The Mantissa whitepaper.

Mantissa

Verified LLM Inference on a Permissionless Network of Consumer GPUs

White paper v1.1 · July 13, 2026 · mantissa.network

Abstract

Decentralized GPU networks promise to turn the world's idle consumer graphics cards into an open alternative to centralized AI infrastructure. They have all faced the same unsolved problem: you cannot trust an anonymous machine to have honestly run the model you paid for. A node can serve a smaller, cheaper model and pocket the difference; without a practical way to catch this, "decentralized inference" reduces to either blind trust or crippling overhead.

The root cause is that identical computations produce different floating-point results on different GPUs. Because an honest AMD card and an honest NVIDIA card disagree in the low bits, honest variation is indistinguishable from cheating, and every existing verification approach pays for that ambiguity through replication, tolerance bands an adversary can hide inside, or with cryptographic proof systems that cost thousands of times more than the computation itself.

We removed the root cause. Mantissa's Exact Inference Profile (XIP) makes LLM inference bit-for-bit identical across GPU vendors, validated end-to-end on real consumer hardware (NVIDIA and AMD), for three model classes: standard autoregressive transformers, diffusion language models, and mixture-of-experts models, including deterministic expert routing. The deterministic numeric patches added at most 8.2% single-stream decode cost versus the same contract-pinned baseline. With exactness, verification collapses to hash comparison: one independently assigned audit can establish an exact match or mismatch, with no voting, tolerance band, or proof-system overhead.

On this foundation we design a network where mining is useful work: nodes earn tokens by serving verified inference, work is committed as signed receipts batched into epoch rollups on an external settlement chain, disputes are resolved by deterministic re-execution, and a burn-and-mint economy ties token supply to real demand for compute. We state plainly what the network is not: it is not cheaper than centralized inference for commodity traffic, and it is not a privacy technology. Its product is provable execution: the receipt, not the token. It is aimed at the emerging class of workloads where an AI's output carries authority and must be auditable.

1. The problem: trust, not capacity

The raw capacity exists: consumer GPUs spend substantial time idle, and 8–24 GB cards can serve selected quantized open-weight models. Mature building blocks exist for peer-to-peer networking, model quantization, and local inference. What has kept "Airbnb for GPUs" from working for inference is a trust asymmetry:

The buyer of inference cannot see the hardware. The seller controls everything: which model actually loaded, at which precision, with what shortcuts. The most profitable strategy for an anonymous operator is to serve something cheaper than promised: a 4-bit quantization sold as 8-bit or a 3B model sold as an 8B. The output can still look plausible.

Any open network that pays for inference must therefore answer one question before it can pay a single token: did this specific machine really run this specific model on this specific input? Every other mechanism, including payments, reputation, staking, and scheduling, inherits its security from the quality of that answer.

2. Why existing answers fall short

Full replication. Run every job on k independent nodes and compare. Honest but ruinous: k× the cost of every request. Because of the hardware divergence described below, the comparison itself must use fuzzy tolerances that a careful adversary can hide inside.

Zero-knowledge / cryptographic proofs (zkML). Produce a cryptographic proof that the model ran correctly. Elegant, and today three to six orders of magnitude more expensive than the inference itself for billion-parameter models. Not a launch-relevant option, and unlikely to close the gap soon on consumer hardware.

Trusted execution environments (TEEs). Delegate trust to secure hardware attestation. This re-centralizes trust in a vendor's silicon and firmware supply chain, excludes today's consumer GPU install base, and has a history of attestation breaks. Useful as a future opt-in tier; unfit to be a permissionless network's foundation.

Optimistic / economic verification with fuzzy comparison. Accept results by default, spot-check statistically, slash liars. This is the right economic architecture, but it is only as strong as the spot-check. If honest hardware disagrees with honest hardware, the checker needs tolerance bands; our own measurements (Section 3) show tolerance-band verification generalizes poorly: on diverse real-world prompts, the gap between "honest different-GPU output" and "cheaper-model output" can invert. The check must be exact, or the economics leak.

Each approach pays somewhere for the same underlying fact. So we attacked the fact itself.

3. The root cause: honest GPUs disagree

Floating-point addition is not associative: (a + b) + c need not equal a + (b + c). GPU vendors, drivers, and compilers are free to reorder reductions, fuse multiply-adds, flush denormals differently, and select different fused kernels. The same model, weights, and input yield different low-order bits on different silicon. The differences compound layer by layer. Measured on our own two-vendor rig before any fixes: identical greedy decoding requests on NVIDIA-CUDA vs. NVIDIA-Vulkan vs. AMD-Vulkan diverge in log-probabilities by the third decimal place within a single forward pass, and on longer generations the divergence flips actual output tokens.

