AZR: Risk-Adaptive Verification for Decentralized AI Inference on Blockchain Rollups

May combine two claims.

For LLaMA-7B (≈14 GB), computing SHA-256 of the weights takes approximately 15 seconds on commodity hardware; doing this per-query would dominate latency.

“For LLaMA-7B (≈14 GB), computing SHA-256 of the weights takes approximately 15 seconds on commodity hardware; doing this per-query would dominate latency.”

May combine two claims.

AZR is the only system in the evaluation able to meet all three properties-computational integrity, model confidentiality, and input privacy-that no single-tier architecture can satisfy for all workload types.

“AZR is the only system that simultaneously satisfies CI, MC, and IP; the partial marks on LA and LC reflect the high-risk tier's asynchronous finality and the small dispatch overhead.”

• Also stated in: § 10 Conclusion · plain

  “AZR is the only system in the evaluation able to meet all three properties-computational integrity, model confidentiality, and input privacy-that no single-tier architecture can satisfy for all workload types.”

May combine two claims.

At threshold τ2, the false-negative rate is 4.3%, so 4.3% of the actual high-risk queries are routed into the medium-risk tier.

“for example, at τ 2 , the false-negative rate is 4.3%, so 4.3% of the actual high-risk queries are routed into the medium-risk tier.”

May combine two claims.

opML achieves low normal-path overhead at the expense of a multi-day dispute window and a liveness assumption over economically rational challengers.

“Optimistic verification (opML) achieves low normal-path overhead at the expense of a multi-day dispute window and a liveness assumption over economically rational challengers.”

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [9]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim. May combine two claims.

opML correctness guarantee is economic rather than cryptographic: it holds only if at least one honest challenger stays online and motivated for the entire seven-day dispute window.

“The correctness guarantee is economic rather than cryptographic: it holds only if at least one honest challenger stays online and motivated for the entire seven-day dispute window.”

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

For high-risk queries, the user receives the TEE-attested provisional result immediately upon enclave completion; ZK proof generation proceeds asynchronously and is submitted to the L1 contract upon completion, providing deferred cryptographic finality.

“For high-risk queries, the user receives the TEE-attested provisional result immediately upon enclave completion.ZK proof generation proceeds asynchronously and is submitted to the L1 contract upon completion, providing deferred cryptographic finality.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Several results reported in this work rely on analytical extrapolations rather than direct measurements.

“Several results reported in this work rely on analytical extrapolations rather than direct measurements.”

May combine two claims.

Hybrid systems such as Optimistic TEE-Rollups combine two mechanisms but do not allow per-query policy optimization.

“Hybrid systems such as Optimistic TEE-Rollups [14] combine two mechanisms but do not allow per-query policy optimization.”

• cites [14]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Existing works have solved the verification problem along only one axis: zkML ensures cryptographic soundness; opML ensures low cost in the normal path; and TEE-based systems ensure low latency and confidentiality.

“Existing works have solved the verification problem along only one axis: zkML ensures cryptographic soundness; opML ensures low cost in the normal path; and TEE-based systems ensure low latency and confidentiality.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Lee et al. [11] showed that the branch-shadowing technique can be used to leak SGX control flow from an OS-privileged adversary, as the Branch Target Buffer (BTB) is shared between the enclave and the OS.

“Lee et al. al. [11] showed that the branch-shadowing technique can be used to leak SGX control flow from an OS-privileged adversary, as the Branch Target Buffer (BTB) is shared between the enclave and the OS.”

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

AZR is a Layer-2 rollup framework that routes each inference request to the minimum-cost verification pipeline satisfying its assurance requirement.

“AZR is a Layer-2 rollup framework that routes each inference request to the minimum-cost verification pipeline satisfying its assurance requirement.”

Probably not a substantial claim: may not pass S3 (load-bearing).

LLaMA-7B and GPT-scale proving times are derived from previously published scaling laws and should be interpreted as indicative rather than definitive.

“In particular, LLaMA-7B and GPT-scale proving times are derived from previously published scaling laws and should therefore be interpreted as indicative rather than definitive.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Executor reputation Rep_i feeds into bond requirement (32), creating economic incentives for sustained honest participation without requiring trusted third parties for reputation management.

“Executor reputation Rep i feeds into bond requirement (32), creating economic incentives for sustained honest participation without requiring trusted third parties for reputation management.”

May combine two claims.

