papers/surplus/surplus.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/hanzocover}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\input{../shared/market-preamble}

\title{Where the Surplus Comes From}

\author{
Hanzo AI Research\thanks{Corresponding author: [email protected]} \\
\textit{Hanzo Industries Inc (Techstars '17)} \\
San Francisco, California \\
\texttt{https://hanzo.ai}
}

\date{2026}

\begin{document}
\hanzocoverpage

\begin{abstract}
Most infrastructure partnerships are announced before anyone has written down
where the joint value comes from, which is why most of them produce a blog post
and nothing else. This paper does the arithmetic first.

We identify four distinct sources of surplus available to a decentralized
compute market that adopts the substrate described in this series, size each one,
and state what each party contributes and captures. The largest is not subtle: a
personalized-agent population served with per-sequence adapter selection needs
roughly two accelerators where the na\"ive deployment needs one hundred
seventy-five. Whoever ships that first sets the cost floor for the category.

We are equally explicit about what would make this not work, because a risk
register written by the proposing party is worth more than one written after the
fact. And we state the governance position plainly: the technical work is
valuable without any token relationship, the code is already permissively
licensed, and the shared specifications belong in a neutral venue owned by
neither side.
\end{abstract}

\tableofcontents
\newpage

\section{The two sides}

\begin{table}[h]
\centering
\begin{tabularx}{\textwidth}{lXX}
\toprule
 & Market operator & Substrate provider \\
\midrule
Brings & demand aggregation, an agent population, a provider network, a payment
and staking asset, distribution and brand in decentralized compute
 & a Hamiltonian market maker with hidden-Markov regime detection; a learned
per-request router over frontier arms with fan-out synthesis, in production and
metered; an inference engine with adapters and a training API; an open-weight
fine-tuning framework; a byte-equality kernel corpus; post-quantum primitives and
policy; confidential-compute tiering with local attestation; threshold custody \\[4pt]
Needs & a verification story that is cheap enough to run at volume; a
personalization story that does not multiply capital; long-lived key material
that survives its own roadmap
 & real demand at scale; a permissionless provider population; a settlement asset
and the governance to run one \\[4pt]
Captures & take on cleared volume, network effects, the standard
 & adoption of open primitives, reference deployment at scale, the segment that
requires post-quantum guarantees \\
\bottomrule
\end{tabularx}
\caption{Contribution and capture.}
\end{table}

The asymmetry is the point. Neither side is trying to build the other's half,
and the halves are separately valuable, which is what makes the arrangement
stable rather than a merger conducted by press release.

\section{Four sources of surplus}

\subsection{Removed duplication in personalized serving}

A population of personalized agents is served today by running one process per
adapter, each with its own copy of the base model. For one hundred agents on a
70B model at \code{bf16}:

\begin{table}[h]
\centering
\begin{tabular}{lrr}
\toprule
 & Memory & Accelerators \\
\midrule
One process per adapter & \SI{14000}{\giga\byte} & \num{175} \\
Per-sequence adapter selection & \SI{141.7}{\giga\byte} & \num{2} \\
\bottomrule
\end{tabular}
\caption{At \SI{80}{\giga\byte} per accelerator. A rank-16 adapter on a 70B is
\SI{167.8}{\mega\byte}; at rank 8 on a 7B it is \SI{16.8}{\mega\byte}.}
\end{table}

The reduction is roughly \num{87}-fold in capital required per served agent, and
it compounds: the freed memory is what makes two to three thousand resident
agents per accelerator possible, which is what makes per-agent personalization a
product rather than a demonstration.

This is the single largest number in the series. It is also the least
speculative, because it is arithmetic over published model dimensions rather than
a forecast. What is uncertain is only the engineering effort to realise it, and
that is bounded --- multi-adapter co-residency already works in the engine, and
the unmerged forward pass already exists on its training side.

\subsection{Collapsed verification cost}

A market that replicates three-fold for confidence spends two hundred percent of
its useful compute on verification. Moving a job into a bit-reproducible class
takes that to approximately zero, and moving it to algebraic spot-checking takes
it to about one and a half percent for a soundness error below $10^{-6}$.

\begin{table}[h]
\centering
\begin{tabular}{lrl}
\toprule
Verification approach & Overhead & Applicability \\
\midrule
Three-fold replication & $200\%$ & any \\
Freivalds, 20 rounds & $1.5\%$ & linear-algebra-dominated \\
Byte equality & $\approx 0$ & bit-reproducible only \\
Succinct proof & $10^{5}$--$10^{8}\%$ & on-chain or reused statements \\
\bottomrule
\end{tabular}
\caption{Verification overhead as a fraction of useful compute.}
\end{table}

The share of volume that can be moved into the cheap classes is a design choice,
not a fact of nature. All cryptographic work, all quantized inference with pinned
numerics, all search, and all embedding generation can be made bit-reproducible
deliberately. On a market where that is a material fraction of volume, this is
the second-largest efficiency available and it needs no new cryptography.

