Hi,

You have paid a deposit on a flat at some point. Nobody followed you around afterwards checking whether you were putting holes in the walls. The money just sat there, and that was enough.

Now change two things. Make the landlord a piece of software that cannot be argued with, has no opinion about you, and takes the money the moment a rule is broken. And make that same deposit the one guaranteeing your rental car at the same time, without ever leaving the flat.

That is close to the machine sitting underneath an AI answer when the computer that produced it belongs to a stranger. Almost nobody ever checks whether the answer was computed honestly, and that is the design rather than the failure.

This week's episode walks the whole thing from the ground up: why checking the work is the one fix nobody can afford, what a permissionless crowd of watchers is for, and the newest move underneath it all, which is to stop raising the money behind the threat and borrow it from Ethereum instead.

Listen:

Spotify: https://open.spotify.com/episode/0Og97wujvVRBVsMYPjJ3Pn

Apple Podcasts: https://podcasts.apple.com/kg/podcast/plain-strata/id6783455764?i=1000780288838

YouTube: https://youtu.be/hpJ_pA3R_80

---

The full piece, no need to click through:

Somewhere in a rented data centre, a graphics card finishes a job. A question came in, a language model ran over it, an answer went back out. Total elapsed time, under a second. The person who asked reads the answer and gets on with their day.

Now ask the uncomfortable question. Did that machine actually run the model it said it would run? Or did it quietly run something a tenth of the size, produce a plausible-looking answer, pocket the difference in electricity and rent, and hope nobody noticed?

Here is the thing worth sitting with: there is no way to tell by looking. An answer from a large model and an answer from a small cheap model are both just text. They do not carry a receipt. They do not smell different. If the machine is not yours, and the model weights are not yours to inspect, and you were not standing behind it with a stopwatch, then you have no way, from the answer alone, to know what produced it.

That problem has a name in this field, and it has been the central problem for about three years. This episode is about the answer that seems to be winning, which is stranger than the obvious one.

This episode is about one thing: almost nobody ever checks whether an AI answer was computed honestly, and that is the design rather than the failure. The system works by keeping one possible check hanging over every answer, expensive enough to fail that lying stops paying. And the newest move in the field is to borrow the money behind that threat instead of raising it.

Say the simple version out loud, because it is the whole episode. The obvious fix is to check the work. The obvious fix does not scale, because checking the work means doing the work again, which doubles the cost of everything, forever. So the field went the other way. Do not check. Make it dangerous not to be checkable.

Three plain definitions, and none of them are hard.

Inference is the act of using a trained model to answer one question. Training is building the model, which takes months and enormous machines. Inference is running it once, which takes a fraction of a second. When you type into a chatbot, you are buying one inference. Almost all the money in AI, day to day, is inference money.

A decentralized inference network is a marketplace where the machines running those inferences belong to strangers. Instead of one company owning the data centre, thousands of independent operators plug in their own graphics cards and get paid per job. The appeal is obvious: more supply, lower prices, no single company holding the switch. The problem is equally obvious, and it is the scene above. You are now buying computation from someone you have never met, who is paid by the job, and who can cheat invisibly.

Verification is any scheme for making that stranger's work checkable. There are roughly three families. You can prove it mathematically, which is real, exact, and until recently far too slow. You can seal the computation inside a special locked region of a chip that even the machine's own owner cannot look into, and trust the chip maker's signature that the right code ran. Or you can do the thing this episode is about: assume everyone is honest, and build a trapdoor under anyone who is not.

That third family has a name, and the name tells you the design philosophy: optimistic verification. From the Latin optimus, best. You assume the best case. You act as if every answer is correct, immediately, with no delay and no proof, because in practice almost all of them are. And you keep a window open afterward during which anyone can challenge one, and if the challenge lands, the person who lied loses a great deal of money.

That word "optimistic" is doing honest work. It is not naive. It is a statement about where you put your effort: not on the answers, on the consequences.

Stake comes from Old English staca, a stick driven into the ground to mark a claim. To stake land was to plant a post in it and say this is mine and I stand behind it. In these networks, to stake is to lock up money as a bond that can be taken away if you cheat. The wooden post became a financial one, and the ground you drive it into is your own honesty.

Slashing is the taking-away. If the network proves you misbehaved, a portion of your locked money is destroyed or redistributed. Not a fine you might argue about later. Automatic, mechanical, enforced by the code holding the money.

Restaking, the newer word, is re, again, plus stake. It means taking money that is already locked up securing one system and additionally pledging it to secure a second, unrelated system, without pulling it out of the first. The same money does two jobs. That is the entire idea, and every interesting consequence in this episode comes out of it.

