Research prototype

Check what AI did, without trusting chips.

Proofs can show which model answered, and would show how chips were used.

27–43×

less proving time than zkLLM, per layer¹

¹Ours hides nothing yet; zkLLM hides the weights. One synthetic layer vs a whole model; newer GPUs vs its A100.

Conditions

Ours: one Llama-8B-width layer over 2,048 positions, 0.220 ms per layer and token position on a rented H100, 0.354 ms on a rented RTX 6000 Ada (cold). zkLLM: its whole LLaMA-2-7B model on an A100, 9.46 ms per layer and token position (620 s ÷ (32 × 2,048)), and it hides the weights. One-time costs excluded on both sides.

Per layer and token position: ours , (H100, RTX 6000 Ada); zkLLM . 9.46 ms ÷ 0.220 ms ≈ 43 (H100); 9.46 ms ÷ 0.354 ms ≈ 27 (RTX 6000 Ada, cold).

Ours is not zero knowledge yet; zkLLM hides the weights
One synthetic layer vs a whole model
H100 or RTX 6000 Ada vs A100
zkLLM's time is a sum of per-operation times
Our proof is larger: for one layer (at 4,096 positions) vs for zkLLM's whole model
Ours by our own model, not externally reviewed; zkLLM states no bit level
One-time costs excluded on both sides

Our zero-knowledge path runs end to end, but its proofs are being re-checked after a verifier fix, and it is not faster than published systems. Our fast path is not yet zero knowledge.

Every speed number, with its conditions

Pace the frontier

Compute limits hold only if use is checked.

Earn customer trust

Customers could check which model answered them.

No special hardware

No enclaves or chip-maker keys, just rented GPUs.

How it works

Six steps, one hall

Planned cluster

Register the GPUs
Every GPU is listed; the list caps compute.
Rests onA complete GPU list
More
The list sets the ceiling in step 6. Nobody inspects the hall, so a complete list is a premise, not a check.
Admit the model
The checker fingerprints the approved weights. Every proof must match.
Would proveThe approved model answered
More
Proofs are checked against the checker's own fingerprint; that it fingerprinted the real published checkpoint is a premise. The proof covers an integer version of the model; how closely it matches the released model is not measured yet. A verifier flaw found on 29 Sep is fixed (reviewed), and earlier proofs are being re-checked with the fixed verifier; until then they count .
Record every request
A recorder seals every exchange in order, so none can be removed later.
ShowsEvery exchange, in order
More
Each entry seals the one before it, so an edit breaks every later seal. Today the log and its signed checkpoints stay inside the recorder: outside witnesses are built but not tested yet. Traffic that skips the recorder isn't covered.
Prove random answers
After sealing, random answers are picked and proven.
Would proveAnswers weren't edited
More
Picking after sealing means the operator can't know which answers get checked. Our zero-knowledge proof of a 7B model took on an 8-core cloud CPU.
How soon a cheater is caught, 99 times in 100
Answers proven Fake answers it takes
1 in 100 459
1 in 1,000 4,603
1 in 10,000 46,050
44 proofs catch a batch that is 10% fake, 99 times in 100, however large.
If answers are sealed before an unpredictable pick, and each proof is sound.
Check where it ran
A nearby landmark would time each reply. Light is only so fast, so a quick reply means nearby work.
Would placeWork within
More
Light covers per millisecond of round trip, so a deadline allows at most . No landmark exists yet: these are sizing numbers, and the landmark's position would be trusted.
Balance the books and publish
Proven work is weighed against capacity. The gap would be published.
BoundsUnexplained capacity
More
The bound holds only if its premises hold: a complete GPU list, the recorder as the only way in, and work and capacity counted in the same units. Publishing to outside witnesses is built but not tested yet.

Answers proven	Fake answers it takes
1 in 100	459
1 in 1,000	4,603
1 in 10,000	46,050

What they don’t prove

That the GPU list is complete. The rental record is trusted.
That the model is safe, or what it was trained on.
How closely the proven integer version of the model matches the released model. That is not measured yet.
Anything about traffic that goes around the recorder.
Answers that weren't picked are covered only statistically, and today the proofs are being re-checked after a verifier fix.
Which GPU did the work. The landmark's position would be trusted, and no landmark exists yet.
Compute outside the declared cluster. The bound holds only if its premises hold.
That the parties are independent. In this demo Lucid would run every role; today only the recorder and verifier software exist, and Lucid runs both.

Every limit, with its conditions

Try it out

As a user

Know which AI answered you
See what your agent may do
Receipts anyone can check

Open Lucid ChatNo real model yet

or watch a scripted walkthrough

As a verification organization

Check compute use without trusting chips
Bound undeclared compute
Evidence for pacing agreements

Open the verifier appNo real model yet

or watch a scripted walkthrough

Checkable claims about AI, without trusted hardware

Back to the story

See what checking an AI would look like.

A scripted replay. Every answer carries a sample receipt.

Know which AI answered you
See what your agent may do
Receipts anyone can check

Lucid ChatMistral-7B-v0.1 · scripted replay

Every answer carries a sample receipt. Tap one to see what it would check.