TEE enables low-latency confidential execution, but documented microarchitectural side-channel vulnerabilities mean attestation cannot be treated as an unconditional integrity guarantee.

“Trusted execution environments (TEE) enable low-latency confidential execution, but documented microarchitectural side-channel vulnerabilities mean that attestation cannot be treated as an unconditional integrity guarantee.”

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [12]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [13]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

STARKs achieve O(log N) verifier complexity and require no trusted setup, at the cost of larger proofs.

“STARKs [33] achieve O(log N ) verifier complexity and require no trusted setup, at the cost of larger proofs.”

• cites [33]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Reference values for on-chain verification cost are C_tee ≈ 50K gas, C_opml ≈ 150K gas, and C_zk ≈ 250-700K gas.

“where reference values are C tee ≈ 50 K gas (attestation verification via DCAP on-chain check), C opml ≈ 150 K gas (Merkle commitment plus trace root on normal path), and C zk ≈ 250-700 K gas (Groth16 pairing check, depending on circuit size).”

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [32]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim.

PLONK avoids per-circuit ceremonies via a universal structured reference string.

“PLONK [17] avoids per-circuit ceremonies via a universal structured reference string.”

• cites [17]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing).

The additive risk function ignores possible interactions: a query with medium V and medium A could be riskier than the linear combination αV + βA indicates.

“Such an approach ignores possible interactions: a query with medium V and medium A could, for instance, be riskier than the linear combination αV + βA indicates.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The workload distribution used in AZR evaluation (40/40/20) reflects a governance-defined policy scenario and may differ across deployment environments.

“Additionally, the workload distribution used in AZR evaluation (40/40/20) reflects a governance-defined policy scenario and may differ across deployment environments.”

May combine two claims.

AZR requires executors to use a canonical, on-chain-committed 16-bit fixed-point quantization standard upon model registration, ensuring deterministic equivalence between floating-point results inside the enclave and field-element arithmetic in the circuit.

“AZR requires executors to use a canonical, on-chain-committed 16-bit fixed-point quantization standard upon model registration.This ensures deterministic equivalence between floating-point results inside the enclave and field-element arithmetic in the circuit.”

May combine two claims.

Three independent barriers prevent an adversarial executor from substituting a cheaper model θ' ≠ θ: H(θ) is embedded in the attestation report and checked against the on-chain model registry; for high-risk queries, H(θ) is a public input to the ZK circuit; and the on-chain model registry maps approved identifiers to precomputed hash commitments.

“Three independent barriers prevent this.First, H(θ) is embedded in the attestation report (11) and checked against the on-chain model registry.Second, for high-risk queries, H(θ) is a public input to the ZK circuit; a proof for a different model requires a different public input, which the verifier rejects.Third, the on-chain model registry maps approved identifiers to precomputed hash commitments”

May combine two claims.

The TEE+opML tier's integrity guarantee is Pr[invalid result accepted] = ε_TEE+opML ≤ p_hw • p_nc under the independence model, or ≤ p_hw conservatively; this is a probabilistic, not cryptographic, guarantee.

“The TEE+opML tier's integrity guarantee is: Pr[invalid result accepted] = ϵ TEE+opML ≤ p hw • p nc under the independence model, or ≤ p hw conservatively.Note that this is a probabilistic, not cryptographic, guarantee.”

• AssumptionThe authors state this as an assumption: Hardware compromise and challenger non-participation are independent, so the TEE+opML integrity error is bounded by p_hw • p_nc.

Classified as probably not a substantial claim. May combine two claims.

Zhao et al. identify the verification gap as the key remaining open problem for decentralized AI: all existing systems face the tradeoff between either fully trusting the executor or paying prohibitive verification costs.

“Zhao et al. [29] identify the verification gap as the key remaining open problem for decentralized AI: all existing systems face the tradeoff between either fully trusting the executor or paying prohibitive verification costs.”

• cites [29]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Under an adversary who simultaneously compromises the TEE and economically suppresses all challengers, the events are perfectly correlated, and the conservative bound is ε_TEE+opML = p_hw.

“Under an adversary who simultaneously compromises the TEE and economically suppresses all challengers, the events are perfectly correlated, and the conservative bound is ϵ TEE+opML = p hw .”

May combine two claims.

AZR is compatible with Optimism Cannon [9], which uses a deterministic MIPS VM for dispute resolution.

