papers/hanzo-consensus-ai/sections/05-inference-attestation.tex

\section{Inference Attestation}

\label{sec:attestation}
% ============================================================================

Inference attestation creates a tamper-proof on-chain record binding an
inference output to its provenance: which model, which input, which GPU node,
and when.

\subsection{Attestation Structure}

\begin{definition}[Inference Attestation]
An inference attestation $\mathcal{A}$ is a signed on-chain record:
\begin{equation}
\mathcal{A} = \left(H(m), H(\mathbf{x}), H(\mathbf{y}), w, v_1, \ldots, v_t,
\sigma_{\text{threshold}}, b\right),
\end{equation}
where $H(\cdot)$ denotes cryptographic hashes, $w$ is the worker, $v_1,
\ldots, v_t$ are the verifiers that confirmed the result, $\sigma_{\text{threshold}}$
is a threshold signature from the verification committee, and $b$ is the block
number.
\end{definition}

\subsection{Commitment Scheme}

Workers commit to their outputs before verification begins, preventing them
from changing outputs after seeing verification results:

\begin{enumerate}[leftmargin=1.4em]
    \item \textbf{Commit phase}: Worker computes $c = \texttt{Hash}(m \|
    \mathbf{x} \| \mathbf{y} \| r)$ with random nonce $r$ and submits $c$
    on-chain.
    \item \textbf{Reveal phase}: After the verification committee is selected,
    the worker reveals $(m, H(\mathbf{x}), H(\mathbf{y}), r)$.
    \item \textbf{Verification phase}: Verifiers re-execute and confirm or
    dispute the result.
    \item \textbf{Finalization}: If $\geq t$ verifiers confirm, the attestation
    is finalized with a threshold signature.
\end{enumerate}

\begin{theorem}[Attestation Binding]
Under the collision resistance of SHA-256, a finalized attestation
$\mathcal{A}$ uniquely binds the output $\mathbf{y}$ to the model $m$ and input
$\mathbf{x}$. No polynomial-time adversary can produce a different output
$\mathbf{y}' \neq \mathbf{y}$ with a valid attestation for the same $(m,
\mathbf{x})$.
\end{theorem}

\subsection{Model Version Pinning}

Attestations include a hash of the model weights, ensuring that results are
reproducible:
\begin{equation}
H(m) = \texttt{SHA256}(\theta_1 \| \theta_2 \| \cdots \| \theta_L),
\end{equation}
where $\theta_l$ are the serialized parameters of layer $l$. This prevents a
worker from using a cheaper (smaller, distilled) model while claiming to run
the requested model.

% ============================================================================