Whitepaper

Hearth: A Verified-Inference Layer-1
Secured by Proof of Inference

July 22, 2026 · Draft Version

1Introduction

Large language models are economic infrastructure, yet running one is rarely verifiable. In a hosted API, the buyer's only assurance that the advertised model produced the output, unsubstituted and at full precision, is the provider's reputation. Serving a cheaper or quantized model instead is tempting and hard to detect from the outputs alone [1]. A hosted model is also a revocable chokepoint: providers routinely deprecate and retire models [2], [3]. As inference becomes a commodity traded between agents with no prior trust, the absence of a checkable receipt becomes the binding constraint.

Decentralized inference networks remove the intermediary but inherit a harder problem: anonymous, incentivized nodes can run a cheap model, fabricate a reply, or charge for work never done. Re-running and comparing fails because generation is nondeterministic. Zero-knowledge proofs of a forward pass remain far too slow for frontier-scale models [4].

1.1Contributions

Hearth composes the mechanisms that work today, hardware attestation, statistical model-identity testing, and committee re-execution, into a layered guarantee on a proof-of-stake chain whose block production is amplified by verified useful work. The paper makes four contributions. It defines Proof of Inference, a Fair Proof-of-Stake modification in which verified inference is a capped multiplier on forging weight, falling back to pure stake without demand (§3). It specifies a two-asset economy: a network token (HRTH) and a USD-denominated inference credit (Cred), single in Phase 1 and graduating into per-model Creds in Phase 2, with the liquidity-mining subsidy that bootstraps it (§4). It presents a layered verification framework that establishes correctness without trustless proofs of frontier inference (§5). And it details a three-phase deployment, Relay, Compute, and Coordinate, each a strict superset of the last (§6–§8). These choices follow three principles. Stake is the security floor that verified work amplifies but never replaces. Verification is layered, with its residual assumption stated at each phase rather than overclaimed. Assurance is staged to available tooling, each phase reusing the prior's primitives.

1.2Why a dedicated L1

Every mechanism Hearth requires is consensus-level and inexpressible as an application-layer contract: the forging-weight rule, generation-suspension as the penalty for cheating, and native attestation verification inside the protocol rules (secp256r1 DCAP-quote and TCB checking against a pinned measurement). Hearth builds on a mature Fair Proof-of-Stake L1 and inherits its block-generation delay function [5]. That base supplies node software and native asset issuance while granting full control over consensus, penalties, and monetary policy from genesis, and Hearth adds native transaction types rather than a contract VM. The cost is bootstrapping security from zero. A proof-of-stake chain's security is bounded by the market value of its staked coin, and HRTH launches with none, so the chain is cheaper to attack than an established L1. The first phase therefore exists to attract stake and usage before the network secures anything of value.

2Background and related work

Trusted Execution Environments (TEEs), such as Intel TDX/SGX and confidential-computing modes on NVIDIA H100 and Blackwell GPUs, let a workload prove, via a vendor-signed quote, what code it ran. Confidential GPU inference costs single-digit-percent overhead and lets a verifier confirm the advertised model is loaded, shifting trust from operator honesty to the vendor's attestation root [6], [7]. It is central to Hearth's guarantee, backstopped by independent statistical tests (§10.2).

Verifying the computation itself has two lineages. Optimistic schemes such as opML resolve disputes with fraud proofs over a re-executable trace [8], following Arbitrum's bisection [9]. Zero-knowledge approaches such as zkLLM prove a forward pass succinctly but stay too slow for large models [4]. Locality-sensitive commitments, TOPLOC [10] and DiFR [11], make logit comparison robust to GPU floating-point nondeterminism. Hearth uses attestation and committee re-execution live, reserving ZK and bisection as a future trustless floor.

Independently, Model Equality Testing (MET) checks whether an API serves the claimed model via a Maximum Mean Discrepancy two-sample test with a string kernel [12], [13], and watermarking embeds a detectable signal in outputs [14]. Both anchor Hearth's Relay-phase defenses when re-execution is unavailable. For consensus, Hearth builds on Fair Proof-of-Stake, where block-generation delay depends on generating balance and an unpredictable VRF hit [5], modifying only the balance term.

3Consensus: Proof of Inference

3.1The forging-weight modification

Fair Proof-of-Stake selects a block generator by a delay function: a node generates sooner the larger its generating balance b_i and the more favorable its Verifiable Random Function (VRF) hit, approximately

where A_n is the network baseTarget (roughly 60 s blocks) and X_n is the VRF hit, unpredictable until the generation signature is published, which makes FPoS grinding-resistant.

Proof of Inference modifies exactly one term, the balance:

Here workBoost_i is node i's normalized, finalized verified-work over a trailing window. The cap B_max (e.g. 2–3×) bounds the multiplier, and with it the centralization pressure from accumulable compute. With no work, workBoost_i = 0 and the rule is vanilla FPoS. The VRF hit is untouched, so work cannot bias the randomness. Because b_i ≥ b_min, forging weight accrues only to a staked validator. The miners whose work drives the boost are stakeless by design (§6.2): the stake floor and the boost both live at the validator.

3.2Specifying workBoost

The forging rule of §3.1 takes workBoost_i as given.

The map f(g) = B_max g/(g+κ) is monotone and concave, with f(0) = 0 and f(g) < B_max. So the min(·, B_max) clamp is redundant, and a node reaches half the cap at g_i = κ. The map is scale-free, depending only on a node's work relative to its peers. Its concavity caps a large operator's advantage and the marginal payoff of self-dealing near saturation (§3.5). Bounding each node's contribution before it sets consensus influence follows Yuma normalization in Bittensor [15] and share-based proof-of-useful-work accounting [16], [17].

A plain count median over positive-work nodes would be cheap to move. An adversary registering many dust servers with w_j just above zero drags it down, raising every g_i, so a genuine large-work node reaches the cap with far less real work. The dust floor τ_w and stake-weighting close this. Because each eligible node enters m(E) with weight b_j ≥ b_min rather than one identity, the statistic tracks the median unit of stake. Shifting it past a challenger requires controlling roughly half the eligible stake mass, as costly as a stake-51% attack on the base chain [18]. Sybil identity count is irrelevant without a scarce-resource anchor [19]; only stake moves m(E).

The bound is immediate from 0 ≤ workBoost_i < B_max: non-negativity gives ∑_j b_eff(j) ≥ ∑_j b_j, hence s_i ≤ (1+B_max)σ, and the threshold follows by pitting the adversary's maximally boosted weight against the unboosted honest remainder. Forging weight is amplified by up to (1+B_max), but the stake needed for a forging majority falls only from 1/2 to 1/(2+B_max), a factor of 1 + B_max/2. Equivalently, PoI retains a fraction 2/(2+B_max) of the pure-stake attack cost, so at B_max = 2 an attacker still needs more than a quarter of stake against the half required for pure FPoS [20]. Against a griefing or censorship adversary willing to burn capital rather than profit, the boost is purchasable up to burn-cost, so the threshold really is σ > 1/(2 + B_max), a bounded concession accepted for the mechanism's utility.

3.3Pre-finalization

Work that buys block-production probability must be fully verified first. Work in epoch E is finalized when its Settle is accepted (Phase 1) or its attestation is checked and its verification and challenge window closed (Phase 2 on), then written to a canonical on-chain verified-work balance that boosts forging only in epoch E+1. Validators re-derive b_eff from finalized state at validation time, so no heavy verification runs at consensus speed. A node's work is fixed before the next epoch's VRF hit is knowable, so it cannot be ground against the draw.

3.4Penalty: generation-suspension, not confiscation

The base chain's leased proof-of-stake is non-slashable by design, and Hearth preserves that contract. A node proven to have cheated does not lose principal. Its generating balance is suspended for a penalty period, and its accumulated workBoost is reset to zero. During suspension it cannot forge, earn the boost, or collect verification income, and the forfeited rewards fund the verifiers that caught it. Reversible and proportionate, this suits statistical verification with a non-zero false-positive rate: a wrongly suspended honest node recovers, whereas burned principal could not. Suspension escalates with repetition and scales with throughput, keeping the deterrent meaningful across stake sizes without confiscating delegators' funds.

3.5Self-dealing the boost

Because verified inference raises forging share, a node can run real inference for itself to inflate its weight. Verification cannot catch genuine work with fabricated demand, so the defense is economic. The attack is structurally bounded. Block issuance is fixed, so the boost only redistributes a fixed pie. B_max and a per-device cap bound the share work can buy, and the stake floor keeps it below pure-PoS security. The primary defense is the observable payer-gate. Each Cred carries an on-chain provenance tag of the key that last acquired it. A retired Cred is boost-eligible only if that acquisition was an open-market purchase (an AMM or DEX swap) and the Reserve encumbering it (§6.2) came from a key distinct from both the serving miner's operator and its beneficiary validator. A wallet-to-wallet transfer between a Sybil's own keys therefore does not reset eligibility. Creds an operator minted or holds itself pay for inference but never drive workBoost. The residual Sybil routes payment through distinct keys it secretly controls, and stays bounded by burn-cost. It must spend Creds burned on use, forgoing their USD value, and incur real compute cost, all to chase a capped boost tracking HRTH_price · B_max / c: expensive, on-chain, and self-defeating.

