Jun 2026
You cannot trust a GPU
Rent a thousand GPUs from strangers and you have no way to know if any of them ran your job.
Hand a remote GPU a matrix multiply and ask for the result. It hands one back. You have no way to know if it did the work. It could have run a smaller model. It could have cached an old answer. It could have rolled dice. The number that comes back looks exactly like the number that comes back from honest work, because a result is just a result. There is no receipt baked into a float.
This is the whole problem with decentralized compute, and almost nobody says it out loud. You can rent ten thousand GPUs from strangers tomorrow. You cannot trust a single one of them. The market sells you cycles and asks you to assume the cycles happened.
The result tells you nothing about the work
With storage, you can prove possession. Ask a node to hash a random slice of the file it claims to hold, give it a fresh nonce, and a cheater who deleted the file cannot answer. The challenge is cheap, the answer is unforgeable, and the honest path costs almost nothing. Filecoin runs on exactly this asymmetry.
Compute has no such asymmetry. The output of a real computation and the output of a faked one are the same kind of object: bytes. If I ask a node to run llama-70b on a prompt and it instead runs a 7B model, the answer is still fluent English. If I ask for a gradient and it returns noise scaled to look plausible, I cannot tell by staring at the tensor. The work leaves no fingerprint on the result. That is the entire difficulty in one sentence.
And you cannot just re-run it yourself to check. If you could run the job, you would not be renting the GPU. The verifier is, by construction, weaker than the worker. So every honest scheme has to make checking dramatically cheaper than doing, or it collapses into "do everything twice," which defeats the point of renting at all.
The three escape hatches, and what each one costs
There are exactly three known ways out, and every serious project is some blend of them.
The first is redundancy. Send the same job to several nodes and compare. This is what BOINC and the old SETI@home did, and it works for one brutal reason: if the answers disagree, somebody cheated. But it multiplies your cost by the replication factor, and it dies on floating point. Two honest GPUs from different vendors will not return bit-identical results for the same matrix multiply. Reorder the additions and the rounding drifts. So you cannot demand exact agreement, which means a clever cheater can hide inside the tolerance band you were forced to allow.
The second is cryptographic proof. A zero-knowledge proof lets a node prove it ran the exact computation, no re-execution required, no trust at all. The math is real and the verifier work is tiny. The catch is the prover overhead. Proving a computation in a zk circuit has historically cost hundreds to thousands of times the raw compute, and that multiplier is brutal precisely on the dense linear algebra that GPUs exist to do fast. The frontier is moving (proof systems for ML inference are a hot research area) but "I will prove this fp16 GEMM in zk" is not a thing you cheaply do at scale today.
The third is hardware attestation. Modern accelerators ship with a trusted execution mode. NVIDIA's Hopper and Blackwell parts have Confidential Computing: the GPU signs a statement saying "this exact code ran inside me, untampered," and you verify the signature against NVIDIA's root of trust. Clean, fast, almost no overhead. You have just relocated your trust. You no longer trust the operator. You trust NVIDIA's silicon, NVIDIA's firmware, and NVIDIA's attestation servers, and you trust that no one has pulled secrets out of the chip with a probe. For a decentralized network whose pitch is "no central boss," leaning on a single vendor's root key is a strange hill.
Pick which trust you can live with
So here is the honest shape of it. Redundancy costs you money and breaks on floating point. Proofs cost you compute and are not ready for dense ML at scale. Attestation costs you nothing and hands your trust to a chipmaker. There is no fourth door, and there is no door with zero cost. Trustless general compute, cheap and verifiable on hardware you do not own, is not a solved problem. Anyone who tells you their network has it solved is selling you the float and asking you to assume the work.
The useful move is to stop asking "is this trustless" and start asking "whose word am I taking, and what does it cost me when they lie." A render farm can eat redundancy because frames are cheap to spot-check and disagreement is obvious. A regulated workload can accept NVIDIA's attestation because the alternative is a datacenter you also did not build. A small high-value proof can justify zk overhead. The mistake is pretending one answer fits all three. You cannot trust a GPU. You can only choose, on purpose, which trust you are willing to buy.
What we picked
Verse picked the re-run, and made re-running cheap. Our compute is deterministic WebAssembly, not raw GPU. Same bytes in, same bytes out, on every honest machine, so any node can re-execute a job and check it against the signed receipt. The verifier is not weaker than the worker, it is the worker run again. We do not check every job, we sample, because one caught lie burns a bond and the math makes cheating lose money. The honest edge: a GPU kernel is not bit-reproducible, so GPU work is fit-for-purpose, not replay-proof. We took the trust you can buy with math over the trust you rent from a chipmaker.