REVIEW 4 major objections 6 minor 2 cited by
Trust, but verify
T0 review · 4 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash
Pith's one-line read Answer-embedding statistics can expose which LLM a network node actually runs.
desk verdict A reproducible but narrow embedding-separation result is stretched into a system design whose detection threshold is uncalibrated for the actual cross-node comparison setting. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the embedding-space separation ratio. Each answer is mapped to a high-dimensional vector by the gte-Qwen2-1.5B-instruct embedding model; for a question $q$ and node $m$, the paper defines the internal scatter $\sigma(q,m)$ as the RMS, over embedding dimensions, of the standard deviation of the node's $n$ answers, and the cross-node distance $D(q,m,q,m')$ as the Euclidean distance between the two nodes' mean answer vectors. The discriminator is the inequality $D(q,m,q,m') > 3(\sigma(q,m)+\sigma(q,m'))$: whenever inter-node separation exceeds that multiple of internal scatter, the two configurations are statistically distinguishable. This distance-ratio criterion is what carries the entire verification scheme; the EigenLayer AVS design is the enforcement mechanism wrapped around the same statistical test.
What would settle it
Re-run the 20-question model protocol on the closest pair (Gemma-2-9b vs Gemma-2-27b) at a sampling temperature of 1.0 instead of greedy decoding; if the mean inter-model distance over the largest within-model RMS scatter drops below 3 for a substantial fraction of questions, the 3-sigma criterion fails.
Extended reading notes
Core claim
The paper's central claim is that an outside validator can tell, from repeated answers to the same question, which LLM and which knowledge base a node is running. Formally, the paper states two hypotheses: answers from two nodes with different configurations on the same question satisfy $D(q,m,q,m') > 3(\sigma(q,m)+\sigma(q,m'))$, and answers from one node to two different questions are likewise distinguishable. Experiments with Llama-3.1-8b, Gemma-2-9b, and Gemma-2-27b, and with Paris and London Wikipedia knowledge bases, confirm the separation: the smallest cross-model distance is still 32.5 times the largest within-model scatter, and cross-knowledge-base distances run from about 5 to 26 times the within-knowledge-base scatter. The authors conclude that social consensus among a mostly honest cluster can detect nodes running unauthorized or incorrect configurations.
Load-bearing premise
The load-bearing premise is that a node's answer distribution is stable and almost entirely determined by its advertised LLM and knowledge base, so any answer farther than a fixed multiple of within-node scatter marks a different configuration; this was tested on three models, two knowledge bases, and 20 hand-picked factual questions at one point in time.
Editorial extensions
If this is right
- Validators can audit a Gaia domain by polling nodes with a question set and computing embedding distances; nodes whose answers fall outside the 3-sigma criterion are flagged as outliers without any access to node internals.
- Because the separation ratios are large (32–65× for models, 5–26× for knowledge bases), a modest number of repeated questions per node per epoch is enough to keep false positives low in a mostly honest cluster.
- The AVS design adds cryptoeconomic teeth: flags accumulated over epochs lead to suspension or slashing of node stakes, while validators who repeatedly disagree with the majority are themselves suspended or slashed.
- Domain owners can rank test questions by their observed separation power and build an adaptive question set, so verification becomes stronger over time as real user questions are filtered for the ones that cluster honest nodes most tightly.
Reading between the lines
- Out-of-the-box, the threshold assumes a single honest cluster per domain; if a majority of nodes in a domain colludes to run a different model, the statistical test stays self-consistent and the only correction is market pressure from users switching domains—a failure mode the paper itself acknowledges.
- The stability of the embedding model is an unstated prerequisite: if the gte-Qwen2 embedding model is updated, all distance and scatter values shift, so a production deployment would need to recalibrate the 3-sigma criterion or freeze the embedding model across the network.
- A natural testable extension is to measure how the within-node scatter $\sigma(q,m)$ changes under quantization, temperature, hardware, and load; if any of these inflate scatter toward one-third of the inter-model distance, the scheme's false-positive rate will rise.
