Jul 2026
The bits survive the trip
We claimed our math was bit-identical everywhere. We had only ever proven half of that claim.
Here's a fact most working programmers never trip over: floating-point addition, subtraction,
multiplication, division and square root give you the exact same bits on every machine on
earth. IEEE-754 requires it — correctly rounded, no wiggle room, x86 and ARM and a WebAssembly engine
all agree to the last bit. And here's the fact that ruins it: almost nothing else does.
exp, sin, cos, pow — the functions every neural
network leans on — come from your platform's math library, and those libraries disagree with each
other in the last digits. Quietly. Per platform, per version.
For most software that drift is invisible. For us it's fatal. Our whole network rests on one move: a
provider runs your job, signs a receipt, and any skeptic can re-run the same bytes and check. If an
honest provider computes exp(x) on ARM and the verifier re-runs it on x86 and the last
bit differs, the re-run says liar — and an honest machine gets slashed for the crime of
having a different libm. Determinism isn't perfectionism here. It's the difference between catching a
cheat and convicting an innocent.
The fix is old-fashioned: build the functions you need out of only the operations the
standard actually guarantees. Our det_math is 379 lines of Rust that computes exp, sine,
cosine, softmax and the f64 log/exp our scoring path needs — from adds, multiplies, divides, square
roots and integer bit-fiddling, in a fixed order, and nothing else. No platform libm anywhere in the
forward path, and CI greps to keep it that way (introduce a fused multiply-add or a
par_iter into a determinism-critical file and the build fails). Same bits on every
conforming machine, by construction.
Now the embarrassing part, because the whole point of this network is that we don't skip it. Our headline says "verifiable down to a browser and a microcontroller." Browsers run WebAssembly. And until last week, every determinism proof we had ran on native x86 and native ARM — never once under a wasm engine. The one word doing the most work in our pitch was resting on a layer we had never tested. The field-standard move is to keep the headline and hope. We'd rather make it true.
So the proof is now seventeen lines. A tiny no_std capsule pulls in the same
det_math.rs source file the node ships — not a port, not a copy that can drift, the
literal file compiled a second time — and exports one function: a digest over the raw output bits of
every det_math function across four thousand points, the full argument range our attention math
actually uses. Compile it natively, you get a 64-bit fingerprint. Compile it to wasm32 and run it
inside a wasm engine — different compiler backend, different instruction set, different execution
model — and you get 0xb87421e672bdf23a. The same number. Every push to the repo
recomputes both and fails the build if they ever part ways.
Why go this far when nobody else does? Because everybody else went the other way. The serious verifiable-ML projects get bit-exactness by pinning the hardware — one GPU architecture, sometimes a trusted enclave on top, FP32-only kernels that cost up to 3× to stay reproducible on a single vendor. That's a real achievement and it buys GPU scale, but the reproducibility dies at the edge of the pinned fleet. We're the opposite bet: smaller math, no pinned anything, and the bits survive the trip from a rack server to the phone in your pocket. Verification you can carry.
The honest edges, stated plainly. Our wasm engine in this proof is wasmtime, embedded — a browser ships a different engine, and until we run this same digest under one, "browser" is still a claim about the spec, not a demo; that demo is the very next thing we build. And this proves the math library and the model's forward pass, not every capsule under the sun — a verifier on a different runtime version declines to judge rather than convicting, on purpose. The claim is exactly as big as the proof, which is the only size a claim should ever be.
Everyone else pins the hardware so the bits can't drift. We pinned the math, so the hardware stops mattering.