Eigen, as in EigenLayer, the company that built the restaking market, is German for "own" or "characteristic". It is the same root behind eigenvalue in mathematics, the value a transformation leaves pointing the same way. The intended sense: the characteristic security layer, the one everything else can be described in terms of.

Threshold, one more, is the sill of a doorway, the piece of wood you step over to enter a room. In cryptography a threshold scheme splits a secret into many pieces so that some minimum number of them, the threshold, can reassemble it, and any fewer cannot. Nobody ever holds the whole thing alone.

Follow one request through the machines. There are six places, and they are all real hardware in real buildings.

First, a validator set that already exists. Tens of thousands of computers around the world are already running the Ethereum network, and each has money locked up as a bond against misbehaving there. This has been true for years and has nothing to do with AI. Hold that picture: an enormous pile of collateral, already deposited, already doing a job.

Second, a smart contract that changes a promise. The owner of some of that locked money signs a statement pointing it at a second system. Physically nothing moves. Not one coin travels anywhere. What changes is a line in a program that says: this same money can now also be taken from me if I misbehave over there. A second post driven into the same ground.

Third, an operator's graphics card. A separate party runs the actual hardware that performs the inference. Their machine is pinned to a fixed configuration: a specific chip generation, a specific driver version, a specific build. That pinning matters enormously and we come back to it.

Fourth, a storage network whose only job is availability. After running the inference, the operator does not simply hand back the answer. It encrypts the full record of the request and the response, and publishes that scrambled blob to a separate network of machines whose sole purpose is guaranteeing the blob stays retrievable. The record is public. The contents are not readable.

Fifth, anyone at all. For a set period afterward, any person running the right software can point at one specific logged job and demand it be re-run. No permission, no membership, no invitation. This openness is load-bearing. A challenger set that has to be approved by someone is a challenger set that can be captured.

Sixth, a sealed region of a chip. When a challenge is triggered, enough pieces of a split decryption key are brought together inside a locked enclave to unscramble that one disputed record, and only that one. Inside the enclave, the model runs again on the same fixed configuration, and the new output is compared, byte for byte, against what the operator originally claimed.

Six locations. A pile of pre-existing collateral, a contract repointing a promise, a graphics card, a storage network, an open crowd of watchers, and a sealed chip doing the actual re-check.

The pieces arrive in a specific order, and each one exists because the previous one had a problem.

First, someone proved the optimistic idea works for AI. The hard part was never the economics. It was determinism. Run the same model twice on two different graphics cards and you can get slightly different numbers, because the chips add up long lists of decimals in different orders and the tiny rounding differences accumulate. If honest machines disagree by a hair, you cannot use disagreement as evidence of lying. Solving that, forcing bit-for-bit identical output across different hardware, is what made the whole approach possible, and it is why the operator's machine has to be pinned to a fixed configuration.

Second, the money turned out to be the bottleneck. A challenge system only works if the bond is big enough that cheating never pays. Which means every new network of this kind has to persuade a large amount of capital to lock itself up specifically for that network, before the network has proven anything. That is slow, and it caps how safe a young network can be at however much a young network can attract, which is not much.

Third, someone turned the bond itself into a rentable service. This is the restaking move, and it was not built for AI. It was built for oracles and bridges, and it existed with other tenants before anyone pointed it at inference. The pitch: stop digging your own well. Borrow a slice of an existing, enormous, already-tested pile of collateral, and pay for the slice you use. A new service launches with real security on its first day.

Fourth, pointing it at AI exposed a problem the earlier tenants never had. A price feed has nothing to hide. A person's question to a language model is frequently the most private thing in the transaction. So a design that says publish everything so anyone can re-check it destroys exactly what the customer came for. The answer is the encrypted-record trick from the physical walk above: publish the scrambled version so the record provably exists and cannot be quietly altered, and put the readable version behind a lock that opens only for a legitimate challenge, and only for the one record being challenged.

Fifth, because the output is bit-exact, the argument gets very short. Older designs in this family needed several rounds of back and forth to narrow down where two parties disagreed before anything could be judged. If the output is identical down to the last digit or it is not, there is nothing to narrow. One honest re-run, one comparison, finished.

Here is the one place we go all the way down, because it is the question a careful listener should have been forming for several minutes.

If the same pile of money is now backing ten unrelated services, does a disaster at one drain the pot for all the others?

The answer is that the money is not pooled in the loose sense. It is allocated. An operator does not put their whole balance behind every service they join. They explicitly assign a chosen portion to each one, and the rule for taking money away for service A can only ever reach the portion assigned to service A. It can never touch the portion assigned to service B. Shared infrastructure, fenced-off exposure, which is the same discipline as deciding how much of your savings goes into any one investment.

