Verathos (SN96) Delivers Bittensor’s First Verifiable AI Compute Layer

Verified compute has been a known problem in AI for years, but every existing solution carried a hidden cost that kept it from running on ordinary hardware.

Verathos (SN96) is built to attack that gap with cryptographic proofs of inference and training generated inline during model serving, with no secure enclave required and none of the heavy overhead of zk-ML (zero-knowledge machine learning) circuits.

The proofs are cheap enough to attach to every request rather than as a sampled audit, and the verification works on uncertified consumer hardware where most of the world’s idle compute already sits. Bittensor can now pool consumer GPUs, Apple Silicon, and data-center slack into one serving layer where cheating is mathematically unprofitable.

The Problem Verathos Is Solving

Demand for inference is effectively unbounded, frontier GPUs are rationed, and yet enormous quantities of capable compute sit idle.

Where the idle compute lives:

1. Consumer Gaming GPUs: Mostly at rest between sessions.

2. Apple Silicon: Runs modern models efficiently across millions of machines that almost never do serious inference.

3. Workstations: Idle overnight and during much of the workday.

4. Data Center Slack: Capacity that ebbs between peaks.

The hardware is unreachable not because of bandwidth or latency, but because of trust. You cannot safely pay a stranger’s machine for compute when you cannot confirm the machine did what it claimed.

In June 2026, a frontier laboratory was compelled by government directive to cut off access to two of its most capable models, for every customer, everywhere, at once. The models you depend on sit behind someone else’s door, and that door can be closed on a timeline you do not control.

Why Verification Is Not A Feature

Verification is often presented as a checkbox feature, but Verathos makes it the precondition for the network existing at all.

Build the obvious decentralized compute network in your head, where operators are paid for the work they report, and watch it collapse:

1. The operator runs a smaller, cheaper model and bills for the original.

2. The operator serves a heavily quantized shadow of the advertised model.

3. The operator caches previous responses and replays them.

4. The operator reports work it never performed.

None of these require malice. Honesty becomes the strategy that costs the most and earns the least. Self-reported metrics get inflated, reputation systems get gamed, random spot checks raise the cost of cheating without eliminating it. Every partial remedy leaks because the hole is the load-bearing flaw.

What Verathos Actually Proves And How

Verathos uses a sumcheck protocol applied over Merkle-committed model weights. How the proof works:

1. Sumcheck reduces heavy arithmetic to a compact polynomial statement. The verifier confirms the result without redoing the computation.

2. Merkle-committed weights bind the proof to a specific model. Forecloses the shortcut where the operator substitutes a smaller model and proves a correct computation of the wrong thing.

3. SHA-256 output commitment welds the answer to the computation. Tampering invalidates the proof.

4. The Fiat-Shamir transform makes the proof non-interactive. It travels with the result and can be checked independently later.

The proof plugin integrates into production-grade vLLM (Virtual Large Language Model) serving and generates the sumcheck proofs in parallel during CUDA (Compute Unified Device Architecture) graph execution, with single-digit-percent overhead. Validators verify on ordinary CPUs in milliseconds.

The same machinery extends into training. The prover verifies the forward pass, the backward pass, and the optimizer step across full fine-tuning and LoRA (Low-Rank Adaptation) , under AdamW, SGD, and Muon optimizers. The claim is that the training computation was performed correctly. Whether the resulting model is better is a separate question that only measured performance can answer.

Why No Secure Enclave Is The Breakthrough

Existing approaches cannot unlock the world’s idle hardware:

1. Secure enclaves relocate trust rather than removing it. The trust shifts to the chip manufacturer, the firmware, and the attestation chain. Apple Silicon does not fit the standard attestation story at all.

2. zk-ML circuits are too expensive for live serving. Compiling a model into a zero-knowledge circuit has historically been heavy enough to keep the technique out of production.

Verathos is the first Bittensor subnet to serve production inference and prove it correct within a single system, depending on neither approach. Serving and proving are one integrated act, which is what makes the proofs cheap enough for every request and portable enough to run on uncertified hardware.

Pooling The World’s Idle Hardware

A single consumer machine cannot hold the largest models alone. The resolution is to let many individually-insufficient machines act together as one sufficient whole.

The mesh inference architecture (currently experimental):

1. Cross-architecture cooperation: A Mac with a GPU box, two Macs together, two GPUs together, mixed pools spanning CUDA and Apple Metal.

2. The first end-to-end split is running over the public internet. A local GPU and a Mac on ordinary Wi-Fi collaborating on the same model, with proof hooks in the loop end to end.

3. Low single-digit-percent overhead on organic traffic.

The structure has two roles. Controllers build and operate a mesh; any registered identity can become one. Workers contribute compute and earn a proportional share.

How Demand Reaches The Network

Two paths keep the demand side as open as the supply side:

1. Per-Call Settlement: A wallet signature authorizes payment, with no account, no subscription, and no stored balance. Natural fit for autonomous agents.

2. Conviction Allowance: Locking the subnet’s alpha earns a daily budget of verified inference proportional to the commitment, while the locked stake is never spent.

Both work only because the underlying compute is provable. Strip away the proof and the economics collapse straight back into the incentive trap.

Where Verathos Begins

Several strong projects have already turned AI inference into something you stake for rather than pay for by the request, and the teams who built those staking-for-access models arrived first.

What they share is the boundary of what they actually solve, which is access to inference. None of them prove that the inference was performed correctly. Their pitches around privacy, cost, convenience, or uncensored availability are real value propositions, but underneath all of them, the same assumption remains untouched: you are still trusting that the model you requested is the model that ran.

Verathos begins where those designs stop, because access was the easy part and proving the computation was real is what converts a payment rail into actual infrastructure.