\subsection{Locality rent}

State rent --- a continuous fee to keep an agent's weights resident on a capable
node --- is revenue that does not exist in a stateless spot market, because there
is no state to rent. It is priced against the shadow value of a residency slot,
it converts a stochastic cold-start cost into a predictable stream for the buyer,
and it pays the provider for memory that would otherwise be held speculatively.

We do not size this one, because sizing it requires demand data neither party has
yet. We note only that it is structurally new rather than a redistribution, and
that it is the natural instrument for a continuous formulation to quote.

\subsection{Verification for the nondeterministic majority}

Byte equality is free but reaches only bit-reproducible work. The rest ---
large-batch inference at full throughput, training --- has until recently faced a
choice between replication at $200\%$ overhead and proofs at five orders of
magnitude.

Hardware confidential computing on current accelerators has closed that gap. For
compute-bound large-model work the overhead of running inside an attested,
encrypted boundary is a few percent, because arithmetic dominates the boundary
crossings; current-generation encrypted device links remove most of what remains.
At that price, attested execution is not a complement to the cheap checks --- it
is the default for everything they cannot reach, and it collapses the
verification cost of the largest class of volume from $200\%$ to roughly $3\%$.

It also unlocks a workload that is otherwise impossible: training on weights the
provider may not keep and data it may not copy. A model owner ships proprietary
weights into an attested boundary, a data holder supplies a licensed corpus that
never leaves it, and the provider is paid for accelerators without receiving
either in extractable form. That is the difference between a network that can only
train public models on public data and one that can serve enterprise training
demand, which is where the budgets are.

\subsection{Training and data, not just inference}

Inference is the cheap half of the spend. Training tolerates latency, tolerates
heterogeneity and is checkpointable, which means it can use exactly the supply
that interactive serving cannot --- the idle, distant, mid-tier capacity a
decentralized network has in abundance and cannot otherwise sell.

The immediately tradable units are better than they look. Synthetic data
generation is batch inference with no latency constraint and verifies under byte
equality. Evaluation is scored inference on a fixed set, deterministic under a
pinned harness, and gives the market an independent measurement of every model in
its own catalogue. Adapter fitting parallelises across tenants rather than within a
job, which is the shape a heterogeneous network actually wants. None of these
require solving distributed training over a wide-area network, and all three have
standing demand from anyone training anything.

\subsection{Access to constrained demand}

Institutional, defence and regulated buyers increasingly carry hard post-quantum
requirements, and those requirements are not satisfiable by adding a feature
later --- they constrain identity keys, session establishment and custody, all of
which are decisions made at protocol design time. A market whose long-lived key
material is classical cannot serve that segment at any price.

The retrofit pattern in the companion paper makes the requirement satisfiable
without a fork or a flag day. The surplus here is segment access rather than
efficiency, and it is the one that most rewards acting early, since the migration
cost rises with the installed base.

\section{Why open source is the vehicle}

Every component discussed in this series is already published under a permissive
licence. That is a deliberate choice with three consequences worth naming.

The activation energy for adoption is zero. No licence negotiation precedes a
technical evaluation, which means an engineer can determine whether the substrate
is any good before anyone has to have a commercial conversation. Partnerships that
require the reverse order usually die in the reverse order.

Verification of our claims is possible. The byte-equality contract, the crossover
thresholds, the adapter arithmetic and the threshold latencies are all checkable
by a third party. A partnership premised on unfalsifiable claims about
proprietary internals is a worse partnership even when the claims happen to be
true.

And the standard can be shared rather than owned. Determinism classes, tier
registries and job specifications are only useful if more than one implementation
honours them. A specification controlled by one vendor is a product; a
specification in a neutral venue is infrastructure.

\section{Governance, stated plainly}

We want to remove an ambiguity that otherwise sits under every conversation of
this kind.