“AZR is compatible with Optimism Cannon [9], which uses a deterministic MIPS VM for dispute resolution.”

• cites [9]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Correctness of optimistic fraud proofs is only assumed during the ∆t window, which is an economic rather than a cryptographic assumption: it holds if and only if there exists no adversary who can corrupt or economically silence every single independent challenger.

“Thus, correctness is only assumed during the ∆t window, which is an economic rather than a cryptographic assumption: it holds if and only if there exists no adversary who can corrupt or economically silence every single independent challenger.”

• cites [27]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

In zkML circuits, linear layers compile into matrix-vector multiplications that are the cheapest circuit primitives; activation functions require lookup arguments or range checks; and Softmax is the most expensive layer.

“In this formulation, linear layers compile into matrix-vector multiplications that are the cheapest circuit primitives.Activation functions, on the other hand, require lookup arguments or range checks.Softmax is the most expensive layer since it requires approximating exponentials.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

User-visible latency L_user_t = L_inf + L_att,t + L_batch, where L_inf is inference execution time, L_att,t is attestation or commitment generation overhead (near-zero for TEE, seconds for opML trace, zero for ZK which runs asynchronously), and L_batch is rollup batching delay (1-12 s for Ethereum L2s).

“L user t = L inf + L att,t + L batch ,(19) where L inf is inference execution time, L att,t is attestation or commitment generation overhead (near-zero for TEE, seconds for opML trace, zero for ZK which runs asynchronously), and L batch is rollup batching delay (1-12 s for Ethereum L2s).”

Classified as probably not a substantial claim.

zkML systems compile neural network inference into arithmetic circuits, producing succinct proofs that any on-chain verifier can check cheaply.

“Systems such as ZKML [5] and the work of Kang et al. [6] compile neural network inference into arithmetic circuits, producing succinct proofs that any on-chain verifier can check cheaply.”

• cites [5]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [6]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

AZR scores each inference query by a risk function R(q) = αV + βA + γD, where V measures economic exposure, A measures adversarial attack surface, and D measures data sensitivity, and dispatches the query to one of three verification tiers based on the score.

“In other words, instead of using a uniform mechanism for all workloads, AZR scores each inference query by a risk function of the form R(q) = αV + βA + γD, where V measures economic exposure, A measures the adversarial attack surface, and D measures the data sensitivity; then, AZR dispatches the query to one of three verification tiers based on the score.”

May combine two claims.

opML satisfies D5 and is near-satisfying for D4, but violates D1 conditionally: integrity holds only under the 1-of-n honesty assumption, not by cryptographic reduction; D2 and D3 are violated because input and output data must be posted publicly for fraud-proof resolution.

“opML.Satisfies D5 (single hash commitment on the normal path) and is near-satisfying for D4, but violates D1 conditionally: integrity holds only under the 1-of-n honesty assumption, not by cryptographic reduction [27].D2 and D3 are violated because input and output data must be posted publicly for fraud-proof resolution [8].”

• cites [27]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

zkML provides D1 and D2, but violates D4 and D5 at LLM scale; prover complexity Θ(N log N) yields hours of wall-clock time for N > 10^9, making interactive use infeasible and imposing large on-chain verifier costs for large circuits.

“zkML.Provides D1 (cryptographic integrity) and D2 (zero-knowledge property), but violates D4 and D5 at LLM scale.Prover complexity Θ(N log N ) yields hours of wall-clock time for N > 10 9 [5,7], making interactive use infeasible and imposing large on-chain verifier costs for large circuits.”

• cites [5]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing).

LLaMA-7B results should be interpreted as indicative rather than definitive.

“LLaMA-7B results should therefore be interpreted as indicative rather than definitive.”

Probably not a substantial claim: may not pass S3 (load-bearing).

Brasser et al. [12] showed a software-only key recovery side-channel attack that does not require any physical access to the machine.

“In the same paper, Brasser et al. [12] showed a software-only key recovery side-channel attack that does not require any physical access to the machine.”

• cites [12]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

AZR is a multi-tiered verification architecture for AI inference on blockchain rollups that selects the lowest-cost verification pipeline for each individual request.

“In this paper, we propose AZR (Adaptive zkTEE Rollups): a multi-tiered verification architecture for AI inference on blockchain rollups that selects the lowest-cost verification pipeline for each individual request.”

May combine two claims.

For all tiers, confidentiality fails only if the hardware is compromised, which occurs with probability at most p_hw.

