Checking someone else's training without repeating it

In distributed computing, checking a result usually costs as much as producing it. To be sure a node really pushed gradients rather than emitting a pile of random numbers, a verifier would have to redo the entire run — and the whole benefit of handing work out evaporates on the spot.

Why that matters historically is set out in the article's opening chapter: training large networks was the privilege of corporations with access to centralised supercomputers, and control travelled with the hardware — censored weights, ideological restrictions, ownership of the outcome. The CODE answer is called decentralised neural synthesis and gathers thousands of independent nodes, the training miners, into a federated learning network.

Question one: was the declared computation performed, and performed correctly. Question two: is the submitted chunk any good at all, or did the node slip a backdoor into the model. These are different questions handled by different machinery — the proof answers only the first.

Hence the shape of the defence. Mathematics catches lies in the arithmetic, aggregation statistics catch sabotage in the content, economics makes both unprofitable. Remove any one of the three and the remaining two will not cover its stretch.

Having moved from weights `Wₜ` to `Wₜ₊₁` on a batch, a training node assembles a zk-SNARK `πₜᵣₐᵢₙ` asserting three things. The forward pass was computed correctly: layer activations came out as `Y = f(Wₜ · X + B)`. The backward pass followed the error propagation rule strictly. The new weights obey the optimiser formula, `Wₜ₊₁ = Wₜ − η · Update(∇ W)`, whether that is Adam or SGD.

The gain is precisely in verification time: a Solana validator needs milliseconds for a short proof standing in for hours of someone else's GPU. That gap is the entire reason the construction exists.

ReLU taken apart into equalities

Inside a circuit a nonlinearity is never a function; it is a system of constraints. A layer reads `aₗ₊₁ = σ(Wₗ · aₗ + bₗ)`, and σ for the rectifier enters through a binary selector `s ∈ {0, 1}` and three conditions: `y · (1 − s) = 0`, `(x − y) · s = 0`, `y ≥ 0`. For the backward pass the circuit proves that the sum of products `∂L/∂wⱼₖ = Σᵢ δⱼ · aₖ` was honestly accumulated across the whole batch, so nudging a gradient before sending is no longer available.

Why every number is multiplied by a billion

The field the scheme lives in is finite: an order around `2²⁵⁴` for the BN254 curve. There are no fractions there, so matrix elements are taken at a scale of `10⁹` and the product lands at `10¹⁸` immediately. To keep the register from sliding, every intermediate value carries a range constraint `z < 2⁶⁴` over 64-bit selectors, and the way back is checked by division with a remainder: `ȳᵢ = qᵢ · 10⁹ + rᵢ` with `rᵢ < 10⁹`. The side benefit outweighs the main one — the result stops depending on which accelerator produced it.

Hundreds of local updates merge into one model through federated averaging rewritten around reputation: `W_global = Σᵢ (Rᵢ / Σ Rⱼ) · Wᵢ`, where `Rᵢ` grows with the accuracy of past rounds and the size of the locked stake. Who will do the adding is unknown in advance: aggregators are drawn by a verifiable random function, and the correctness of the merge is confirmed by a separate proof, `π_merge`.

This is also where model poisoning is caught — the very thing a step proof cannot see in principle. Convergence holds while byzantine nodes stay below a third of the total, `f < n/3`. On top of that runs a geometric median: a vector sitting too far from the centre of mass of the majority is given zero weight in the averaging, and its sender's locked stake is confiscated by the smart contract.

A training campaign opens by locking a budget in $GALATIN, and the whole flow passes through the canonical 5/5/15/7/3/65 router. Five per cent burns, five goes to the research pool of the Maksim Valentinovich Galatin fund, 15/7/3 reach ambassadors on three levels, and 65% is shared between training miners renting out capacity, users who contributed their cognitive footprints, and the validators of proofs.

Half of that 65% stays in escrow until an aggregation round is confirmed. If a node turns out to have submitted incorrect weights or a forged proof, slashing fires: the address goes on the blacklist of the sovereign `did:code` registry, the entire locked stake moves to an insurance fund, and the unspent campaign budget returns to the customer.

The most expensive item for a prover is multi-scalar multiplication — up to 80% of its working time. Pippenger's method with fixed windows, typically `c ≈ 4`, cuts the number of elliptic-curve point additions by 75%. Local proofs of individual layers are then packed by folding in Nova or Halo2 schemes, where the constraint count does not grow with the number of layers, and only the final compressed polynomial hash of the model is verified on chain.

Devnet measurements come out flatly linear. A 512-neuron layer takes 1.2 seconds, 16 GB of node memory and a 45 KB proof. Doubling the width doubles everything: 1024 neurons give 2.4 seconds, 32 GB and 90 KB; 2048 gives 4.8 seconds, 64 GB and 180 KB; 4096 gives 9.6 seconds, 128 GB and 360 KB.

Results as of 5 March 2026: a network of 250 active training GPU nodes on Nvidia A100 and H100, the model under training being Llama-3-8B-Instruct, roughly 4.5 seconds to build a proof for one step at batch size 32, and on-chain verification at 210,000 compute units. The accuracy line is worded carefully by the source: in the simulation, false weights were blocked.

The schedule took a little over a week. On 27 February a hundred H100 nodes were deployed and basic coordination started. On 1 March poisoning was simulated: fifteen nodes sent forged updates, the verification schemes turned every attempt away in that simulation, and the attackers' stake was burned. On 3 March Llama-3-8B-Instruct was trained on a medical dataset and weight merging was brought down to three minutes per round. On 5 March Solana Devnet was wired in and the final figures were taken.

Privacy rests on the order of operations rather than on a promise: base weights arrive on the user's device or on a protected local node, updates and gradients are encrypted in place with session keys, and outside validators see only the fact that the computation was correct, never the dataset itself. Traffic between nodes runs over p2p with Noise encryption.

The figure about training costing up to 80% less than centralised hyperscalers is presented by the source as a target estimate for an open auction of capacity, not as a measurement. The roadmap is named as a plan too: June 2026, a mobile swarm on consumer devices; September, a cross-chain model marketplace across Solana, Ethereum and Cosmos; December, continuous self-improvement in which the model announces its own campaign. Not one phase had been completed when the piece appeared.

And the main limitation, which follows straight from how the first line is built. The proof testifies about arithmetic, not about the worth of the data: a node that honestly computed gradients over a useless dataset gets a flawless `πₜᵣₐᵢₙ`, because the validator is never shown the source data at all. That is exactly why two more lines stand behind the first, and exactly why the hardware floor is set hard: no lower than an Nvidia RTX 4090 with 24 GB of video memory, 16 physical cores from 3.5 GHz, 64 GB of RAM and a symmetric channel from 100 Mbit/s.