symmetry breaks in the defender's favour. One opcode decides
whether the scheme works.
\subsection{Container arithmetic}
A second lesson is that where a script lives can dominate what it does.
\begin{table}[h]
\centering
\begin{tabular}{lrr}
\toprule
& Bare script & Committed script path \\
\midrule
Funding output & \num{9661} vB & \num{43} vB \\
Unspent-output-set cost until spent & \SI{9661}{\byte} & \SI{43}{\byte} \\
Spend & \num{646} vB & \num{2645} vB \\
Lifecycle total & \num{10318} vB & \num{2699} vB \\
One million protected addresses & \SI{9.66}{\giga\byte} & \SI{43}{\mega\byte} \\
\bottomrule
\end{tabular}
\caption{Block-space cost of a \SI{9650}{\byte} script by container, for one
input and one output revealing seventeen 32-byte preimages.}
\end{table}
The inversion is instructive. The bare-script \emph{spend} is cheaper, because
the script was already paid for when the output was created. That is precisely
the problem: this construction is insurance, and the bare container charges the
entire premium on day one, on chain, permanently, whether or not the policy is
ever claimed. A committed script path defers about ninety-eight percent of the
cost to the claim and reduces the permanent burden on every validating node by a
factor of \num{225}.
There is a caveat that outranks the table. If the construction depends on a
script-evaluation quirk that exists only in legacy script and was removed by the
segregated-witness upgrade, then it cannot be relocated at all, and the size
ceiling, the opcode ceiling and the grind stop being implementation choices and
become structural. That is the first thing to establish about any such design,
because it determines whether the remaining questions are about tuning or about
redesign.
\subsection{The construction that needs no search}
Worth stating because it reframes the whole exercise: the grind exists only
because legacy script could not compute the index selection. The tapscript
upgrade removed both the opcode limit and the script size limit, and hash-chain
one-time signatures have since been implemented in that environment as bit
commitments. Such a signature commits to the message digest directly. There is
no index selection, therefore no grind, therefore no search job, therefore no
compute market involvement --- and the construction is studied rather than
bespoke.
A market should want to know this. Selling compute for a search that a better
construction eliminates is not a business; recognising it and pricing the
remaining genuine search workloads is.
\section{Market mechanics for search}
\paragraph{Job specification.} Declare $\mathcal{V}$ as content-addressed code,
the success probability $p$, the search domain, and a deadline. Expected cost is
$1/p$ trials divided by the aggregate rate purchased.
\paragraph{Partitioning.} Assign disjoint domain ranges. A provider can lie about
which range it searched, but cannot fabricate a solution, so the worst outcome is
duplicated effort rather than theft. Overlapping assignments with a modest
redundancy factor are usually cheaper than the coordination needed to prevent
overlap.
\paragraph{Settlement.} Winner-take-all invites providers to hoard a solution
until the last moment when a race is close, and pays nothing to the participants
who bounded the risk. Proportional payment on assigned-and-attested range
coverage plus a finder's bonus is better behaved, at the cost of needing a weak
attestation of coverage --- which is one of the few places in this class where
some trust re-enters.
\paragraph{Pricing.} Expected work is known in advance, which makes search one of
the few compute workloads that can be quoted as a fixed price with a genuine
distribution rather than a guess. Variance is geometric with parameter $p$; the
market can offer a fixed-price contract and absorb the variance across jobs,
which is an insurance product and a real revenue line.
\section{Summary}
Search is the workload where a decentralized market's verification story is
free, its adjudication story is empty, and its sharding story is trivial.
Starting there is not a compromise; it is the case the architecture handles
perfectly, and it buys the time needed to do inference verification properly.
The example examined here also carries a warning worth generalising: a search
workload created by a design limitation may evaporate when the limitation is
lifted. The durable search workloads are the ones where the search is intrinsic
to the problem, not an artifact of the container.
\end{document}
shared/market-preamble.tex
+47
View File
@@ -0,0 +1,47 @@
% Shared preamble for the compute-market series.
% One style, one vocabulary, inputted by every paper so the series reads as one voice.
