Glossary

α (alpha), a validator’s audit coverage in [0,1]. --alpha 1 audits every reply; --alpha 0 audits none. The design target is full coverage, affordable because checking is cheap.

β (beta), target lifetime false-ejection rate (the Ville bound) used by the SPRT when deciding to eject a provider.

Attestation, a hardware-signed proof of what code and model an enclave is running; the trust root of the Confidential (TEE) tier. See DCAP quote.

Commitment, a verifiable digest a provider emits over its work: a Merkle tree, root commit_root, whose leaves bind a hidden-state SRP sketch and a top-k logprob digest per 32-token window. Lets a verifier re-check a sampled slice cheaply.

commit_root, the Merkle root of a reply’s per-window commitment leaves, signed into the provider’s record.

consensus_id, sha256(cert); ties a registered validator to the QUIC cert it presents, so peers pin one another by their on-chain-registered certs.

DCAP quote, a hardware-signed attestation (Intel TDX) proving what code/model is running inside a TEE; the trust root for the Confidential tier.

Earned-trust ramp, a freshly registered provider starts at a low routing-weight floor (~10%) and rises to full weight only after enough clean history (~16 audited accepts and ~16 passed GPU challenges), with full-coverage force-auditing until then. Makes the register-cheat-eject-recycle cycle unprofitable.

Ejection, the whole penalty in a zero-bond protocol: an identity that cheats loses its place, and with it every future emission that place was worth. Nothing it holds is confiscated, because it was never required to post anything.

Escrow, on-chain account holding a consumer’s funds until a release is audited and quorum-settled. On a reject the funds are refunded to the consumer.

Gateway, ogong-gatewayd; the OpenAI-compatible HTTP front door for consumers, and an optional fiat on-ramp.

Honeypot audit, a planted audit carrying a known verdict; a verifier that disagrees with it (rubber-stamping a known-bad accept, or false-flagging a known-good reply) forfeits its fee and, on repetition, its place in the audit rotation. A complementary check: the primary defense against a lazy/colluding verifier is the two-verifier cross-check (an audit goes to two independent verifiers and settles as accept only if both agree).

Hybrid PQ signature, the provider record is signed with Ed25519 and ML-DSA-44, so it survives the future break of either scheme.

KS test (Kolmogorov–Smirnov), the sup-norm distance between the committed and recomputed top-k logprob distributions; catches a localized probability shift that an averaged TV would dilute. Reject threshold ≈ 0.10.

LOGIC, the logprob-commitment primitive: top-k logprob digests at every decode position. The cheap first check, using values the engine already exposes.

Maker, the author of a model, identified in ogong/<tier>/<maker>/<model> and attributed on-chain. A royalty slot is reserved but inactive at launch (deferred to governance).

model_root, a SHA-256 over the model’s ordered shard content hashes; binds a commitment to a specific model identity (quantization included implicitly).

OGONG L1, the sovereign Substrate chain: BABE authorship, GRANDPA finality, and a GRANDPA authority weight equal to a validator’s recently verified work. It has no staking pallet and no bond of any kind. The finalising committee is bounded at 300 seats because GRANDPA messaging is quadratic in the committee; mining is unbounded, so anyone may earn and claim emission without holding a seat. See The OGONG L1.

Proof-of-distinct-GPU, the Verified-tier Sybil cost: a timed challenge in which the validator requires a committed reply on the provider’s loaded model within a wall-clock deadline (default ~16 tokens in 20s). Misses feed a miss-rate SPRT that ejects identities an operator’s real throughput cannot sustain. The challenge reply doubles as a correctness audit, so the anti-Sybil work is productive verification.

Provider, a node serving inference from a GPU; the daemon is ogong-provider. Risks no correctness bond and doubles as a verifier for peers serving the same model.

Quorum settle, the on-chain settlement that releases escrow; requires co-signatures from a supermajority of validators, weighted by recently verified work on the OGONG L1 and by stake on the deployed EVM lane (more than two-thirds either way, and never a headcount). Each co-signature also binds the specific consumer escrow being debited, so a settle cannot be redirected to charge a different consumer’s allowance.