This single fact is why decentralized inference verification has been stuck: bit-equality, the only comparison an adversary cannot negotiate with, appeared unattainable across heterogeneous hardware, and to our knowledge no published system had demonstrated it for full LLM inference across GPU vendors.

4. Our result: bit-exact inference across GPU vendors

The Exact Inference Profile (XIP) is a constrained execution mode for LLM inference. It is implemented as a patched open-source inference engine under which every conforming device, regardless of vendor, produces byte-identical outputs at every token position. Three design elements carry the result (the core method is documented in a U.S. provisional filed July 10, 2026; full details are reserved for a subsequent technical paper):

1. Order-fixed integer-domain arithmetic for the operations that dominate inference (quantized matrix multiplication and accumulation), replacing order-sensitive floating-point reductions with fixed-point computations whose results are independent of execution order.
2. A deterministic math library for the nonlinear operations (softmax, normalization, rotary embeddings, activations) with pinned evaluation order and exact cross-platform conformance, verified value-by-value across vendors.
3. A deterministic dispatch policy. The subtlest failures were not in kernels but in which kernel the runtime silently selects: vendor-specific cooperative-matrix pipelines, fused attention paths, and fused expert-routing paths each reintroduced vendor-dependent arithmetic even when every individual kernel was clean. XIP pins dispatch so only conformant paths execute.

4.1 Validated, on real hardware

All results below are from a physical two-vendor rig (one NVIDIA GPU, one AMD GPU) running three backends: NVIDIA-CUDA, NVIDIA-Vulkan, and AMD-Vulkan. Raw 32-bit logits were hashed at every position.

Cheating is caught, not just theorized. In every experiment we also ran the realistic economic attack: substituting a 4-bit quantization for the promised 8-bit model. Against an honest cross-vendor ceiling of exactly zero, every substituted run diverged by wide margins (0.09 to 1.10 in score distance; in the exact-hash regime, any single differing byte suffices). Both error directions were validated: honest cross-vendor results are always accepted; substituted results are always rejected.

Cost. Determinism is not free. R5 measured the XIP numeric patches against the same contract-pinned engine and found a maximum 8.2% single-stream decode throughput loss. This is not total end-to-end overhead: compared with an unrestricted stock engine, the current profile's total decode delta was 11.7–69.9%, because contract pinning also disables divergent fast paths. Prompt-ingestion (prefill) cost was 74.5–89.2% versus the pinned baseline. These are spike measurements from exactness-first reference kernels, not production targets or a blanket end-to-end network tax. Phase 1A targets tiled and parallel grouped-8 attention, deterministic MMQ variants that preserve the pinned term structure, and safe-fast-path recovery. Every optimization must rerun the cross-vendor conformance matrix before it enters a profile.

Diffusion models required one further idea. Diffusion LLMs denoise in parallel and their generation schedule is not naturally reproducible. We verify them by re-scoring rather than re-generating: the network fixes the claimed output and deterministically re-evaluates the model over it in a teacher-forced pass. Under XIP this re-score is bit-exact cross-vendor, which extends verification to a model class many considered unverifiable in decentralized settings, and, notably, covers mixture-of-experts routing, the mechanism at the heart of frontier-scale models.

5. What exactness buys: verification by receipt

With bit-exactness, the verification problem changes shape. There is no longer a judgment call, only a hash comparison. The protocol becomes simple:

Work receipts. Every job produces a signed receipt: job ID, model hash, input commitment, output commitment, and intermediate checkpoint hashes. The receipt is a falsifiable claim: this model, this input, these exact bytes out.

Sampled audits instead of replication. Because an exact mismatch is decisive, the default path does not need to run every job k times. One executor produces the result; a risk-calibrated fraction is audited by independently selected conforming nodes. The audit re-scores the claimed output in a parallel teacher-forced pass, the same primitive as diffusion verification, rather than serially re-generating token by token. The production audit rate and cost remain per-service-tier calibration gates.

Verifiable assignment. Auditors and referees are independently assigned from a stake-anchored node registry using publicly recomputable randomness. The executor cannot select or audit itself. Replicated execution remains available for QoS, failover, capacity, and measured high-risk needs, not as the routine correctness mechanism.

The economic invariant. Before launch, every service tier must be calibrated so that stake × P(detection) > gain from cheating holds at every reputation level. A node's in-flight work is capped in proportion to its stake so exposure cannot outrun collateral. Reputation can buy priority and lower audit rates only within measured safe bounds, never security. Referee-confirmed dishonesty enters the full-stake penalty path; a single isolated mismatch is rejected and flagged without slashing, absorbing the reality of consumer-hardware silent data corruption, while a pattern of mismatches slashes.