There is a second and blunter protection. Anyone wanting to pull their money out entirely has to wait roughly fourteen days, and during that wait they can still be punished for anything they did before asking to leave. That closes the obvious trick of cheat on Monday, withdraw on Tuesday. It also sets a hard boundary on everything else: the window during which a job can be challenged has to fit comfortably inside that two-week exit delay, or the whole guarantee has a hole in it where someone can outrun their own consequences.

Notice what that means for the spine. The safety of the system is not really in the checking. It is in the timing. Money cannot leave faster than doubt can arrive.

This shape has a name that recurs across the entire field, and it is worth learning once because you will then see it everywhere: cost of corruption greater than profit from corruption.

Written out: a system is secure not when cheating is impossible, but when cheating reliably costs more than it earns. You are not trying to build a wall. You are trying to make the wall not worth climbing. Every staking system, every insurance deposit, every security bond a builder posts before starting work on a house, runs on this. It shows up in optimistic systems, in reputation systems, in ordinary commercial law.

What is genuinely new here is which pocket the cost comes out of. Until now the bond was raised specifically for the service it protected, which made it easy to read: the size of the bond was a direct measure of how much people believed in that particular thing. Now the bond is a slice of a much larger reservoir, most of which was gathered for something else entirely.

Which raises a real question with no settled answer. Does sharing make the threat bigger and therefore better, since a slice of an enormous pool can still be a large number? Or does it quietly connect things that were previously unconnected, so that a shock at the reservoir, or a bad failure at one unrelated tap, becomes everyone's problem including services that did nothing wrong? Both readings are defensible right now. Anyone who tells you confidently which one is correct is ahead of the evidence.

Underneath all the machinery is an old question wearing new clothes: where should trust capital live?

The old model is the private well. Every new service digs its own. The security protecting it was raised by people who specifically believed in it, so its size is an honest signal, and if it fails, it fails alone. The weakness is that digging takes a long time and a young service is thirsty immediately.

The new model is the water main. One reservoir, built once, metered out to whoever connects. A new service gets real security on day one instead of earning it slowly. The weakness is that the town now shares its plumbing, and a problem at the reservoir is everybody's problem at once.

Neither is correct in the abstract. Dedicated versus shared is the oldest trade-off in security economics, and it has been argued over for private insurance versus mutual pools, for local banks versus correspondent banking, for national armies versus alliances. What is quietly remarkable is that a group of engineers trying to make AI answers checkable did not set out to re-derive it. They set out to solve rounding errors on graphics cards, and the question found them anyway.

Put it together. A hospital sends a question to a decentralized inference network.

The job lands on a stranger's graphics card, pinned to a fixed configuration so its output is reproducible to the last digit. The operator has money locked behind them, but that money is a slice of a much larger pile that is simultaneously securing an entirely different network, and only the assigned slice is at risk here. The operator runs the model, returns the answer in under a second, and separately publishes an encrypted record of the whole exchange to a storage network whose only job is to guarantee the record stays retrievable and unaltered.

The hospital gets its answer immediately. Nobody has checked anything. This is the optimistic part, and it is why the service is fast and affordable.

For the next stretch of time, any stranger anywhere can point at that record and demand a re-run. If someone does, enough pieces of a split key come together inside a sealed region of a chip to unscramble that one record only. The model runs again. The outputs are compared byte for byte. If they differ, the operator's assigned slice is taken from them, automatically, and the operator cannot have withdrawn it in the meantime because leaving takes two weeks and doubt travels faster than that.

Almost certainly nobody will challenge. That is fine. The point was never the checking. The point is that the operator could not know they would not be checked, and that being caught costs more than the cheating would have earned. Cost of corruption greater than profit from corruption, running quietly under a system where, on any given day, nobody checks the answer.

Two honest unknowns.

The first is the cost of a challenge as models get bigger. Re-running an entire modern model, even in a fast enclave, is not cheap, and it gets less cheap every time models grow. Older designs that narrow the argument down to a single small piece before re-running anything stay flat as models grow. This one does not. Whether that matters depends on how often real disputes actually happen, and there is not yet enough public data to say.

The second is the borrowed-security question itself. Shared collateral has not yet been through a genuine crisis with AI services attached to it. Until a real failure happens somewhere on that reservoir and we get to watch what does and does not spread, the well-versus-water-main argument stays theoretical, and everyone claiming to know the answer is guessing with confidence.

---

The two voices are AI. The research and writing are mine.

Decentralized AI, layer by layer.

Dastan