\usepackage[margin=1in]{geometry}
\usepackage{booktabs}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{graphicx}
\usepackage{xcolor}
\usepackage{hyperref}
\hypersetup{colorlinks=true, linkcolor=blue, urlcolor=blue, citecolor=blue}
\usepackage{enumitem}
\usepackage{listings}
\usepackage{array}
\usepackage{tabularx}
\usepackage{siunitx}
\sisetup{group-separator={,}, group-minimum-digits=4}
\definecolor{kw}{rgb}{0.13,0.29,0.53}
\definecolor{cmt}{rgb}{0.40,0.40,0.40}
\definecolor{str}{rgb}{0.16,0.50,0.16}
\lstset{
basicstyle=\ttfamily\footnotesize,
keywordstyle=\color{kw}\bfseries,
commentstyle=\color{cmt}\itshape,
stringstyle=\color{str},
showstringspaces=false,
breaklines=true,
columns=fullflexible,
frame=single,
framesep=4pt,
}
\newtheorem{definition}{Definition}
\newtheorem{proposition}{Proposition}
\newtheorem{remark}{Remark}
\newcommand{\code}[1]{\texttt{#1}}
\newcommand{\repo}[1]{\texttt{#1}}
% Series vocabulary — used identically in every paper.
\newcommand{\job}{\ensuremath{J}}
\newcommand{\bundle}{\ensuremath{R}}
\newcommand{\cost}{\ensuremath{\mathcal{C}}}
\tolerance=800
\emergencystretch=3em
soundness/soundness.pdf
BIN
View File
Binary file not shown.
soundness/soundness.tex
+236
View File
@@ -0,0 +1,236 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{The Price of Certainty:\\Verification Tiers and Their Cost}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
Los Angeles, California \\
\texttt{https://hanzo.ai}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
Verification is usually treated as a protocol constant: a system decides how
work is checked and every participant lives with that choice. We argue it should
be a purchased good with a published price curve, selected per job by the party
bearing the loss.
We enumerate six verification tiers, give each an honest cost model, and derive
the indifference conditions that separate them. The central quantity is the
ratio of value at risk to verification cost, and it varies over many orders of
magnitude across the jobs a real market will carry --- which is exactly why a
single protocol-wide soundness bar is either wasteful or unsafe, and usually
both at once for different jobs.
We also make a refinement to the claim that pricing and verification are
orthogonal. They are orthogonal in \emph{mechanism} --- the allocator need not
know whether the provider is honest, and the verifier need not know whether the
price was fair. They are coupled in the \emph{objective}, because the cost of
soundness is a term in the price. Getting this distinction right is what allows
both to be designed independently without either being wrong.
\end{abstract}
\tableofcontents
\newpage
\section{Soundness as a demand-side parameter}
A buyer posting a job faces an expected loss
\begin{equation}
\mathbb{E}[\text{loss}] \;=\; \pi \cdot (1 - \sigma) \cdot V,
\end{equation}
where $V$ is the value at risk if the answer is wrong, $\pi$ is the prior
probability that a given provider defects, and $\sigma$ is the soundness of the
verification tier --- the probability that a defection is caught. Buying tier
$T$ costs $c(T)$. The buyer's problem is
\begin{equation}
\min_{T} \; \Big[ c(T) \;+\; \pi\,(1-\sigma(T))\,V \Big],
\label{eq:tierchoice}
\end{equation}
and the optimum plainly depends on $V$, which is private to the buyer and
differs by six or more orders of magnitude between a chat completion and a
settlement instruction. No protocol constant can be right for both.
\begin{remark}
This is why we resist framing a market's verification level as a property of the
market. The market's job is to make each tier available, priced, and honestly
described. The choice belongs to whoever loses money when the answer is wrong.
\end{remark}
\section{The tiers}
\subsection{T0 --- Recomputation by the buyer}
The buyer runs the job itself. Soundness is total; cost is the job. Rational
only when the buyer wanted the answer for reasons other than lacking the
capacity to compute it --- audit sampling, spot checks at rate $q$, giving
$\sigma = q$ at cost $q \cdot c_{\text{job}}$. Random audit at low $q$ combined
with a large stake is often the cheapest adequate mechanism and is systematically
underused.
\subsection{T1 --- Byte equality and known-answer tests}
Available only for determinism class $\mathsf{D}$. The provider's output is
compared against a canonical implementation or a published vector set.
Soundness is $1$ against output corruption; cost is $O(1)$ amortised when
vectors are published, or one canonical execution otherwise. Adjudication yields
a proof of misbehaviour rather than a vote.