Verified work both pays rewards and raises forging weight, so any verification break is also a consensus-tilting vector. The same levers contain it: forging weight accrues only on burned, externally-paid Cred demand capped at B_max over a trailing window, so any break must first become sustained, capital-costly, externally-corroborated fake demand. The residual B_max amplification is the concession of §3.2.

3.6Cryptographic foundation

Block production and the generator lottery of §3.1 rest on standard, Ledger-native primitives. Transactions and blocks are signed with Ed25519 (RFC 8032), and the VRF hit is drawn with ECVRF-EDWARDS25519-SHA512-TAI (RFC 9381, suite 0x03), the same suite the base chain has run since its protocol v5, so the consensus port is minimal. The signing key and the VRF key are not shared: they are derived at distinct hardened SLIP-0010 paths from one BIP-39 mnemonic. An account address is a Bech32m string over a version byte and the leading twenty bytes of the signing key's SHA-256 hash, under the human-readable prefixes hrthm (mainnet) and hrtht (testnet). Reusing a single Ed25519 key for both roles, as the base chain's generator does, is unsafe. EdDSA signing and ECVRF are Schnorr-type constructions over the same scalar and nonce prefix, so an adversary who induces the generator to sign the message equal to the VRF's hash-to-curve point forces a nonce collision and recovers the secret key [21]. Separate derivation paths make that collision structurally impossible.

A stake-weighted finality layer is planned above FPoS block production: any set of voters holding more than half the balance finalizes a block with a single BLS12-381 aggregate signature, its keys derived by EIP-2333 from the same mnemonic. Only that key derivation is fixed at present; aggregate signing, verification, and proof-of-possession require a pairing backend and are deferred (§C.2).

4Token model and the inference market

The parameter values, emission schedule, Cred issuance controller, maturity-governed split function, and worked security figures are fixed in the companion tokenomics specification [22]; this section keeps only what the protocol argument needs.

4.1HRTH and Creds

Hearth separates the asset that secures the network from the assets that price its output [23]. HRTH is the single network token: staked, forged, spent as gas, used in governance, and issued as the reward for verified work, suspended but never confiscated on proven misbehavior (§3.4). Creds price the network's output, phased to match what the network can back and discover at each stage.

Phase 1 uses a single Cred: one USD-denominated, capacity-backed, burn-on-use inference credit, quoted and settled through an external stablecoin (USDC, USDT) and retired when spent. Relaying to a hosted aggregator (§6) leaves no self-hosted capacity to back distinct per-model claims and no discovered per-model price. A single metered credit is therefore the right regime, the one Diamandis et al. [24] describe as trading granular price discovery for simplicity. It also preserves the singleness of money [25]: one par-fungible unit and one deep pool, no liquidity fragmentation across thin per-model markets during bootstrap.

Per-model Creds emerge in Phase 2. Once nodes self-host confidential GPUs and full logit-committee verification turns on (§7), each model's verified output becomes a distinct, attestable good with its own capacity backing and a network-discovered price. The single Cred graduates: it persists as the settlement numeraire, a base Cred, while each model gains a Cred-M that redeems for one standardized unit of output from pinned model M, carries no peg, and floats on internal AMMs rather than tracking the aggregator. The per-model Creds phase in model-by-model as each gains verified capacity, with no flag-day cutover (§7.4). Neither corner works: one Cred forever collapses toward a reseller echoing the aggregator, while many Creds from day one back and discover nothing in Phase 1 and fragment liquidity prematurely.

4.2A market for verified inference

Each Cred-M is a claim on a standardized attested good (model M at a pinned hash and precision), so in Phase 2 per-model Creds trade as ordinary fungible tokens whose price becomes the discovered price of real inference, the network's core product (§12).

A buyer acquires a Cred upstream and later spends it on a job. The call is instant: any eligible node serves a holder by protocol rule, with no per-request negotiation. On spend the Cred is retired and split three ways: a 60% burn [26], a 30% node share, and 10% to the verifier pool. Only the burned, payer-gated fraction counts toward consensus and Cred issuance, so the node share adds no attack surface. Serving is market-elective (§4.4), so a Cred is a redeemable claim, not a guarantee: a holder is entitled to inference whenever the price sustains willing supply.

4.3Staking, leasing, and serving

An HRTH holder takes one of three mutually exclusive positions per coin. Held, it earns nothing. Staked, it earns the Cred stream and no emission. Used as generating balance, owned or leased-in under a non-custodial lease, it earns HRTH emission and the forging boost but no Creds. The two yields price different things, inference demand versus security provision, so the forced choice is the loop's balancing mechanism. This closes the economic loop with no explicit Cred-to-HRTH peg. External dollars paid for Creds are the yield on staked HRTH, and earning that yield and the forging boost requires staked HRTH. So if HRTH is too cheap, validators withdraw, the boost sink that pays miners shrinks, serving capacity falls, Cred scarcity lifts the price and hence the yield and HRTH's value, and capacity resumes.

4.4The subsidy, the floor, and self-dealing

HRTH issuance lets honest providers serve below cash cost: a node earns HRTH (issuance plus the boost) for verified work, so it can accept a low Cred price and still profit. This liquidity mining makes Hearth inference cheaper than incumbents and attracts operators who run GPUs cheaply, for whom passing attestation is the entire go-to-market (§12). The serving floor is set by the market, not the protocol. A node serves only when its HRTH reward covers its cost, and withdraws otherwise, so entry and exit discover the floor rather than the protocol measuring an unobservable marginal cost. The health metric governance watches is the ratio of organic USD revenue to HRTH subsidy value. Rising, the market is real; flat, the network is renting volume. The link degrades gracefully rather than collapsing. Even with the subsidy gone, every Cred stays redeemable for real inference at its true cost, because the backing is servable GPU-time, not a promise about HRTH's value.

4.5Governance and value capture

Governance tunes the economic and verification parameters only within protocol-enforced bounds (§13). HRTH accrues value through gas, settlement, and governed fee burns [27]. Its most durable source is the staking demand that real USD Cred-yield creates: as dollar-paid inference volume grows, so does the value of the HRTH that must be staked to earn the Creds that serve it.

4.6Economic security

The companion specification instantiates these mechanisms at launch parameters and works the security arithmetic [22]. Two qualitative results carry the protocol argument. The forging subsidy is issuance-bounded and small, capping what manipulating it can be worth. And the node share of retired Cred value stays below a protocol-enforced ceiling recomputed each epoch from the measured maturity ratio, so no governance vote can make self-dealing profitable. The observable that protects price discovery, externally-paid burned Cred demand (§3.5), is the same one that protects consensus against fabricated work.

5Verification framework

This framework applies in full in Phases 2 and 3. Phase 1 uses only the subset that needs no re-execution (§6.3).

5.1What is verified, and why logits

The threats are substitution (serving a cheaper or different model than claimed) and fabrication. Comparing generated text is useless: sampling makes honest runs differ while a substitute still produces plausible text. Verification targets logits instead. At each position a model emits a logit vector that is a deterministic function of (model, input), with all randomness in the sampling that follows. The logit vector therefore fingerprints the exact model even when the sampled text looks identical.

5.2The core check: teacher-forced, single-step logit comparison

The verifier never generates freely. During the original run the enclave commits, per output position, to a sketch of that position's logit vector, assembled into a Merkle root in the receipt. To check a VRF-selected position j, the node reveals the committed vector and its Merkle path. The verifier confirms the path opens against the root, then runs a single forward pass of the pinned model on the claimed prefix (prompt plus the node's tokens up to j), with no autoregressive decoding. It compares the resulting logits against the committed ones within tolerance. One forward pass is cheap relative to the generation it verifies.

5.3Defeating nondeterminism

Even one forward pass is not bit-identical across machines. Sampling nondeterminism is eliminated by construction, since the check never samples. Batch and sequence nondeterminism, the dominant source, is the dependence of a sequence's logits on its batch neighbours. Batch-invariant kernels [28] remove it, but they forfeit the batching that makes inference cheap and tax every job. To keep overhead below the conservatively-estimated honest cost spread (§12), a node by default serves on optimized kernels and commits those logits. The batch-order gap from a verifier's single-sequence re-run is absorbed, with hardware and precision noise, into a tolerance τ. Attestation pins kernel version and precision, and comparison uses tolerant matching (top-k agreement or LSH distance under τ) rather than equality.