- One could also try to fingerprint smaller model deltas, such as fine-tuned variants of the same base model, to see whether the distance ratio remains above the threshold; the paper only distinguishes different base models and different knowledge bases.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript proposes and empirically tests a statistical method for verifying that nodes in a decentralized LLM inference network run the advertised model and knowledge base. The core idea is to ask a fixed set of questions, embed the answers with a sentence embedding model, and compare the distribution of answer embeddings across nodes; nodes whose answer profiles deviate from the majority by more than a 3-sigma threshold are flagged as running unauthorized or incorrect configurations. The authors report experiments with three open-source LLMs (Llama 3.1 8b, Gemma 2 9b, Gemma 2 27b) and two Wikipedia-derived knowledge bases, finding inter-model and inter-knowledge-base centroid distances 5-65 times larger than within-node repeat scatter. They then outline an EigenLayer AVS design with staking, slashing, and validator voting, and discuss cryptoeconomic considerations.
Significance. If the detection ratios hold in deployment, the approach would offer a practical, low-cost alternative to ZK-proofs and TEEs for verifying LLM identity in open, permissionless inference networks, with real economic consequences via slashing. The paper's strengths are its concrete, reproducible experiments (code and data are promised in an open repository), its use of real open models and knowledge bases, and its explicit acknowledgment of type I/type II errors and collusion. The empirical separation reported is large and suggestive. However, the central gap--using intra-node repeat scatter as a proxy for inter-node same-configuration scatter--means the operational claims are not yet supported. The paper is a useful proof-of-concept but does not yet establish the reliability of the proposed detection rule in its intended deployment context.
major comments (4)
- [Section 5, Eq. (8)] The separation ratios in Table 1 and the 5-26x claim in Section 5.2 use as their denominator the RMS scatter computed from 25 repeated answers of a single node instance (Eq. 7). In the AVS described in Section 7, however, the comparison is between independent peers running the same advertised LLM and knowledge base on different hardware, software stacks, and under varying load. No experiment measures between-node scatter for identical configurations, so the fixed 3-sigma threshold in Eq. (8) is uncalibrated for the operational setting. If cross-node same-config scatter approaches the smallest inter-model distance (0.0669) or the smallest inter-knowledge-base distance (0.037), the detector would generate false outliers on honest nodes or miss cheaters; Section 6 explicitly defers hardware, load, and model updates to future work. This gap is load-bearing for the paper's central claim.
- [Section 5, Hypotheses 1 and 2] Hypothesis 2 (Eq. 9) is stated as validated in Section 5 ('Our hypotheses are validated'), but the paper reports no comparison of answer distributions from the same node across different questions. Sections 5.1 and 5.2 only compare different nodes for the same question, which tests Hypothesis 1. The claimed validation of Hypothesis 2 is therefore unsupported; either add the relevant analysis (e.g., pairwise question distances per node) or remove the claim.
- [Section 5, Table 1 and Section 8] The 'reliably signal' conclusion is based solely on ratios of mean distances to within-node RMS, with no error rates, confidence intervals, or calibration of the k=3 rule. For a detection system that will impose slashing, the operator needs the false-positive and false-negative rates implied by the chosen threshold; the manuscript provides no such analysis. The large reported ratios do not by themselves establish the operational reliability of the 3-sigma criterion.
- [Section 4, Appendix A and B] The empirical basis is narrow: 20 hand-picked factual questions with known answers, 3 models, and 2 knowledge bases at a single point in time. The paper's own results show large variation across questions (inter-model distances from 0.0669 to 0.5291; inter-KB distances from 0.037 to 0.188), so the method's performance depends crucially on question selection. No selection criterion or representativeness argument is given, which limits the generalization of the claim that 'in a cluster of mostly honest nodes, we can detect nodes that run unauthorized or incorrect LLM' to real traffic.
minor comments (6)
- [Abstract vs Section 7] The abstract says the system is 'implemented as an EigenLayer AVS', but Section 7 presents a proposed design ('we propose an EigenLayer AVS design') without an implementation or evaluation; please align the wording.
- [Throughout] Please fix typographical and encoding errors, including '768 ot 1536 dimensions' (Section 2, should be 'or'), 'exmaple' (Section 8, should be 'example'), and inconsistent spacing in 'A VS'.
- [Abstract and Section 7] The acronym AVS is expanded inconsistently: 'Actively Validated Service' in the abstract and 'Actively Verified Services' in Section 7; choose one expansion and use it consistently.
- [Eq. (6)] Eq. (6) uses population standard deviation (dividing by n); with n=25 the difference from the sample standard deviation is negligible, but please state the convention explicitly.
- [Table 1] Table 1's ratio uses the maximum RMS across all models (0.0062) rather than the per-pair sum of RMS used in Eq. (8); the minimum inter-model distance (0.0669) corresponds to a ratio of about 10.8, not 32.5x. Report both the average and the minimum ratio for clarity.
