โ RENDER: MAX GOOFY โ
TRUST NOBODY.
TRAIN EVERYBODY.
~ trusted training from untrusted compute (fr fr) ~
ok so basically ๐ it's a fault-tolerant, low-communication protocol that trains a frontier-scale model across churning, heterogeneous, Byzantine consumer GPUs โ WITHOUT assuming a single node is trustworthy. the GPUs can drop out, run cursed hardware, and straight up LIE ๐ and it still works. sheeeesh.
COMPUTE IS LOCKED BEHIND LIKE 3 DATACENTERS and that's not a cost problem bestie, it's a gatekeeping problem ๐ช๐
the math of low-communication training?? already solved. DiLoCo- and DeMo-class methods thin gradient sync by 100รโ1000ร. we did NOT reinvent that (we're not weird). asmon solves the ONE thing nobody solved: making that algorithm survive a swarm that drops out, runs random hardware, and lies to your face. the moat isn't cheap GPUs โ it's a heterogeneity-aware, Byzantine-robust aggregation + verification layer. based.
io.net & Nosana-type networks sell inference hours; their moat = cheap GPUs.
asmon is on the TRAINING side. they sell cheaper compute. we produce trusted training from untrusted compute. different game entirely ๐ฎ
EVERY MODULE EITHER FEEDS THE BOUNDARY, DEFENDS IT, OR MEASURES IT. no freeloaders. ๐ง
each worker trains a local replica for H inner steps, then yeets a pseudo-gradient ฮ = ฮธ_global โ ฮธ_local. the outer optimizer treats the aggregate as a gradient under Nesterov momentum (the DiLoCo outer loop). sabotage lives STRICTLY between "workers producing" and "aggregator combining." workers always compute honestly โ the boundary is where the chaos sneaks in. ๐ณ๏ธ
- OUTER OPTIMIZERNesterov ยท lr 0.7 ยท ฮฒ 0.9
- PSEUDO-GRADIENTฮ = ฮธ_global โ ฮธ_local
- SYNC INTERVALevery 20 inner steps
- SUBSTRATEmanual MLP ยท Adam ยท flat ฮธ
- REPLAYABILITY(wid, round) โ pure fn
- DETERMINISM1 master seed โ all draws
SECURITY = 3 LAYERS STACKED ON TOP OF EACH OTHER each one covering the others' L ๐ฅ
ROBUST AGGREGATION
aggregator.pybounds the damage radius of any single attack. Mean, coordinate-wise median, Multi-Krum, and centered clipping w/ far-outlier excision. crude attacks that break naive averaging get rejected FOR FREE. ๐
VERIFICATION
verifier.pyraises the PRICE of lying. exact recompute audits over replayable claims โ binary fraud proofs, judged by a randomly sampled committee of bonded verifiers under majority vote. being statistically invisible does NOT save you. ๐๏ธ
STAKING
economy.pymakes the adversary fraction a real, PRICED quantity. every worker posts a bond; conviction slashes it in full & ejects them; seized bonds split between committee + treasury. Sybil attacks now cost real money ๐ธโ๏ธ
โณ ๐ the blockchain sits ONLY at the settlement edge โ a bonded-verifier network that rewards honest compute and slashes fake contributions. that's it. we're not doing a coin bro chill.
A ROBUST AGGREGATOR THAT QUIETLY YEETS THE MOST HETEROGENEOUS HONEST WORKERS just re-invents the centralization we're trying to KILL ๐
under Multi-Krum on non-IID shards with ZERO real attackers, the same honest workers (w3, w6, w9) get permanently exiled at 100% rejection ๐ โ a 0.092 mean-accuracy tax paid to literally nobody (scenario C, huge L). two-regime aggregation (banish the impossible, clip the plausible) fixes it: honest FPR drops to 0.000 and the accuracy gap shrinks to โ0.005 (scenario F, we're so back ๐). THIS is why FPR โ not attack success โ is the number the protocol optimizes.
