Proof it thought.

A model answers, and the answer reaches you with nothing attached: not which model produced it, not what it was asked, not whether anyone could produce it again.

Whoever serves the model can say anything about it. They can swap in a cheaper model, edit a response after the fact, or claim a call was made before the outcome it predicted. The person relying on the output usually has less to go on than the engineer who served it, and nothing they can check.

A cloud chamber has the same shape of difficulty. The particle is never seen. What is seen is the line of condensation it leaves in supersaturated vapour, and from that line a physicist can say what went through. KORTX does the same for inference: it never sees the model, the prompt or the completion. It records the hashes the inference left behind, on Solana, with a bond behind them that is lost if they turn out to be false.

A provider first registers a plate: a model, its weights hash and fingerprint, and the reproduction policy it agrees to be judged by (exact bytes, canonical text, a token prefix, a logit band), with a bond behind it. Each inference served under that plate is then committed as a trace.

Four things about a trace cannot be revised once it lands: the commitment itself, signed by a bonded account at a known slot; the tier it claims, which it never inherits from a stronger one; its challenge history, whether anyone objected and how the dispute ended; and its place in the provider's record over time. That record is the part hardest to fake, because it is cumulative and adversarial.

The receipt a person is handed is the same four hashes and the seed. With a deterministic open model, that is enough to re-run the input and compare the output byte for byte without an account at the provider.

None of the three is new. What KORTX adds is that the class travels with the output, on chain, instead of sitting in a dashboard claim.

Cost: on Azure the confidential H100 size and the ordinary H100 size of the same generation list at the same 6.98 USD per hour (Linux, East US 2, retail price API, 2026-08-20). The cost is throughput, not price: three independent measurements put confidential-computing overhead on H100 between -0.13 and 21 percent, depending on model size, sequence length and serving mode. Trust reduces to the silicon vendor, its attestation service and the cloud operator's firmware.

It only works when the execution is pinned: hardware model, exact weights and quantisation, parallelism, software and kernel versions, batch size. With those pinned, 10,000 runs on two hosts produced identical hashes. Without them it fails badly: at temperature 0 the same prompt run 1,000 times produced 80 distinct outputs, and an A100 and an H100 running the same weights on the same input agree 0.0 percent of the time at the bit level. Verifier pools are therefore split by hardware architecture. Cost: the sampling rate times the inference (5 percent at p = 0.05), plus a determinism cost between 1.8 and 133 percent depending on the serving stack.

Accepted classes: linear and logistic regression, support vector machines, decision trees and tree ensembles, small convolutional networks. Measured in the framework author's own benchmark (2024-01-28): linear regression 0.118 s and 19.4 MB, SVM classification 0.318 s, tree ensemble regression 0.308 s, random forest classification 6.161 s and 383 MB. The same benchmark did not measure verification time. MobileNetV2 takes about four hours and 204 GB of RAM in a third-party benchmark. The program records a proof commitment and how much of the computation the circuit covers; it does not verify the proof on chain.

Detail per tier, the sampling detection table and the measured costs with their sources are on the tier page.

Anyone who believes a trace is false can open an incident inside its challenge window, posting a bond and the output hash they claim is correct. Bonded verifiers then re-run the input. Each one first commits a blinded hash of its result, so nobody can copy anybody else, and reveals it only after the commit phase closes.

A reveal is checked against its commitment and ruled a match or not under the plate's own policy, which is not always byte-for-byte equality: floating-point non-determinism would slash honest providers if it were. A tolerance policy is judged on the divergence verifiers report, so it is forced to a quorum of at least three.

The ruling needs a quorum of reveals (3, the floor the program enforces) and enough revealed stake. More stake behind mismatch than behind match upholds the incident; a tie goes to the provider; too few reveals or too little stake voids it. Settlement is one transaction that anyone can send, and it has to carry every verifier's record, so there is no state in which half of them have been paid.

