Blindproof
Phase T — public testnet
Subnet 575 on Bittensor testnet. 24 of 24 jobs settled, lazy miner never credited, first on-chain weights.
Read the report →Evidence · status as of 5 October 2026
Every claim, with its receipt.
Each report states what was claimed, how it was tested, what happened, where to check it, and what it does not prove.
- Measured Tested, with results on this page
- Prototype Runs, but mocked or off-chain
- Designed Specified, not yet built
- Pending In progress
Milestones
Phase M — local chain
16 of 16 attack and load scenarios passed. Zero wrong settlements across about 300 jobs.
Read the report →First earned incentive
Emissions are running on 575 and the validator is staked. The first epoch with non-zero miner incentive is next.
Real model, real GPUs
A real GPU miner on the deterministic model build, then a mixed-GPU quorum agreeing on one hash on chain.
See the roadmap →Report · Phase T · v0.4.2 · Bittensor testnet
Phase T — the payment gate on a public chain
Claim
On Bittensor’s public testnet, the Blindproof validator credits miners only when their work verifies, in both the deterministic tier (two-miner hash agreement) and the proven tier (single miner plus proof check), and writes weights that reflect only verified work.
Test
One validator (UID 0) on a separate machine, making outbound calls only. Three miners (UIDs 1–3) on a single rented CPU server with public endpoints, calling a mock inference server paced at a measured 32.8 tokens/s. Two miners behave honestly. The third is lazy: it returns a cheap guess instead of running the model. The validator dispatches 12 deterministic-tier and 12 proven-tier jobs, settles each one, and then writes weights.
Result Measured
| Deterministic tier | Proven tier | |
|---|---|---|
| Jobs settled | 12 / 12 | 12 / 12 |
| Wrong settlements | 0 | 0 |
| m01 (honest) credited | 12 / 12 | 4 / 4 |
| m02 (honest) credited | 12 / 12 | 8 / 8 |
| m03 (lazy) credited | 0 / 9 | 0 / 1 — rejected as unsound |
| Median time to settle | 5.9 s | 31.6 s |
Validator weights were written at 19:33:50 EDT on 5 October 2026: FINAL SetWeights {1: 0.337, 2: 0.547} -> OK. Miner incentive in that epoch was zero because the subnet’s emission schedule had not yet been started and the validator held no stake. Both were fixed immediately after; the first non-zero incentive is Pending.
Chain references
| Event | Extrinsic |
|---|---|
| Subnet 575 created (21 Sep) | 8055866-8 |
| m01 registered, UID 1 | 8158067-5 |
| m02 registered, UID 2 | 8158071-8 |
| m03 registered, UID 3 | 8158075-6 |
| Emission schedule started | 8158453-5 |
| Validator stake τ0.1 → 178.83 α | 8158480-7 |
Addresses for every key are on the testnet record.
How to check
Open each block in the explorer and confirm the extrinsic and its signer. List current participants with btcli subnets metagraph --netuid 575 --network test. Run logs and per-job ledgers are archived and will be published with the reference validator.
What Phase T does not prove
- Real inference: miners used a mock server, not the model.
- Real proofs: proven-tier proofs were mock objects.
- Privacy: no masked execution on testnet.
- Decentralization: one team operates the validator and all miners.
- Sustained operation: one graded cycle, no fees, testnet only.
Report · Phase M · v0.4.1 · local chain
Phase M — attacks and load on a local chain
Claim
Before spending anything on a public network, the validator rejects forged or misdirected traffic, never pays a cheating miner in either tier, and keeps settling correctly under load.
Test
A full local Bittensor chain with the subnet, a validator, and miner personas scripted to cheat in specific ways. Sixteen scenarios, each run repeatedly, against a mock inference server paced at a measured 32.8 tokens/s.
Result Measured — 16 / 16 scenarios passed
| Group | What was attempted | Outcome |
|---|---|---|
| Request security | Unsigned, non-validator, wrong receiver, replayed, and tampered requests | All rejected |
| Deterministic-tier cheats | Lazy, nondeterministic, and withholding miners, each 6–11 times | Never paid |
| Proven-tier cheats | Forged, missing, late, wrong-input, and lazy proofs, each 6–11 times | Never paid |
| Proven-tier settlement | All proven jobs, with retry | 144 / 144 settled |
| Load | Sustained dispatch | 11.7 jobs/min · p50 10.6 s · p95 21.0 s |
| Realistic mix | Mixed prompt sizes and tiers | p95 57.7 s |
| Overall | About 300 jobs | 0 wrong settlements |
What Phase M does not prove
- Anything about a public network: this ran on a private local chain.
- Real inference or real proofs: both were mocked, as in Phase T.
- Resistance to colluding miners: the deterministic tier assumes the two matched miners are not colluding.
Foundation results from Paradatum
Blindproof runs on Paradatum’s deterministic execution work. These results are Paradatum’s, measured outside the subnet, and are listed here so the dependency is visible.
| Result | Status |
|---|---|
| A mid-size open-weight model (14B parameters, full BF16, lossless) produces bit-identical output across three GPU types and a CPU verifier | Measured |
| Fits on a 24 GB GPU and runs about 40% faster than a standard open-source inference engine on the same hardware | Measured |
| The deterministic build reproduces its reference output hashes on a consumer GPU, including on prompts of about 2,800 tokens | Measured |
| Per-layer proofs on that model, with the full proof chain verified in tens of milliseconds and a single changed byte detected | Measured |
| Masked computation at piece scale, including masked multiplication with two independent mask owners | Prototype |
| A full-model zero-knowledge proof of one inference | Audit in progress |
The subnet itself commits only to per-piece proofs. A full-model proof is not a subnet claim.