WE RAN THE SIMS. HERE'S THE RECEIPTS. ๐งพ
10 workers ยท 40 outer rounds ยท sync every 20 inner steps ยท 8-class Gaussian blobs in 20 dimensions ๐ซง
| ID | Setup | Attack | Final acc | Key metric |
|---|---|---|---|---|
| A2 | IID ยท Multi-Krum | none | 0.882 | honest FPR 0.30 ยท damage none |
| B1 | IID ยท mean | sign-flip 3/10 | 0.080 ๐ | attack success 0.91 (RIP) |
| B3 | IID ยท Multi-Krum | ALIE 3/10 | 0.810 | malicious selected 1.00 |
| C | non-IID ยท Multi-Krum | none | 0.787 | honest FPR 0.30 ยท gap 0.092 |
| F | non-IID ยท clip+excision | none | 0.868 | honest FPR 0.000 ๐ |
| G | non-IID ยท clip+excision | sign-flip 3/10 | 0.790 | vs mean 0.125 ยท Krum 0.828 |
| H | non-IID ยท full stack | ALIE 3/10 | 0.805 | ejected by r2 ยท honest PnL +40 |
| I | churn + Dirichlet ยท full stack | ALIE 3/10 | 0.785 | FPR 0.000 ยท ejected by r5 |
โณ crude attacks break naive aggregation (B1, big oof). robust aggregation is BLIND to coordinated stealth (B3). verification closes the hole aggregation leaves open (H). teamwork makes the dream work ๐ค
MORE VOTERS = MORE CORRECT. it's literally in the name. ๐ณ๏ธ
committee verdicts are majority votes over verifiers sampled from a pool with malicious fraction q. error decays EXPONENTIALLY in committee size while q < ยฝ, and stalls as q creeps toward ยฝ. an independent plurality makes collusion infeasible. collusion is the only attack that survives scale. that's the whole Condorcet Jury Theorem, no notes. ๐ง
DETERRENCE IS A DIAL, not a hope & a prayer ๐๏ธ
every audit is a paid recompute โ a fee of one round's reward. attacker income before slashing tracks (1 โ p)/p and detection latency tracks 1/p. at audit rate 0.25 a colluder banks like THREE reward units before forfeiting a 100-unit bond. the mean obeys theory; the geometric tail sets the bond. math is mathing. ๐งฎ
| Audit rate p | Ejected in rounds | Break-even bond | Theory | Fee overhead | Uncaught / 40r |
|---|---|---|---|---|---|
| 0.10 | 14.6 | 13.7 | 9.0 | 12% | 1 of 12 ๐ฌ |
| 0.15 | 6.2 | 5.2 | 5.7 | 17% | 0 of 12 โ |
| 0.25 | 4.1 | 3.1 | 3.0 | 31% | 0 of 12 โ |
| 0.40 | 2.5 | 1.5 | 1.5 | 48% | 0 of 12 โ |
| 0.60 | 1.7 | 0.7 | 0.7 | 67% | 0 of 12 โ |
Scenario H: 64 audits cost 64 in fees while seizures returned 305. security pays for ITSELF while it's being attacked. free real estate. ๐
with zero attackers, audits are pure overhead: p ร fee per worker-round, or 31% of payroll at p = 0.25. picking the audit rate is basically an insurance-pricing problem. ๐
v0 IS A SELF-CONTAINED SIM OF THE PROTOCOL'S SINGLE AXIS. clone it. run it. gaslight your GPU. ๐
the three-layer security story maps onto three files: aggregator.py, verifier.py, economy.py. same config, same history, bit for bit. deterministic af. ๐ฏ
# set up the environment ๐ ๏ธ
uv venv .venv && uv pip install -e ".[dev]"
# run the test suite ๐งช
.venv/bin/pytest
# scenario suite AโI + jury curve ๐
.venv/bin/python -m condorcet.train
# economics sweep ยท break-even bond ๐ฐ
.venv/bin/python -m condorcet.sweepADAPTIVE THRESHOLDS
estimated adversary fractions replace static f, w/ median-of-means hardening for small populations.
VERIFIER STAKING
bonded verifiers w/ their own slash conditions + collusion-resistant committee rotation.
SUBSTRATE SCALE-UP
toy MLP โ transformer blocks, quantized delta compression, gradient sparsification.
CHURN REALISM
session-length distros from real consumer fleets, stragglers, partial credit for interrupted rounds.