- [Section 5.2] The sentence 'the distances between knowledge base pairs (average 0.0862) are about 5-26 times larger than the RMS scatter observed within a knowledge base (0.0072)' is technically correct, but specifying the per-question minimum and maximum ratios would be more informative.
Circularity Check
No circular derivation: the core claims are tested against externally labeled models and knowledge bases, and the acknowledged consensus limitations are not hidden reductions.
full rationale
The derivation is self-contained. Hypotheses 1 and 2 (Eqs. 8 and 9) are empirical separability claims, and the paper tests them on known, externally identifiable configurations: Llama 3.1 8b and Gemma 2 9b/27b for models, and Wikipedia-derived Paris and London knowledge bases for knowledge-base variation. The reported 32–65x and 5–26x ratios are computed from measured inter-cluster distances divided by measured within-node scatter; no parameter is fitted to the validation data and then relabeled as a prediction. The 3-sigma factor in Eq. (8) is a fixed prior threshold, not a constant derived from the same data. The main weaknesses—intra-node repeat scatter may not equal inter-node same-configuration scatter under differing hardware, load, or quantization, and a colluding majority can shift the consensus ground truth—are experimental-calibration and governance limitations that the paper explicitly acknowledges in Sections 6 and 8. They are not definitional substitutions of the target property: the experiments independently show that known different configurations produce separable clusters. No load-bearing step reduces to a self-citation; the Gaia and EigenLayer references and the GitHub repository are supporting materials, and the data are offered for external reproduction. Therefore no circular step can be exhibited.
Assumptions & free parameters
free parameters (3)
- Separation threshold k=3 in Hypothesis 1 (Eq. 8) =
3 (chosen by hand)
- Slow-node threshold of 3 standard deviations =
3 (chosen by hand)
- Repetition count n=25 =
25 (chosen by hand)
assumptions (5)
- domain assumption Same-configuration nodes produce tightly clustered answer embeddings for a fixed question.
- domain assumption Repeated sampling with n=25 yields a representative distribution of a node's answers.
- ad hoc to paper The 20 hand-picked factual questions are representative of real user traffic and of the differences that matter.
- domain assumption Most validators and nodes are honest and economically rational.
- domain assumption The embedding model preserves the semantic differences that identify models and knowledge bases.
Cite this review
Pith. "Pith review of Trust, but verify." pith.science (2026). https://pith.science/paper/ARJHLJIX
@misc{pith2026250413443,
author = {Pith},
title = {Pith review of: Trust, but verify},
year = {2026},
howpublished = {\url{https://pith.science/paper/ARJHLJIX}},
note = {Machine review of arXiv:2504.13443}
}
read the original abstract
Decentralized AI agent networks, such as Gaia, allows individuals to run customized LLMs on their own computers and then provide services to the public. However, in order to maintain service quality, the network must verify that individual nodes are running their designated LLMs. In this paper, we demonstrate that in a cluster of mostly honest nodes, we can detect nodes that run unauthorized or incorrect LLM through social consensus of its peers. We will discuss the algorithm and experimental data from the Gaia network. We will also discuss the intersubjective validation system, implemented as an EigenLayer AVS to introduce financial incentives and penalties to encourage honest behavior from LLM nodes.
Figures
Forward citations
Cited by 2 Pith papers
-
Hollow-LLM Attack: Computationally Trivial Weights in Zero-Knowledge Verification of LLM Inference
ZK-verified LLM inference can be fooled: a provider can serve a small model while producing valid proofs for a much larger declared model by embedding structure-preserving ghost weights.
-
CoIn: Counting the Invisible Reasoning Tokens in Commercial Opaque LLM APIs
CoIn verifies the count and semantic validity of invisible reasoning tokens in opaque LLM APIs using a Merkle tree over token embedding fingerprints plus learned relevance matching.