Disputes end in re-execution, not votes. A challenged receipt escalates to independently assigned conforming referees, which re-execute the disputed work and compare exact hashes. Truth in this system is not a majority opinion; it is a reproducible computation.

6. Network architecture

Three loosely coupled layers, each replaceable behind stable interfaces:

P2P core. Rust client (memory-safe, unsafe forbidden) built on libp2p for identity, discovery, and gossip. Every node carries a three-axis passport covering compute capability, network quality, and trust, decaying over time and anchored by stake. Nodes join by passing the XIP conformance self-test: a golden-vector suite proving their hardware/driver stack reproduces the profile bit-for-bit. The inference engine is treated as an untrusted component behind a supervised process boundary; model files are validated in Rust before loading. A least-privilege, no-network operating-system sandbox remains a pre-public hardening gate.

Verification layer. The pluggable strategy interface described in Section 5 uses XIP exact-hash verification with sampled teacher-forced audits as the primary mechanism, replicated execution retained where latency hedging or failover QoS justifies it. Verification strategy is per-model-class configuration, not architecture: new model classes onboard by extending the profile, not the protocol.

Ledger and settlement. The network does not run its own blockchain. Signed receipts are batched per epoch into a Merkle rollup committed to Solana, the selected launch settlement layer, with an optimistic dispute window before finality. Inputs needed for audits are committed by hash on-chain and stored encrypted off-chain with reveal-on-audit. The epoch aggregator starts operator-run with a published progressive-decentralization schedule.

7. Token economy

A burn-and-mint loop ties token flows to real compute. The network's token is $XIP, named for the Exact Inference Profile:

• Buying inference burns. When a customer pays in $XIP, the job payment is burned at settlement. Up to 98% of equivalent value may be reissued from work authority; 2% remains permanently retired.
• Useful work mints. Work rewards are issued only against valid settled jobs and fund executors, independently assigned audits, and dispute operations. There is no emissions faucet: mining without verified demand mints nothing, which removes the dominant failure mode seen in DePIN token design: paying for presence instead of work.
• Stake gates work. Operators bond stake to accept jobs; throughput caps scale with stake (the invariant of Section 5). Audit and referee rewards come from each job's disclosed common value pool, not a separate emissions faucet.
• Published supply accounting. The design sets a 210,000,000-token maximum outstanding ceiling: 58% work-reward authority, 20% network treasury, 17% core contributors, and 5% counsel-gated launch/community authority. Burns can restore work authority except for the permanent-burn share; they do not silently create insider inventory.

This document describes mechanism design, not an offering. Actual issuance, distribution, transferability, prices, stake, audit rates, and community eligibility remain subject to legal, economic, contract, and operational gates. Nothing here is an offer to sell or a solicitation to buy any asset.

8. The honest economics: what this network is for

We modeled the unit economics before writing this paper, and we publish the unfavorable number ourselves: a verified consumer-GPU node cannot beat centralized commodity inference on price. At the 8B-class tier, verified consumer inference costs roughly 20–30× the cheapest centralized per-token price floor; the node's electricity alone exceeds that floor. Datacenter memory bandwidth, batching, and subsidized pricing are structural advantages that no peer-to-peer network abolishes. Any DePIN pitch that promises cheap commodity tokens from consumer hardware is, in our analysis, wrong.

The product is therefore not cheap inference. It is provable inference, and that market is arriving fast. Autonomous agents increasingly execute with authority: they move money, sign transactions, modify production systems, make decisions someone must answer for. Today, users often have only the API provider's word about which model processed an agent's context. Mantissa's receipt turns that claim into a verifiable fact: exactly this model, exactly this input, exactly this output, checkable by anyone, disputable on-chain. Categories where that premium is rational:

• Agentic execution with authority. Auditable trails for autonomous actions; per-step receipts for high-stakes agent pipelines.
• Regulated and contested decisions. An AI-assisted decision that may face challenge (compliance, adjudication-support, published research) can be re-verified bit-for-bit years later, by a regulator or a court, on any conforming hardware.
• Reproducible ML. Scientific and safety-critical users get identical results on conforming GPUs, and redundant execution across different vendors detects vendor-specific silicon and driver faults that homogeneous redundancy structurally cannot.

Two levers close the operating-cost gap in practice: utilization (the dominant sensitivity in our model; the demand floor and agent workloads exist to keep nodes busy) and session affinity (agent loops are prompt-heavy; pinning a session to its node and retaining its context cache converts the network's worst cost shape into its best).