“For all tiers, confidentiality fails only if the hardware is compromised, which occurs with probability at most p hw .”

Classified as probably not a substantial claim. May combine two claims.

The risk function R(q) = αV + βA + γD is additive by design: each component contributes independently to the overall risk, and governance may freely adjust the relative weights without needing to calibrate a non-convex problem.

“Equation (5) is additive by design: each component contributes independently to the overall risk, and governance may freely adjust the relative weights (α, β, γ) without needing to calibrate a non-convex problem.”

May combine two claims.

TEE-only satisfies D4 and D3, and provides D2 under hardware trust, but violates D1 with probability ≥ p_hw > 0 due to hardware attacks, and violates D2 through microarchitectural leakage.

“TEE-Only.Satisfies D4 (low attestation latency) and D3 (input encrypted to enclave), and provides D2 under hardware trust, but violates D1 with probability ≥ p hw > 0 due to hardware attacks [12,13], and violates D2 through microarchitectural leakage [11,25].”

• cites [12]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [13]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

For the ZK tier, user-visible latency equals L_user_T (TEE attestation arrives immediately), while cryptographic finality latency includes the asynchronous ZK proving time.

“For the ZK tier, user-visible latency equals L user T (TEE attestation arrives immediately), while cryptographic finality latency includes the asynchronous ZK proving time.”

May combine two claims.

The reference implementation uses Groth16: constant proof size (≈200 bytes), O(1) on-chain pairing-check (≈250,000 gas).

“The reference implementation uses Groth16 [32]: constant proof size (≈200 bytes), O(1) on-chain pairing-check (≈250,000 gas).”

• cites [32]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

The threshold search over (τ1, τ2) is a two-dimensional grid search, not a free linear program in the thresholds themselves, though the objective is linear in the routing probabilities for fixed thresholds.

“The threshold search over (τ 1 , τ 2 ) ∈ (0, 1) 2 is a two-dimensional grid search not a free linear program in the thresholds themselves, though the objective is linear in the routing probabilities for fixed thresholds.”

Classified as probably not a substantial claim. May combine two claims.

opML commits inference onchain with an interactive bisection fallback, reducing normal-path cost to a single hash check.

“He et al. [8] showed that inference can be committed onchain with an interactive bisection fallback, reducing normal-path cost to a single hash check.”

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Wrapping VM_AI as a Cannon-interpretable program enables deployment within existing Optimism-compatible stacks without modifying L1 fault-proof logic, at the cost of higher replay overhead than the specialized VM.

“Wrapping VM AI as a Cannon-interpretable program enables deployment within existing Optimism-compatible stacks without modifying L1 fault-proof logic, at the cost of higher replay overhead than the specialized VM.”

May combine two claims.

Under the trusted hardware assumption, the TEE tier satisfies D2, D3, and D4; computational integrity holds with probability 1 - p_hw.

“Under the trusted hardware assumption, this tier satisfies D2, D3, and D4.Computational integrity holds with probability 1 -p hw .”

• AssumptionThe authors state this as an assumption: TEE hardware is trusted except for the modeled compromise probability p_hw; under this assumption the TEE tier satisfies confidentiality and input privacy.

May combine two claims.

Requiring challenger bond B_C ≥ G_D before dispute initiation and slashing invalid disputes makes griefing self-defeating for rational actors.

“Mitigation: require challenger bond B C ≥ G D before dispute initiation; invalid disputes result in bond slashing, making griefing self-defeating for rational actors.”

• AssumptionThe authors state this as an assumption: Actors are rational.

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Cryptographic finality latency L_final_t = L_user_t + L_proof,t + L_verify,t, where L_proof,t is proof generation time (zero for TEE, O(log N) rounds for opML disputes, minutes-to-hours for ZK), and L_verify,t is on-chain confirmation latency (≈12 s on Ethereum mainnet).

“L final t = L user t + L proof,t + L verify,t ,(20) where L proof,t is proof generation time (zero for TEE, O(log N ) rounds for opML disputes, minutes-to-hours for ZK), and L verify,t is on-chain confirmation latency (≈12 s on Ethereum mainnet).”

Classified as probably not a substantial claim.

Due to the absence of a full zkML implementation for LLaMA-7B in the evaluation environment, the reported proving times are analytical estimates derived from the empirical scaling law T_prove ∝ N^1.4 reported in [7], using BERT-Base as the calibration point.