Reputation, a per-provider score, derived from verdict history, that weights how much work the router routes to it. On the EVM lane it multiplies the provider’s stake; see Stake.

ρ (rho), the ratio of verification cost to generation cost. Measured at a few percent (2.5-3.7%) on datacenter GPUs (~30-40x cheaper than generation) and ≈ 5% on Apple Silicon (~20x). This is what makes full-coverage auditing affordable.

Router, ogong-routerd; the marketplace match engine, an attested enclave that draws a provider proportionally to stake × reputation on the deployed EVM lane, and is slashable for misrouting. It holds no consensus stake of its own.

Score mode, the engine path that returns per-token logprobs/hidden states from a single teacher-forced prefill without generating (what makes the audit cheap). The default verification path (capability-detected, with a fallback).

Settlement sink, the role/env that lets a validator submit the on-chain settle. Only the handling validator holds it; peers are cosign-only.

SPRT, sequential probability ratio test; accumulates per-reply verdicts into a running decision so a persistent cheater is ejected quickly while honest noise rarely is (bounded by β).

SRP sketch (sign-random-projection), the hidden-state commitment: the activations projected onto a bank of random ±1 directions seeded by a per-request projection key the validator derives from the request id. Well-conditioned and not the provider’s to choose (nor precomputable), so a substitute model can’t hide in a hand-picked subspace. Mandatory on the Verified tier, with a fixed public seed kept only as a legacy whole-model fallback. Replaces the older provider-chosen magnitude-top-k scheme. Reject threshold (relative-L2) ≈ 0.10.

Stake, an EVM-lane-only concept: OGONG locked by an operator to buy priority and availability weighting. It is not a slashable correctness bond, and it does not exist on the OGONG L1, where priority and consensus weight are bought with verified work instead.

Teacher-forced verification, the audit method: the verifier runs one forward pass over (prompt + claimed output) and reads the model’s hidden states and logprobs off that pass, instead of re-generating. The source of ρ ≈ a few percent (2.5-3.7% on datacenter GPUs).

TEE (Confidential tier), Trusted Execution Environment; the verifiably-private tier where the operator can’t read your prompt.

Threshold-BLS beacon, the committee randomness source for audit selection. Validators share one BLS key (via a dealerless DKG); each epoch’s beacon is the unique threshold signature over it, so no coalition can grind or steer the draw and withholding can’t move it. Anyone verifies it against the group public key. A drand-style construction; it closes the “watch then decide” attack.

TOPLOC, the hidden-state-commitment primitive (implemented as the SRP sketch); a stronger check than logprobs alone because it pins internal activations, which distillation can’t fake.

Total-variation (TV) distance, the distance between committed and recomputed top-k logprob distributions; a companion signal to KS (honest ~0.01, a quant cheat ~0.05). The logprob reject line itself is KS ≈ 0.10.

Trajectory, the recorded sequence of a generation (token windows, or sampled denoising steps for diffusion) that a verifier re-checks during an audit.

Validator, ogong-validatord; an attested CPU enclave (no GPU) that audit-selects work, adjudicates verifier scores, and co-signs settlement. It posts no bond: on the OGONG L1 a validator earns its seat with verified work and, if it issues false verdicts, is ejected, forfeiting the seat and its future emission rather than any posted capital.

Verifier, ogong-verifierd; a provider GPU in audit duty that teacher-forces the claimed output on an independent engine and returns Accept/Reject, paid a flat fee per audit.

Verified work, the L1’s single scarce resource: inference and audits that a quorum has confirmed. It sets emission share, routing priority, and GRANDPA authority weight, and it decays, halving every 24 eras, so a seat has to keep being earned rather than being held on past performance.

VRF (verifiable random function), the per-validator audit-selection primitive, now the bootstrap fallback to the threshold-BLS beacon. Keeps audit selection unpredictable yet verifiable, so a provider can’t tell which replies are checked.