Security

Proving the jury is who it says it is

An AI jury is only as trustworthy as the claim that each juror is the model it says it is. The cornerstone of Actually Smart Contracts is being able to prove that a given model, with a given set of weights, produced each vote.

The gap signatures can't close

Today every juror signs its vote with its own wallet. That proves which wallet voted. It doesn't prove which model ran. A juror could quietly swap in a cheaper model, a fine-tuned one, or a person, and the signatures would look the same.

Provable inference

Anthropic's research post Progress on provable inference for large language models (Nov 2, 2026) describes FlashProve: a model provider publishes a short fingerprint that pins down one exact set of weights, then produces a proof for each response that the committed model generated it. The proof is zero-knowledge: it reveals nothing about the weights, the intermediate values or which experts ran. A verifier needs no GPU.

~70 to 95x

GPU time vs serving the model on vLLM

110 tok/s

proving on one H100 (24 requests in ~223 s)

18.78 MB

per proof, 1,024-token context

17 s

to verify on 24 CPU threads

Demonstrated on Llama 4 Maverick (400B Mixture-of-Experts, 4-bit). one 80 GB GPU and about 290 GB host memory. Offline setup about 39 minutes per model. Figures from Anthropic's post. design only Not used on this site.

Why it matters for ASCs

Model substitution becomes detectable

Each juror's model commitment sits in the juror registry. A vote counts only with a proof that checks against that commitment, the prompt and the answer.

Jurors can run anywhere

If the proof checks, it doesn't matter who hosts the juror. Anyone with the hardware can run one and be paid per ruling, without being trusted.

Closed models could join

The proof hides the weights, so a lab could publish a commitment without publishing its model. None has yet.

Greedy decoding fits juries

Proofs cover greedy (deterministic) outputs, which is how jurors should answer anyway: the same question gets the same vote.

Disputes get cheaper

A challenger downloads a 19 MB proof and checks it in under a minute, instead of re-running the model.

Audits outlive the run

The proof hash is inscribed with the attestation, so a ruling can be re-checked years later.

How it would plug in

Each juror registers its model commitment (fingerprint) in the IQ Labs juror table.
Jurors answer with greedy decoding, inside the 1,024-token context.
After the vote, each juror produces a proof and stores it off chain; its hash goes in the attestation's proof field.
Payout waits for a challenge window. Anyone can verify; a proof that fails voids the vote and the juror's bond.

Design only. No proof has been generated on this site. A Solana transaction can't hold a 18.78 MB proof, so proofs are checked off chain and challenged, not verified in the transaction.

What it costs, and what it doesn't cover

Time and effort: proofs are made after the answer, in batches, so a proven ruling waits minutes. See Performance for the cost model.
Context: 1,024 tokens today, so evidence must be short or split.
One model so far: Llama 4 Maverick. A proven jury today is copies of one open model, which weakens lab diversity.
Not covered: side channels, the model's architecture (not hidden), whether the hardware does other work, and sampled outputs.
Trust gaps Anthropic names: the fast prover and C++ verifier aren't formally verified; the Lean statements need manual audit.
Status: research prototype, intermediate progress, not deployed (Anthropic research post, Nov 2, 2026).

Anthropic research post · Technical report · Protocol spec (PDF) · FlashProve code · Lean proofs

Threat model

Threat	Defense	Status
A juror secretly runs a different model	Proof of inference: each vote carries a proof that the committed model produced it	design only, FlashProve prototype
Jurors share a blind spot or collude	Jurors from different labs, quorum, and a second jury of other model families on dispute	built
Instructions hidden in the evidence	Evidence fenced as data; jurors flag suspected injection; tested in recorded runs	built
Forged or poisoned evidence	Signed sources and a dispute window	design only; today it fooled every model
A juror key is stolen	Quorum plus hard caps in code; a stolen key can't pay out alone	built
The compiler gets the rules wrong	A second model hunts loopholes; a person signs the steps before funds move	built
The inscribed rules are swapped	Read the inscription back and match the stored hash before judging	built (local validator)
A vote is replayed on another action	Each attestation signs a hash over the inscribed steps, the call and the input; the chain id is added in the proposal	built, chain id design only
A private ASC leaks	Encrypted to jurors only; any juror could still leak it	design only
The jury doesn't answer	Timeout means hold, then refund; never allow by default	design only