STEP 01 · ASK
Prompt → token ids
Your question is tokenized in the browser with the model's exact byte-level BPE (verified token-for-token against HuggingFace). The contract receives raw ids — tokenization stays deterministic and auditable.
STEP 02 · SIMULATE
The quorum runs the model
Operators execute ~545B gas of integer-only transformer under unbounded simulation, weights mounted as pinned code overlays committed by one 32-byte manifest hash. Every honest operator computes a bit-identical result.
STEP 03 · SETTLE
One signature on-chain
The quorum BLS-signs the single-slot diff and verifyAndUpdate lands it
on Sepolia for ~384k gas — up to 99% cheaper execution, verified by aggregate
signature. Wrong results are slashable via bisection fraud proofs.
On-chain history
loading events from Sepolia…
Connection
Reads (history, state) go straight to the chain.
Submitting a prompt POSTs a task to the router; the operator quorum simulates the
billion-gas inference off-chain, BLS-signs the single-slot diff, and lands it via
verifyAndUpdate. The answer appears here when the event hits Sepolia.Contracts (Sepolia)
Bisection proof — disputing a billion-gas inference with log₂(n) hashes
Every Gas Killer result is signed by a quorum, and every honest operator computes a
bit-identical integer inference. If a signed result is ever wrong, a challenger
doesn't re-execute 1.4B gas on-chain — that's impossible. Instead the execution is
checkpointed at every generated token (the commitment chain the contract already
maintains), and challenger + defender bisect: compare the midpoint checkpoint,
recurse into the half that disagrees, and after ⌈log₂ n⌉ rounds isolate one token's
forward pass — small enough to re-execute inside the SP1 slashing guest (or even
on-chain for the 260K model). The fraud is proven at the first divergent step; the
dishonest party is slashed. This lab simulates the whole game.
Execution trace — one segment per generated token
token 0 (prompt committed)
—
total execution gas (off-chain)
—
disputed window (segments)
—
bisection rounds used / max
—
gas to prove the culprit segment
—
vs naive full re-execution
Dispute transcript
How this maps to Gas Killer
Checkpoints are free. The consumer's story/chat root is already a running
keccak commitment; emitting the per-token intermediate roots during simulation
costs the operators nothing extra — they're deterministic integer states.
The pinned environment is part of the claim. Both parties bisect over the same
The endgame is tiny. One stories260K token ≈ 44M gas — provable by direct on-chain re-execution. One Qwen token ≈ 28.6B gas — still 50,000× smaller than the naive dispute, and exactly the workload the SP1 guest re-executes to produce a fraud proof bound to
Honest defenders can't lose. Try the honest mode: every midpoint matches, the challenger's window never isolates a divergence, and the challenge bond is forfeited instead.
The pinned environment is part of the claim. Both parties bisect over the same
env_commitment — gas limits and the overlay manifest
(0x23216c…7ae9 for Qwen). A defender who simulated with different
weights diverges at segment 0 and is slashed immediately: availability games
can't forge the manifest.The endgame is tiny. One stories260K token ≈ 44M gas — provable by direct on-chain re-execution. One Qwen token ≈ 28.6B gas — still 50,000× smaller than the naive dispute, and exactly the workload the SP1 guest re-executes to produce a fraud proof bound to
chainConfigHash.Honest defenders can't lose. Try the honest mode: every midpoint matches, the challenger's window never isolates a divergence, and the challenge bond is forfeited instead.
The Gas Killer pipeline
The same pipeline every Gas Killer consumer
uses — this demo just makes the “execution” box a 596M-parameter transformer.
More at gaskiller.xyz.