Cheating must not pay: the challenge game
FLOP never re-runs inference to trust it. Every session leaves commitments that stay challengeable for a fixed window; a lottery and bonded disputes re-check slices of the work; an upheld fraud verdict burns 100% of the miner's stake. The game is sized so that cheating loses money in expectation even when most single cheats slip through.
What the miner must retain
During a session the model commits tiny fingerprints of its internal state — TOPLOC: 258 bytes per 32 tokens — and every turn becomes a co-signed leaf under a Merkle root the chain stores at settlement. Those commitments and the audit data are published to the data-availability layer and kept for the full challenge window. The miner pays the storage deposit as a cost of being paid, and providers are slashed if they fail to serve it.
- Retention lives on the DA layer under serve-or-slash — not as a promise on the miner's own disk.
- Missing audit data does not dodge the audit: an unanswerable challenge resolves against the miner.
Who can challenge, and when
Two lanes.
Scheduled. At the end of each epoch a random, unbiasable lottery selects turns to audit, drawn across the work by value, so a single huge faked turn cannot hide inside a long session.
Discretionary. The paying agent can dispute its own sessions, and any active validator can dispute any session — so a lazy or colluding payer does not switch detection off.
- The sampled check is cheap by construction: one prefill (~100x cheaper than generation) or a sub-cubic arithmetic check — never the whole session.
- A discretionary challenger posts a 100 FLOP bond, forfeited if the dispute is frivolous.
- Bisection narrows any disagreement to a single turn in a handful of rounds, so dispute cost is independent of session length.
- A challenged miner has two hours to produce the disputed turn's signed evidence — its transcript entry, Merkle proof, and enclave signature. Silence defaults to a fraud verdict.
What failing costs
An upheld fraud verdict is the full-burn class: 100% of the miner's stake slashed, ejection, blacklist — the same maximum tier as collusion and evidence forgery — and the agent's escrow is refunded.
- Liveness faults (being offline) stay cheap, 1-5%. The burn is reserved for provable fraud.
- A fraud conviction needs on-chain cryptographic evidence; there is no oracle input to bribe.
- Stake is capacity-proportional, so the largest miners face the largest absolute burn — fraud never pays off by growing.
Why the math closes
Sampling never promises to catch every cheat. It makes cheating unprofitable.
At a 2.5% audit rate a single cheated slice slips through about 97.5% of the time — and that is fine:
- The odds of escaping every audit fall off exponentially as more slices are cheated.
- Audits are spread across the work by value, so stolen value tracks the number of draws.
- The deterrence rule — slash x stake >= gain / catch-rate — is closed by the 100% burn.
Steal a small slice, risk the entire capacity-proportional stake: negative expected value at any realistic scale. The two dials, audit rate and stake size, are substitutable, and governance can raise either until honesty is the only profitable strategy.
Who pays the auditors
1% of session fees is earmarked to validators for performing audits. Re-check work is cheap — a fraction of a percent of session value at the current sampling rate — so the earmark covers it with margin, and audit income scales with usage rather than dying with the block-subsidy halvings.
Status
Draft design. The 1% audit earmark is documented now and wired later; until then auditing sits under the validators' existing 10% block-reward share, and a successful challenger recovers its bond. The ~7-day challenge window is bounded by DA retention and is under review to shorten toward hours, since audited slices re-verify in minutes. Per-turn encrypted input/output blobs — so an audit needs no live cooperation and discloses nothing in the honest case — are a designed next step.