“Due to the absence of a full zkML implementation for LLaMA-7B in our evaluation environment, the reported proving times are analytical estimates derived from the empirical scaling law T prove ∝ N 1.4 reported in [7], using BERT-Base as the calibration point.”

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The three verification paradigms involve fundamentally different cost-security trade-offs, and no single paradigm dominates across all workload types.

“These three paradigms involve fundamentally different costsecurity trade-offs, and no single paradigm dominates across all workload types.”

Classified as probably not a substantial claim. May combine two claims.

The verification dispatch layer sits between the requester and the verification backends and uses a formal risk score to select the appropriate tier.

“A verification dispatch layer sits between the requester and the verification backends and uses a formal risk score to select the appropriate tier.”

May combine two claims.

EIP-4844 blob transactions reduce calldata costs for both rollup variants by approximately 10× relative to standard calldata, materially improving the economics of AZR.

“EIP-4844 blob transactions [28] reduce calldata costs for both rollup variants by approximately 10× relative to standard calldata, materially improving the economics of AZR.”

• cites [28]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Microarchitectural attacks demonstrate that the TEE attestation guarantee is not absolute: branch shadowing, cache timing, and Foreshadow-class speculative execution vulnerabilities have all been shown to compromise enclave confidentiality or attestation key material.

“Microarchitectural attacks demonstrate that this guarantee is not absolute: branch shadowing [11], cache timing [12], and Foreshadow-class speculative execution vulnerabilities [13] have all been shown to compromise enclave confidentiality or attestation key material.”

• cites [11]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [12]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [13]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Since each mechanism fails at least one desideratum for some model scale or workload distribution, no uniform policy dominates.

“Since each mechanism fails at least one desideratum for some model scale or workload distribution, no uniform policy dominates.”

May combine two claims.

opML normal-path cost is a single hash commitment, orders of magnitude cheaper than zkML proof verification.

“Normal-path cost is a single hash commitment, orders of magnitude cheaper than zkML proof verification.”

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Pre-registration of the model hash shifts the cost to a one-time setup, and the registry entry is checked against the attestation commitment by the L1 contract.

“Pre-registration shifts this cost to a one-time setup, and the registry entry is checked against the attestation commitment by the L1 contract [10].”

• cites [10]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

Prover time for ResNet-50 is already measured in tens of seconds on a 64-core GPU server, and LLM-scale models extend this to hours, making interactive deployment infeasible.

“The practical limitation is equally unambiguous: prover time for ResNet-50 is already measured in tens of seconds on a 64-core GPU server [7], and LLM-scale models extend this to hours, making interactive deployment infeasible.”

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

AZR provides formal arguments showing an aggregate soundness theorem and a strict cost dominance theorem for the adaptive dispatch policy compared to any uniform policy.

“Moreover, we provide formal arguments showing an aggregate soundness theorem and a strict cost dominance theorem for the adaptive dispatch policy compared to any uniform policy.”

Probably not a substantial claim: may not pass S4 (based).

AZR is the first blockchain-native AI verification architecture to formalize verifier selection as an explicit risk-constrained optimization problem across cryptographic, optimistic, and hardware-based verification domains.

“To the best of our knowledge, AZR is the first blockchain-native AI verification architecture to formalize verifier selection as an explicit risk-constrained optimization problem across cryptographic, optimistic, and hardware-based verification domains.”

Probably not a substantial claim: may not pass S4 (based). May combine two claims.

Executor reputation Rep_i = n_success/(1 + n_total) reduces bond requirements for established nodes: B_i = λ_B • R(q)/(1 + Rep_i), creating sustained incentives for honest participation while preserving Sybil resistance via mandatory minimum collateral at Rep_i = 0.

“Executor reputation Rep i = n success /(1 + n total ) reduces bond requirements for established nodes: B i = λ B • R(q) 1 + Rep i ,(32) creating sustained incentives for honest participation while preserving Sybil resistance via mandatory minimum collateral at Rep i = 0.”

May combine two claims.

Van Bulck et al. [13] demonstrated extraction of SGX attestation keys through speculative execution, undermining the attestation guarantee in unpatched hardware.

“Van Bulck et al. [13] demonstrated extraction of SGX attestation keys through speculative execution, undermining the attestation guarantee in unpatched hardware.”

• cites [13]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

TEE-based systems run inference inside Intel SGX enclaves and use hardware-signed attestation to communicate integrity to the chain.

