Requant research

The research path

TNet v1 was not the first design. Each candidate below was specified with the experiments that could reject it, tested, and then adopted, corrected or dropped. The order matters: every step is a reaction to what the previous one showed.

Links point to the Abacus repository at commit c826c01. Labels: measured is a recorded experiment; analytic is an argument or bound, not a measurement.

Step 1. Three candidates and their verifiers

Candidate A: a matrix product checked with Freivalds' algorithm.
Candidate B: an NTT checked with sumcheck/GKR over the Goldilocks field.
Candidate C: a multi-scalar multiplication checked with KZG commitments.
Verification cost (analytic). Freivalds checking is cheaper than recomputation by a factor of n^(ω−2); for B the advantage over recomputing the NTT is only a log n factor; C needs pairings, which are not post-quantum. Candidate A was prioritised; B and C were not developed beyond their verifiers.
Instance screening is not the threat when instances come from the header (measured). Random dense matrices were full rank; a rank-r instance would be about n/2r cheaper, which matters only if a miner could choose the instance.
The work must be priced as n^ω, not n^3 (measured). Strassen's algorithm saves 1.14× of the multiplications at n = 128 and 2.23× at n = 4096.

Sources: ADR 0002, ADR 0003, research notes.

Step 2. Candidate A: a matrix product bound to the block header

The matrices A and B are expanded from the block header; the miner computes C = A·B modulo the Goldilocks prime 2^64 − 2^32 + 1; the score is a hash of C against a target; Freivalds challenges verify C.

A single header-derived Freivalds challenge is forgeable. If the challenge r is known before C, a cheater picks any C' with C'·r = A·B·r and grinds the hash without computing the product. Fix: several Fiat–Shamir challenges derived from the committed C (ADR 0004).
A derivation bug made verification 714× the work. Re-hashing all of C for every challenge element took 62.8 s against 0.088 s for the product at n = 256. Fix: hash C once, then expand challenges from that root (ADR 0006).
The error bound is 1/P, not 1/2. With challenges uniform over the field, each one fails with probability at most 2^−63; two challenges are enough, where 128 had been planned (ADR 0009).
Review fixes. Difficulty committed in the header and derived from ancestors, chainwork counted from the required target, canonical field entries checked before hashing, median-time-past timestamps, and a sumcheck verifier that accepted prover-chosen challenges (ADR 0010).
Verification cost (measured). A complete block check at n = 256 took 19.1 ms on one thread of a Ryzen 7 8745HS, 13.1 ms of it expanding the instance with SHA-256 (verifier-throughput-v2).
GPU throughput (measured). A tiled Goldilocks kernel sustained about 175 GMAC/s on the CMP 50HX (gpu-suite-v1).

Verdict. Sound at the construction level: no screening, no reuse, forgery fixed. But the linear algebra adds cost, not security: the protection comes from deriving the instance from the header. Dense 64-bit modular arithmetic suits dedicated chips, and every block would carry C, 512 KiB at n = 256 and 8 MiB at n = 1024. Kept as a reference construction (ADR 0005, ASSESSMENT.md).

Step 3. Candidate A′: memory-hard gathered operands

Idea: gather A and B from a large per-epoch dataset, data-dependently, so that memory bandwidth rather than arithmetic becomes the bottleneck (ADR 0007).

The first estimate was wrong. It assumed tensor-core rates for 64-bit field arithmetic; with one gathered block per entry the product dominates and the memory layer is cosmetic (ADR 0008).
A linear fold is broken by prefix sums. A per-epoch prefix table answers any segment sum with two reads; the attacker was 2.2× to 53× faster in the measured configurations (ADR 0010, gpu-suite-v1).
Measured memory behaviour (CMP 50HX). Random 8–32-byte reads are limited by access rate (about 3.1 × 10^9 reads/s); warp-cooperative reads of 2560-byte segments reach 527–533 GB/s, about 98% of the sequential rate.