Reference graph
Works this paper leans on
-
[1]
Zhao, W. X. et al. A Survey of Large Language Models, https://arxiv.org/abs/2303.18223, v16, 2025
arXiv 2025
-
[2]
Fourrier, C., Habib, N., Lozovskaya, A., Szafer, K., Wolf, T. Performances are plateauing, let’s make the leaderboard steep again, https://huggingface.co/spaces/open-llm-leaderboard/blog , 2024
work page 2024
-
[3]
A Survey on Large Language Models for Code Generation, https://arxiv.org/abs/2406.00515, 2024
Jiang, J., Wang, F., Shen, J., Kim, S., Kim S. A Survey on Large Language Models for Code Generation, https://arxiv.org/abs/2406.00515, 2024
arXiv 2024
-
[4]
GaiaNet: GenAI Agent Network, https://docs.gaianet.ai/litepaper, 2024
Gaia Foundation. GaiaNet: GenAI Agent Network, https://docs.gaianet.ai/litepaper, 2024
work page 2024
-
[5]
Goldwasser, S., Micali, S., Rackoff, C. The knowledge complexity of interactive proof-systems, Proceedings of the seventeenth annual ACM symposium on Theory of computing, 1985
work page 1985
-
[6]
zkLLM: Zero Knowledge Proofs for Large Language Models, https://arxiv.org/abs/2404.16109, 2024
Sun, H., Li, J., Zhang, H. zkLLM: Zero Knowledge Proofs for Large Language Models, https://arxiv.org/abs/2404.16109, 2024
arXiv 2024
-
[7]
Ganescu, B-M., Passerat-Palmbach, J. Trust the Process: Zero-Knowledge Machine Learning to Enhance Trust in Generative AI Interactions, The 5th AAAI Workshop on Privacy-Preserving Artificial Intelligence, 2024
work page 2024
-
[8]
Dong, B., Wang, Q. Evaluating the Performance of the DeepSeek Model in Confidential Computing Environment, https://arxiv.org/abs/2502.11347v1, 2025
arXiv 2025
Show all 65 references
-
[9]
& Nertney, R
Apsey, E., Rogers, P., O’Connor, M. & Nertney, R. Confidential Computing on NVIDIA H100 GPUs for Secure and Trustworthy AI, https://tinyurl.com/9henzz7t, 2023
2023
-
[10]
A Cup of TEE, Please
Oasis. A Cup of TEE, Please. But How Do We Know It’s The Right Flavor?, https://oasisprotocol.org/blog/tees-remote-attestation-process , 2025
2025
-
[11]
and Yih, W
Karpukhin, V ., Oguz, B., Min, S., Lewis, P., Wu, L., Edunov, S., Chen, D. and Yih, W. Dense passage retrieval for open-domain question answering. In EMNLP (1), pp. 6769â C"6781, 2020
2020
-
[12]
EigenLayer: The Restaking Collective, https://docs.eigenlayer.xyz/assets/files/ EigenLayer_WhitePaper-88c47923ca0319870c611decd6e562ad.pdf, 2023
EigenLayer. EigenLayer: The Restaking Collective, https://docs.eigenlayer.xyz/assets/files/ EigenLayer_WhitePaper-88c47923ca0319870c611decd6e562ad.pdf, 2023
2023
-
[13]
EIGEN: The Universal Intersubjective Work Token,https://docs.eigenlayer.xyz/assets/ files/EIGEN_Token_Whitepaper-0df8e17b7efa052fd2a22e1ade9c6f69.pdf, 2024
EigenLayer. EIGEN: The Universal Intersubjective Work Token,https://docs.eigenlayer.xyz/assets/ files/EIGEN_Token_Whitepaper-0df8e17b7efa052fd2a22e1ade9c6f69.pdf, 2024
2024
-
[14]
Verifiable Inference, https://github.com/GaiaNet-AI/verifiable-inference , 2025a
Gaia Foundation. Verifiable Inference, https://github.com/GaiaNet-AI/verifiable-inference , 2025a
-
[15]
Grattafiori, A. et al. The Llama 3 Herd of Models, https://arxiv.org/abs/2407.21783, 2024 10 A PREPRINT - S EPTEMBER 17, 2025
2024 arXiv
-
[16]
Mesnard, T. et al. Gemma: Open Models Based on Gemini Research and Technology, https://arxiv.org/abs/2403.08295, 2024
2024 arXiv
-
[17]
Gaia nodes with long-term knowledge, https://docs.gaianet.ai/tutorial/concepts, 2025b
Gaia Foundation. Gaia nodes with long-term knowledge, https://docs.gaianet.ai/tutorial/concepts, 2025b
-
[18]
Paris, https://en.wikipedia.org/wiki/Paris, 2025a
Wikipedia. Paris, https://en.wikipedia.org/wiki/Paris, 2025a
-
[19]
London, https://en.wikipedia.org/wiki/London, 2025b
Wikipedia. London, https://en.wikipedia.org/wiki/London, 2025b
-
[20]
X., Duderstadt, B
Nussbaum, Z., Morris, J. X., Duderstadt, B. and Mulyar, A. Nomic Embed: Training a Reproducible Long Context Text Embedder, https://arxiv.org/abs/2402.01613, 2025
2025 arXiv
-
[21]
Paris knowledge base,https://huggingface.co/datasets/gaianet/paris, 2024a
