https://arxiv.org/abs/2509.24257

VeriLLM is a verification protocol for large language models that run across a decentralized network of volunteer GPUs. Its goal is simple and strict: when you ask a model to run on untrusted hardware, the answer you get should be as trustworthy as if you had run it yourself.

Instead of relying on heavy cryptography or blind faith in majority voting, VeriLLM uses a cheap, random spot-check mechanism that makes it strictly more profitable to be honest than to cheat.

The Problem: Trust in Decentralized Inference

Decentralized inference promises resilience, transparency, and open access. Anyone with spare GPU capacity can help serve large models. In practice, that only matters if users can trust the outputs.

Without verification, providers are strongly tempted to cut corners:

Swapping in quantized or pruned versions of the model
Skipping tokens to save time
Quietly using a smaller substitute model

The verification problem is much harder than it looks.

Inference is non-deterministic
Small changes in hardware, kernels, or floating-point behavior can produce slightly different results. That makes it difficult to disentangle benign numerical drift from malicious behavior.
Consensus alone is weak
If multiple nodes vote on whether an output is “correct,” they can collude, or simply stop doing real checks and always vote “true” to save computation. Majority voting without strong incentives does not guarantee correctness.
ZK proofs do not scale yet
Zero-knowledge ML frameworks are improving, but today they often require hours of prover time per non-trivial inference. That cost is incompatible with real-time serving of large models.

For decentralized inference to be meaningfully different from a trusted cloud, we need verification that is:

Lightweight enough to run on live systems
Permissionless, so anyone can participate
Public, so anyone can audit the process and results

Without verification, every answer from a decentralized network is a guess.

VeriLLM: Our Approach

VeriLLM introduces a commit–sample–verify protocol designed around three principles:

Minimal verification cost
Incentive compatibility
Security under a global majority of honest nodes

Minimal Verification Cost (Around 1%)

Modern LLMs have two phases at inference time:

Prefill: process the prompt into hidden states
Autoregressive decode: generate tokens one by one

The autoregressive phase is usually the dominant cost. VeriLLM takes advantage of this structure.

Verifiers only recompute the prefill phase for a randomly sampled subset of positions, skipping the expensive decode loop. They then compare their recomputed hidden states against the commitments made by the original inferencer.

On-chain, only a small set of scalar comparisons are required. These comparisons are cheap and publicly auditable.

Empirically, the cost of running VeriLLM is roughly 1 percent of a full inference. In other words, you get verifiability almost “for free” relative to the serving cost.

Incentive Compatibility

VeriLLM assumes participants are economically rational.

Verifiers are selected at random and must recompute the assigned positions.
Results are committed and then compared on-chain against the inferencer’s commitments.
A peer-prediction mechanism rewards verifiers who match the honest distribution and punishes deviating reports.

Lazy behavior is not profitable. A verifier who does not actually recompute the assigned positions will eventually be detected and slashed.

Under the protocol design, honest inference plus honest verification forms a Nash equilibrium. Any deviation that tries to save cost by cheating becomes strictly unprofitable in expectation.

Security Under Global Majority Honest

Many committee-based schemes assume that a randomly sampled committee is majority honest. VeriLLM avoids that assumption.

The protocol incorporates a ReVerification mechanism that can be triggered when disputes or anomalies appear. This mechanism:

Escalates checks beyond the initial sampled committee
Ensures security under the assumption that the global network is majority honest, even if a specific sample is not

Optionally, VeriLLM can be extended with zero-knowledge proofs so that security holds even when there is only a single honest verifier in the system.

Binding commitments plus unpredictable sampling turn random spot-checks into reliable verification.

Architecture: Inference Meets Verification

Most verification architectures clearly separate “inferencers” and “verifiers” into different roles. This creates an obvious attack surface: if a node can tell it is serving a verification request rather than a user request, it can behave honestly only when it expects to be checked.

VeriLLM adopts a different approach.

Isomorphic Workers and Node Groups

GPU workers are organized into Node Groups, where each group hosts a slice of the model:

A Node Group is a homogeneous set of GPUs that share the same model slice.
Any node in the group can be assigned to serve as an inferencer or as a verifier.
Nodes do not know whether they are handling a live query or a verification job.