“Systems such as Ekiden [10] run inference inside Intel SGX enclaves and use hardware-signed attestation to communicate integrity to the chain.”

• cites [10]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Classified as probably not a substantial claim. May combine two claims.

Prover time for zkML scales as Θ(N log N), which excludes practical verification of LLM-scale models for interactive use.

“Zhang et al. [7] present a comprehensive survey on the topic and conclude that, in general, prover time scales as Θ(N log N ), which excludes practical verification of LLM-scale models for interactive use.”

• cites [7]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S4 (based).

As p_hw increases, the governance threshold τ1 can be reduced, routing more workload to the TEE+opML or ZK tiers automatically.

“As p hw increases for example, following a disclosed hardware vulnerability the governance threshold τ 1 can be reduced, routing more workload to the TEE+opML or ZK tiers automatically.”

May combine two claims.

The high-risk tier of AZR uses Groth16 as the reference implementation for verifier gas efficiency, while PLONK is more suited for situations where a large number of different model circuits must be deployed.

“The high-risk tier of AZR uses Groth16 as the reference implementation for verifier gas efficiency, while PLONK is more suited for situations where a large number of different model circuits must be deployed.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

STARKs eliminate trusted setup entirely and offer post-quantum security, at the cost of O(log 2 N) proof size and O(log N) on-chain verifier complexity.

“STARKs [33] eliminate trusted setup entirely and offer post-quantum security, at the cost of O(log 2 N ) proof size and O(log N ) on-chain verifier complexity.”

• cites [33]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

Groth16 proofs (≈200 bytes) are posted as regular calldata; their fixed small size makes calldata pricing more favorable than blob pricing for this component.

“Groth16 proofs (≈200 bytes) are posted as regular calldata their fixed small size makes calldata pricing more favorable than blob pricing for this component.”

Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

EIP-4844 blob transactions reduce rollup calldata costs by roughly 10×, improving the economics of both opML and AZR.

“EIP-4844 [28] introduced blob-carrying transactions that reduce rollup calldata costs by roughly 10×, improving the economics of both opML and AZR.”

• cites [28]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

The attestation process only ensures software integrity if the underlying hardware has not been compromised; known attacks on Intel SGX indicate it should not be considered an absolute guarantee.

“However, the attestation process only ensures software integrity if the underlying hardware has not been compromised.While it is a reasonable assumption, known attacks on Intel SGX indicate that it should not be considered an absolute guarantee.”

May combine two claims.

Groth16 produces constant-size proofs with O(1) on-chain verification, but requires a circuit-specific trusted setup.

“Groth16 [32] produces constant-size proofs with O(1) on-chain verification, but requires a circuit-specific trusted setup.”

• cites [32]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

All AZR executions use a canonical 16-bit fixed-point arithmetic standard and deterministic PRNG seeding, as specified by the opML determinism protocol [8], to mitigate non-determinism.

“Mitigation: all AZR executions use a canonical 16-bit fixed-point arithmetic standard (committed on-chain at model registration) and deterministic PRNG seeding, as specified by the opML determinism protocol [8].”

• cites [8]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

May combine two claims.

AZR enforces risk-scaled bonds B_E = λ_B • R(q), where governance multiplier λ_B is set such that λ_B • R(q) • p_d > R(q) • V_max for all R(q), bounding the maximum extractable gain from cheating on any single query to less than the value at risk.

“AZR enforces this via risk-scaled bonds: B E = λ B • R(q),(31) where governance multiplier λ B is set such that λ B • R(q) • p d > R(q) • V max for all R(q), bounding the maximum extractable gain from cheating on any single query to less than the”

May combine two claims.

AZR adopts the Arbitrum Nitro convention of automatic timeout resolution favoring the defender on challenger non-response, combined with a force-inclusion fallback path to Layer-1, to mitigate censorship.

“Mitigation: AZR adopts the Arbitrum Nitro convention of automatic timeout resolution favoring the defender on challenger non-response, combined with a force-inclusion fallback path to Layer-1.”

May combine two claims.

Equivalent bounds hold for PLONK [17] under the algebraic group model, and for STARKs [33] under the random oracle model.

“Equivalent bounds hold for PLONK [17] under the algebraic group model, and for STARKs [33] under the random oracle model.”

• cites [17]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.

• cites [33]Not matched

  Couldn’t be matched to a paper in Crossref, so it can’t be checked.