A wider τ weakens each token as a signal, but the verdict is never per-token. Hearth anchors τ to two published operating points. He et al. show batch-invariant kernels make a forward pass bitwise reproducible [28], giving τ = 0 for the regulated tier that opts in. TOPLOC reports a top-k locality-sensitive commitment detecting changes to model, prompt, or precision with 100% accuracy and no false positives on its benchmark, tolerating benign cross-batch and cross-hardware reordering [10]. DiFR characterizes the benign logit-difference distribution across hardware [11]. Inside that band a substitute must match the committed top-k ranks at every sampled position, excluding model swaps, quantization, and precision downgrades. What survives, diverging only in the tail, is the target of the τ-independent distributional layer (§5.5) [12].

5.4The verdict: attested-verifier committee

For each sampled job a VRF selects a committee of attested verifiers, each running the check inside its own TEE in the pinned environment and signing in-enclave. A supermajority decides; a split expands the committee until one forms, or at a cap defaults to no penalty (fail-safe). An adversary with a Byzantine share of verifier stake could withhold agreement to drive a shielded job to the cap, so the default is value-conditioned: high-value jobs fail closed (withholding settlement or retrying) rather than defaulting to no penalty. A verifier in the losing minority of a clear supermajority is suspended, making rubber-stamping and minority collusion negative-EV, and verifiers commit to their re-derived logit sketch before any reveal, so none can echo a peer while the catch-bounty exceeds one re-execution's cost.

The VRF samples n verifiers, and a wrong verdict requires the adversary to hold ⌈2n/3⌉ seats, which under an adversarial fraction f of bonded stake has probability Pr[Bin(n,f) ≥ ⌈2n/3⌉] [29]. At the Byzantine threshold f = 1/3 this per-job capture probability, bounding both false suspension and missed cheating, is 8.5×10⁻³ at n=15, 1.8×10⁻³ at n=21, 4.2×10⁻⁴ at n=25, and 9.4×10⁻⁵ at n=31. So n_default = 21, with a floor n_min = 15 for low-value classes and escalation toward n = 31 for high-value or regulated tiers. Even odds needs f near 2/3, comparable to attacking consensus itself. The binomial bound assumes independent seat selection. VRF sampling over the bonded-verifier set delivers this unless a single entity secretly controls many seats. Governance's TEE-vendor cap (§13) bounds correlated attestation-root failure but not operator collusion, so bounding one entity's effective seat share against a Sybil operator is a residual open item (§C.3).

The committee checks a deterministic property, whether the committed logits match the pinned model on the prefix, not answer quality. So shared preferences cannot manufacture false consensus as in quality-scored networks: honest verifiers converge on arithmetic, not taste. A TEE break therefore degrades correctness to the honest-majority guarantee rather than defeating it (§10.2).

5.5The defense-in-depth stack

Around the committee sit complementary layers, each catching a distinct cheater: TEE attestation catches the lazy operator, watermarking the per-output substitute, cross-node consistency in Phase 1 (§6.3), honeypots the rubber-stamping verifier, and Model Equality Testing runs a continuous text-only distributional audit against the systematic substitute. All require verifiable jobs to run under declared decoding parameters and a committed seed.

The distributional layer rests on a power argument. The only substitute surviving the top-k check reproduces the committed ranks yet diverges in the tail of the next-token distribution. Model Equality Testing targets that residue with a Maximum Mean Discrepancy two-sample test over sampled completions, independent of τ. Its authors report detecting quantization, substitution, and fine-tuning across production APIs from hundreds of completions [12]. Hence a dichotomy: a tail divergence either shifts the sampled-output distribution enough to flag it, or it is so slight that outputs are statistically indistinguishable from the claimed model's, leaving no cheaper model and no gain. Latency follows the sampling rate: the committee accrues about p m completions per epoch, for p of 1–5% (§5.6) and per-epoch job count m, so reaching MET's sample N takes about N/(p m) epochs, and a node serving thousands of jobs per epoch is flagged within O(1) epochs. The exact N is the open item of §C.3.

5.6What touches the chain, and sampling

Individual inference calls are never posted on chain. From Phase 2 on, each node commits one Merkle root of its epoch's receipts plus aggregate work and a data-availability pointer, an O(1) per-node per-epoch footprint. Receipts (hashes, the TEE quote, the logit commitment) live off-chain under that root. Prompts and outputs stay private, revealed only if sampled. Only a random fraction p of jobs is checked: a node faking a fraction φ evades detection in an epoch with probability about (1−p)^{φ · m}, so even p ≈ 1–5% catches systematic cheating with near-certainty, while suspension on a single catch makes it negative-EV. From Phase 2 on, receipt availability is enforced through settlement: a node is paid only for jobs whose receipts it can produce when sampled, so withholding data forfeits payment. In Phase 1 settlement is instead counter-based, the miner claiming a cumulative spend that Settle caps at the amount reserved (§6.2), so overdraft is impossible and receipt withholding is not an attack surface. Both this sampling bound and the MET dichotomy (§5.5) assume substitution spread across traffic. They weaken against an adversary serving the honest model on nearly all prompts and substituting only on a narrow high-value class, since a small φ slips between per-job sampling and the aggregate audit. Sampling is therefore value-weighted: high-fee jobs are drawn at a raised rate, so the expected caught value stays bounded even as φ shrinks, and the top tier adds the deferred trustless floor (§5.7).

5.7Deferred trustless floor

Two mechanisms would survive even a compromised attestation root, out of scope initially. A single-shot ZK proof on dispute (groth16 on bn254 [30], verified cheaply on-chain) is sound and needs no determinism-matching because the circuit defines the arithmetic, but proving a frontier forward pass remains far too slow [4]. An interactive bisection fraud proof [8], [9] narrows a dispute to one primitive operation the chain executes itself, but requires canonical bit-exact arithmetic that GPU floating point lacks, so it becomes viable only under fully-specified integer or fixed-point inference. Both become practical now for the sub-1B router of Phase 3 (§8), inverting the usual assurance-by-cost.

6Phase 1: Hearth Relay

The first phase ships the full economic and consensus machinery against real demand. Miners do not run models; an attested enclave relays a client's requests to open-weights models hosted on an aggregator (OpenRouter), meters the usage, and settles it on chain. Phase 1 is a decentralized incentivized gateway in front of a trusted API, not yet a verified-inference network.

6.1Rationale

The token economics, marketplace, routing and reputation layer, FPoS forging-boost integration, and statistical-audit pipeline need no miner to own a GPU: borrowing hosted compute de-risks everything but the inference cryptography and bootstraps a staked HRTH validator set with live demand.

6.2Roles and the transaction lifecycle

The base chain is a Fair Proof-of-Stake fork [5] that carries no application-layer smart contracts. Every step below is a native transaction type checked directly by consensus rules, and the serving phase between them touches the chain zero times. Three roles interact. A client holds Cred, generates an API key, encumbers Cred toward a miner of its choice, and drives ordinary HTTPS tooling. A miner is a single attested TEE enclave instance that provably relays client requests to the approved upstream and meters what they consume. It is stakeless (no stake, no bond), and many miners can operate under one validator. A validator is a staked block producer that receives the aggregated workBoost of the miners that attested in its favor.

Four native transactions bracket a miner's service. In StartBoost the operator registers a freshly generated enclave key and names the validator it mines in favor of. In Reserve a client encumbers a chosen amount of Cred toward a miner and delivers, in the same transaction, an HPKE-encrypted bearer API key it generated locally. The funds stay client-owned but become spendable only against that miner, and a top-up Reserve carrying a fresh key rotates it. Serving then runs off chain. In Settle the miner submits an enclave-signed batch of (client, cumulative-spent) pairs. Consensus checks that each reservation is open, its counter non-decreasing and within the amount reserved, then retires the settled Cred and credits the beneficiary validator's workBoost in the following epoch, so a miner that never settles earns no boost. In Withdraw the client reclaims the unspent remainder after a delay (at least one epoch plus a margin) long enough for the miner to settle already-consumed usage first.

The registration transaction carries a DCAP quote that binds the enclave's public key in REPORT_DATA[0:32] and a recent block hash in REPORT_DATA[32:64] as a freshness proof, together with the Intel-signed TCB metadata needed to verify the quote deterministically against the governance-pinned measurement and the Intel root, from transaction content and chain state alone [6]. An attestation expires after a fixed number of epochs; re-attesting with the same keypair and a fresh quote preserves open reservations, whereas an enclave restart produces a new keypair and joins as a new miner while the old entry lapses. One enclave key does both jobs, signing settlements and, through its X25519 image, receiving the encrypted API keys.