Why a ruling is hard to capture

The first devnet program counted one vote per verifier key, and the security review reproduced what that allows: a swarm of keys filling the slots and slashing an honest provider, at a profit of a quarter of its bond. The current program closes that in three layers.

• Stake, not head count. Each reveal is weighed by the bond behind it, fixed at the moment of reveal, and the verifier share is paid by the same weight. Splitting one bond across many keys buys no extra vote and no extra reward.
• A quorum with a floor. A verdict needs at least 3 reveals under every match policy, and a minimum total revealed stake (6,000 test tokens on devnet, read 2026-10-06). Short of either, the dispute is void and nobody is slashed.
• Reserved slots. Of an incident's 7 re-run slots, 5 are held for curated verifiers. Outside keys share the other 2, so they can no longer crowd the curated set out of a dispute.

The split is burn-dominant as well, so that even a ruling captured some other way stops paying: on devnet since 2026-10-06, 30% of the provider bond is slashed and 70% of the pool is burned, and the same values are the mainnet launch profile. They are parameters the authority can change, not a fixed promise. Opening an incident can also carry a fee, escrowed with the bond: refunded if the incident is upheld, forfeited into the fee split if it is rejected or void. Fees start switched off.

Open registration, where anyone can bond a verifier, is the right end state and the wrong start. A ruling trusts its verifiers completely: the chain never re-runs the model, so even an exact policy settles on the hash a verifier reports. Someone who controls enough verifier keys can force a ruling against an honest provider, and the security review did exactly that on a local validator.

So the network opens in stages. The first is live on mainnet; the rest are planned.

• Curated at launch. Registering a verifier needs the protocol authority to co-sign. On devnet, read on 2026-10-06, 5 curated verifiers were registered with 2,000 test tokens each. The program keeps this as a single switch, so opening the network later is one transaction, not a redeploy.
• Team-operated verifiers, in public. At mainnet launch the team runs 5 verifiers and spreads a bond of 5 to 10 percent of launch supply across them. Their addresses are published when they bond, and their bonds can be slashed by the same rules as anyone's. With a quorum of 3, two of the five can be down and a dispute is still ruled.
• Independent operators admitted. Operators outside the team are added to the curated set, which is what lets the quorum rise above the team's own count.
• Open registration. The switch is turned off once there are enough known independent operators to cover the quorum with room to spare, verifier pools are separated by hardware architecture, and the burn-dominant split has been seen to keep a captured ruling unprofitable on the live network. Those conditions are judged against the live set at the time; no date is attached to them.

Samples are checked the same way. Only the first 3 checks of a trace count. A diverged sample from a verifier outside the curated set is recorded, but it neither counts against the trace nor removes its verified badge: it carries no bond liability, so any new key could otherwise deny a trace its badge for the price of rent. A real mismatch found by such a verifier goes through a bonded incident. A curated verifier's divergence still takes the badge back.

$KORTX is collateral, and it is the only currency the protocol's fees settle in. Every use of it either puts it at risk or pays for work.

Bonds

Providers bond plates, verifiers bond their votes, challengers bond their objections. A bond comes back to its owner unless a dispute goes against it; the settlement above is the only way one moves. All three are live on mainnet.

Fees, and where they go

The program carries a fee vault, kept apart from the bond vault. Fees start switched off, so a commit costs SOL for the account and the signature and nothing in $KORTX. Turning them on is a Config change by the authority, and when that happens is not set. Planned