This tier is free in the only sense that matters --- it costs nothing beyond
what the market already publishes --- and it is unavailable to anyone who has
not done the work of making their kernels reproducible. That work is the subject
of the companion paper.
\subsection{T2 --- Freivalds and algebraic spot checks}
For the matrix products that dominate inference, correctness of $AB = C$ is
checkable without recomputing the product. Draw $r$ uniformly from
$\{0,1\}^{n}$ and test
\begin{equation}
A(Br) \;\overset{?}{=}\; Cr .
\end{equation}
If $AB \neq C$ the test fails with probability at least $1/2$; after $k$
independent rounds the soundness error is at most $2^{-k}$.
The cost is three matrix--vector products, $6n^{2}$ operations, against $2n^{3}$
for the product itself. At $n = 4096$:
\begin{equation}
\frac{2n^{3}}{6n^{2}} \;=\; \frac{n}{3} \;=\; \num{1365},
\end{equation}
so a single round costs $0.073\%$ of the product and twenty rounds --- soundness
error below $10^{-6}$ --- costs $1.5\%$. For linear-algebra-heavy work this is
the best value on the ladder by a wide margin, and it applies to class
$\mathsf{S}$ where T1 does not.
Its limits should be stated. Freivalds checks the linear algebra, not the
nonlinearities, the sampling, or that the weights were the ones paid for. It is
a strong check on the expensive part of the computation and silent about the
rest. Combining it with a weight commitment --- the provider commits to a hash of
the weight tensors, the buyer's job specification names the expected hash --- closes
the most valuable of those gaps cheaply.
\subsection{T3 --- Replication}
Dispatch to $m$ independent providers, compare. With independent defection
probability $\pi$ and no collusion, undetected corruption requires all $m$ to
defect identically:
\begin{equation}
1 - \sigma \;=\; \pi^{m} \quad\text{(identical-defection model)},
\qquad c(T3) \;=\; m \cdot c_{\text{job}}.
\end{equation}
Cost is linear in $m$; soundness is exponential. The independence assumption is
the weak point and it is not a technicality: providers running the same image on
the same cloud in the same region are not independent, and a market that
allocates purely on price will systematically produce correlated committees.
Diversity has to be an explicit allocation constraint or replication silently
degrades to $m = 1$.
\subsection{T4 --- Succinct proofs}
The provider produces a proof $\pi$ that the buyer verifies in time polylogarithmic
in the computation. Soundness is cryptographic and independent of any honesty
assumption. Prover overhead relative to native execution is currently $10^{3}$
to $10^{6}$, depending on arithmetization and how badly the computation fits the
field.
Rational when the same statement is verified many times, when verification must
happen on-chain, or when $V$ is large enough that $10^{4} \times$ compute is
still cheap insurance. For a single off-chain inference it is not close.
One property matters for anything intended to outlive the current cryptographic
era: a proof system resting on pairings or discrete logarithms is Shor-breakable,
which makes it an odd foundation for a market that markets itself on quantum
readiness. Groth16, KZG and PLONK all fall in that class. Our proof substrate is
deliberately restricted to hash-based STARK/FRI with no elliptic-curve recursion
and no pairings anywhere in the pipeline, using cSHAKE256, KMAC256 and
TupleHash256 (FIPS 202 with SP 800-185) as the hash family throughout so that
Merkle commitments, FRI folding and the Fiat--Shamir transform present one
auditable surface. We note plainly that this substrate is at a stable-surface,
audit-gated stage rather than a finished one; it should be pinned to a tagged
release and treated as forward-looking rather than deployed.
\subsection{T5 --- Hardware attestation}
A trusted execution environment attests that the declared binary ran on
unmodified hardware. Cost is near zero and soundness is high --- against a
different adversary. The trust root moves to a silicon vendor, and the history of
side-channel and fault attacks on such environments argues against using them as
a sole tier for high $V$. As a cheap complement to T2, raising the cost of the
easiest attacks, they are good value.
\section{Choosing a tier}
Substituting into~\eqref{eq:tierchoice}, tier $T$ dominates tier $T'$ when
\begin{equation}
c(T) - c(T') \;<\; \pi \, V \, \big[\sigma(T) - \sigma(T')\big].