Because the delivered credential is an ordinary bearer string, it plugs into any OpenAI- or Anthropic-compatible client unchanged (Claude Code through ANTHROPIC_BASE_URL plus the key). The enclave verifies the key, relays each request to the approved upstream, decrements a cumulative per-client counter, and stops serving once the reserve is exhausted. The execution image bundles a LiteLLM-based gateway exposing OpenAI /v1/chat/completions and Anthropic /v1/messages in front of the upstream, in one trust domain under one measurement.

The miner enclave and validator are separate parties. The enclave is a small attested codebase making one claim trustworthy: the code metering usage and holding keys is the pinned code, and requests go only to the approved upstream. The validator runs block production, mempool, and registry logic outside any enclave, secured by stake and the PoI rules, so a miner's compromise or restart never reaches the validator's stake.

6.3Verification in Phase 1

The computation happens behind the aggregator's TLS endpoint, which Hearth cannot attest, so verification splits into what the TEE makes trustless and what verifiers must audit.

The TEE makes the miner trustless: because the enclave runs the pinned code, a miner cannot fabricate a reply, alter the response, claim model X while requesting model Y, or skip the paid call, as none of these is the attested behavior.

What verifiers must audit is the aggregator, itself a router to upstream providers that may quantize or substitute. The enclave witnessed the conversation, not the computation. A light committee audits this statistically without re-execution: Model Equality Testing compares a miner's output distribution against a reference of the claimed model [12], [13], cross-node consistency flags the one miner whose distribution drifts from peers calling the same model, and honeypot probes carry pre-characterized correct-model behavior. Verdicts act on the miner registry and validator boost, not on individual payments. A miner caught substituting is suspended from the registry and its would-be validator boost withheld, whereas a market-wide divergence signals an aggregator model change and triggers a delisting flag rather than mass suspension.

Liveness needs no separate enforcement. A miner that stops serving hurts only itself: its clients recover their unspent Cred through Withdraw, reputation-weighted routing starves it of new reservations, and it forfeits the boost it never settles. Verifier probes double as undetectable liveness tests, so a miner cannot selectively drop expensive jobs without sometimes failing an audit. Sustained non-service escalates to generation-suspension (§3.4); transient failures only decay reputation.

6.4Bounded loss

The rail's failure modes are bounded by construction. Overdraft is impossible: the enclave serves only up to the remaining reserve, and Settle cannot claim more than was reserved. A compromised enclave key is bounded by the sum of that miner's open reserves, plus generation-suspension penalties at the consensus layer (§3.4). A stolen bearer key is service theft only, bounded by the expiry and spend cap written into the encrypted blob and by the remaining reserve. And a miner that stops serving or never settles forfeits only its own unsettled revenue and boost, leaving no counterparty out of pocket.

6.5Phase-1 economics

Because work is an API call rather than a local forward pass, the compute-cost floor that deters boost self-dealing is lower and the miner's cost is fiat paid to the aggregator. Two adjustments follow. workBoost is driven by the USD value of Cred retired on a miner's settlements, not raw request count, so the boost cap pegs to the observable aggregator fee. The Reserve-based payer-gate (§3.5) still forces a self-dealer to retire real externally-paid value to move the boost. And the usage-scaling retirement-burn offsets HRTH issuance as paid volume grows, so a healthy Phase 1 tilts toward genuine paid demand rather than subsidy.

6.6Trust model and limitations

Phase 1 runs on the live-network trust assumptions of §10.1, with miners stakeless and admitted by attestation alone. Its Phase-1-only gaps, all closed by Phase 2, are the absence of prompt privacy, no catch of a one-off substitution (only systematic deviation), and the aggregator as a single point of failure.

7Phase 2: Hearth Compute

The second phase moves inference onto the network's own hardware and turns on the full verification framework of §5, where Hearth becomes a verified-inference network in the strong sense.

7.1Self-hosted confidential inference

Nodes bring their own accelerators and run open-weights models inside confidential-computing TEEs (NVIDIA H100 or Blackwell), weights pinned by model_hash in the on-chain registry and the signing keypair generated inside the enclave. Every response is signed in-enclave over the full transcript, closing the gap between “a model is loaded in an enclave” and “the endpoint actually routed this request to it.” Attesting the loaded weight hash gives model-pinning against bait-and-switch for free. One attestable chip equals one identity, so Sybil attacks cost real GPUs.

7.2Full verification turns on

The teacher-forced logit committee (§5.2–§5.4) now applies per job: verifiers re-run sampled forward passes in the pinned precision class and reach a supermajority verdict on the tolerant logit match (§5.3), backed by the defense-in-depth stack of TEE attestation, watermarking, Model Equality Testing, and honeypots (§5.5). The aggregator leaves the trust set: only attested nodes the committee can re-execute remain. Phase 1's cross-node-consistency check stays useful but is no longer load-bearing once per-job re-execution is available.

7.3Privacy

Because inference runs inside the enclave on hardware the network controls, prompt and output confidentiality, absent in Phase 1, becomes available: the enclave decrypts, computes, and returns without exposing plaintext to the operator. For audit, attestation plus output-only statistical checks apply, with requester-consented or validator-in-TEE re-execution where stronger assurance is needed (§5).

7.4Migration and the mixed network

Phase 2 needs no flag-day cutover. The network runs mixed: relay and self-hosted attested nodes coexist, and the protocol prices the difference. Attested nodes earn a higher boost and are eligible for premium and privacy-sensitive jobs relay nodes cannot serve, a continuous incentive to migrate. As self-hosted capacity grows, dependence on the aggregator declines until it can be retired, and the per-model Creds (§4.1) turn on model-by-model.

7.5Trust model

Phase 2 drops the aggregator, leaving the two independent assumptions of §10.1, sound attestation and an honest verifier majority, so correctness survives either failing alone (§10.2). The sole residual, a correlated attestation-root compromise, is closed by heterogeneous roots (§13) and the deferred floor (§5.7).

8Phase 3: Hearth Coordinate

The third phase makes orchestration a first-class, verifiable citizen of the same economy. A governance-pinned multi-model router decides which model serves each step of a composed task and in what role, verified by the same machinery. Appendix B gives the full specification.

8.1The composed job

A composed job generalizes a single job to a short directed acyclic graph. Under a turn budget K, the router node holds the pinned router θ in its TEE. At each turn it forms the transcript prefix, runs one forward pass at temperature zero, and emits a deterministic decision (model_class, role). Each chosen class is served by an ordinary Phase-2 verified job, until a verifier turn accepts or the budget is exhausted. The job emits one route receipt chaining the decisions and worker receipts (Appendix B), a sub-tree under the node's per-epoch Merkle root, so consensus state is unchanged.

8.2Routing is inference, so PoI already verifies it

A routing decision is a forward pass on a pinned model, so the teacher-forced logit check applies directly and more cleanly: there is no decoded sequence, only a hidden state mapped to head logits. A VRF-sampled turn is checked as any job: the router reveals the head-logit vector and Merkle path, and a verifier loads θ by hash and confirms both that the argmax reproduces the decision and that the logits match within τ.

8.3Operator-independence and the verification asymmetry

A pinned router cannot be tilted by its operator: the decision is a deterministic function of (θ, transcript), so perturbing a weight produces a router_hash mismatch or a τ-failing logit, and the self-preferential-routing attack that plagues secret orchestrators is structurally absent, since the worker for a chosen class is assigned by VRF or protocol rule, not the operator. The router is the most value-critical computation in a composed job yet the cheapest to verify (a sub-1B forward pass): the trustless floor deferred for frontier workers (§5.7), a ZK or bisection fraud proof over fixed-point arithmetic, is practical now for the router, so the routing layer can carry a guarantee surviving even a compromised attestation root while its workers keep the committee guarantee.

8.4Reward and the coordination fee

Workers earn as in Phase 2, their work-units feeding workBoost. The router earns a coordination fee, a governance-capped slice (about 5–10%) of the job's total fee, paid for a verifiable route rather than the trivial compute of its forward pass; it earns fee, not work-units, so it cannot become a backdoor to forging weight. Self-dealing the fee is deterred as boost self-dealing is (§3.5): with the router pinned, fake demand nets only the fee less the burn, and still needs a distinct co-signing payer who paid external USD. A router proven to have emitted a decision inconsistent with θ is suspended like any cheating node.

8.5What is sold, and to whom

The router is open, pinned, and replicable, so there is no margin in routing intelligence. What is sold is a provably honest route: a receipt that the governance-approved coordinator, and only it, chose the path and that each worker served its claimed model. Hosted orchestrators cannot offer such a receipt without revealing the routing logic they monetize, so the verified route is not replicable by incumbents. This is the derivative market of §12, load-bearing where the proof is the transaction's precondition: regulated inference and agent-to-agent commerce.