9. Product and scaling path

Tier 0: launch. An OpenAI-compatible API over nodes that each serve a whole model fitting their VRAM (roughly 8B–32B-class quantized models on 12–24 GB cards; ~70B only on 48 GB-class single nodes, which shade into Tier 1). No model sharding in the serving path: single-node serving is the regime where consumer hardware is genuinely competitive and where verification is cleanest. Developers change one base URL; each response is backed by a receipt.

Tier 1: regional clusters. Small (2–3 node) metro-area clusters pool 24 GB-class cards to serve ~70B models. Within a metro, latency is negligible and the binding constraint, inter-node bandwidth × activation size, is engineering, not physics: fewer, smarter splits, compressed activation transport, and pipelined batching. Centralized 70B-class pricing is also several times higher, so the cost ratio compresses in our favor exactly where we scale.

Tier 2: research. Wide-area sharding of frontier-scale mixture-of-experts models remains a gated research track: it enters engineering only if a rigorous transport analysis survives, and its early workloads are latency-tolerant batch jobs. We publish the gate rather than the promise.

10. What we do not promise

Credibility requires stating limits as plainly as results.

• Privacy. On consumer hardware, the operating node can read the prompts it processes at compute time. No consumer-GPU network can cryptographically prevent this today, and we will not pretend otherwise. The network provides transport encryption, contractual non-retention, and user routing control (including operator allow-lists); a datacenter TEE tier is a possible future opt-in. Sensitive-data users should treat the base network accordingly.
• Performance. Section 4.1 publishes the full R5 benchmark ranges and their baselines. They are active prototype engineering constraints, not production targets. The optimization roadmap is explicit, but no performance change can weaken exactness or bypass cross-vendor conformance.
• Scope, today. The validated profile covers single-stream decoding and teacher-forced verification across the three model classes of Section 4. Batched decoding under exactness is a scoped, in-progress extension (the root cause is characterized); autoregressive mixture-of-experts models ride the same deterministic-routing mechanism validated for diffusion MoE but have not yet been explicitly certified; both are conformance-suite roadmap items, and the profile is versioned so every widening ships with its own cross-vendor evidence.
• Decentralization is progressive. Epoch aggregation and model-registry governance begin operator-run, with the decentralization schedule published rather than implied.

11. Related work

Bittensor-style networks demonstrated that markets can price machine intelligence, but their subjective, vote-based scoring cannot prove any individual result correct. zkML efforts (proof-carrying inference) target the same trust problem with cryptographic guarantees we consider the right long-term ideal and the wrong decade for consumer-scale LLMs, at 10³–10⁶× overhead. Optimistic verification frameworks and fingerprinting schemes (e.g., locality-sensitive activation hashes) established the audit-and-slash economic pattern we adopt, but rested on tolerance-band comparisons that, per our measurements, an adversary can exploit and honest hardware diversity can break. Deterministic inference has been achieved within a fixed stack (one vendor, one build, batch-invariant kernels); we are not aware of prior published work demonstrating cross-vendor bit-exact LLM inference, which is the property that makes exact verification permissionless. Mantissa's contribution is that property, plus the receipt protocol and economics built on it.

12. Status and roadmap

Proven today: cross-vendor bit-exact inference for dense autoregressive, diffusion, and diffusion-MoE models; downgrade attacks caught in every trial; a Rust job-to-receipt loop; independent sampled audits; referee dispute outcomes and epoch settlement on the project simnet; an OpenAI-compatible gateway; and a portable three-node WAN committee over the relay.

Next: finish the signed Windows operator app, diagnostics/uninstall gates, and clean-install friend cohort → complete XIP productization and profile v1 → port the chain-blind settlement seam to Solana devnet/testnet → open node onboarding and public telemetry only after the economic, legal, security, and operational launch gates pass.

13. Conclusion

Every decentralized compute network before now has had to choose between trusting strangers and paying a prohibitive verification tax, because honest hardware could not even agree with itself. We removed that premise: consumer GPUs from different vendors, running a constrained execution profile, now produce bit-identical LLM inference across autoregressive, diffusion, and mixture-of-experts models. The measured numeric- patch decode cost is single-digit relative to the pinned profile baseline; broader performance costs and optimization work are disclosed above. On that foundation, verification stops being statistics and becomes arithmetic; payment stops being trust and becomes settlement of falsifiable receipts.

The pooled VRAM of consumer GPUs is a large, fragmented compute resource. What it lacked was not capacity but accountability. We built the accountability first. Now we build the network.

v1.1, July 13, 2026. Results referenced in this paper were produced on the project's two-vendor validation rig; evidence records (per-position output hashes, sweep results, and economic model) are retained and will accompany the technical publication. This document contains forward-looking engineering plans that may change with evidence, as several already have, deliberately and on record.