{"id":"8fe34b9a-52d6-41f5-b489-d25abca0d3b9","arxiv_id":"2512.13666","paper_version":2,"verdict":"REJECT","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"high","formal_verification":"none","parameter_count":8,"one_line_summary":"A proof-of-learning blockchain in which each miner trains a separate ML task and a block is a hash of the resulting model checkpoint is proposed.","lead":"Researchers propose a blockchain consensus protocol that uses machine-learning training as the mining puzzle, so mining electricity is not wasted on meaningless hashes. Each miner gets a different ML task, and a new block is a hash of a freshly trained model checkpoint that anyone can re-check.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Block and task verification require bit-exact SGD reproducibility, which the paper's own Footnote 1 concedes is impossible; no noise-resistant mechanism is specified, so honest blocks cannot be verified as written.","rationale":"The reader's weakest assumption correctly identifies the bit-exact reproducibility requirement as the load-bearing gap. The paper itself acknowledges the impossibility of exact reproduction, then assumes a 'noise-resistant training reproduction' mechanism without proposing one. Since all verification—both block and task—is hash-based and hashes are sensitive to every bit, the protocol cannot function as described unless such a mechanism exists. This is an internal inconsistency, not merely a divergence from current consensus: the cited reference [38] is evidence that the assumption is unsupported. The reader's verdict of REJECT is appropriate; the central practical claim of a distributed, secure, and verifiable PoL depends on an unstated and likely impossible mechanism. I find no other concern as load-bearing: the incentive analysis in Section 7, while simplified, is logically coherent, and the simulation results, though not ML-based, do speak to the stochastic block-generation process. However, the reproducibility gap alone is fatal to the protocol's correctness. Therefore I agree with the reader's verdict and recommend no change.","tokens_in":23558,"tokens_out":3403,"duration_ms":34046,"concrete_test":"Implement the proposed verification on two different hardware/software configurations (e.g., NVIDIA GPU with CUDA vs. CPU, or two different deep-learning library versions), training a small standard model (e.g., a CNN on CIFAR-10) with the same initial weights, same dataset, same shuffle seed, and same hyperparameters. Compute SHA-256 of the resulting W_s after each stage. If the hashes differ between runs—as [38] and the paper's footnote predict—the equality check in Section 4.3 fails for honest miners, refuting the protocol's central verification assumption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The protocol's central verification step, in Section 4.3 and 4.4, is the equality fH(fM^τ(W_{s-1}, σ_φ_s(D_tr))) = fH(W_s), used for both block verification by all miners and task verification by the committee. This requires every honest miner's SGD execution to produce bit-identical model weights W_s from the same W_{s-1}, shuffled data, and seed φ_s. The paper's own footnote 1 (Section 3.2) states that exact reproduction is impossible due to low-level library and hardware noise, citing [38], and then simply 'assumes noise-resistant training reproduction' without defining any mechanism. Because a cryptographic hash has an avalanche effect, even a single floating-point rounding difference changes the hash completely, so the equality check will fail for honest miners on different hardware/software stacks. This is not a performance or implementation detail: it breaks completeness (valid blocks rejected) and soundness (miners cannot agree on what a valid block is). The assumption is load-bearing for both the ML-specific PoL and the MatMul extension, and the simulations in Section 8 do not train any real model, so they provide no evidence that the required reproducibility holds.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript proposes SEDULity, a Proof-of-Learning (PoL) consensus framework in which each miner is assigned a distinct ML training task and receives a block generation opportunity (BGO) after every τ training epochs. Block validity is governed by the useful function f_U = fH(fH(fM^τ(W_{s-1}, σ_φ_s(D_tr))), fH(B_{h-1})) < T_p, and block verification consists of re-running the corresponding training stage and comparing hashes. Task verification is delegated to a randomly appointed committee of verifiers, who use probabilistic verification; a capture-the-flag (CTF) protocol is added to incentivize honest verification. The authors claim that the framework is fully distributed, secure, efficient in terms of useful work, and that rational miners are incentivized to train honestly via a sufficient penalty condition. The paper also sketches an extension to matrix multiplication and presents MATLAB simulations of system dynamics.","tokens_in":23951,"tokens_out":6335,"duration_ms":62813,"significance":"The high-level idea is timely and potentially valuable: replacing competition-based PoL with per-stage block generation opportunities on distinct tasks would address redundant training and winner-take-all security issues in earlier PoL designs. Encoding block data into the training seed is a natural way to bind proofs to the chain