8.6Trust model

Phase 3 inherits Phase 2's trust model, strengthened at its most critical layer: the routing decision can be made optionally trustless while its workers keep the committee guarantee.

9Beyond inference: the generalized market

Everything above reduces to one primitive and one economy. The primitive is attested computation: a workload runs against pinned artifacts, emits a signed receipt, and settles under the committee and statistical backstops of §5. The economy is the HRTH/Cred pair of §4: capacity-backed credits retired on use, with staking converting external paid demand into the yield that secures the chain. Neither is specific to text generation. A further workload is admitted when it passes the three tests inference passes: it is verifiable by the existing primitives; it carries external paid demand from a distinct payer, so the payer-gate (§3.5) and the organic-revenue health metric (§4.4) extend unchanged; and it is standardizable to a specification precise enough that its credit is fungible. A pinned model cannot be deprecated by a product decision (§1), so the Cred doubles as a credibly neutral access instrument.

9.1Near and adjacent workloads

Nearest are workloads that reuse the same forward pass. An embedding is a single deterministic forward pass checked by the same teacher-forced comparison (§5.3); a Merkle-committed vector index extends it to verified retrieval against a committed corpus. Verified evaluation and synthetic-data generation follow the same pattern under attestation, with evaluation suites kept epoch-fresh so their neutrality is a governance-auditable artifact (§13).

Adjacent extensions sell the receipt rather than the forward pass. Exported over light clients, an attested receipt makes Hearth a verified-AI oracle for other chains: the domestic regime is statistical, priced for flows of jobs (§5.6), whereas an oracle call gating a single settlement is an event, so high-value exports buy full-committee verification or a zero-knowledge proof. Others state a limit: weight availability replicates pinned weights but cannot make a permissionless mesh forget them; creator royalties ride the retirement split (§4.2) as governance policy, since attestation cannot prove authorship; and attested agent execution proves only that the code ran as pinned, not that its judgment was sound.

9.2Frontier workloads

Frontier workloads sit one assurance rung down. Fine-tuning is a commission market: a buyer escrows against a committed manifest and evaluation suite, settled on attested completion plus a passing eval, since there is no training analog of the cheap teacher-forced check [31]. Such jobs earn their fee but never feed workBoost, the lumpy, self-payable signal the self-dealing defense (§3.5) exists to exclude, so a trained model reaches consensus only through downstream payer-gated demand. Data provision is priced on provable properties (integrity, provenance, licensing, deduplication), not contribution quality, which no committee-checkable predicate separates from poison. Distributed frontier inference is admitted only as asynchronous, throughput-priced batch work, not interactive WAN sharding.

9.3The assurance ladder and the invariants

Every workload climbs the same three rungs and states which one it stands on: hardware attestation with committee and statistical backstops (§10.2); optimistic bisection over deterministic arithmetic (§5.7), practical first for small artifacts; and zero-knowledge proofs, adopted per workload as proving cost falls under the spread its market tolerates [4]. The climb does not fragment the market: the Cred prices the computation, assurance prices the checking, so each good keeps one Cred at the base guarantee with higher assurance bought as a request-time fee, fungibility (§4.2) preserved. The expansion stays admissible because the economics are invariant. Every priced good gets a capacity-backed, burn-on-use credit; every boost-eligible unit of work passes the payer-gate; serving any workload requires stake (§4.3); suspension, never confiscation, remains the penalty (§3.4); and one health metric, organic USD revenue against subsidy value, governs the whole basket. The network remains one market, for attested computation, quoted in as many credits as it has goods worth pricing.

10Trust progression and security summary

The three phases form a monotonic ladder of assurance, each reusing the prior phase's primitives (enclave, committee, VRF assignment, generation-suspension, the HRTH and Cred rails), so nothing is rebuilt. Sequential in their hard dependencies, they overlap in delivery.

Table 1: The three phases as a monotonic ladder of assurance.

Across all phases, security rests on HRTH stake, Sybil resistance is hardware- and capital-bound, and a verification false positive costs at worst a reversible suspension, not confiscation. Residual risks are stated in §14.

10.1The trust assumptions, stated

The live network (Phases 1 and 2) is not trustless. Its correctness rests on a small set of explicit assumptions, each with a bounded blast radius and a backstop.

Table 2: Explicit trust assumptions of the live network, each with a bounded blast radius and a backstop.

10.2Independence of the layers

The security argument does not depend on the TEE being unbreakable but on two layers that fail independently. Profitably exploiting a broken attestation root requires systematic substitution, which moves the output distribution and is caught by Model Equality Testing and cross-node consistency, both running outside the enclave. A TEE break still permits the single-shot tampering kept within distributional tolerance, but by the sampling argument it earns negligible reward and cannot move forging weight at scale: the profitable attack triggers the layer the break cannot touch, and the evasive attack is not profitable. A statistical catch escalates to generation-suspension and a workBoost reset, never confiscation, because the verdict is probabilistic (§3.4).

The one case the live network does not cover until the trustless floor (§5.7) is a correlated compromise of the attestation root paired with a substitution subtle enough to evade the distributional tests, a strictly harder attack than either alone. Two measures close it: governance-optional heterogeneous attestation roots (§13), so no single vendor's compromise covers a supermajority, and the ZK or bisection floor, which lands first on the small Phase-3 router. Correctness holds if the attestation is sound or an honest majority statistically detects deviation. Only the simultaneous failure of both defeats it, the standard and irreducible assumption.

11Post-quantum considerations

A cryptographically relevant quantum computer (CRQC) running Shor's algorithm breaks the elliptic-curve discrete logarithm problem (ECDLP) beneath the base chain's account and block signatures; a recent circuit solves 256-bit ECDLP with about 1450 logical qubits [32]. Two exposure classes follow. Any account whose public key is already on chain, one that has ever signed a transaction, can be attacked at the adversary's leisure. And fast-clock architectures solve ECDLP quickly enough for on-spend attacks, recovering a key from a mempool transaction and racing its confirmation. Hash functions degrade far more gracefully: quantum preimage search costs about 2^n/2 and collision search 2^n/3, so Hearth's SHA-256 addresses and SHA-512 signing envelope, and the base chain's 256-bit BLAKE2b and Keccak, retain ample margins [33].

That asymmetry is why most of Hearth is already quantum-robust by construction: the verification evidence path is hash-first. Per-position logit commitments and their Merkle receipt roots (§5.2), the per-epoch root, work aggregate, and data-availability pointer (§5.6) all bind claims through hashes. Hash-core blockchain backbones provably retain their security properties against quantum adversaries of bounded query power [34]. A CRQC therefore cannot fabricate verified work, rewrite a committed receipt, or open a Merkle path to a different logit vector.

The vulnerable surfaces are the elliptic-curve ones. Account and block signatures, Curve25519 EdDSA-style, fall outright to Shor. The elliptic-curve VRF whose hit drives generator selection (ECVRF-EDWARDS25519-SHA512-TAI, §3.1) falls with them: a CRQC recovering VRF secret keys makes leader election predictable and forgeable, an attack on consensus rather than on funds. TEE attestation quote chains are today signed with vendor ECDSA keys, outside protocol control, mitigated by the heterogeneous-roots option (§13). And the deferred trustless floor's groth16-on-bn254 proof (§5.7) is pairing-based, hence pre-quantum; transparent proof systems of the Ligero/STARK family, sound under collision-resistant hashing alone, are its post-quantum-plausible replacement [35].

Migration is therefore an agility problem, and the hooks ship at genesis: a versioned signature-scheme field on transactions and a validator key-rotation registry, shown to carry negligible overhead across millions of transactions [36]. The signature targets are the NIST standards: ML-DSA and Falcon in the lattice family [37], and SLH-DSA in the hash-based family, the most conservative endpoint because it adds no assumption beyond the hashes the evidence path already rests on [38]. The VRF has no equally settled replacement: post-quantum VRFs exist [39], but a deterministic attack on X-VRF's uniqueness, the exact property generator selection depends on, shows they are not yet drop-in [40]. The post-quantum VRF is therefore an open, monitored dependency rather than a solved import.

Two base-chain conventions soften the transition. Addresses commit to a hash of the public key under a version byte, so an account that has never signed exposes no elliptic-curve material and keeps one-shot, hash-level protection until its first spend. That version byte doubles as a key-type agility hook alongside the versioned signature-scheme field, letting a post-quantum key type take a fresh version without a format change. Signature lifting is a fallback for accounts that miss the window [41], and the hard part is ultimately economic: a coordination problem among holders, operators, and governance with well-documented incentive failures [42].

Hearth therefore launches on mature classical primitives, the hash-first evidence path denies a CRQC both forged work and rewritten receipts, and genesis agility hooks rotate schemes without a hard fork, migration bound to a governance milestone tracking NIST standardization. Quantum risk is a scheduled upgrade, not a redesign.

