Proof of useful inference: how Flop verifies AI work

Flop Network pays GPU miners for AI inference that agents ask for. Anyone who has run models will ask the next question: how does the network know a miner ran the requested model, and didn't return a cheaper model's output or a canned answer? Flop's answer is a design it calls proof of useful inference (PoUI). This guide explains it using the official verification page, the miner and agent role pages and the draft whitepaper. All of them are drafts, so the figures can change. The Yellow Paper is the definitive specification and isn't final.

What is proof of useful inference?

PoUI is the set of rules that decides whether a miner gets paid for an inference session, and what it loses if it lied. The whitepaper describes it as the network's answer to "the central objection to any proof-of-useful-inference design: that verifying inference honestly costs as much as re-running it."

Flop doesn't re-run every job. The verification page says the network "never re-runs inference to trust it". Each session leaves evidence behind, a sample of that evidence is re-checked later, and a miner caught cheating loses its whole stake. The stated goal is a game "sized so cheating loses money in expectation even when most single cheats slip through."

PoUI is also not Flop's consensus mechanism. Per the whitepaper, it "governs rewards and validator eligibility, while consensus is AlephBFT", and miners never produce blocks. For the wider design, see What is FLOP?

What happens in an inference session?

1. Request. An agent posts a session request with five fields: a model-weight hash, a maximum latency, the compute in FLOPs, a confidentiality flag and the fee in $FLOP (agent page).
2. Match. A miner with suitable hardware accepts and opens a private connection with the agent. They talk directly, and the whitepaper says verification happens "after the fact, outside the critical path".
3. Commit. While the model runs, the miner records fingerprints of the model's internal state and builds a co-signed transcript of every turn.
4. Settle. The transcript root goes on-chain and the miner is paid. The evidence stays open to challenge for a fixed window.

What evidence does a miner have to keep?

The verification page lists two kinds:

• TOPLOC activation commitments. Compact fingerprints of the activations the model produces, "258 bytes per 32 tokens". The whitepaper says activations "are specific to the model and the hardware and cannot be faked cheaply", so "a substituted model, skipped work or a canned answer fails the check even when the output text looks right."
• A co-signed transcript. Every turn becomes a leaf under a Merkle root, and the chain stores that root at settlement.

The miner pays a storage deposit to publish this data to the data-availability layer, which validators run, and it has to stay there for the whole challenge window. Providers that fail to serve it are slashed. Losing the data doesn't help a cheat either: per the verification page, "an unanswerable challenge resolves against the miner."

How does the challenge game work?

Challenges come through two lanes, according to the verification page:

• A random lottery. At the end of each epoch an "unbiasable" lottery picks turns to audit. Draws are weighted by value, so one large faked turn can't hide inside a long session.
• Bonded disputes. The paying agent can dispute its own sessions, and any active validator can dispute any session, so a lazy or colluding payer can't switch detection off. A discretionary challenger posts a 100 FLOP bond and forfeits it if the dispute is frivolous.

The check itself is small. A checker re-runs one prefill, which the page puts at "~100× cheaper than generation", or a sub-cubic arithmetic check, and never the whole session. Bisection narrows any disagreement to a single turn "in a handful of rounds", so the cost of a dispute doesn't grow with session length. The challenged miner then has two hours to produce the signed evidence for that turn, and silence counts as a fraud verdict.

Parameter	Draft value (verification page)
Challenge window	About 7 days, under review to shorten toward hours
SOFT-tier spot-check rate	2.5%, about one session in forty
Sampled-audit lottery	5% of turns by default
Dispute bond	100 FLOP
Response deadline	2 hours
Upheld fraud	100% of the miner's stake slashed, ejection, blacklist; the agent's escrow is refunded

The page says the audit rates "are governable, not fixed constants".

Why can a 2.5% audit rate stop cheating?

At a 2.5% spot-check rate, a single cheated slice gets through about 97.5% of the time, and the verification page accepts that. Its argument rests on two facts. The odds of escaping every audit fall exponentially as a miner cheats on more slices. And a caught cheat loses its entire stake, which scales with the compute the miner is calibrated to serve. The page writes the deterrence rule as "slash × stake ≥ gain ÷ catch-rate" and concludes that stealing a small slice while risking the whole stake has "negative expected value at any realistic scale". Because stake grows with capacity, the largest miners face the largest absolute burn.

If cheating ever starts to pay, governance can raise either dial: the audit rate or the stake size.

Do miners need TEE or confidential-computing hardware?