and prevent model theft. The formal incentive condition (Theorem 1) and the useful-work metrics (UBGR, UWR) are useful contributions if the framework is sound. However, the central block- and task-verification mechanism depends on bit-exact reproducibility of stochastic gradient descent, which the paper's own footnote (Section 3.2, Footnote 1) concedes is currently impossible and then simply assumes away without a mechanism. Because this assumption is load-bearing, the main claim of a distributed, secure, and efficient PoL framework is not currently supported.","major_comments":[{"comment":"The verification of both blocks and task proofs reduces to the equality fH(fM^τ(W_{s-1}, σ_φ_s(D_tr))) = fH(W_s). This requires every honest miner's SGD execution to produce bit-identical weights from the same W_{s-1}, shuffled data, and seed. Section 3.2, Footnote 1 states that exact reproduction is impossible due to low-level library/hardware noise, citing [38], and simply \"assumes noise-resistant training reproduction\" without specifying any mechanism. Because a cryptographic hash has an avalanche effect, any floating-point or non-deterministic GPU difference changes the hash completely, so honest miners on different hardware/software stacks would produce different fH(W_s). This breaks both completeness (valid blocks rejected) and soundness (miners cannot agree on a valid block). This is not a minor implementation detail: it invalidates the core consensus mechanism as written. The sim","section":"Section 3.2 (Footnote 1) and Sections 4.3, 4.4"},{"comment":"The unstated security theorem of the paper is that \"rewriting the history requires more than half of the total computational power.\" This is asserted without proof or a formal adversary model. In PoW, the statement follows from the independence of hash trials and a well-defined chain-growth process. Here, block generation opportunities are tied to ML training stages of arbitrary tasks: the probability of producing a block depends on task assignment, download times, stage duration τ, and the computational cost of fM, and these are not interchangeable with hash invocations. No theorem for chain growth, common prefix, liveness, or fork resolution is provided. The paper needs a formal security analysis of the longest-chain protocol under this new block generation process before the central security claim can be accepted.","section":"Section 5.1, last paragraph"},{"comment":"The incentive-security result relies entirely on Lemma 1 imported from [27], which bounds the probability q(ρ) of a dishonest prover passing verification by (1−κ+κρ)^α. The manuscript does not verify that the assumptions of this lemma hold in the SEDULity protocol, where (i) some stages are publicly verified by all miners because they generated blocks, (ii) the CTF protocol changes the verifier's strategy to a two-attempt flag-search procedure, and (iii) verification is performed by a committee of gv verifiers rather than a single verifier. The statement after Eq. (42) that committee verification is \"similar to just increasing α to gvα\" is a heuristic, not a proof. Without a formal justification, the claim that rational miners are incentivized to train fully honestly is not established.","section":"Section 7, Theorem 1 and Lemma 1"},{"comment":"The simulations do not train any ML model and do not execute the hash-based verification of Eq. (9). Block generation opportunities are \"realized by coin tosses with success probability p\" (Section 8), which models the lottery aspect but omits the actual useful function f_U, the training reproducibility assumption, and the cost of re-running fM^τ for verification. Consequently, the reported UBGR/UWR values and fork rates are derived from assumed timing parameters rather than from measurements of the proposed consensus mechanism. The simulations therefore cannot validate the feasibility of the central block/task verification procedure, nor can they compensate for the lack of a reproducibility mechanism.","section":"Section 8"}],"minor_comments":[{"comment":"Typo: \"noise-resistant training reproduction is this paper\" should read \"in this paper.\"","section":"Section 3.2, Footnote 1"},{"comment":"The phrase \"if we were to give a single opportunity for each task (τ = S)\" appears to be a notational slip: with a single stage, τ should be the total number of training epochs E, not the number of stages S.","section":"Section 5.2"},{"comment":"The last row, \"Ours\", reads \"Above limitations are overcome and decentralized\"; this should be rephrased grammatically, e.g., \"Overcomes the above limitations and is decentralized.\"","section":"Table 1"},{"comment":"Several references are to arXiv preprints (e.g., [27], [38]) that have since appeared at peer-reviewed venues; the authors may want to cite the published versions.","section":"General"}],"recommendation":"reject","confidential_remarks":"The manuscript addresses an important problem and contains an interesting non-competitive PoL design, but the central verification mechanism is contradicted by the paper's own footnote about SGD non-reproducibility. This is not a local issue: it affects both block and task verification and cannot be repaired by tweaking parameters within the current framework. The absence of a formal security proof for the core longest-chain claim and the fact that the simulations do not exercise the actual ML pipeline further support rejection. The authors could potentially salvage the work by either proposing a concrete noise-tolerant/deterministic training verification mechanism or by reframing the contribution as a PoUW framework for deterministic computations (e.g., the MatMul extension), with the ML application presented explicitly as an open problem."