\end{equation}
Writing $\rho = V / c_{\text{job}}$ for the value-to-compute ratio, the
boundaries take a simple form.
\begin{table}[h]
\centering
\begin{tabular}{llll}
\toprule
Tier & Cost / $c_{\text{job}}$ & Soundness & Rational when \\
\midrule
T1 & $\approx 0$ & $1$ (class $\mathsf{D}$) & always, where available \\
T5 & $\approx 0$ & vendor-dependent & complement, never sole \\
T2 & $0.001k$ & $1 - 2^{-k}$ & $\rho \gtrsim 10^{2}$, linear algebra \\
T0 & $q$ & $q$ & $\rho \gtrsim 1/q$, with stake \\
T3 & $m$ & $1 - \pi^{m}$ & $\rho \gtrsim 10^{3}$, diverse committee \\
T4 & $10^{3}$--$10^{6}$ & cryptographic & $\rho \gtrsim 10^{6}$, or on-chain \\
\bottomrule
\end{tabular}
\caption{Tier selection by value-to-compute ratio $\rho$.}
\end{table}
The practical reading: most volume should sit at T1 or T2, replication should be
reserved for jobs whose value genuinely warrants tripling the bill, and proofs
should be reserved for statements that are settled on-chain or reused. A market
that defaults everything to replication is burning two thirds of its compute for
soundness that most of its jobs do not need.
\section{Orthogonality, stated precisely}
The claim that pricing and verification are orthogonal is right and worth
defending, but it needs a sharper statement than it usually gets.
\begin{proposition}[Mechanism orthogonality]
The allocator requires no belief about provider honesty, and the verifier
requires no belief about whether the clearing price was fair. Neither mechanism
takes the other's state as input.
\end{proposition}
\begin{proposition}[Objective coupling]
The cost of verification $c(T)$ appears as a term in the allocation objective.
A buyer requiring T3 with a diversity constraint faces a different feasible set
and a different clearing price than one requiring T1.
\end{proposition}
Both are true simultaneously, and the distinction is what makes the architecture
work: because the coupling is only through a scalar cost term, the two
mechanisms can be designed, audited, replaced and reasoned about separately.
That is a stronger and more useful statement than unqualified independence,
which would be false --- if verification were genuinely free of price
consequences, no one would ever choose a cheaper tier.
\section{What a market should publish}
Three artifacts turn this from an analysis into infrastructure. A tier registry
giving $c(T)$ and $\sigma(T)$ with stated assumptions, so buyers can compute
their own optimum rather than trusting a recommendation. A per-provider
capability declaration listing which tiers and determinism classes it honours,
which the allocator treats as a hard constraint. And a public record of caught
defections, which is what turns $\pi$ from a guess into a measurement --- without
it, every buyer is solving~\eqref{eq:tierchoice} with an invented parameter.
\end{document}
surplus/surplus.pdf
BIN
View File
Binary file not shown.
surplus/surplus.tex
+269
View File
@@ -0,0 +1,269 @@
\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}
\title{Where the Surplus Comes From}
\author{
Zach Kelling\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
Los Angeles, California \\
\texttt{https://hanzo.ai}
}
\date{2026}
\begin{document}
\hanzocoverpage
\begin{abstract}
Most infrastructure partnerships are announced before anyone has written down
where the joint value comes from, which is why most of them produce a blog post
and nothing else. This paper does the arithmetic first.
We identify four distinct sources of surplus available to a decentralized
compute market that adopts the substrate described in this series, size each one,
and state what each party contributes and captures. The largest is not subtle: a
personalized-agent population served with per-sequence adapter selection needs
roughly two accelerators where the na\"ive deployment needs one hundred
seventy-five. Whoever ships that first sets the cost floor for the category.
We are equally explicit about what would make this not work, because a risk
register written by the proposing party is worth more than one written after the
fact. And we state the governance position plainly: the technical work is
valuable without any token relationship, the code is already permissively
licensed, and the shared specifications belong in a neutral venue owned by
neither side.