Each fee is a fixed $KORTX amount set in Config, and each starts at zero: nothing is charged until the authority turns fees on. When the token price moves, the config authority adjusts the amounts. As a fee settles it is split 60% verifier work, 30% burn, 10% treasury, the split the economics review recommends and the program's default; a bounty splits 90% to the verifiers who did the check, 5% burned and 5% to the treasury. Fees are pooled by epoch. A verifier joins an epoch's pool only by doing slashable work in it, a matched re-execution inside a challenge window or a reveal in a dispute, and when the epoch ends it can claim a share in proportion to its bond. If nobody worked in an epoch, its verifier share is not burned: it rolls into the next epoch's pool and goes to whoever works there. Only a share that has gone unworked through more than 30 consecutive epochs, a limit the authority sets, is burned. A bond alone, with no work, earns nothing, and a verifier cannot withdraw its bond until an epoch it worked in has ended. A finite bootstrap pool can pay per completed check while fees are still small, taper as real fees grow, and end, with any remainder burned. It ships empty and switched off, and it can only hold existing tokens, never newly minted ones.

Holding

• Use. Holding 25,000 KORTX unlocks issuing a tier badge embed; 250,000 KORTX unlocks a programmatic board key. Higher usage limits, priority and fee discounts are planned on the same pattern. Only a balance is read. Looking up a trace, reading the board and re-running a receipt stay free.
• Burn. A share of every fee and of every penalty pool is burned, so supply falls as the protocol is used and as it catches things. How much is burned depends on use and on the token price; there is no fixed rate.
• Settlement currency. Fees are paid only in $KORTX, so anyone who uses the protocol has to hold some first.

At three levels of use

What the fee vault would move per day, under assumptions stated here rather than forecast: a blended fee worth $0.02 per verification event when paid, split as above. Reality depends on adoption that has not happened.

Figures are USD-equivalent at the time each fee is paid. The tokens burned for the same USD amount fall as the price rises, which is why no burn rate is stated.

A trace account is 271 bytes. Committing one locks 0.002027 SOL as a rent deposit and spends 0.000005 SOL as the signature fee, 0.002032 SOL in all. Rent was 5,080 lamports per byte on both devnet and mainnet when read on 2026-10-05, so a commit takes the same SOL on either; only what that SOL is worth differs.

The deposit is not spent, it is locked in the account, and it comes back.

• close_trace. Once a trace's window has passed with no incident and no unsettled bounty open, anyone can close it, and the whole deposit goes back to the provider who paid it. Net cost per commit falls to 0.00001 SOL, two signature fees. Nothing an incident could use is lost: closing is only possible after the window, and the commit transaction and its event stay in the ledger.
• Evidence only where it exists. Attestation and proof data live in accounts created only when the provider attaches that evidence, with attest_trace or submit_proof; a commit carries no evidence link. The first devnet program kept all of it inside every trace: 897 bytes, 0.005212 SOL per commit, with no way to close it.
• Verifier records close too. A dispute vote can be closed once the incident has settled, and a sample once its trace has closed and its liability has lapsed; the rent goes back to the verifier.

This section is not optional. A verification layer that hides its edges is worse than none.

• KORTX does not prove that a model is good. A reproducible output can still be wrong, biased or unsafe. Reproducibility is a property of the execution, not of the answer.
• It does not prove that the declared weights are the weights that ran, except where the tier says so. Hardware attestation measures the driver and the VBIOS, not the weights.
• It does not prove that a prover spent computation matching the advertised model size. Published research demonstrates a model that presents itself as twelve layers while computing six, at no extra serving cost.
• It does not prove anything about an inference that was not sampled. The sampled tier gives a probability, and the rate behind it is printed on the record.
• It does not carry a zero-knowledge proof of a full large language model forward pass. No system does today: the published ceiling is 13B parameters, 803 seconds on one A100 for one 2,048-token sequence, a 188 kB proof. A Solana transaction holds 1,232 bytes.
• It does not survive a compromise of the hardware vendor's root of trust at the attested tier.
• It does not prove what an agent did in the world, or that a committed call was right. A record that cannot be rewritten is evidence of what was said and when, not of whether it was true.
• It cannot re-run a closed model. Where a model or its inputs cannot be reproduced, the attested and sampled tiers carry what evidence there is, and the record says which.
• It cannot tell a sample that copied the public output hash from a real re-execution, when the trace was honest. A matched sample on an honest trace looks the same on chain either way, and both are paid.