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: this is a real protocol proposal, not a rehash, but it has a load-bearing hole at the center. The authors build a non-competitive proof-of-learning framework where each miner trains a staged ML task, gets a block-generation opportunity per stage from a block-dependent seed, and anyone can verify a block by re-running the stage and hashing the weights. The combination is genuinely different from [27] and [39]: it avoids redundant competition, keeps verification non-interactive, and extends naturally to matrix multiplication. I'll give credit where it's due — the design is thoughtful and the incentive analysis (Section 7) is a clean derivation from the [27] lemma, even if the lemma itself is imported.\n\nThe problem is the equality check. Block verification and task verification both reduce to fH(fM^τ(W_{s−1}, σ_φ_s(D_tr))) = fH(W_s). That requires every honest miner to produce bit-identical weights from the same W_{s−1}, seed, and data. The paper's own footnote 1 says exact reproduction is impossible because of low-level noise in libraries and hardware, then simply assumes 'noise-resistant training reproduction' without proposing any mechanism. A single floating-point rounding difference changes the hash completely. So the protocol as written cannot reach consensus: honest blocks get rejected, and miners can't agree on what a valid block is. This isn't a detail; it breaks completeness and soundness, the two properties the paper sets up in Section 2. The MatMul extension avoids this because integer arithmetic is deterministic, but the core ML contribution is what needs to work.\n\nThe other soft spots are secondary. The claim that rewriting history requires more than half of total computing power is asserted, not proved. The simulations in Section 8 don't train a single model — they simulate BGOs with coin tosses and assume an ML stage takes a fixed time. So they provide no evidence for the reproducibility assumption or for the real training workload. The incentive theorem is reasonable within its model, but it inherits the verification problem: detecting a dishonest stage requires the same bit-exact re-run.\n\nWho is this for? Anyone working on PoUW/PoL will want to know this design exists, especially the per-miner task assignment and the CTF tweak. But the paper is not usable as a consensus mechanism as written. I'd send it to a serious referee — the idea deserves engagement, and a good referee could push the authors toward a real noise-handling mechanism or reposition the contribution as a design study. I wouldn't cite it as a working system.","headline":"A coherent PoL protocol design whose central verification mechanism quietly assumes away the one thing that makes it impossible – bit-exact SGD reproducibility.","tokens_in":24352,"tokens_out":2256,"would_cite":false,"duration_ms":21601,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SEDULity replaces the PoW nonce with a machine-learning training step, and claims anyone can verify a block by re-running that step.","keywords":["blockchain","consensus mechanism","proof of useful work","proof-of-learning","machine learning training","stochastic gradient descent","incentive mechanism","probabilistic verification"],"falsifier":"Run the same stochastic-gradient-descent stage twice on two different GPUs (or with different low-level library settings) and hash the resulting weights: if the hashes differ, the protocol's universal verification equation f_H(f_M^τ(W_{s-1}, σ_φ(D_tr))) = f_H(W_s) would reject an honestly trained block. This experiment can settle whether 'noise-resistant training reproduction' holds on commodity hardware.","tokens_in":23478,"feed_emoji":"🧠","tokens_out":6602,"duration_ms":57040,"temperature":0.7,"pith_summary":"This paper proposes SEDULity, a blockchain consensus that replaces the Proof-of-Work puzzle with a machine-learning training step. The central claim is that the same computation that advances an ML model can also decide who gets to append a block: a prover trains a stage of an assigned task, hashes the resulting weights together with the previous block hash, and if the hash falls below a threshold the block is valid. Because the training seed is derived from the block being built, each miner works on a different task and no solution can be stolen or reused. The framework is designed so that any node can verify a block by re-running the training stage, no committee is trusted for block validity, and a probabilistic verification plus penalty mechanism makes honest training the rational strategy. If correct, this would let blockchain infrastructure produce trained models as a by-product rather than burning energy on useless hashes.","feed_headline":"ML training becomes the proof-of-work puzzle in this blockchain","feed_subtitle":"Each miner trains a different ML task, and any node can validate a block by rerunning the training stage.","key_machinery":"The central