My landlord sent a letter saying my rent goes up by 12% next month. My lease runs until March. Can they do that?

Scripted replay

Usually not. A fixed-term lease normally locks the rent until it ends, unless the lease itself has a clause that allows increases during the term.

Check your lease for a rent review or escalation clause. If there isn't one, you can reply in writing that the current rent stands until March, and ask them to point to the clause they rely on.

LucidWork · AI Passport v3

AI Passport

Model: Mistral-7B-v0.1

Fingerprint: 4da7 d2e4 … 3077 (sample)

Model admitted: By the demo verifier, run by Lucid

Special hardware: None needed

Which model is it?
How does it answer?
Where does it run?

Learn more

Proven means our checker accepted a proof. A verifier flaw is fixed, but earlier proofs are being re-checked ( until then), so these checks read Would be Proven until that re-check; production strength starts at .

The model named is the one our measured zero-knowledge proof covers. It is a base model and would not write answers like these; a live demo would admit an instruction-tuned open model. The proof covers an integer version of the model; how closely it matches the released model is not measured yet.

The agent's checks, the turn receipts and the principal's rules are built but not tested yet, so every check on those tabs is a Preview. In the design, the checker works from sealed fingerprints, not your words; today that runs only on a small test model (Preview). The service's own machines still read them to answer.

Against published provers

How fast is proving?

27–43×less proving time than zkLLM per layer and token position, on our fast path.
Not zero knowledge yetOne synthetic layer vs a whole modelNewer GPUs than zkLLM's A100
about 1,100×slower than zkLLM per token position, on our zero-knowledge path today.

Every number, with its conditions

Back to the story

Agreements on AI, checkable by proof.

One planned cluster, as it would be checked hour by hour. Sample data.

Check compute use without trusting chips
Bound undeclared compute
Evidence for pacing agreements

Lucid AI cluster · hourly check4 rented GPUs · no special hardware

Planned cluster

Last closed hour

26 Sep 12:00–13:00 UTC (sample)

≤ 14%

of capacity could have gone to unexplained work, if the premises hold.

Last 14 hours

GPUs

This hour, timed checks

GPU 1On time ·
GPU 2On time · 0.25 ms
GPU 3On time · 0.27 ms
GPU 4Late ·

Deadline , so work stays within . GPU 4 missed one deadline, so it earns no credit this hour.

Evidence feed

13:58
Timed check passed
13:44
GPU 4 missed a timed deadline
Flagged
13:05
12 picked answers proven
13:00
Epoch closed and published
12:58
Timed check passed

Why it matters for existential risk

Frontier AI built out of sight cannot be paced. Checkable compute could let rivals slow down together, and know it.

The argument, in four points

The pathway this is meant to cut. When no party can check another's restraint, each has a reason to keep racing, and a race leaves less time to build and test safeguards against the most severe risks from advanced AI, including losing control of it (Armstrong, Bostrom and Shulman 2016; Wasil, Reed, Miller and Barnett 2024).

Restraint needs checking. A limit on frontier compute holds only if its use can be checked.
Dark compute is the gap. Undeclared frontier training is the move a race rewards; a bound on unexplained capacity could narrow it at declared sites. It can't tell customer traffic from the operator's own, so inference on the admitted model counts as explained even if it feeds capability work.
Rivals won't share one chip maker's trust. Proofs on ordinary machines don't ask them to.
Oversight without reading everything. In the design, the checker would need proofs and fingerprints, not the work itself. Today it sees the tokens.

This is an argument, not a result: whether checkable compute slows frontier progress is a question this system cannot answer. Compute-focused governance: Shavit 2023, arXiv 2303.11341.

What the bound assumes

Complete inventory
Capacity envelope ×
Recorder coverage
No outsourcing
Units match

The bound can't tell customer traffic from the operator's own. Inference on the admitted model counts as explained, even if it feeds capability work such as generating training data. It bounds other uses of the chips, such as undeclared training.

How strong are the proofs?

The proofs run. A verifier flaw found on 29 Sep is fixed (reviewed), and earlier proofs are being re-checked with the fixed verifier; until then they count . We would call or more production strength.

Light covers per millisecond of round trip, so a deadline allows at most . No landmark has been built, so the timings here are sample values.

What timing can't catch

We hid extra useful work in the unused rows of one GPU kernel. The timing check never caught it, and never raised a false alarm. Caught: 0 of 60 trials, at each of 4 amounts.

So timing alone is not evidence of how chips were used: the site bounds unexplained work with proofs and names what the bound assumes. What didn't work

A demo check run by Lucid; in practice an independent verifier would run it. In this demo Lucid would run every role: the cluster, the recorder, the landmark, the verifier and the log witnesses. Today only the recorder and verifier software exist, and Lucid runs both. The proofs show what was computed; they can't show that separate parties agree. An outside witness or landmark operator would change that.

Check what AI did, without trusting chips.

Pace the frontier

Earn customer trust

No special hardware

Six steps, one hall

Register the GPUs

Admit the model

Record every request

Prove random answers

Check where it ran

Balance the books and publish