The technical work described here is valuable to a market operator with no token
relationship of any sort. The substrate is licensed permissively; adopting it
creates no obligation. A market's payment, staking and denomination asset is its
own business, and our contribution neither requires nor benefits from a claim on
it. We say this because the alternative --- letting a token question hover
unaddressed over an engineering discussion --- reliably makes the engineering
discussion worse.

For the shared specifications, we propose a neutral home: a non-profit research
foundation running a public improvement-proposal process with academic reviewers
and a grant programme. Non-commercial ground keeps the technical argument
technical, and it means neither party owns the standard that both depend on.

\section{Risk register}

Written by the proposing party, which is the only time it is worth anything.

\paragraph{Per-sequence adapter selection is unshipped.} The largest number in
this paper depends on work that is scoped but not done. Co-residency exists, the
unmerged forward exists on the training side, and the request path does not carry
an adapter field. This is a bounded engineering task with references in the same
repository --- but it is a task, and until it ships the \num{87}-fold figure is a
design target rather than a measurement.

\paragraph{The soundness bar may not admit determinism classes.} If a market's
verification design assumes a single protocol-wide standard, introducing
per-job classes is a protocol change and not a configuration. The efficiency
argument depends on that change being acceptable.

\paragraph{The proof substrate is audit-gated.} Our post-quantum STARK and FRI
work has a stable surface and a body pending audit, currently at an early tagged
release. It should be treated as forward-looking. Nothing in the near-term
sequencing depends on it, which is deliberate.

\paragraph{Adoption requires provider software to change.} Determinism classes,
residency reporting and tier declarations are provider-side capabilities. A
permissionless network cannot be upgraded by decree, so the rollout has to be
incentive-compatible: providers that declare and honour more classes should
receive more allocation, and the market has to make that true before it is
believed.

\paragraph{Attestation moves the trust root rather than removing it.} The
confidential-computing argument rests on a silicon vendor's certificate chain.
That is a different assumption, not the absence of one, and side-channel and fault
attacks against such boundaries have a history. It should be composed with
sampled recomputation and algebraic checks, not relied on alone at high value.

\paragraph{Our market parameters are chosen, not fitted.} Friction, energy scale,
potential shape per regime and the price bounds in our market maker are defensible
rather than fit against a large live market --- because the market that would fit
them is what this is proposing to build. The claim is that the \emph{shape} is
right for perishable heterogeneous capacity, not that our constants are.

\paragraph{Data contribution measurement is unsolved.} Attributing model quality
to individual data sources at scale is genuinely open; influence functions and
leave-one-out retraining are both far too expensive. Proportional payment by
tokens contributed, weighted by measured improvement for the corpus as a whole, is
crude and implementable, and we do not claim it is fair.

\paragraph{Correlated committees.} Both replication and threshold custody assume
independence that price-driven allocation actively destroys, since the cheapest
$n$ providers tend to be the same image on the same cloud in the same region.
Diversity has to be an explicit constraint or both mechanisms silently degrade.

\paragraph{Some search workloads evaporate.} As the companion paper on search
notes, a search created by a design limitation disappears when the limitation is
lifted. Building a business line on a specific search workload requires first
establishing that the search is intrinsic.

\section{Sequencing}

The smallest useful thing first, and each step standing on its own.

Begin with a joint technical review of one concrete workload --- ours of theirs,
or theirs of ours --- published openly under both names. It costs a repository
link, it produces a shared artifact, and it establishes whether the two teams can
actually work together, which is the thing no memorandum can establish.

Then contribute the primitives that require no protocol change: the kernel corpus
with its equality contract, the threshold settlement boundary, the model catalog.
These are adoptable unilaterally and each is useful alone.

Then the protocol-adjacent work: determinism classes on the job specification, a
tier registry, residency reporting. These need agreement and should be specified
in the neutral venue.

Then the post-quantum retrofit, in the order the companion paper derives from key
lifetime: session establishment and long-lived identity first, governance next,
per-job receipts last.

Per-sequence adapter selection runs in parallel throughout, because it is
independent of every agreement above and its value does not depend on any of
them.

\section{The one-line version}

A compute market's two hardest problems are proving that work happened and
serving personalized state without paying for it many times over. The first is
free for bit-reproducible work and about three percent for everything else, now
that attested execution is cheap --- against two hundred percent for replication.
The second has an eighty-seven-fold answer that is scoped but not yet built. The
pricing layer that allocates against both, and the learned router that sits above
it, are already running. All of it is open source, and none of it requires a
token.

\end{document}