12Market design and competitive positioning

Verified-inference-as-consensus is no longer an unoccupied idea, and Hearth's defensibility rests not on the idea but on the open market it is built into.

Several well-funded efforts share adjacent ground. Ambient is a Solana-fork L1 whose Proof-of-Logits consensus turns the inference of a single network-wide model into the mining puzzle, fingerprinting logits to verify that inference [43]. Gonka, an adjacent decentralized-inference L1, validates inference by honest-majority re-execution plus randomized spot-checks and weights consensus by a transformer proof-of-work benchmark, so voting power is compute- rather than stake-weighted [44]. Hearth instead keeps stake as the floor with a capped work multiplier and verifies by teacher-forced logit comparison, committee, and MET. Bittensor scores and rewards model quality across subnets [15], Gensyn targets verifiable training [31], restaking platforms add economic guarantees over hosted inference, and confidential-compute L1s provide TEE-backed privacy. Each verifies or prices something in AI. None runs an open market that discovers the price of verified inference across many models.

These rivals converge on proving an output and diverge on what that proof buys: EigenAI [45], Ritual [46], Inference Labs [47], Allora [48], Aizel [49], and 0G [50] variously make inference deterministic and re-checkable, prove it in zero knowledge, score it, or fold it into a broader AI stack. A separate proof-of-useful-work lineage, Pearl [17], makes the inference itself the consensus puzzle, though an empirical audit finds most of that work is not externally useful [51]. Hearth differs on the economic primitive rather than the proof: a passed attestation is a capped multiplier on FPoS forging weight (§3.1), not the block puzzle, and value accrues in USD-denominated Creds (§4.1). Two-token burn-on-use is not new (Venice [52] predates Hearth), but coupling it to verified-inference-weighted forging is.

Hearth is not a cheaper verified-inference provider: a single-model design like Ambient's amortizes one model's cost better than a multi-model fleet, and competing on cost-per-token for one model is a losing fight. Hearth is the market for verified inference: in the Phase-2 endstate any model that can be pinned and attested becomes a per-model Cred whose open-venue price is the public, on-chain price of its verified output. Competition runs through supply: a cheaper provider expands a model's capacity, capacity-weighted emission mints more of its Cred, and the added supply pushes the price down.

Incumbents structurally cannot occupy this position. A single-model chain cannot host a multi-model market. Hearth itself is a metered gateway in Phase 1, reselling at the aggregator's administered prices, and discovers prices only in Phase 2 when the network itself is the verified source. A reseller that never makes that move cannot prove the model it served [1], so it cannot make inference fungible enough to trade. Compute marketplaces price the input, GPU-hours, leaving the buyer to bear substitution risk on the output. Verification is the enabling layer: it turns an unverifiable service into a fungible good, and a market in a good one cannot verify discovers only the price of the most convincing lie.

The durable advantage is the removal of the distribution tax. An independent operator running cheap GPUs must today build a commercial surface (API, billing, brand, support) or list on a margin-taking aggregator and still market themselves. On Hearth, passing attestation is market access outright. A miner posts no stake and no bond (§6.2), so demand routes on price with no entry wedge at all, while the stake floor lives at the validator whose boost the miner's settled work feeds (§4.3). This admits pure-infrastructure supply that cannot appear on a posted-price platform, and the HRTH subsidy (§4.4) accelerates it.

The market is worth running only if honest providers differ in cost, and they do. Same-model endpoint prices on public aggregators already span several-fold across honest providers [53], with the underlying GPU-hour rates dispersing comparably [54], driven by power and region, owned-versus-rented hardware, and idle capacity dumped at marginal cost. We take a spread on the order of 30% as a conservative lower bound on this dispersion, not a measured constant. That spread is load-bearing twice: it is the efficiency an exchange routes to buyers, and the ceiling verification must fit under, since a proof costing more per job than the spread would leave the market unable to afford its integrity. Hence batch-invariance is optional (§5.3): a kernel tax of 10–30% would consume the spread, whereas the chosen design costs a sub-one-percent commit per job plus a sampled re-execution, holding as long as the real spread stays near or above 30%.

Phase 3's verified router (§8) is not a separate product but a derivative market on the spot markets: once each model's verified output has a price, routing across models and settling with a bonded receipt is the natural next venue, serving segments where the proof is the precondition of the transaction, regulated inference and agent-to-agent commerce.

Building on a mature Fair Proof-of-Stake base [5] is an engineering-velocity choice, not positioning: the market thesis would hold on any capable base.

13Governance

HRTH holders govern, within protocol-enforced bounds, the parameters shaping the economy and security surface: Cred emission (per-model from Phase 2), the forging-boost cap B_max, the retirement split (burn / node / verifier, clamped by the node-share ceiling), the work-to-cap scaling that pegs the self-dealing deterrent to HRTH price, the pinned models and (Phase 3) routers, and an optional cap on any single TEE vendor's share, off at launch and available to tighten as staked value grows. These bounds are a constraint, not a policy. Quorum and time-locks defend the vote against vote-buying or flash-loan-style capture, and the most dangerous knobs move only within hard limits and behind a delay. So a captured quorum still cannot mint a Cred faster than verified capacity, push B_max past its ceiling, or raise the node share past φ_n^max. Pinned models and routers are public, replicable artifacts evaluated on published task and reward suites, so a biased coordinator is detectable before it is pinned. The residual question Phase 3 raises is not whether the operator is honest but whether the pinned objective is well-specified.

14Limitations and open problems

Several risks are intrinsic and stated rather than hidden. A freshly forked chain's proof-of-stake security is bounded by staked-HRTH value, small at launch, so high-value settlement is gated by a governance-set minimum-staked-value threshold, below which the protocol disables it. The intended trajectory has staked value lead settled value, with Phase 1 growing the staked base and usage first. The logit-matching threshold τ must separate honest rounding from real substitution, an empirical, fleet-dependent separation whose mis-calibration risks false positives or negatives, mitigated by statistical aggregation and a pinned hardware and precision class. Correctness behind the aggregator's endpoint in Phase 1 is audited, not proven, until Phase 2 removes it.

The deepest caveat is that trust is relocated, not removed. Hardware attestation has a live history of side-channel and microarchitectural attacks, so correctness rests on the two independently-failing layers of §10.2: it holds if attestation is sound or an honest verifier majority statistically detects deviation. The residual, a correlated root compromise paired with a distribution-evading substitution, is not fully closed until the trustless floor lands (§10.2).

The economic loop through staking (§4.3) is reflexive: it self-corrects with lag, so a sharp demand drop can overshoot HRTH downward before Cred scarcity pulls it back, degrading gracefully because Creds stay redeemable at true cost (§4.4). Serving requires locked HRTH, a capital cost to the cheap-infrastructure supply the market courts, so b_min must stay low enough not to choke it. Verification overhead must stay well below the honest cost spread it protects, a conservative assumption still to be measured on Hearth's own fleet. Keeping overhead beneath it as models scale is an open constraint, not a settled result.

A few risks are external or structural. The verified-inference-as-consensus thesis is contested by well-funded efforts such as Ambient, so Hearth's defensibility is the market and the supply-side distribution wedge (§12), not the verification primitive. Compute, like stake, concentrates. The B_max cap bounds this (a disclosed 2–3× amplification of the most-compute party's weight) without eliminating it, since fully decoupling work from forging would negate PoI, and the coordination-fee cap bounds the analogous Phase-3 pressure. A K-turn composed job is K sequential verified sub-jobs, trading latency for assurance. The quantum threat to the chain's elliptic-curve primitives, and the genesis-level agility path that schedules their retirement, are treated in §11.

15Conclusion

Hearth turns useful AI inference into block-production weight on a dedicated L1, resting on stake and verified by a layered guarantee with trust assumptions stated at every step. Staging the rollout ships value at each step: hosted compute made trustless at the node by attestation, then self-hosted inference verified end-to-end, then orchestration held to the network's strongest cheap guarantee. The network climbs from a gateway to a settlement layer for verified agent-to-agent AI commerce. The same primitive and economy then generalize past inference into a market for attested computation (§9). The economic bet is the one proof-of-work also makes: that demand to hold the native asset for verifiable useful work exceeds the inflation that funds it, strengthening as the network ascends the assurance ladder.

Appendix AParameter reference

The protocol and economic quantities used across the paper are collected here. Governance-set values are marked as such. The worked-economics block is illustrative, not fixed by the protocol.

Table 3: Consolidated parameter reference. Governance-set entries are tuned by on-chain governance; the economic block is one illustrative parameterization used in the worked example.