\end{abstract}
\tableofcontents
\newpage
\section{The two sides}
\begin{table}[h]
\centering
\begin{tabularx}{\textwidth}{lXX}
\toprule
& Market operator & Substrate provider \\
\midrule
Brings & demand aggregation, an agent population, a provider network, a payment
and staking asset, distribution and brand in decentralized compute
& inference engine with adapters, a training API, a byte-equality kernel corpus,
post-quantum primitives and policy, threshold custody, a router and price catalog \\[4pt]
Needs & a verification story that is cheap enough to run at volume; a
personalization story that does not multiply capital; long-lived key material
that survives its own roadmap
& real demand at scale; a permissionless provider population; a settlement asset
and the governance to run one \\[4pt]
Captures & take on cleared volume, network effects, the standard
& adoption of open primitives, reference deployment at scale, the segment that
requires post-quantum guarantees \\
\bottomrule
\end{tabularx}
\caption{Contribution and capture.}
\end{table}
The asymmetry is the point. Neither side is trying to build the other's half,
and the halves are separately valuable, which is what makes the arrangement
stable rather than a merger conducted by press release.
\section{Four sources of surplus}
\subsection{Removed duplication in personalized serving}
A population of personalized agents is served today by running one process per
adapter, each with its own copy of the base model. For one hundred agents on a
70B model at \code{bf16}:
\begin{table}[h]
\centering
\begin{tabular}{lrr}
\toprule
& Memory & Accelerators \\
\midrule
One process per adapter & \SI{14000}{\giga\byte} & \num{175} \\
Per-sequence adapter selection & \SI{141.7}{\giga\byte} & \num{2} \\
\bottomrule
\end{tabular}
\caption{At \SI{80}{\giga\byte} per accelerator. A rank-16 adapter on a 70B is
\SI{167.8}{\mega\byte}; at rank 8 on a 7B it is \SI{16.8}{\mega\byte}.}
\end{table}
The reduction is roughly \num{87}-fold in capital required per served agent, and
it compounds: the freed memory is what makes two to three thousand resident
agents per accelerator possible, which is what makes per-agent personalization a
product rather than a demonstration.
This is the single largest number in the series. It is also the least
speculative, because it is arithmetic over published model dimensions rather than
a forecast. What is uncertain is only the engineering effort to realise it, and
that is bounded --- multi-adapter co-residency already works in the engine, and
the unmerged forward pass already exists on its training side.
\subsection{Collapsed verification cost}
A market that replicates three-fold for confidence spends two hundred percent of
its useful compute on verification. Moving a job into a bit-reproducible class
takes that to approximately zero, and moving it to algebraic spot-checking takes
it to about one and a half percent for a soundness error below $10^{-6}$.
\begin{table}[h]
\centering
\begin{tabular}{lrl}
\toprule
Verification approach & Overhead & Applicability \\
\midrule
Three-fold replication & $200\%$ & any \\
Freivalds, 20 rounds & $1.5\%$ & linear-algebra-dominated \\
Byte equality & $\approx 0$ & bit-reproducible only \\
Succinct proof & $10^{5}$--$10^{8}\%$ & on-chain or reused statements \\
\bottomrule
\end{tabular}
\caption{Verification overhead as a fraction of useful compute.}
\end{table}
The share of volume that can be moved into the cheap classes is a design choice,
not a fact of nature. All cryptographic work, all quantized inference with pinned
numerics, all search, and all embedding generation can be made bit-reproducible
deliberately. On a market where that is a material fraction of volume, this is
the second-largest efficiency available and it needs no new cryptography.
\subsection{Locality rent}
State rent --- a continuous fee to keep an agent's weights resident on a capable
node --- is revenue that does not exist in a stateless spot market, because there
is no state to rent. It is priced against the shadow value of a residency slot,
it converts a stochastic cold-start cost into a predictable stream for the buyer,
and it pays the provider for memory that would otherwise be held speculatively.
We do not size this one, because sizing it requires demand data neither party has
yet. We note only that it is structurally new rather than a redistribution, and
that it is the natural instrument for a continuous formulation to quote.
\subsection{Access to constrained demand}
Institutional, defence and regulated buyers increasingly carry hard post-quantum
requirements, and those requirements are not satisfiable by adding a feature
later --- they constrain identity keys, session establishment and custody, all of
which are decisions made at protocol design time. A market whose long-lived key
material is classical cannot serve that segment at any price.
The retrofit pattern in the companion paper makes the requirement satisfiable
without a fork or a flag day. The surplus here is segment access rather than
efficiency, and it is the one that most rewards acting early, since the migration
cost rises with the installed base.
\section{Why open source is the vehicle}
Every component discussed in this series is already published under a permissive
licence. That is a deliberate choice with three consequences worth naming.
