M
ModelProof
Guest
How an integer-only model format, a content-hashed manifest and Arweave let anyone prove a model still does what its publisher claimed.
"Open" AI models live on mutable storage. Files get replaced, repos get deleted, and there is no cheap way to check that the model you run today is the one someone benchmarked yesterday. Even with the same file, floating-point inference differs between CPUs, GPUs and libraries, so two honest people can get different outputs and neither can prove the other wrong.
ModelProof is a small, working answer to that problem: a model format whose outputs are identical on every machine, a manifest that pins those outputs, and permanent storage on Arweave so the evidence can't quietly disappear.
1. Integer-only inference (MPW1 format). Weights are int8, biases int32, accumulation is integer, activations are ReLU, and requantization is an arithmetic right shift. No floats at inference time means the same bytes in, the same bytes out, on any platform.
2. A manifest. A JSON document that records the SHA-256 and size of the weights, the Arweave transaction holding them, the preprocessing rules, the evaluation metrics, a set of test vectors (exact input to exact output) and a digest over all outputs.
3. Permanent storage. Weights and manifest are uploaded to Arweave as ANS-104 data items through ArDrive Turbo and tagged App-Name: ModelProof, so they are discoverable and immutable.
4. Verification. Fetch the manifest, fetch the weights by transaction ID, check the hash, re-run every test vector and compare the output digest. Two independent runtimes, Python and JavaScript, have to agree.
The sample model is deliberately tiny: a 4-8-3 MLP trained on Iris. It reaches 100% holdout accuracy (30 samples) both in float and after int8 quantization, which shows the integer format costs nothing on this task. Open the web app, paste the manifest TX, and your browser downloads the weights from Arweave, checks the hash and re-runs every test vector locally. No server of ours is involved.
The Python side has no dependencies beyond the standard library. Training is deterministic, so rebuilding the model from iris.csv reproduces the published weights byte for byte.
Most "verifiable inference" proposals either re-run a model and accept small numeric drift, or reach for zero-knowledge proofs that are still expensive for real networks. Integer-only inference sits in between: it is cheap, it already powers quantized models on phones and edge devices, and it turns "close enough" into "equal or not". Once outputs are exact, a hash of them becomes a fingerprint of the model's behaviour, and that fingerprint can be stored next to the weights forever.
ModelProof was built for the HackerNoon Decentralize AI Hackathon with the help of an AI coding agent. The code, the live Arweave artifacts, and the verifier are all public; please break it and tell me what you find.
"Open" AI models live on mutable storage. Files get replaced, repos get deleted, and there is no cheap way to check that the model you run today is the one someone benchmarked yesterday. Even with the same file, floating-point inference differs between CPUs, GPUs and libraries, so two honest people can get different outputs and neither can prove the other wrong.
ModelProof is a small, working answer to that problem: a model format whose outputs are identical on every machine, a manifest that pins those outputs, and permanent storage on Arweave so the evidence can't quietly disappear.
The idea in four steps
1. Integer-only inference (MPW1 format). Weights are int8, biases int32, accumulation is integer, activations are ReLU, and requantization is an arithmetic right shift. No floats at inference time means the same bytes in, the same bytes out, on any platform.
2. A manifest. A JSON document that records the SHA-256 and size of the weights, the Arweave transaction holding them, the preprocessing rules, the evaluation metrics, a set of test vectors (exact input to exact output) and a digest over all outputs.
3. Permanent storage. Weights and manifest are uploaded to Arweave as ANS-104 data items through ArDrive Turbo and tagged App-Name: ModelProof, so they are discoverable and immutable.
4. Verification. Fetch the manifest, fetch the weights by transaction ID, check the hash, re-run every test vector and compare the output digest. Two independent runtimes, Python and JavaScript, have to agree.
What is live today
- Verifier web app, hosted on Arweave.
- Manifest TX: XCnP6FwdPqVPz5REcI7hHmBR8X75bKdOMGWXTOstbLI
- Weights TX (117 bytes): SVHIFB9pR84SAv5TYwo_JUXJuAG8h7c1lTl-wmVmHl0
- Source code (MIT)
The sample model is deliberately tiny: a 4-8-3 MLP trained on Iris. It reaches 100% holdout accuracy (30 samples) both in float and after int8 quantization, which shows the integer format costs nothing on this task. Open the web app, paste the manifest TX, and your browser downloads the weights from Arweave, checks the hash and re-runs every test vector locally. No server of ours is involved.
Try it yourself
Code:
python3 train_iris.py
python3 cli.py verify XCnP6FwdPqVPz5REcI7hHmBR8X75bKdOMGWXTOstbLI
node verify_node.js XCnP6FwdPqVPz5REcI7hHmBR8X75bKdOMGWXTOstbLI
python3 cli.py predict XCnP6FwdPqVPz5REcI7hHmBR8X75bKdOMGWXTOstbLI 6.3 3.3 6.0 2.5The Python side has no dependencies beyond the standard library. Training is deterministic, so rebuilding the model from iris.csv reproduces the published weights byte for byte.
Why integers matter for verifiable AI
Most "verifiable inference" proposals either re-run a model and accept small numeric drift, or reach for zero-knowledge proofs that are still expensive for real networks. Integer-only inference sits in between: it is cheap, it already powers quantized models on phones and edge devices, and it turns "close enough" into "equal or not". Once outputs are exact, a hash of them becomes a fingerprint of the model's behaviour, and that fingerprint can be stored next to the weights forever.
Honest limits
- The demo model is small. The format scales to bigger int8 networks, but a large model needs chunked weights with a Merkle root, which is on the roadmap.
- ModelProof proves that a model behaves as its manifest says. It does not prove the training data or the claimed metrics were honest; it only makes them permanent and checkable.
- Content addressing protects against silent replacement, not against a publisher who uploads a bad model in the first place.
Roadmap
- Chunked weights with a Merkle root for larger models.
- Verification attestations published as tagged Arweave items, so a model accumulates independent "reproduced by" proofs over time.
- Running verifiers for larger int8 models as Nosana GPU jobs.
ModelProof was built for the HackerNoon Decentralize AI Hackathon with the help of an AI coding agent. The code, the live Arweave artifacts, and the verifier are all public; please break it and tell me what you find.