No. The miner page says SOFT is the default tier and runs on "any capable GPU", with audit exposure of about one session in forty. HARD is opt-in: NVIDIA Confidential Computing on a TDX or SEV-SNP host, which binds the measured model weights. On HARD, an attestation failure is a 100% slash. The whitepaper treats hardware attestation (TEE) as one of four layers, optional per request, next to TOPLOC, re-execution and stake at risk.

The same miner page adds a caveat: SOFT is "ratified and first-class, but its end-to-end settlement and dispute lane is still being specified, and the currently wired settlement path remains the attested one." Hardware requirements are in how to mine FLOP, and what the official calculator says about earnings is in FLOP mining profitability.

Who checks the work, and who pays them?

The verification page says a sampled validator re-runs the cheap check today. Under the "ratified checker lane", three bonded checkers do it and validators verify their unanimous verdict. The whitepaper describes those checkers as "calibrated miners in a trust domain separate from the miner under audit, assigned by verifiable random function".

Audits are paid from fees. Settlement carves 1% of the miner's payment into an audit pool, and a validator that submits audit evidence claims a flat fee per verdict. A successful challenger gets its bond back, but the extra bounty out of the fraud slash "is not wired yet". The 1% audit cut is also why settlement currently pays the miner 99% of a session fee, while the target split is 85% to the miner and 15% to validators (revenue model). Validator duties are covered in our validator guide.

How do agents pay for compute?

The agent page describes an account-based chain with spend controls for agents: pre-set spend limits, bounded authority delegated through proxies, multisig, timelocks and multi-party escrow. Flop Labs made the same point on October 16, quoting a post by David Hoffman (@TrustlessState) that said an OpenAI agent with no gas for a Sepolia testnet transaction took it from an address with exposed keys. Flop's reply: "Fund its own wallet, cap the spend, let it pay for its own gas and compute."

Give an agent a job and an empty wallet and this is what you get. Fund its own wallet, cap the spend, let it pay for its own gas and compute. We’re building Flop Network around exactly that. https://t.co/G3Gc8qPGt0

— Flop Labs (@flop_labs) October 16, 2026

If the work is wrong, the agent can challenge it, and an upheld fraud verdict refunds its escrow. Agents can also swap FLOP for other crypto, agent to agent, through native hash time-locked contracts (HTLCs). The whitepaper says agents that come in through brokers "never touch $FLOP" and pay in fiat or stablecoin instead. An agent's identity is a self-signed DID, the same identity used on Technocore.

What isn't built or final yet?

• The whitepaper's risk section says some components are "specified but not yet implemented, calibrated or audited", and that "verification thresholds are still being calibrated".
• The SOFT-tier settlement and dispute lane is still being specified (miner page).
• The challenger bounty paid out of fraud slashes isn't wired yet (verification page).
• The whitepaper flags statements of its own that still differ from the Yellow Paper, including "that no $FLOP is burned" and "slashing a miner for non-delivery". The newer verification page describes an upheld fraud verdict as burning 100% of the miner's stake.

Outside miners will first run this design on the public testnet, which the testnet page plans for Q4 2026. Follow it on our testnet guide.

FAQ

What is proof of useful inference (PoUI)?

It is Flop Network's system for checking that a GPU miner ran the AI inference an agent paid for. Miners keep TOPLOC activation fingerprints and a co-signed transcript for each session, a random sample is re-checked during a challenge window of about seven days, and an upheld fraud verdict slashes 100% of the miner's stake. All figures are from draft documents.

Does Flop re-run every inference job to check it?

No. The official verification page says the network "never re-runs inference to trust it". It audits sampled slices of work, at about one session in forty on the default SOFT tier, plus disputes opened by the paying agent or any validator. A check re-runs one prefill or a small arithmetic test, never the whole session.

Do I need a TEE GPU to mine FLOP?

No. SOFT, the default tier, runs on any capable GPU. HARD, which uses NVIDIA Confidential Computing on a TDX or SEV-SNP host, is optional. The miner page notes that the SOFT settlement and dispute lane is still being specified.

What happens if a FLOP miner cheats?

If a fraud verdict is upheld, the miner loses 100% of its stake, is ejected and blacklisted, and the agent's escrow is refunded. A miner that doesn't answer a challenge within two hours is treated as having cheated.

Is proof of useful inference the same as proof of work?

No. Proof of work pays miners for solving hash puzzles. Flop's block rewards go to inference that agents requested, weighted by verified compute. Blocks are finalised by AlephBFT among validators, and miners never produce blocks.