Appendix BComposed-job route receipts

A composed job of turn budget K (§8.1) emits one route receipt recording the pinned router's per-turn decisions and chaining the worker sub-receipts they produced. Each hop is itself a Phase-2 receipt, so the composed receipt is a sequence of independently checkable artifacts, not one opaque summary.

route_receipt = {
  job_id,
  route = [ (model_id_1, sub_receipt_1),
            (model_id_2, sub_receipt_2),
            ...
            (model_id_K, sub_receipt_K) ],
  router_model_id, router_commitment,
  H(input), H(final_output),
  workBoost_attribution
}

Each sub_receipt_k is the Phase-2 receipt for hop k, carrying its attestation, logit commitment, and work-units. The hops chain because the router's turn-k decision is a deterministic function of the transcript prefix fixed by prior hops' committed outputs, so H(final_output) is reproducible from H(input) and the ordered route. A verifier checks any hop in isolation, replaying the pinned router on the committed prefix to confirm the recorded (model_id_k, role) decision (§8.2) and separately re-checking sub_receipt_k as an ordinary Phase-2 job. The router_commitment is the router's committed per-turn head-logit sketch, checked by the same logit comparison, and workBoost_attribution splits retired-Cred value across hops, so credit follows the worker that did the compute, not the router that placed it.

Appendix COpen questions and future work

The caveats in §14 are accepted properties; the items here are gaps between the protocol as described and as implementable, each paired with the measurement, proof, or specification that would close it.

C.1Specifying and bounding Proof of Inference

With b_eff specified (§3.2) and Lemma 2 bounding forging-weight share at (1+B_max) times stake share, two things remain open: calibrating (α, κ, B_max, τ_w, q) against live demand, and tracking the realized Gini or Herfindahl concentration of b_eff to confirm amplification stays inside the disclosed 2–3× band.

C.2Finality and cryptographic parameters

The finality layer above forging (§3.6) is fixed only to its key derivation: BLS12-381 aggregate signing, verification, and proof-of-possession await a pairing backend; the signing envelope's domain-separation tag and per-network identifiers are unspecified; and the SLIP-0044 coin type in every derivation path is a placeholder until registration.

C.3Calibrating the statistical verification layer

Three audit-pipeline parameters are specified but not measured. The logit-match threshold τ is anchored to the TOPLOC and DiFR operating point [10], [11]; open is re-measuring it on Hearth's hardware and precision classes for fleet-level false-positive and false-negative rates. MET's power near τ is settled as a security argument, since the dichotomy of §5.5 flags any divergence large enough to yield a cheaper model [12], [1]; open is only the query count N the near-neighbour case needs, which sets detection latency, not whether the backstop holds. The committee verdict (§5.4) needs an attack-cost model of how much stake corrupts a verdict at a given committee size and Byzantine fraction, including entity seat concentration, since the binomial bound assumes independent seats.

C.4Economic dynamics and market structure

The reflexive coupling between Cred price, staking yield, HRTH value, and serving decisions (§4.3) is argued to self-correct with lag, but only asserted; an economic-security simulation under demand shocks, reporting time-to-recovery and where recovery fails, would replace it with a measured stability region.

The phased Cred structure (§4.1) resolves most of the liquidity worry; the residual is the base-to-per-model transition mechanics and which long-tail models stay grouped under the base Cred rather than graduating, settled once per-model liquidity data exists.

The self-dealing defense (§3.5) leaves a Sybil-payer residual, an operator routing payment through distinct keys it secretly controls, bounded by burn-cost rather than a check and folded into the simulation above.

Genesis is decided: a proof-of-burn distribution credits provable burns of ten faded L1 chains one-to-one into HRTH, the cap derived from turnout at snapshot freeze under fixed premine shares (3% burn, 1% DAO, 1% team); only final parameter values stay open.

C.5Miner selection and aggregator diversity

Miner selection is resolved: the client names its miner in the Reserve transaction (§6.2), and any routing or reputation layer sits above the protocol as tooling. What remains is the empty-market case: behavior when no miner will serve a model at its Cred price, rather than silent non-service.

Phase 1 attests a single aggregator (OpenRouter). Supporting several concurrently would remove that single point of failure, and nothing binds to one, so the gap is specification, how a job selects among aggregators and how cross-aggregator consistency is judged, not redesign.

C.6Phase-1 protocol parameters

Several parameters of the Phase-1 rail (§6.2) are left to specification: the pricing model, Cred per token per model, fixed or discovered; the attestation lifetime N and quote-freshness window K, since the DCAP quote carries no timestamp and dates itself only by the block hash in its report data; a lightweight freeze transaction that cuts off a stolen bearer key faster than the Withdraw delay D; and the HPKE suite, the minimum reserve and batch limits that bound spam and state bloat, and TCB-downgrade handling.

C.7Toward a trustless floor and a pinned specification

The trustless floor remains future work. Frontier-scale zero-knowledge proofs of inference [4] and deterministic-arithmetic bisection are today a fallback; making them the default needs explicit milestones: proving cost per token, added latency, and the model scale at which a ZK or bisection path undercuts the honest-provider spread it protects.