The activation energy for adoption is zero. No licence negotiation precedes a
technical evaluation, which means an engineer can determine whether the substrate
is any good before anyone has to have a commercial conversation. Partnerships that
require the reverse order usually die in the reverse order.
Verification of our claims is possible. The byte-equality contract, the crossover
thresholds, the adapter arithmetic and the threshold latencies are all checkable
by a third party. A partnership premised on unfalsifiable claims about
proprietary internals is a worse partnership even when the claims happen to be
true.
And the standard can be shared rather than owned. Determinism classes, tier
registries and job specifications are only useful if more than one implementation
honours them. A specification controlled by one vendor is a product; a
specification in a neutral venue is infrastructure.
\section{Governance, stated plainly}
We want to remove an ambiguity that otherwise sits under every conversation of
this kind.
The technical work described here is valuable to a market operator with no token
relationship of any sort. The substrate is licensed permissively; adopting it
creates no obligation. A market's payment, staking and denomination asset is its
own business, and our contribution neither requires nor benefits from a claim on
it. We say this because the alternative --- letting a token question hover
unaddressed over an engineering discussion --- reliably makes the engineering
discussion worse.
For the shared specifications, we propose a neutral home: a non-profit research
foundation running a public improvement-proposal process with academic reviewers
and a grant programme. Non-commercial ground keeps the technical argument
technical, and it means neither party owns the standard that both depend on.
\section{Risk register}
Written by the proposing party, which is the only time it is worth anything.
\paragraph{Per-sequence adapter selection is unshipped.} The largest number in
this paper depends on work that is scoped but not done. Co-residency exists, the
unmerged forward exists on the training side, and the request path does not carry
an adapter field. This is a bounded engineering task with references in the same
repository --- but it is a task, and until it ships the \num{87}-fold figure is a
design target rather than a measurement.
\paragraph{The soundness bar may not admit determinism classes.} If a market's
verification design assumes a single protocol-wide standard, introducing
per-job classes is a protocol change and not a configuration. The efficiency
argument depends on that change being acceptable.
\paragraph{The proof substrate is audit-gated.} Our post-quantum STARK and FRI
work has a stable surface and a body pending audit, currently at an early tagged
release. It should be treated as forward-looking. Nothing in the near-term
sequencing depends on it, which is deliberate.
\paragraph{Adoption requires provider software to change.} Determinism classes,
residency reporting and tier declarations are provider-side capabilities. A
permissionless network cannot be upgraded by decree, so the rollout has to be
incentive-compatible: providers that declare and honour more classes should
receive more allocation, and the market has to make that true before it is
believed.
\paragraph{Correlated committees.} Both replication and threshold custody assume
independence that price-driven allocation actively destroys, since the cheapest
$n$ providers tend to be the same image on the same cloud in the same region.
Diversity has to be an explicit constraint or both mechanisms silently degrade.
\paragraph{Some search workloads evaporate.} As the companion paper on search
notes, a search created by a design limitation disappears when the limitation is
lifted. Building a business line on a specific search workload requires first
establishing that the search is intrinsic.
\section{Sequencing}
The smallest useful thing first, and each step standing on its own.
Begin with a joint technical review of one concrete workload --- ours of theirs,
or theirs of ours --- published openly under both names. It costs a repository
link, it produces a shared artifact, and it establishes whether the two teams can
actually work together, which is the thing no memorandum can establish.
Then contribute the primitives that require no protocol change: the kernel corpus
with its equality contract, the threshold settlement boundary, the model catalog.
These are adoptable unilaterally and each is useful alone.
Then the protocol-adjacent work: determinism classes on the job specification, a
tier registry, residency reporting. These need agreement and should be specified
in the neutral venue.
Then the post-quantum retrofit, in the order the companion paper derives from key
lifetime: session establishment and long-lived identity first, governance next,
per-job receipts last.
Per-sequence adapter selection runs in parallel throughout, because it is
independent of every agreement above and its value does not depend on any of
them.
\section{The one-line version}
A compute market's two hardest problems are proving that work happened and
serving personalized state without paying for it many times over. The first has a
free answer for a larger class of work than is generally assumed. The second has
an eighty-seven-fold answer that is scoped but not yet built. Both answers are
open source, and neither requires a token.
\end{document}