Verdict. A one-word gather is compute-bound. A nonlinear large-slice gather is bandwidth-bound, but then the design is an Ethash-class bandwidth proof of work with a matrix product attached, and the linear algebra is no longer what is paid for. Not pursued; no memory-hardness claim is made (ADR 0011).

Step 4. A chain prototype and a GPU miner

A test chain with committed difficulty, retargeting, greatest-work fork choice, pull synchronisation and a solo/pool job protocol (chain-prototype-v2).
End-to-end GPU mining with CPPminer on the CMP 50HX: 96 blocks in 10 s with none rejected, and a two-miner pool (cppminer-backend-v2).
Purpose: a harness for byte-for-byte parity between CUDA, Rust and Python. It had no transactions, rewards or signatures and was not a network design.

Step 5. Candidate A8: int8 matrices on tensor cores

Goldilocks arithmetic cannot use tensor cores. A8 multiplies int8 matrices exactly into int32 on tensor cores and checks the product with Freivalds over Goldilocks (ADR 0012).

Tensor cores are very fast (measured). 67.2 TMAC/s at n = 4096 and 77.7 TMAC/s at n = 8192 on the CMP 50HX with cuBLAS, exact; about 440× the Goldilocks kernel (int8-matmul-v1).
Proving each attempt costs more than the work (measured). A score that cannot be ground must bind all of C, so a succinct commitment is needed on every attempt. With the laboratory's NTT commitment it cost 19–57× the matrix product; even an ideal lower bound was 1.40× at n = 4096 (a8-proof-cost-v1).
Proving only the winner takes minutes (measured). A Plonky3 STARK of the hash of C was extrapolated at about 9 minutes at n = 4096 on an 8-thread CPU (e1-hash-proof-v1).
Sampled checks can be ground. In a non-interactive lottery a miner varies the rows that are not checked.

Verdict. Single-product A8 was stopped by its pre-set stop criterion: tensor cores make the cubic product so cheap that any per-attempt field or proof step costs as much as the product (ADR 0013).

Prior art. Pearl already deploys an int8 matrix-product proof of work whose per-tile lottery is verified by recomputing one tile (Komargodski, Schen, Weinstein, ePrint 2025/685). "GPU-optimal linear algebra as proof of work" is not new (prior-art-v1).

Side track. Interactive tensor-throughput attestation

Not a proof of work. A prover commits to the rows of fresh int8 products; a verifier opens 32 rows against a secret Freivalds vector. It certified 40–49 TMAC/s at n ≥ 8192 with 7–26 ms of online verification, and caught provers that skipped 10% of rows in every trial (ADR 0014, attest-v1). It shows the same check works when the verifier keeps the challenge secret, which a public lottery cannot.

Step 6. Candidate T: a deep requantized int8 network

Candidate T applies every lesson above:

exact integer arithmetic, so results are reproducible bit for bit;
no proof or commitment per attempt;
no free data a miner can grind;
a nonlinear step between linear layers, so the layers cannot be merged;
hashing kept to a few percent of an attempt;
tickets taken from pieces of output rows and verified by recomputing one row, as in Pearl, without noise and without any usefulness claim.

Criteria were set before the run: tensor share at least 85%, CPU verification at most about 100 ms, no cheaper ticket path, a fair lottery.

First result (measured, CMP 50HX, n = 8192, 8 layers). 87.8% of an attempt on tensor-core GEMM, 282 ns per ticket, single-row mining 42–45× more expensive per ticket, ticket counts matching expectation. All criteria met (ADR 0015, tnet-v1).

Step 7. TNet v1 frozen

Parameters fixed, the 256-byte piece added to the block so that a forged header costs its author a hash grind before it costs a node a recomputation, verification optimised to 11.5 ms on 8 threads, robustness measured and precomputation bounded, then the result repeated on an RTX 3090 (ADR 0016, tnet-v2, tnet-ampere-v1). The work function was handed to the Requant node. See how TNet works and the measurements.

A separate line: lattice proof of work (closed)

A second laboratory, Magnet, tested whether the Short Integer Solution lattice problem could serve as a proof of work. It was closed with a negative result; see negative results.