Negative results

Most of the research behind Requant is a record of what does not work. These results are published in full because they constrain any design of this kind, including Requant's own future changes.

From the Abacus laboratory

1. Linear algebra does not by itself make work non-reusable. Where a matrix-product proof of work was sound, its protection against screening, decomposition and reuse came from deriving the whole instance from the block header (ASSESSMENT.md).
2. A single public Freivalds challenge is forgeable. If the challenge is known before the result, a cheater solves one linear equation instead of computing the product. Challenges must be derived from a commitment to the result (ADR 0004).
3. Verification can silently become the expensive part. A careless challenge derivation made checking 714× more expensive than computing (ADR 0006).
4. Linear folds are bypassable. A score or fold that is linear in the data can be answered from precomputed prefix sums; the attacker was 2.2–53× faster (ADR 0010). Design rule: never let a score be linear in the product.
5. Memory-hardness changes what is paid for. Making gathered operands bandwidth-bound turns the design into an Ethash-class bandwidth proof of work, where the linear algebra no longer matters (ADR 0011).
6. Tensor cores make per-attempt proofs too expensive. An exact int8 product is so cheap that a succinct commitment to it on every attempt costs 19–57× the product, and even an ideal one at least 1.4× at n = 4096 (ADR 0013).
7. Proving only the winner takes minutes. A STARK of the hash of the result was extrapolated at about 9 minutes on an 8-thread CPU at n = 4096 (e1-hash-proof-v1).
8. Sampled checks can be ground in a public lottery. A miner varies the parts that are not sampled. The same sampling is sound only when the verifier keeps its challenge secret (ADR 0012, ADR 0014).
9. Matrix-product proof of work is not new. Pearl already deploys an int8 GEMM proof of work with tile tickets verified by recomputation; TNet borrows that ticket structure (prior-art-v1).

What survived these results is TNet: exact integer layers with a nonlinear rounding step, no per-attempt proof, and verification by recomputing a single row.

From the Magnet laboratory: lattice proof of work

Magnet asked whether the Short Integer Solution problem (find a short nonzero x with A·x = 0 mod q, with A derived from the block header) could be a proof of work that is cheap to verify, costs the same for every credited result, runs well on GPUs and cannot be reused. Verification is easy: one matrix-vector product and a norm check. The other properties failed. The programme was closed with a negative result (NEGATIVE-RESULT.md, ADR 0020).

What was built: two independent exact verifiers (Python and Rust), exhaustive, meet-in-the-middle, ball and sphere enumeration solvers, exact and FLINT LLL/BKZ reduction, a CUDA checker and a toy chain, all with pre-committed falsification experiments.

Findings, at toy scale (q ≤ 257, n ≤ 4, m ≤ 16):

• Solutions are reusable. Sign changes, multiples and linear combinations of found vectors are further valid results without a fresh solve.
• A header-only score lets miners skip the work. A miner checks the cheap hash first and solves only for winning headers: the same 8 results took 8 lattice preparations instead of 40.
• A solution-bound score is fed by cheap extra vectors. Lattice sieving ends with roughly 2^(0.2075·d) short vectors, each a further score trial.
• No GPU advantage. The CPU was faster in 716 of 720 matched CPU/CUDA pairs.
• An early screening signal did not replicate. A 2.75× signal fell to 0.959× and 0.769× over 576 replication campaigns; this is not evidence of safety either.

The lesson recorded for Requant: a workable GPU proof of work needs its cost inside each independent trial, with no algebraic structure to amortise across trials. The result is not an impossibility theorem for all lattice constructions, it is toy-scale, and external review has been requested.