Blindproof

Evidence · status as of 21 October 2026

Every claim, with its receipt.

Each report states what was claimed, how it was tested, what happened, where to check it, and what it does not prove.

  • Measured Tested, with results on this page
  • Prototype Runs, but mocked or off-chain
  • Designed Specified, not yet built
  • Pending In progress

Milestones

Measured

Phase T+ — first earned incentive

The chain paid honest miners 37% and 63% of subnet incentive and the lazy miner nothing, for 13 consecutive epochs.

v0.4.2 · 5 Oct 2026 · blocks 8,159,238–8,163,558 Read the report →
Measured

Phase T — public testnet

Subnet 575 on Bittensor testnet. 24 of 24 jobs settled, lazy miner never credited, first on-chain weights.

v0.4.2 · 5 Oct 2026 · mock inference Read the report →
Measured

Phase M — local chain

16 of 16 attack and load scenarios passed. Zero wrong settlements across about 300 jobs.

v0.4.1 · 25 Sep 2026 · mock inference Read the report →
Next

Cheater sweep, then real GPUs

Every cheating persona from Phase M on the public chain, then a real GPU miner on the deterministic model build, then a mixed-GPU quorum agreeing on one hash.

phases T2, G1–G2 See the roadmap →

Report · Phase T+ · v0.4.2 · Bittensor testnet

Phase T+ — the chain paid for verified work

Claim

Weights that the Blindproof validator writes from verified work turn into real subnet incentive on Bittensor’s public testnet: honest miners are paid in proportion to the work the validator credited, and a miner that returned cheap guesses is paid nothing.

Test

Phase T’s first graded cycle wrote weights before subnet 575 had an emission schedule or a staked validator, so no incentive could follow. Both were fixed the same evening: the emission schedule was started and the validator was staked. The same 24-job cycle (12 deterministic-tier and 12 proven-tier jobs, same three miners, same mock inference) was then run a second time, and the validator wrote its weights at 19:54:50 EDT on 5 October 2026: FINAL SetWeights {2: 0.555, 1: 0.327} -> OK. Subnet 575 runs commit-reveal weights, so the chain applies a weight vector two epochs after it is committed. On-chain incentive was then read from the public testnet node at every epoch boundary after the commit.

Result Measured

MinerValidator weightOn-chain incentiveEpochs paid
m01 (honest) · UID 10.327 → 37.1%0.370913 / 13
m02 (honest) · UID 20.555 → 62.9%0.629113 / 13
m03 (lazy) · UID 300.00000 / 13

Incentive first appeared at block 8,159,238, two epochs (720 blocks) after the weight commit at block 8,158,518, and was paid at every epoch through block 8,163,558 — 13 consecutive epochs, about 14 hours. The split matches the validator’s weight vector to four decimal places. Incentive returned to zero by block 8,163,918, when the testnet’s activity cutoff retired the single weight commit; the validator had set weights once and exited, as designed for a graded cycle.

Chain references

EventBlock
Emission schedule started8158453-5
Validator staked τ0.1 → 178.83 α8158480-7
Run 2 weights committed (validator UID 0)8158518
First epoch with non-zero miner incentive8159238
Last epoch paid from this commit8163558

Addresses for every key are on the testnet record.

How to check

The public testnet node keeps full state history, so the incentive vector can be read back at any of the blocks above with the Bittensor Python SDK (v11). Values are stored as 16-bit integers; divide by 65535.

import bittensor as bt
st = bt.Subtensor(network="test")
for blk in (8158518, 8159238, 8163558, 8163918):
    inc = st.query(("SubtensorModule", "Incentive"), [575], block=blk)
    print(blk, [round(v / 65535, 4) for v in inc.value])
# 8158518 [0.0, 0.0, 0.0, 0.0]
# 8159238 [0.0, 0.3709, 0.6291, 0.0]
# 8163558 [0.0, 0.3709, 0.6291, 0.0]
# 8163918 [0.0, 0.0, 0.0, 0.0]

Element order is UID order: validator, m01, m02, m03.

What Phase T+ does not prove

  • Real inference or real proofs: the credited work was mock inference with mock proofs, as in Phase T.
  • Sustained payment: one weight commit, paid for 13 epochs until the testnet’s activity cutoff retired it. A validator that keeps weights current is the next build item and is required before any rung can claim continuous operation.
  • Decentralization: one team operates the validator and all miners.
  • Value: testnet incentive is test TAO, which has no value.