What you are trusting

• The verifier set. Rulings settle on hashes verifiers report. Curated registration, reserved slots, stake-weighted rulings and a quorum floor make capture expensive; none of them makes it impossible, and while the set is curated, it is mostly the team.
• Samplers on honest traces. A paid sample that matched an honest trace may be a real re-run or a copied hash; the chain cannot tell. The first-K cap, the liability lock, slashing on an upheld incident and the curated set bound the damage. They do not prove the work was done.
• Keepers. Closing traces and records, opening fee epochs, settling bounties, burning and sweeping are permissionless calls someone has to send. If nobody does, nothing is lost, but rent stays locked and fees wait.
• The upgrade authority. Whoever holds the program's upgrade key can replace the program, and with it the vault. The security review recommends a multisig with a timelock and a published path to immutability. Until that is in place, this is a real trust assumption.
• The config authority. It can retune parameters and pause new activity. A split changed during a dispute applies to that dispute when it settles.
• The bond mint. The vault assumes the mint has no permanent delegate and no freeze authority. The program refuses such a mint at initialisation, so every Config that exists was set up with a mint that passed: on devnet, and with $KORTX on mainnet.
• Unchecked evidence. Attestation quotes and proofs are recorded, not checked, on chain. Their validity is checked off chain by whoever relies on them.
• Sampling choice. Random assignment without an on-chain random source can be gamed, so the program does not pretend to enforce it. Which traces get sampled is the verifier network's policy.

The program's accounting was reviewed against these attacks on a local validator: the vault stays equal to what the accounts claim under every verdict, a dispute cannot be settled twice or settled with a record left out, and commitments cannot be replayed across verifiers or incidents. The weak point it found was not the code but the verifier set, which is what the changes above address. A second adversarial review of the current program, with the fee vault, found no high or medium issues; what it left open is listed here, the copied-hash limit first.

Today KORTX serves the people who run models and the people who check them. The next readers are the ones who inherit an output without having served it.

• A receipt anyone can check. Ask a deterministic open model a question, get the answer with its committed trace, and let anyone re-run it and compare. This is the first consumer surface.
• Agents and the people holding them. A project whose token rests on an AI agent bonds a plate for the model behind it and commits what the agent decided, so holders read reproducibility off a public board instead of off the project's word.
• Calls committed before the outcome. An output hash committed at a known slot fixes what was said while the result was still unknown. It is tamper-evidence, never advice.
• Apps that integrate it. One SDK call commits a trace from inside a serving path; a CLI and a CI action check fingerprints and reproducibility on every change.

KORTX cannot create demand for honesty. It gives a provider who wants to prove itself the means to, and it only works when providers choose to bond and commit. A board is only as full as the providers who opted in.

• Mainnet: this site reads the program at Eag1WgBbZay94E6Z9dLfUcgGUiDZRLD8Qc9qNNK6a7NS, Anchor 0.31.1, built from an interface of 37 instructions, 11 account types and 45 events.
• Devnet: the program is also deployed at AK6GHxkh1ZJp3YYnpqMmbJiXt5Ft7z6Zu6f4KbKuRqQ3. Its devnet Config was read from the chain on 2026-10-06: registration curated, 5 curated verifiers bonded, 5 of 7 dispute slots reserved for them, fees off.
• The id Eag1WgBbZay94E6Z9dLfUcgGUiDZRLD8Qc9qNNK6a7NS first ran on devnet. That devnet deployment was closed on 2026-10-06, and records committed to it are no longer readable on chain. The same id now carries the current program on mainnet, a new deployment that inherits nothing from the closed one.
• $KORTX is issued, and mainnet bonds are posted in it. The full contract address is below.
• The SDK and CLI in the repository carry the current interface and pick the program id by cluster. Neither is published to npm yet.

Instructions, accounts, events, parameters and integration examples are in the protocol reference.