Jun 2026
The model nobody holds
Split a model across machines you don’t trust, hand each one a single slice, and catch the liar by running its slice again.
We wrote earlier that you cannot trust a GPU you rented from a stranger. That post left a hole. If you can’t trust the machine, and the model is too big to fit on the one machine you do trust, what do you actually do? This is the answer.
Cut the model, not the trust
A transformer is a stack of identical layers. You can slice that stack into contiguous blocks and put each block on a different node. Node one runs layers nought through nine, hands the result to node two, which runs ten through nineteen, and so on. The only thing crossing the wire between them is a single activation vector, a few kilobytes, once per token. No node holds the whole model. No node sees the whole computation. We proved the split is exact: a model run across three nodes produces the identical bytes a single machine would, down to the last bit.
Why this particular cut
There is a more famous way to split a model, called tensor parallelism, where every node holds a sliver of every layer. It is what datacenters use, and over the open internet it is dead. It needs every node to stop and agree after every layer, twice, and on a network with real distance that handshake costs a hundred milliseconds each time. A seventy-billion-parameter model would spend roughly a hundred seconds per token just waiting. The cut we chose, by contrast, only ever passes one vector forward to the next node in line. One hop per stage, no group huddle. It is the only split that survives the speed of light, which is the wall that killed every decentralized compute project before this one.
The honest speed
So we will not lie to you about throughput. A seventy-billion model across eight nodes at fifty milliseconds apart runs at a few tokens a second, not the dozens a datacenter gives you. Physics sets that floor and we cannot argue with it. What we can do is amortize it: a small fast model drafts several tokens, the big distributed model checks them all in one pass, and the effective rate roughly triples. But the pitch is not speed. A datacenter beats us on speed every time. The pitch is that the model runs on nobody’s computer in particular, can’t be pulled offline by one company, and hands you something a centralized API never will: a proof.
The proof is the re-run
Here is the part that makes the untrusted machines safe to use. Each slice is deterministic, so each node signs a receipt committing to exactly what it output. To check a node, you re-run its slice on an independent machine and compare. Honest math reproduces; a lie does not. A node that corrupts its output is caught by one signed receipt, no vote, no quorum to bribe. We close the obvious dodge too: a node must return exactly the bytes it signed, so it can’t commit the honest hash while shipping garbage downstream. The whole trust story is the same one the rest of the network runs on. The re-run is the proof.
And the lie costs money
A proof nobody acts on is decoration, so we wired it to the wallet. To serve a slice, a node stakes a bond. When the re-run catches it lying, it forfeits that bond to the treasury. We ran exactly this: three nodes, each staking three credits, and told the middle one to cheat. The verifier caught it on every step, filed the signed receipt as evidence, and the mint took its entire stake. The two honest nodes kept theirs. Caught lying is not a warning. It is a loss.
The catch
We pointed our own adversaries at this and they found real things, so here they are, and here is what we did about them. The re-run only proves anything if the verifier is honest, so we stopped trusting a single one: every slice is now checked by several independent replicas, and a stage is only convicted when it disagrees with their majority. We tested it with a verifier that colludes with the cheat and votes its way, and the honest replicas outvoted it. The check still happens after the tokens are delivered, though, which means a cheat can corrupt one answer before it loses its stake. The economics deter that; an escrow does not prevent it. And bit-for-bit agreement across different chips is the subtle one. We just moved the heavy matmul to integer arithmetic, which is exact on every machine and four times lighter on the wire, so that part no longer drifts and the slices got faster in the bargain. What is left is a handful of transcendental functions, the exponentials and sines, which different processors round their own way. Pinning those is the same deterministic sandbox the rest of the network already runs on, and it is where the slices are headed. We would rather tell you where the edge is than pretend there isn’t one.
A model too big for any one machine, running on machines you have no reason to trust, where no node holds the whole thing and the liar pays. That is not a faster cloud. It is a different promise.