Report · Phase T · v0.4.2 · Bittensor testnet

Phase T — the payment gate on a public chain

Claim

On Bittensor’s public testnet, the Blindproof validator credits miners only when their work verifies, in both the deterministic tier (two-miner hash agreement) and the proven tier (single miner plus proof check), and writes weights that reflect only verified work.

Test

One validator (UID 0) on a separate machine, making outbound calls only. Three miners (UIDs 1–3) on a single rented CPU server with public endpoints, calling a mock inference server paced at a measured 32.8 tokens/s. Two miners behave honestly. The third is lazy: it returns a cheap guess instead of running the model. The validator dispatches 12 deterministic-tier and 12 proven-tier jobs, settles each one, and then writes weights.

Result Measured

Deterministic tierProven tier
Jobs settled12 / 1212 / 12
Wrong settlements00
m01 (honest) credited12 / 124 / 4
m02 (honest) credited12 / 128 / 8
m03 (lazy) credited0 / 90 / 1 — rejected as unsound
Median time to settle5.9 s31.6 s

Validator weights were written at 19:33:50 EDT on 5 October 2026: FINAL SetWeights {1: 0.337, 2: 0.547} -> OK. Miner incentive in that epoch was zero because the subnet’s emission schedule had not yet been started and the validator held no stake. Both were fixed immediately after, the cycle was run again, and the chain paid the honest miners — see Phase T+.

Chain references

EventExtrinsic
Subnet 575 created (21 Sep)8055866-8
m01 registered, UID 18158067-5
m02 registered, UID 28158071-8
m03 registered, UID 38158075-6
Emission schedule started8158453-5
Validator stake τ0.1 → 178.83 α8158480-7

Addresses for every key are on the testnet record.

How to check

Open each block in the explorer and confirm the extrinsic and its signer. List current participants with btcli wallet overview or the SDK snippet under Phase T+. Run logs and per-job ledgers are archived and will be published with the reference validator.

What Phase T does not prove

  • Real inference: miners used a mock server, not the model.
  • Real proofs: proven-tier proofs were mock objects.
  • Privacy: no masked execution on testnet.
  • Decentralization: one team operates the validator and all miners.
  • Sustained operation: one graded cycle, no fees, testnet only.

Report · Phase M · v0.4.1 · local chain

Phase M — attacks and load on a local chain

Claim

Before spending anything on a public network, the validator rejects forged or misdirected traffic, never pays a cheating miner in either tier, and keeps settling correctly under load.

Test

A full local Bittensor chain with the subnet, a validator, and miner personas scripted to cheat in specific ways. Sixteen scenarios, each run repeatedly, against a mock inference server paced at a measured 32.8 tokens/s.

Result Measured — 16 / 16 scenarios passed

GroupWhat was attemptedOutcome
Request securityUnsigned, non-validator, wrong receiver, replayed, and tampered requestsAll rejected
Deterministic-tier cheatsLazy, nondeterministic, and withholding miners, each 6–11 timesNever paid
Proven-tier cheatsForged, missing, late, wrong-input, and lazy proofs, each 6–11 timesNever paid
Proven-tier settlementAll proven jobs, with retry144 / 144 settled
LoadSustained dispatch11.7 jobs/min · p50 10.6 s · p95 21.0 s
Realistic mixMixed prompt sizes and tiersp95 57.7 s
OverallAbout 300 jobs0 wrong settlements

What Phase M does not prove

  • Anything about a public network: this ran on a private local chain.
  • Real inference or real proofs: both were mocked, as in Phase T.
  • Resistance to colluding miners: the deterministic tier assumes the two matched miners are not colluding.

Foundation results from Paradatum

Blindproof runs on Paradatum’s deterministic execution work. These results are Paradatum’s, measured outside the subnet, and are listed here so the dependency is visible.

ResultStatus
A mid-size open-weight model (14B parameters, full BF16, lossless) produces bit-identical output across three GPU types and a CPU verifierMeasured
Fits on a 24 GB GPU and runs about 40% faster than a standard open-source inference engine on the same hardwareMeasured
The deterministic build reproduces its reference output hashes on a consumer GPU, including on prompts of about 2,800 tokensMeasured
Per-layer proofs on that model, with the full proof chain verified in tens of milliseconds and a single changed byte detectedMeasured
Masked computation at piece scale, including masked multiplication with two independent mask ownersPrototype
A full-model zero-knowledge proof of one inferenceAudit in progress

The subnet itself commits only to per-piece proofs. A full-model proof is not a subnet claim.