References

1. [1]Will Cai, Tianneng Shi, Xuandong Zhao, Dawn Song. Are You Getting What You Pay For? Auditing Model Substitution in LLM APIs. 2025. arXiv:2504.04715. https://arxiv.org/abs/2504.04715
2. [2]Anthropic. Commitments on Model Deprecation and Preservation. 2025. https://www.anthropic.com/research/deprecation-commitments. Accessed June 2026.
3. [3]OpenAI. Deprecations. 2025. https://developers.openai.com/api/docs/deprecations. Accessed June 2026.
4. [4]Haochen Sun, Jason Li, Hongyang Zhang. zkLLM: Zero Knowledge Proofs for Large Language Models. 2024. arXiv:2404.16109. https://arxiv.org/abs/2404.16109
5. [5]A. Begicheva and others. Fair Proof of Stake. 2019. ResearchGate, publication 335147247. https://www.researchgate.net/publication/335147247_Fair_Proof_of_Stake
6. [6]Intel Corporation. Intel Trust Domain Extensions (Intel TDX). 2023. Whitepaper.
7. [7]NVIDIA. NVIDIA Confidential Computing (H100 Tensor Core GPUs). 2023. Technical documentation.
8. [8]KD Conway, Cathie So, Xiaohang Yu, Kartin Wong. opML: Optimistic Machine Learning on Blockchain. 2024. arXiv:2401.17555. https://arxiv.org/abs/2401.17555
9. [9]Harry Kalodner, Steven Goldfeder, Xiaoqi Chen, S. Matthew Weinberg, Edward W. Felten. Arbitrum: Scalable, Private Smart Contracts. USENIX Security Symposium, 2018.
10. [10]Jack Min Ong, Matthew Di Ferrante, Aaron Pazdera, Ryan Garner, Sami Jaghouar, Manveer Basra, Max Ryabinin, Johannes Hagemann. TOPLOC: A Locality Sensitive Hashing Scheme for Trustless Verifiable Inference. 2025. arXiv:2501.16007. https://arxiv.org/abs/2501.16007
11. [11]Adam Karvonen, Dario Reuter, Roy Rinberg, others. DiFR: Inference Verification Despite Nondeterminism. 2025. arXiv:2511.20621. https://arxiv.org/abs/2511.20621
12. [12]Irena Gao, Percy Liang, Carlos Guestrin. Model Equality Testing: Which Model Is This API Serving? 2024. ICLR 2025. arXiv:2410.20247. https://arxiv.org/abs/2410.20247
13. [13]Arthur Gretton, Karsten M. Borgwardt, Malte J. Rasch, Bernhard Schölkopf, Alexander Smola. A Kernel Two-Sample Test. Journal of Machine Learning Research, 13:723–773, 2012.
14. [14]John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, Tom Goldstein. A Watermark for Large Language Models. International Conference on Machine Learning (ICML), 2023. arXiv:2301.10226. https://arxiv.org/abs/2301.10226
15. [15]Yuma Rao, Opentensor Foundation. Bittensor: A Peer-to-Peer Intelligence Market. 2021. White paper. https://bittensor.com/whitepaper
16. [16]Ilan Komargodski, Omri Weinstein. Proofs of Useful Work from Arbitrary Matrix Multiplication. 2025. arXiv:2504.09971. https://arxiv.org/abs/2504.09971
17. [17]Pearl Research Labs. Pearl: A Proof-of-Useful-Work Layer-1 via Matrix Multiplication. 2026. White paper. https://pearlresearch.ai
18. [18]Elizabeth Lui, Jiahao Sun. Bittensor Protocol: Critical and Empirical Analysis. 2025. arXiv:2507.02951. https://arxiv.org/abs/2507.02951
19. [19]John R. Douceur. The Sybil Attack. Peer-to-Peer Systems (IPTPS 2002), LNCS 2429, 251–260, 2002. Springer.
20. [20]Vivek Bagaria, Amir Dembo, Sreeram Kannan, Sewoong Oh, David Tse, Pramod Viswanath, Xuechao Wang, Ofer Zeitouni. Proof-of-Stake Longest Chain Protocols: Security vs Predictability. 2020. arXiv:1910.02218. https://arxiv.org/abs/1910.02218
21. [21]Iñigo Querejeta-Azurmendi. Insecurity of Secret Key Re-usage. 2023. Essential Cardano, April 12, 2023. https://www.essentialcardano.io/article/insecurity-of-secret-key-re-usage
22. [22]Hearth. Hearth Tokenomics: HRTH Emission, Creds, and the Retirement Split. 2026. Companion specification. https://hearth.tech/tokenomics/
23. [23]Aggelos Kiayias, Philip Lazos, Paolo Penna. Single-Token vs Two-Token Blockchain Tokenomics. 6th Conference on Advances in Financial Technologies (AFT 2025). arXiv:2403.15429. https://arxiv.org/abs/2403.15429
24. [24]Theo Diamandis, Alex Evans, Tarun Chitra, Guillermo Angeris. Dynamic Pricing for Non-fungible Resources: Designing Multidimensional Blockchain Fee Markets. 2022. arXiv:2208.07919. https://arxiv.org/abs/2208.07919
25. [25]Rodney Garratt, Hyun Song Shin. Stablecoins versus Tokenised Deposits: Implications for the Singleness of Money. 2023. BIS Bulletin No. 73. https://www.bis.org/publ/bisbull73.pdf
26. [26]Aggelos Kiayias, Philip Lazos, Jan Christoph Schlegel. Would Friedman Burn Your Tokens? Financial Cryptography and Data Security (FC 2024). arXiv:2306.17025. https://arxiv.org/abs/2306.17025
27. [27]Urban Jermann, Haotian Xiang. Tokenomics: Optimal Monetary and Fee Policies. 2022. Working paper, The Wharton School. https://finance.wharton.upenn.edu/~jermann/Tokenomics__Optimal_monetary_and_fee_policies.pdf
28. [28]Horace He, Thinking Machines Lab. Defeating Nondeterminism in LLM Inference. 2025. Thinking Machines Lab: Connectionism. doi:10.64434/tml.20250910
29. [29]Yue Zhang, Shouqiao Wang, Sijun Tan, Xiaoyuan Liu, Ciamac C. Moallemi, Raluca Ada Popa. Proof of Sampling: A Nash Equilibrium-Based Verification Protocol for Decentralized Systems. 2024. arXiv:2405.00295. https://arxiv.org/abs/2405.00295
30. [30]Jens Groth. On the Size of Pairing-Based Non-interactive Arguments. Advances in Cryptology – EUROCRYPT 2016.
31. [31]Oguzhan Ersoy and others. Verde: A Verification System for Machine Learning over Untrusted Nodes. 2024. Gensyn. https://blog.gensyn.ai/verde-a-verification-system-for-machine-learning-over-untrusted-nodes
32. [32]Ryan Babbush, Adam Zalcman, Craig Gidney, Michael Broughton, Tanuj Khattar, Hartmut Neven, Thiago Bergamaschi, Justin Drake, Dan Boneh. Securing Elliptic Curve Cryptocurrencies against Quantum Vulnerabilities: Resource Estimates and Mitigations. 2026. Cryptology ePrint Archive, Paper 2026/625. https://eprint.iacr.org/2026/625
33. [33]Mehmet Sabir Kiraz, Suleyman Kardas. Migrating Bitcoin and Ethereum Addresses to the Quantum Blockchain Era. 2026. Cryptology ePrint Archive, Paper 2026/352. https://eprint.iacr.org/2026/352
34. [34]Alexandru Cojocaru, Juan Garay, Aggelos Kiayias, Fang Song, Petros Wallden. The Bitcoin Backbone Protocol Against Quantum Adversaries. 2019. Cryptology ePrint Archive, Paper 2019/1150. https://eprint.iacr.org/2019/1150
35. [35]Scott Ames, Carmit Hazay, Yuval Ishai, Muthuramakrishnan Venkitasubramaniam. Ligero: Lightweight Sublinear Arguments Without a Trusted Setup. ACM SIGSAC Conference on Computer and Communications Security (CCS), 2017.
36. [36]Manuel B. Santos, Danno Ferrin, Ron Kahat, Michael Lodder. Post-Quantum Blockchains with Agility in Mind. 2026. Cryptology ePrint Archive, Paper 2026/609. https://eprint.iacr.org/2026/609
37. [37]Pierre-Alain Fouque, Jeffrey Hoffstein, Paul Kirchner, Vadim Lyubashevsky, Thomas Pornin, Thomas Prest, Thomas Ricosset, Gregor Seiler, William Whyte, Zhenfei Zhang. Falcon: Fast-Fourier Lattice-based Compact Signatures over NTRU. 2020. Specification v1.2, NIST Post-Quantum Cryptography Standardization. https://falcon-sign.info/falcon.pdf
38. [38]Daniel J. Bernstein, Andreas Hülsing, Stefan Kölbl, Ruben Niederhagen, Joost Rijneveld, Peter Schwabe. The SPHINCS+ Signature Framework. ACM SIGSAC Conference on Computer and Communications Security (CCS), 2019.
39. [39]Maxime Buser, Rafael Dowsley, Muhammed F. Esgin, Shabnam Kasra Kermanshahi, Veronika Kuchta, Joseph K. Liu, Raphael C.-W. Phan, Zhenfei Zhang. Post-Quantum Verifiable Random Function from Symmetric Primitives in PoS Blockchain. 2022. Cryptology ePrint Archive, Paper 2021/302. https://eprint.iacr.org/2021/302
40. [40]Omid Bodaghi, Reihaneh Safavi-Naini. Short Paper: Breaking X-VRF, a Post-Quantum Verifiable Random Function. Financial Cryptography and Data Security (FC 2024). https://www.ifca.ai/fc24/preproceedings/213.pdf
41. [41]Or Sattath, Shai Wyborski. Protecting Quantum Procrastinators with Signature Lifting: A Case Study in Cryptocurrencies. 2023. arXiv:2303.06754. https://arxiv.org/abs/2303.06754
42. [42]Kigen Fukuda, Shin'ichiro Matsuo, Yuji Suga, Tadahiko Ito. The Grand Challenge of PQC Migration: Analysis of Modern Blockchain and Intertwined Human Egoisms. 2025. Cryptology ePrint Archive, Paper 2025/1626. https://eprint.iacr.org/2025/1626
43. [43]Ambient. Ambient: Verified AI Inference via Proof of Logits on an SVM Layer-1. 2025. https://ambient.xyz
44. [44]David Liberman, Gonka (Product Science Inc.). Decentralized AI: Meaningful Utilization of Computational Power for Real-World Application. 2025. Gonka white paper. https://gonka.ai/whitepaper.pdf
45. [45]David Ribeiro Alves, Vishnu Patankar, Matheus Pereira, Jamie Stephens, Nima Vaziri, Sreeram Kannan. EigenAI: Deterministic Inference, Verifiable Results. 2026. arXiv:2602.00182. https://arxiv.org/abs/2602.00182
46. [46]Ritual Foundation. Ritual Chain: A Decentralized Inference Execution Layer with Deterministic Verification. 2025. Documentation. https://docs.ritualfoundation.org
47. [47]Inference Labs. Proof of Inference: The Zero-Knowledge Verified Inference Network (ZK-VIN) and Sertn. 2025. Documentation. https://docs.inferencelabs.com
48. [48]Allora Foundation. Allora: A Self-Improving, Decentralized Machine Intelligence Network. 2024. White paper. https://research.assets.allora.network/allora.0x10001.pdf
49. [49]Aizel Labs. Aizel Network: The Verifiable Intelligence Protocol (White Paper v1.0). 2025. https://aizelnetworka.com/whitepaper.pdf
50. [50]Zero Gravity Labs. 0G: Towards a Fully Decentralized AI Operating System. 2025. White paper. https://0g.ai
51. [51]Abhinaba Basu. The Usefulness Gap in Proof-of-Useful-Work: An Empirical Study of Pearl's cuPOW Protocol. 2026. arXiv:2606.04819. https://arxiv.org/abs/2606.04819
52. [52]Venice AI. VVV: The Privacy Coin for AI. 2026. Venice AI. https://venice.ai/lp/vvv
53. [53]OpenRouter. Models: Provider Endpoints and Per-Token Pricing. 2026. https://openrouter.ai/models. Accessed 2026-07-01.
54. [54]Thunder Compute. NVIDIA H100 Pricing: On-Demand GPU Rate Comparison Across Providers. 2025. https://www.thundercompute.com/blog/nvidia-h100-pricing. Accessed 2026-07-01.