object is the useful work function f_U defined in equation (10), which wraps a τ-epoch SGD training step inside two hash evaluations: f_U = f_H(f_H(f_M^τ(W_{s-1}, σ_{φ_s}(D_tr))), f_H(B_{h-1})). The stage training f_M^τ is the hard-to-compute useful work; the hash-to-threshold check f_U < T_p is the easy-to-verify PoW-style condition. The seed φ_s = g(f_H(B_h), s) derived from the template block is what makes each miner's task unique and prevents model theft/reuse. Verifiability is carried by the equality check f_H(f_M^τ(W_{s-1}, σ_{φ_s}(D_tr))) = f_H(W_s), which any node can perform by re-running the training stage. The capture-the-flag flags embedded in the seed give verifiers","core_discovery":"The paper's central discovery is a useful function f_U = f_H(f_H(f_M^τ(W_{s-1}, σ_{φ_s}(D_tr))), f_H(B_{h-1})) that substitutes for the PoW condition f_H(B_h) < T. In words: before a block is valid, the prover must train τ epochs of a machine-learning stage starting from previous weights and a shuffled dataset, then show that the hash of the new weights concatenated with the previous block hash is below the difficulty threshold T_p. The random seed for the epoch shuffle is derived from the template block, so the block content and the training computation are bound together; the prover cannot reuse a trained checkpoint at a different height, and an adversary who tampers with the ledger invali","pith_inferences":["If the bit-reproducibility barrier is solved, this design could be adapted to train a single shared model across the network by making each block's training task a continuation of the previous block's weights; the paper instead assigns each miner a fresh task.","The same block-derived-seed trick could be applied to other iterative computations with order-dependent intermediates, such as graph traversal or numerical solvers; whether the result remains genuinely 'useful' would need a concrete downstream use.","The simulated 86.8% useful-work ratio at p = 0.00005 is a testable target: a real deployment could measure actual energy spent on productive training versus verification and redundant training, and compare against that parameter point.","Because block validity is independent of task quality, a gap remains between 'the claimed epochs were trained' and 'the resulting model is useful'; closing that gap may require a performance or data-quality check on the final weights, which the paper leaves implicit."],"forward_implications":["If SEDULity works as claimed, blockchain consensus can produce trained machine-learning models rather than only consuming electricity, so mining power becomes reusable for downstream ML tasks.","A fork attack or history rewrite requires controlling a majority of total training power, the same security threshold as PoW, because every miner's training work contributes to consensus security.","Model theft and checkpoint reuse are prevented without trusted hardware or a trusted platform, because the training seed is derived from the block hash and stage index.","A small number of verified stages per task (α = O(1)) plus a modest penalty-to-reward ratio suffices to make full honesty the profit-maximizing strategy, per the paper's Theorem 1.","The same block-derived-randomness trick extends to other useful computations that can be made order-dependent, such as matrix multiplication, provided the computation cost outweighs the communication cost."],"fun_headline_variants":["SEDULity: ML training replaces wasteful PoW in blockchains","Mine by training: SEDULity's proof-of-learning for secure blockchains","SEDULity: Turn ML training into a blockchain's proof-of-work","Proof-of-Learning: SEDULity uses ML training for secure mining"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The whole scheme rests on the assumption that the same training step run twice produces exactly the same numbers; if hardware or library noise makes two honest miners compute slightly different model weights, their hashes will disagree and valid blocks will be rejected. The paper admits exact reproduction is currently impossible and simply assumes 'noise-resistant training reproduction'.","fun_headline_variants_meta":{"raw":{"variants":["SEDULity: ML training replaces wasteful PoW in blockchains","Mine by training: SEDULity's proof-of-learning for secure blockchains","SEDULity: Turn ML training into a blockchain's proof-of-work","Proof-of-Learning: SEDULity uses ML training for secure mining"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000614,"raw_usage":{"total_tokens":2719,"prompt_tokens":802,"completion_tokens":1917,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":546,"completion_tokens_details":{"reasoning_tokens":1842}},"tokens_in":546,"tokens_out":1917,"duration_ms":15211,"temperature":1.0,"reasoning_tokens":1842,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T16:22:30.468943+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the same stochastic-gradient-descent stage twice on two different GPUs (or with different low-level library settings) and hash the resulting weights: if the hashes differ, the protocol's universal verification equation f_H(f_M^τ(W_{s-1}, σ_φ(D_tr))) = f_H(W_s) would reject an honestly trained block. This experiment can settle whether 'noise-resistant training reproduction' holds on commodity hardware.","supporting_citations":[],"review_version":1}