This isomorphic multiplexing makes conditional cheating much harder. A worker cannot “turn on” honesty only when it detects a verification request.

The Supporting Components

To coordinate the system, VeriLLM includes:

Scheduler
Orchestrates inference tasks, selects roles using VRF proofs, and routes hidden states and commitments between nodes.
Smart contracts
On-chain logic aggregates commitments, resolves disputes, and handles incentives, including rewards and slashing.

Together, these components form a fabric where inference and verification are entangled in the same workflow, both logically and economically.

In VeriLLM, inference and verification share the same hardware, making it harder for nodes to cheat selectively.

Security Analysis

VeriLLM is designed to detect a wide range of realistic attacks in decentralized inference.

Attacks and Defenses

Below is a summary of key attack types and how VeriLLM defends against them.

Aattacks	Description	Defense
Precision-Downgrade Attack (PDA)	An adversary replaces a deployed full-precision model (e.g., float32) with a quantized or otherwise lower-precision version (e.g., int8, float16, or an aggressively compressed model)	re-execute the inference and conduct a full-token hidden-state comparison, distinguishing anomalies through statistical characterization.”
Early stopping	Terminate inference before completion.	Check whether the last output token is <EOS>
Prefill-Forgery Attack	The adversary first guesses a plausible final output, then appends this guessed sequence to the original prompt and performs a single-pass prefill to compute per-token hidden states—bypassing the costly step-by-step autoregressive decoding.	Check whether the predicted token exactly matches the given output token.
Lazy-Verifier Attack	Exploiting the belief that misbehavior by inference workers is rare, a verifier rationally shirks—performing no validation whatsoever and unconditionally marking results as “verified” to save cost and latency.	a commit–reveal scheme plus on-chain sampled cross-checks
Sampling Majority Attack	An attacker with only a small global stake can, by chance, win a majority in a randomly sampled committee and thereby steer the verification outcome.	Make cheating strictly unprofitable by adding a dispute mechanism

VeriLLM’s defense matrix covers precision cheats, forged outputs, laziness, and sampling attacks.

Even if multiple parties collude, or the scheduler behaves maliciously, the protocol guarantees eventual detection as long as at least one honest verifier remains online for a given model slice.

Evaluation

We evaluate VeriLLM on Qwen2.5-7B models running across heterogeneous hardware.

Key findings:

Hidden-state checks cleanly separate honest full-precision runs from quantized ones, across different GPU types.
Verification overhead stays below 1 percent of the end-to-end generation time, even on modest hardware.
On-chain scalar checks over sampled indices are robust to floating-point noise while remaining cheap to execute.

These results support the central claim: VeriLLM provides meaningful verification with a cost that is essentially negligible compared to serving the model itself.

VeriLLM adds only a thin slice of extra cost on top of normal inference.

Why It Matters

VeriLLM is designed to make decentralized inference:

Trustless and auditable
Any third party can verify that the protocol was followed and that outputs are consistent with a committed model.
Lightweight
Around 1 percent overhead allows the protocol to run in production, not just in offline audits.
Economically aligned
Honest behavior is rewarded. Laziness and cheating are not only detectable but financially punished.
Scalable
The same GPU mesh that serves user queries also provides verification capacity, so the system grows with the network.

To our knowledge, this is the first decentralized inference verification protocol that offers a formal game-theoretic proof that honest inference and honest verification are the equilibrium behavior.

VeriLLM turns a global GPU mesh into a verifiable inference fabric.

Future Directions

VeriLLM is a foundation, not an endpoint. Besides ongoing plans to integrate it to Parallax, we are actively exploring:

Zero-knowledge escalation
Integrating zk-proofs as an opt-in escalation path for cases that require maximal collusion resistance.
Adaptive thresholds
Automatically tuning statistical detectors to new hardware backends and model architectures.
Protocol-level resilience
Hardening the system against scheduler-level censorship or targeted denial of reverification.

Our long-term goal is a sovereign AI fabric where inference is both decentralized and publicly verifiable. VeriLLM is one step toward that future.