Yuan, J. Paris knowledge base,https://huggingface.co/datasets/gaianet/paris, 2024a
-
[22]
London knowledge base, https://huggingface.co/datasets/gaianet/london, 2024b
Yuan, J. London knowledge base, https://huggingface.co/datasets/gaianet/london, 2024b
-
[23]
Yang, A. et al. Qwen2 Technical Report, https://arxiv.org/abs/2407.10671, 2024
2024 arXiv
-
[24]
What is EigenDA? https://docs.eigenda.xyz/core-concepts/overview, 2025
EigenDA. What is EigenDA? https://docs.eigenda.xyz/core-concepts/overview, 2025
2025
-
[25]
EigenLayer. Introducing Verifiable Agents on EigenLayer, https://blog.eigencloud.xyz/introducing-verifiable-agents-on-eigenlayer/ , 2025 11 Appendix A: Sample questions for distinguishing models
2025
-
[26]
What year did the Apollo 11 mission land on the moon?
-
[27]
Who wrote Pride and Prejudice?
-
[28]
What is the capital of Japan?
-
[29]
What is the chemical formula for water?
-
[30]
Who painted the Mona Lisa?
-
[31]
What is the largest planet in our solar system?
-
[32]
In what year did World War II end?
-
[33]
What is the speed of light in a vacuum?
-
[34]
Who discovered penicillin?
-
[35]
What is the boiling point of water at sea level in Celsius?
-
[36]
Who was the first woman to win a Nobel Prize?
-
[37]
What is the capital of Australia?
-
[38]
Who wrote ’Romeo and Juliet’?
-
[39]
What is the atomic number of oxygen?
-
[40]
Who was the first person to step on the moon?
-
[41]
What is the circumference of Earth?
-
[42]
In which year was the Declaration of Independence signed?
-
[43]
What is the tallest mountain on Earth?
-
[44]
Who developed the theory of relativity?
-
[45]
What is the largest ocean on Earth? 12 Appendix B: Sample questions for distinguishing knowledge bases
-
[46]
What was the population of Greater London according to the 2011 census, and what was the population density per square mile?
2011
-
[47]
In which year did the Romans found Londinium, and what event in 61 AD led to its destruction? 11 A PREPRINT - S EPTEMBER 17, 2025
2025
-
[48]
Who supervised the rebuilding of London after the Great Fire of 1666, and which architect’s cathedral was completed in 1708?
-
[49]
What are the four World Heritage Sites in London, including the combined site that consists of three connected landmarks?
-
[50]
When was Greater London divided into 32 London boroughs plus the City of London, and which administrative body was abolished in 1889?
-
[51]
What was the name of the defensive perimeter wall built during the English Civil War, how many people were involved in building it, and when was it leveled?
-
[52]
What is the highest temperature ever recorded in London, on what date did it occur, and at which measuring station?
-
[53]
Which two areas are London’s main financial districts, and which one has recently developed into a financial hub?
-
[54]
According to the 2021 census data, what percentage of London’s population was foreign-born, and what were the five largest countries of origin?
2021
-
[55]
What governmental body is responsible for London’s transport system, and what is the name of the functional arm through which it operates?
-
[56]
How many visitors did the Louvre Museum receive in 2023?
2023
-
[57]
What is the name of the prefect who supervised the massive public works project that rebuilt Paris between 1853 and 1870?
-
[58]
What happened to Paris during the Fronde civil war in the 17th century?
-
[59]
What is the unemployment rate in Paris as reported in the 4th trimester of 2021?
2021
-
[60]
What percentage of Parisians earned less than €977 per month in 2012, according to the text?
2012
-
[61]
Which organization created the V élib’ bicycle sharing system in Paris and in what year?
-
[62]
What is the name of the Paris stock exchange mentioned in the document?
-
[63]
How many bridges did Philip Augustus build in Paris in the late 12th century?
-
[64]
What percentage of Paris’s salaried employees work in hotels and restaurants according to the document?
-
[65]
What was the date when Paris was liberated from German occupation during World War II? 12
Reviewed August 16, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.